Skip to content

Instantly share code, notes, and snippets.

@tomasr
Created November 27, 2015 14:57
Show Gist options
  • Save tomasr/68ed8a7e76b1f40983b2 to your computer and use it in GitHub Desktop.
Save tomasr/68ed8a7e76b1f40983b2 to your computer and use it in GitHub Desktop.
Filtering ETW Traces by PID
using System;
using System.Collections.Generic;
using Microsoft.Diagnostics.Tracing;
using Microsoft.Diagnostics.Tracing.Session;
using System.Linq;
using System.Text;
namespace EtwFilter
{
class Program
{
static void Main(string[] args)
{
FilterTrace(args[0], args[1], Int32.Parse(args[2]));
}
private static void FilterTrace(String sourceFile, String destinationFile, int pid)
{
using ( var source = new ETWReloggerTraceEventSource(sourceFile, destinationFile) )
{
Console.WriteLine("Processing: {0}", sourceFile);
long count = 0;
long written = 0;
source.AllEvents += (e) => {
if ( ((++count) % 100000) == 0 )
{
Console.WriteLine("{0} events", count);
}
if ( e.ProcessID == pid )
{
source.WriteEvent(e);
written++;
}
};
source.Process();
Console.WriteLine("Wrote {0} events.", written);
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment