1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
|
// Copyright 2012 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Declaration of a Windows event trace consumer base class.
#ifndef BASE_WIN_EVENT_TRACE_CONSUMER_H_
#define BASE_WIN_EVENT_TRACE_CONSUMER_H_
#include <windows.h>
#include <evntcons.h>
#include <evntrace.h>
#include <stddef.h>
#include <wmistr.h>
#include <vector>
#include "base/threading/scoped_blocking_call.h"
namespace base {
namespace win {
// This class is a base class that makes it easier to consume events
// from realtime or file sessions. Concrete consumers need to subclass a
// specialization of this class and override the ProcessEvent, the
// ProcessEventRecord and/or the ProcessBuffer methods to implement the
// event consumption logic.
// Usage might look like:
// class MyConsumer: public EtwTraceConsumerBase<MyConsumer, 1> {
// protected:
// static VOID WINAPI ProcessEvent(PEVENT_TRACE event);
// };
//
// MyConsumer consumer;
// consumer.OpenFileSession(file_path);
// consumer.Consume();
template <class ImplClass>
class EtwTraceConsumerBase {
public:
// If true, receive events in the new EVENT_RECORD format. To receive
// events in the new format, ProcessEventRecord() must be overridden.
// See PROCESS_TRACE_MODE_EVENT_RECORD from
// https://learn.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_logfilea
static constexpr bool kEnableRecordMode = false;
// If true, TimeStamps in EVENT_HEADER and EVENT_TRACE_HEADER are not
// converted to system time. See PROCESS_TRACE_MODE_RAW_TIMESTAMP from
// https://learn.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_logfilea
static constexpr bool kRawTimestamp = false;
// Constructs a closed consumer.
EtwTraceConsumerBase() = default;
EtwTraceConsumerBase(const EtwTraceConsumerBase&) = delete;
EtwTraceConsumerBase& operator=(const EtwTraceConsumerBase&) = delete;
~EtwTraceConsumerBase() { Close(); }
// Opens the named realtime session, which must be existent.
// Note: You can use OpenRealtimeSession or OpenFileSession
// to open as many as MAXIMUM_WAIT_OBJECTS (63) sessions at
// any one time, though only one of them may be a realtime
// session.
HRESULT OpenRealtimeSession(const wchar_t* session_name);
// Opens the event trace log in "file_name", which must be a full or
// relative path to an existing event trace log file.
// Note: You can use OpenRealtimeSession or OpenFileSession
// to open as many as kNumSessions at any one time.
HRESULT OpenFileSession(const wchar_t* file_name);
// Consume all open sessions from beginning to end.
HRESULT Consume();
// Close all open sessions.
HRESULT Close();
protected:
// Override in subclasses to handle events.
static void ProcessEvent(EVENT_TRACE* event) {}
// Override in subclasses to handle events.
static void ProcessEventRecord(EVENT_RECORD* event_record) {}
// Override in subclasses to handle buffers.
static bool ProcessBuffer(EVENT_TRACE_LOGFILE* buffer) {
return true; // keep going
}
HRESULT OpenSessionImpl(EVENT_TRACE_LOGFILE& logfile);
protected:
// Currently open sessions.
std::vector<TRACEHANDLE> trace_handles_;
private:
// These delegate to ImplClass callbacks with saner signatures.
static void WINAPI ProcessEventCallback(EVENT_TRACE* event) {
ImplClass::ProcessEvent(event);
}
static void WINAPI ProcessEventRecordCallback(EVENT_RECORD* event_record) {
ImplClass::ProcessEventRecord(event_record);
}
static ULONG WINAPI ProcessBufferCallback(PEVENT_TRACE_LOGFILE buffer) {
return ImplClass::ProcessBuffer(buffer);
}
};
template <class ImplClass>
inline HRESULT EtwTraceConsumerBase<ImplClass>::OpenRealtimeSession(
const wchar_t* session_name) {
EVENT_TRACE_LOGFILE logfile = {
.LoggerName = const_cast<wchar_t*>(session_name),
.ProcessTraceMode = PROCESS_TRACE_MODE_REAL_TIME,
};
return OpenSessionImpl(logfile);
}
template <class ImplClass>
inline HRESULT EtwTraceConsumerBase<ImplClass>::OpenFileSession(
const wchar_t* file_name) {
EVENT_TRACE_LOGFILE logfile = {.LogFileName =
const_cast<wchar_t*>(file_name)};
return OpenSessionImpl(logfile);
}
template <class ImplClass>
HRESULT EtwTraceConsumerBase<ImplClass>::OpenSessionImpl(
EVENT_TRACE_LOGFILE& logfile) {
if (ImplClass::kEnableRecordMode) {
logfile.ProcessTraceMode |= PROCESS_TRACE_MODE_EVENT_RECORD;
logfile.EventRecordCallback = &ProcessEventRecordCallback;
} else {
logfile.EventCallback = &ProcessEventCallback;
}
if (ImplClass::kRawTimestamp) {
logfile.ProcessTraceMode |= PROCESS_TRACE_MODE_RAW_TIMESTAMP;
}
logfile.BufferCallback = &ProcessBufferCallback;
logfile.Context = this;
TRACEHANDLE trace_handle = ::OpenTrace(&logfile);
if (reinterpret_cast<TRACEHANDLE>(INVALID_HANDLE_VALUE) == trace_handle) {
return HRESULT_FROM_WIN32(::GetLastError());
}
trace_handles_.push_back(trace_handle);
return S_OK;
}
template <class ImplClass>
inline HRESULT EtwTraceConsumerBase<ImplClass>::Consume() {
base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
base::BlockingType::MAY_BLOCK);
ULONG err = ::ProcessTrace(&trace_handles_[0],
static_cast<ULONG>(trace_handles_.size()), nullptr,
nullptr);
return HRESULT_FROM_WIN32(err);
}
template <class ImplClass>
inline HRESULT EtwTraceConsumerBase<ImplClass>::Close() {
HRESULT hr = S_OK;
for (size_t i = 0; i < trace_handles_.size(); ++i) {
if (NULL != trace_handles_[i]) {
ULONG ret = ::CloseTrace(trace_handles_[i]);
trace_handles_[i] = NULL;
if (FAILED(HRESULT_FROM_WIN32(ret))) {
hr = HRESULT_FROM_WIN32(ret);
}
}
}
trace_handles_.clear();
return hr;
}
} // namespace win
} // namespace base
#endif // BASE_WIN_EVENT_TRACE_CONSUMER_H_
|
