Halloween Spooktacular Day 14: Use SysCallEnter to Mark Stop Points

Technically, to mark stop points, you could recycle yesterday’s hint and use SysCallExit events. After all, they will appear after the custom event you would trigger at each stop point by calling TraceEvent.

However, it’s arguably a bit better not to. Since the corresponding SysCallExit event is recorded after TraceEvent completes, if you use it to record PMCs at the stop point, you’ll be including the entire call to TraceEvent in your profile region.

Today’s (relatively minor) hint is to reduce this inaccuracy by using SysCallEnter events for stop points instead. Since the SysCallEnter event will be recorded before TraceEvent executes, using its PMCs rather than those from the SysCallExit will avoid counting TraceEvent’s execution as part of the profiling region.

Mercifully, the only ETW API change you’ll need to make for this is one GUID/opcode addition to the array you pass to TraceSetInformation.

That concludes today’s hint. Until tomorrow, good luck making progress on the Spooktacular Challenge!

I will post additional hints here every day until Halloween. If you’d like the rest of the Spooktacular Challenge to be delivered automatically to your inbox, you can select a subscription option here: