Search code examples
.netstacketw

How to write a custom stack trace using ETW

Event tracing for Windows (ETW) has a facility for capturing stack traces with the event stream. I assume they are fetched/encoded using a EVENT_HEADER_EXT_TYPE_STACK_TRACE32 (or 64) header. However, the event header is beyond control from the POV of an event source.

https://msdn.microsoft.com/en-us/library/windows/desktop/aa363760%28v=vs.85%29.aspx

In my .net application, I have a specific condition I am diagnosing in another thread (the UI thread) by observing it. I can collect stack traces exposing the condition, the data pieces are in place, but I would like to use ETW and its toolchain for further analysis.

[As an aside, yes I'm looking for blockers, but while the existing infrastructure is great for diagnosing known individual blockers, I need to get an overview and event correlation is not sufficient in that case. Also, the data collected easily overwhelms the device I need to collect on. My detector is much smarter, for my case at least.]

So I am looking for (in order of preference)

  1. a way to substitute the stack I have collected to the event's header
  2. use another attribute for the stacktrace, and a way to tell tools (perfview or xperf) to use this one instead
  3. a way to write ETW .etl compatible files without ETW (but in .net), with full control over the header (I don't need the live features)

Pointers anyone?

Solution

  • I went with option 4: Use a completely different format at least one tool can ingest and analyse. In this case, a .perfView.xml file got written and did the job, although the analysis capabilities are not as nice as I would have liked.