Question

By ETW I mean "Event Tracing for Windows".

According to my experimenting one virtue is that while by-design it occasionally fails to record events in Very-Busy conditions it otherwise Just Works, as you might expect from a Kernel feature. ETW is the only game in town if you want per-processor-buffering to avoid cache-vs-multi-thread-logging issues, since as I understand it "Only the Kernel Knows" where your threads are really running at any given instant, especially if you don't assign affinity etc.

Yet the interface is messy, and gets even worse if you consider the Microsoft-recommended approach relative to EventWrite(). What's the best available effort at streamlining the programmer's access to this powerful Kernel Subsystem ? I am interested in a C++ interface, but others viewing this question will want to know about the other languages too.

Was it helpful?

Solution

If you are looking for an ease-of-use C/C++ wrapper on top of ETW, the only thing that comes close is WPP. You might hit limitations in WPP if you get too advanced. Watch out for Microsoft PDC in October for something helpful ;)

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top