Halloween Spooktacular Day 11: Define Your Own Event UserData

If you tried using TraceEvent after yesterday’s hint, you may have noticed a problem: even once you force ETW to produce events at the correct times, your event processing thread has no way to know which events correspond to which start/stop points.

Specifically, ETW requires you to use an asynchronous collection thread. That thread will see a continuous stream of events. When the user uses your API to bracket several start/stop points for PMC collection throughout their code, you can call TraceEvent to produce events at the start and end — but without more information, the collection thread has no way of knowing which events correspond to which start/stop points.

Today’s hint is about how to solve this problem: use event UserData to store whatever context you need to properly track events.

Specifically, you can use RegisterTraceGuids to register your own event type GUID. If you call TraceEvent using your own registered GUID, you are free to supply whatever UserData you want, and this UserData will be pointed to by the EVENT_RECORD that later arrives at your collection thread. TraceEvent will automatically take as much data after the EVENT_TRACE_HEADER as is indicated by the header’s Size field, so you are free to define your own event data by combining an EVENT_TRACE_HEADER with any collection of additional fields you want:

struct pmc_tracer_etw_marker_userdata
{
    u64 AnyValueYouWant;
    u64 AnyOtherValueYouWantEtc;
};

struct pmc_tracer_etw_marker
{
    EVENT_TRACE_HEADER Header;
    pmc_tracer_etw_marker_userdata UserData;
};

// ...

pmc_tracer_etw_marker TraceMarker = {};

TraceMarker.Header.Size = sizeof(TraceMarker);
TraceMarker.Header.Flags = WNODE_FLAG_TRACED_GUID;
TraceMarker.Header.Guid = /* YOUR REGISTERED GUID GOES HERE */;
    
TraceMarker.UserData.AnyValueYouWant = 1234;
TraceMarker.UserData.AnyOtherValueYouWantEtc = 4567;
    
TraceEvent(TraceHandle, &TraceMarker.Header);
 

Since the UserData can contain anything you want, it should be straightforward to capture whatever data you need to ensure your collection thread knows which events go with which start and stop points.

That concludes today’s hint. Until tomorrow, good luck making progress on the Spooktacular Challenge!

I will post additional hints here every day until Halloween. If you’d like the rest of the Spooktacular Challenge to be delivered automatically to your inbox, you can select a subscription option here: