Access trace data

.NET TraceProcessing is available from NuGet with the following package ID:

Microsoft.Windows.EventTracing.Processing.All

This package allows you to access data in a trace file. If you do not already have a trace file, you can use Windows Performance Recorder to create one.

The following example console app shows how to access the command lines of all processes contained in the trace:

using Microsoft.Windows.EventTracing;
using Microsoft.Windows.EventTracing.Processes;
using System;

class Program
{
    static void Main(string[] args)
    {
        if (args.Length != 1)
        {
            Console.Error.WriteLine("Usage: <trace.etl>");
            return;
        }

        using (ITraceProcessor trace = TraceProcessor.Create(args[0]))
        {
            IPendingResult<IProcessDataSource> pendingProcessData = trace.UseProcesses();

            trace.Process();

            IProcessDataSource processData = pendingProcessData.Result;

            foreach (IProcess process in processData.Processes)
            {
                Console.WriteLine(process.CommandLine);
            }
        }
    }
}

Using TraceProcessor

To process a trace, call TraceProcessor.Create. The core interface is ITraceProcessor, and using this interface involves the following pattern:

1. First, tell the processor what data you want to use from a trace
2. Second, process the trace; and
3. Finally, access the results.

Telling the processor what kinds of data you want up front means you do not need to spend time processing large volumes of all possible kinds of trace data. Instead, TraceProcessor just does the work needed to provide the specific kinds of data you request.

Recommended project settings

There are a couple of project settings we recommend using with TraceProcessor:

1. We recommend running exes as 64-bit.

   The Visual Studio default for a new C# .NET Framework console application is Any CPU with Prefer 32-bit checked. The default for .NET may already have the recommended setting.

   Trace processing can be memory-intensive, especially with larger traces, and we recommend changing Platform target to x64 (or unchecking Prefer 32-bit) in exes that use TraceProcessor. To change these settings, see the Build tab under Properties for the project. To change these settings for all configurations, ensure that the Configuration dropdown is set to All Configurations, rather than the default of the current configuration only.

2. We suggest using NuGet with the newer-style PackageReference mode rather than the older packages.config mode.

   To change the default for new projects, see Tools, NuGet Package Manager, Package Manager Settings, Package Management, Default package management format.

Built-in data sources

An .etl file can capture many kinds of data in a trace. Note that which data is in an .etl file depends on what providers were enabled when the trace was captured. The following list shows the kinds of trace data available from TraceProcessor:

See also the extension methods on ITraceSource for all available trace data, or examine the method available from "trace." shown by IntelliSense.

Next Steps

In this overview, you learned how to access trace data using TraceProcessor and the built-in data sources that it can access.

The next step is to learn how to extend TraceProcessor to access custom trace data.