Building your own profiling and diagnosis tools with Event Tracing for Windows
summary
Event Tracing for Windows provides low‑overhead, system‑wide events that can be captured to ETL files or streamed live; expect a 1–3 second delivery delay and use WPR/WPA for GUI recording and analysis. Code examples use TraceEvent and Lobsters (Krabs) libraries to create sessions, enable providers, parse provider schemas and handle events (process start/stop, image loads, TCP/IP connect/disconnect). Kernel provider supports a profile keyword for ~1 ms sampling used to build a simple profiler that ranks CPU consumers and a network connection monitor.
AI-written summary · about
chapters (15)
- 0:00Introduction to speaker
- 0:52What is etw
- 4:45Core components of etw
- 7:03Disadvantages and use cases
- 9:01Analyzing existing sessions
- 12:28Etw tools
- 17:53Etw explorer
- 20:14Etw libraries
- 22:42Implementing a provider
- 31:57Kernel provider
- 37:51State management
- 42:00Debug view replacement
- 45:50Profiling with kernel events
- 50:29Network monitoring
- 56:31Creating custom parsers
related talks
58mETW - Monitor Anything, Anytime, Anywhere
44mEvent Tracing for Windows Internals
34mTrace-Profiling: A New Way About How to Track Application Behavior
27mBeyond OTLP: Unlocking the Potential of OS-native Tracing
01h 02mFrom ETW to EventPipe
57mDistributed Tracing: How the Pros Debug Concurrent and Distributed Systems
25mPerfect Match: Correlating Continuous Profiling with Distributed Tracing for Stronger Observability
37mKernel and userspace tracing with LTTng and friends