WPP / ETW

NTDEV
1

Hi,

I’ve been using WPP / ETW for some time now, and I’ve notice an issue.
I’ve been helping a customer to put some systems into production, and for a
good evaluation of what’s happening I usually configure the services to
generate the ETL logs so that I can evaluate the systems progression and any
issue that might go unnoticed.
I simply turn on a flag on the GUI and the service starts recording a
private ETW session to a specific location, no problem here.
On a weekly basis I connect to the clients network and collect the logs.
Lately when I connect I start a traceview session just to get the immediate
feedback on the system and by doing this I realize that the ETL files stop
receiving data, for some reason by starting a real time session no data
arrives for my private one.

So how can I fix this, any ideas?

Regards
Cláudio Albuquerque

2

ETW Down-level Vista has the limitation that a provider can log to only a single session.

So if you have provider P and start session A and enable the provider P to it then Events be directed to session A.
If you then start Session B, and enable provider P to it, then events will be directed to session B, and session A will get none.

ETW in Vista can allow multiple sessions to receive events from a single provider. But ETW uses the legacy ETW API so you will still get the behavior described above.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Cl?udio Albuquerque
Sent: Monday, August 13, 2007 9:47 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] WPP / ETW

Hi,

I’ve been using WPP / ETW for some time now, and I’ve notice an issue.
I’ve been helping a customer to put some systems into production, and for a
good evaluation of what’s happening I usually configure the services to
generate the ETL logs so that I can evaluate the systems progression and any
issue that might go unnoticed.
I simply turn on a flag on the GUI and the service starts recording a
private ETW session to a specific location, no problem here.
On a weekly basis I connect to the clients network and collect the logs.
Lately when I connect I start a traceview session just to get the immediate
feedback on the system and by doing this I realize that the ETL files stop
receiving data, for some reason by starting a real time session no data
arrives for my private one.

So how can I fix this, any ideas?

Regards
Cl?udio Albuquerque

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Hi Jose,

Thanks for reply!
Now I’ve looked at the online documentation and actually what you replied
here is in the remarks of EnableTrace, sorry.
But I was actually mislead in thinking that ETW supported multisessions
because of my local documentation provides a remark regarding multisessions,
which still lingers on the online docs, and pontencial issue of confusion:
“You can call this function, one time, to enable a provider before the
provider registers itself. After the provider registers itself, ETW calls
the provider’s ControlCallback function. If you try to enable the provider
for MULTIPLE SESSIONS before the provider registers itself, ETW will only
enable the provider for the last session. For example, if you enable the
provider to Session A and then enable the provider to Session B, when the
provider registers itself, the provider is only enabled for Session B.”

So WPP will not be upgraded to the manifest based ETW right?

Now I have to decide how to provide some internal statistics, I was thinking
of using the ETW session created by WPP to do this. Although not being able
to set up multiple readers on a provider somehwat limits the use of the
statistics. Can you give me your opinion on this, should I go with WMI or is
there way arround this issue for ETW events only?

Thanks again for your reply
Cláudio Albuquerque

“Jose Sua” wrote in message
news:xxxxx@ntdev…
ETW Down-level Vista has the limitation that a provider can log to only a
single session.

So if you have provider P and start session A and enable the provider P to
it then Events be directed to session A.
If you then start Session B, and enable provider P to it, then events will
be directed to session B, and session A will get none.

ETW in Vista can allow multiple sessions to receive events from a single
provider. But ETW uses the legacy ETW API so you will still get the behavior
described above.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Cláudio Albuquerque
Sent: Monday, August 13, 2007 9:47 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] WPP / ETW

Hi,

I’ve been using WPP / ETW for some time now, and I’ve notice an issue.
I’ve been helping a customer to put some systems into production, and for a
good evaluation of what’s happening I usually configure the services to
generate the ETL logs so that I can evaluate the systems progression and any
issue that might go unnoticed.
I simply turn on a flag on the GUI and the service starts recording a
private ETW session to a specific location, no problem here.
On a weekly basis I connect to the clients network and collect the logs.
Lately when I connect I start a traceview session just to get the immediate
feedback on the system and by doing this I realize that the ETL files stop
receiving data, for some reason by starting a real time session no data
arrives for my private one.

So how can I fix this, any ideas?

Regards
Cláudio Albuquerque

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Hi Jose,

Thanks for reply!
Now I’ve looked at the online documentation and actually what you replied
here is in the remarks of EnableTrace, sorry.
But I was actually mislead in thinking that ETW supported multisessions
because of my local documentation provides a remark regarding multisessions,
which still lingers on the online docs, and potential issue of confusion:
“You can call this function, one time, to enable a provider before the
provider registers itself. After the provider registers itself, ETW calls
the provider’s ControlCallback function. If you try to enable the provider
for MULTIPLE SESSIONS before the provider registers itself, ETW will only
enable the provider for the last session. For example, if you enable the
provider to Session A and then enable the provider to Session B, when the
provider registers itself, the provider is only enabled for Session B.”

