How can I determine if an ETW session is dropping events?
If it is dropping events, how can I configure the tracing session so that events are not dropped?
I’ve written a custom ETW provider to help with some debugging efforts. I’m currently capturing the trace data using logman.exe.
In viewing the results, it appears that some of the events are being dropped. Basically I’m seeking something like:
Event A
Event C
where their should be an intervening Event B, but one does not appear in the trace file. It should be impossible for that to happen, which leads me to believe that ETW is dropping events.
Of course, I’d like to verify that the problem I’m seeing is due to dropped events, and not caused by a bug in my code. I’ve tried Google, but wasn’t able to come up with anything. Does any one know how I can check to see if events are being dropped?
I’ve been using logman to capture the results. It looks like tracelog will give me info about lost events, and I can tweek its buffer parameters to reduce the event loss.