How do I allow lost events and time inversion when processing ETW traces with TraceProcessor

2

When trying to recreate UIforETW's IdentifyChromeProcesses.py script using TraceProcessor I hit this error:

    System.InvalidOperationException
      HResult=0x80131509
      Message=The specified trace has lost 1531353 events and allowLostEvents was not specified.
  Source=Microsoft.Windows.EventTracing.Processing
  StackTrace:
   at Microsoft.Windows.EventTracing.TraceProcessor.Create(String path, ITraceProcessorSettings settings)

In my Python script I had run xperf with the "-tle -tti" options to specify that I wanted to be tolerant of lost events and time inversions but when using TraceProcessor it was not immediately clear how to specify AllowLostEvents.

.net-traceprocessing
asked on Stack Overflow Jul 9, 2019 by Bruce Dawson

1 Answer

4

There is an overload to TraceProcessor.Create which takes an ITraceProcessorSettings. I realized that TraceProcessorSettings is the expected implementation of this interface and came up with this:

var settings = new TraceProcessorSettings();
settings.AllowLostEvents = true;
settings.AllowTimeInversion = true;
using (ITraceProcessor trace = TraceProcessor.Create(args[0], settings))

That works quite nicely.

The one extra glitch I hit was that some values of process.Images[i].FileName were invalid so I had to wrap the reads of those values in a try/catch operation. I guess there is no certainty about what data will be missing so allowing lost events and time inversions comes with some risks.

Perhaps the ideal thing to do would be to try to open the trace normally, inside an exception handler, and if that fails then print a warning before opening it with the permissive settings.

answered on Stack Overflow Jul 9, 2019 by Bruce Dawson

User contributions licensed under CC BY-SA 3.0