So WPP will not be upgraded to the manifest based ETW right?

Now I have to decide how to provide some internal statistics, I was thinking
of using the ETW session created by WPP to do this. Although not being able
to set up multiple readers on a provider somewhat limits the use of the
statistics. Can you give me your opinion on this, should I go with WMI or is
there way around this issue for ETW events only?

Thanks again for your reply
Cláudio Albuquerque

“Jose Sua” wrote in message
news:xxxxx@ntdev…
ETW Down-level Vista has the limitation that a provider can log to only a
single session.

So if you have provider P and start session A and enable the provider P to
it then Events be directed to session A.
If you then start Session B, and enable provider P to it, then events will
be directed to session B, and session A will get none.

ETW in Vista can allow multiple sessions to receive events from a single
provider. But ETW uses the legacy ETW API so you will still get the behavior
described above.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Cláudio Albuquerque
Sent: Monday, August 13, 2007 9:47 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] WPP / ETW

Hi,

I’ve been using WPP / ETW for some time now, and I’ve notice an issue.
I’ve been helping a customer to put some systems into production, and for a
good evaluation of what’s happening I usually configure the services to
generate the ETL logs so that I can evaluate the systems progression and any
issue that might go unnoticed.
I simply turn on a flag on the GUI and the service starts recording a
private ETW session to a specific location, no problem here.
On a weekly basis I connect to the clients network and collect the logs.
Lately when I connect I start a traceview session just to get the immediate
feedback on the system and by doing this I realize that the ETL files stop
receiving data, for some reason by starting a real time session no data
arrives for my private one.

So how can I fix this, any ideas?

Regards
Cláudio Albuquerque

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

WPP will not be upgraded to the manifest.

Instead the ETW will have tools to simplify adding instrumentation, the tools will take the manifest and generate the required code for logging the events.

Maybe you can have two provider GUIDs one that is your normal runtime stuff.
One that is only enabled to collect statistics.

The issue really is that you are using WPP for other than software tracing.
What you can do is use the raw ETW, with manifest or MOF.

Then write your own consumer application using StartTrace, ProcessTrace to show the data and have control of the events.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Cl?udio Albuquerque
Sent: Tuesday, August 14, 2007 4:50 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] WPP / ETW

Hi Jose,

Thanks for reply!
Now I’ve looked at the online documentation and actually what you replied
here is in the remarks of EnableTrace, sorry.
But I was actually mislead in thinking that ETW supported multisessions
because of my local documentation provides a remark regarding multisessions,
which still lingers on the online docs, and potential issue of confusion:
“You can call this function, one time, to enable a provider before the
provider registers itself. After the provider registers itself, ETW calls
the provider’s ControlCallback function. If you try to enable the provider
for MULTIPLE SESSIONS before the provider registers itself, ETW will only
enable the provider for the last session. For example, if you enable the
provider to Session A and then enable the provider to Session B, when the
provider registers itself, the provider is only enabled for Session B.”

So WPP will not be upgraded to the manifest based ETW right?

Now I have to decide how to provide some internal statistics, I was thinking
of using the ETW session created by WPP to do this. Although not being able
to set up multiple readers on a provider somewhat limits the use of the
statistics. Can you give me your opinion on this, should I go with WMI or is
there way around this issue for ETW events only?

Thanks again for your reply
Cl?udio Albuquerque

“Jose Sua” wrote in message
news:xxxxx@ntdev…
ETW Down-level Vista has the limitation that a provider can log to only a
single session.

So if you have provider P and start session A and enable the provider P to
it then Events be directed to session A.
If you then start Session B, and enable provider P to it, then events will
be directed to session B, and session A will get none.

ETW in Vista can allow multiple sessions to receive events from a single
provider. But ETW uses the legacy ETW API so you will still get the behavior
described above.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Cl?udio Albuquerque
Sent: Monday, August 13, 2007 9:47 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] WPP / ETW

Hi,

I’ve been using WPP / ETW for some time now, and I’ve notice an issue.
I’ve been helping a customer to put some systems into production, and for a
good evaluation of what’s happening I usually configure the services to
generate the ETL logs so that I can evaluate the systems progression and any
issue that might go unnoticed.
I simply turn on a flag on the GUI and the service starts recording a
private ETW session to a specific location, no problem here.
On a weekly basis I connect to the clients network and collect the logs.
Lately when I connect I start a traceview session just to get the immediate
feedback on the system and by doing this I realize that the ETL files stop
receiving data, for some reason by starting a real time session no data
arrives for my private one.

So how can I fix this, any ideas?

Regards
Cl?udio Albuquerque

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer