ETW - Monitor Anything, Anytime, Anywhere
summary
Event Tracing for Windows (ETW) records kernel and user events with tiny overhead, no recompilation or restart, and is used to diagnose real problems: a Visual Studio startup trace runs 70s with the main thread active ~40s and a JetBrains subroutine costing ~15s; a WPF app shows ~1.5 GB of string allocations. Demos use perfview and WPA for offline analysis, the TraceEvent library plus a command-line tool for live sessions, and WPR auto-loggers for boot traces; a self‑profiling app builds kernel/CLR/JIT sessions, collects samples and worked end‑to‑end.
AI-written summary · about
chapters (16)
- 0:00Introduction to ETW
- 1:03Traditional tool challenges
- 4:28ETW architecture overview
- 8:54ETW monitoring scenarios
- 12:28Concurrency analysis
- 14:20Perftools demo
- 16:03Visual Studio profiling demo
- 21:42Continuous monitoring
- 27:07Real-time analysis demo
- 29:08WPA visualization demo
- 32:04Flame graph analysis
- 33:43Real-time parsing
- 37:53Live tracing demo
- 43:05Offline file analysis
- 44:22Boot performance analysis
- 51:41Takeaways and Q&A
related talks
01h 00mBuilding your own profiling and diagnosis tools with Event Tracing for Windows
01h 02mFrom ETW to EventPipe
27mBeyond OTLP: Unlocking the Potential of OS-native Tracing
43mSelf-Aware Applications: Automatic Production Monitoring
59mOpenTelemetry will save your day and night
01h 00mPractical OpenTelemetry for .NET
48mEfficient and Large-scale Infrastructure Monitoring With Tracing
01h 01mPractical OpenTelemetry in .NET 8