I am using ETW to get some Microsoft pre-defined events. I set the EVENT_TRACE_PROPERTIE as follow:
TraceProperties->LogFileMode = EVENT_TRACE_REAL_TIME_MODE;
TraceProperties->MaximumFileSize = 100; // Limit file size to 100MB max
TraceProperties->BufferSize = 1024; // Use 1MB trace buffers
TraceProperties->MinimumBuffers = 128;
TraceProperties->MaximumBuffers = 256;
Then I create a thread to print the following properties:
std::cout << " EventsLost：" << mainSessionProperties->EventsLost ;
std::cout << " BuffersWritten：" << mainSessionProperties->BuffersWritten ;
std::cout << " FreeBuffers：" << mainSessionProperties->FreeBuffers;
std::cout << " NumberOfBuffers：" << mainSessionProperties->FreeBuffers;
std::cout << " RealTimeBuffersLost：" << mainSessionProperties->RealTimeBuffersLost;
Then I find that at the beginning the "EventsLost==0" and "BuffersWritten" keeps going up.
After a while , the "EventsLost" keeps going up and the "BuffersWritten" remains the same.
At the same time , I find that "RealTimeBuffersLost" always equals 0 ,FreeBuffers always equals a constant number.
Did someone who knows ETW can help me? I wonder why there are still some free buffers, the events still lose? And why the value of "BuffersWritten" stops increase when "EventsLost" begins to increase?