ETW event tracing in WPF 4+

user_573420 0
Viewed 342

I am trying to use a Microsoft demo project which shows how to do ETW event tracing in WPF as a basis for some specific profiling I want to do in an app I'm developing.

Compiled as is, the demo works fine. However, change the target framework from .Net 3.5 to .Net 4, and it breaks. Clearly there is some significant change between the framework versions.

The question is what changed, and (more importantly) is it possible to fix the demo?

My investigation so far

Adding a Debug.WriteLine to FpsEventConsumer.EtwEventCallback I see that in framework 4 either no events arrive or two events arrive, both with Header.Guid of 68fdd900-4a3e-11d1-84f4-0000f80464e3; one with Header.Class.Type of UCE_GLASS_START and the other with UCE_GLYPHRUN_START. Note that I also observe these events, among many others, when testing under framework 3.5.

By digging around in referencesource.microsoft.com I discovered that MS.Utility.EventTrace's static field EventProvider of type MS.Utility.TraceProvider controls what gets sent to ETW. Using reflection to access the event provider (since it's non-public) I observe that in 3.5 it starts with everything enabled (_enabled is true, _flags is 2147483647, _level is 5); and in 4 it starts with everything disabled (_enabled is false, _keywords is 0, and _level is 0). But changing those values with reflection doesn't seem to help the situation much. At best, on a very rare occasion I get a few events emitted before the UCE_ ones mentioned above.

By placing a WriteLine in TraceConsumer.ProcessTrace as follows, I observe that the p/invoked call continues to block, so the problem isn't that the trace is being interrupted.

             ErrorCode errorCode = UnsafeEventTrace.ProcessTrace(handleArray, handleArray.Length,
                                                                 (FILETIME)startTime, (FILETIME)endTime);
+            System.Diagnostics.Debug.WriteLine("ProcessTrace: " + errorCode);
             if (errorCode != ERROR.SUCCESS)
             {
                 errorCode.OutputErrorMessage("TraceConsumer.ProcessTrace");
             }
etw wpf
1 Answers

It turns out that the answer was there all along in one of the referencesource files I looked at:

    /// ...
    /// TreatAsSafe:  it generates the GUID that is passed into the TraceProvider
    /// WPF versions prior to 4.0 used provider guid: {a42c77db-874f-422e-9b44-6d89fe2bd3e5}
    ///</SecurityNote>
    [SecurityCritical, SecurityTreatAsSafe]
    static EventTrace()
    {
        Guid providerGuid = new Guid("E13B77A8-14B6-11DE-8069-001B212B5009");
        ...

The following simple patch to Sample.RunTrace causes events to start flowing (although they no longer include the particular event which the demo uses for the FPS).

-            m_traceSession = TraceController.WpfController;
+            m_traceSession = typeof(System.Windows.Rect).Assembly.GetName().Version.Major == 3
+                ? TraceController.WpfController
+                : TraceController.GetController(new Guid("E13B77A8-14B6-11DE-8069-001B212B5009"), "WPF");
user_5734200
Related