c - 检测 ETW 何时丢弃事件

Question

如何确定 ETW session 是否正在丢弃事件？

如果正在丢弃事件，我如何配置跟踪 session 以便事件不被丢弃？

我编写了一个自定义 ETW 提供程序来帮助进行一些调试工作。我目前正在使用 logman.exe 捕获跟踪数据。

在查看结果时，似乎某些事件正在被删除。基本上我正在寻找类似的东西:

事件A事件C

其中它们应该是一个干预事件 B，但它没有出现在跟踪文件中。这种情况应该是不可能发生的，这让我相信 ETW 正在丢弃事件。

当然，我想验证我看到的问题是由于事件丢失造成的，而不是由代码中的错误引起的。我尝试过谷歌，但无法想出任何东西。有谁知道我如何检查事件是否被删除？

Answer 1

它没有直接回答问题(如何检测掉落)，但它可能会解释掉落:

EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING

Writes events that were logged on different processors to a common buffer. Using this mode can eliminate the issue of events appearing out of order when events are being published on different processors using system time. This mode can also eliminate the issue with circular logs appearing to drop events on multiple processor computers.

If you do not use this mode and you use system time, the events may appear out of order on multiple processor computers. This is because ETW buffers are associated with a processor instead of a thread. As a result, if a thread is switched from one CPU to another, the buffer associated with the latter CPU can be flushed to disk before the one associated with the former CPU.

If you expect a high volume of events (for example, more than 1,000 events per second), you should not use this mode.

Note that the processor number is not included with the event. Not available prior to Windows 7 and Windows Server 2008 R2.