When trying to recreate UIforETW's IdentifyChromeProcesses.py script using TraceProcessor I hit this error:
System.InvalidOperationException
HResult=0x80131509
Message=The specified trace has lost 1531353 events and allowLostEvents was not specified.
Source=Microsoft.Windows.EventTracing.Processing
StackTrace:
at Microsoft.Windows.EventTracing.TraceProcessor.Create(String path, ITraceProcessorSettings settings)
In my Python script I had run xperf with the "-tle -tti" options to specify that I wanted to be tolerant of lost events and time inversions but when using TraceProcessor it was not immediately clear how to specify AllowLostEvents.
There is an overload to TraceProcessor.Create which takes an ITraceProcessorSettings. I realized that TraceProcessorSettings is the expected implementation of this interface and came up with this:
var settings = new TraceProcessorSettings();
settings.AllowLostEvents = true;
settings.AllowTimeInversion = true;
using (ITraceProcessor trace = TraceProcessor.Create(args[0], settings))
That works quite nicely.
The one extra glitch I hit was that some values of process.Images[i].FileName were invalid so I had to wrap the reads of those values in a try/catch operation. I guess there is no certainty about what data will be missing so allowing lost events and time inversions comes with some risks.
Perhaps the ideal thing to do would be to try to open the trace normally, inside an exception handler, and if that fails then print a warning before opening it with the permissive settings.
User contributions licensed under CC BY-SA 3.0