Understanding ETW

[simnether]

Hi there,

Let me start with stating that I'm not a dev engineer, so I'm having some troubles understanding how to start a trace of a process with ETW.

My goal would be getting the current bandwidth usage (and used so far) of a specific process. Being a systems engineer, I was looking at ways to do it with powershell. I can't seem to find any help online on this; the only thing I found is EventTracManCmdlets is: EventTracManCmdlets

Does anybody know how to use those cmdlets in powershell by any chance? I know this is a powershell question, and I did ask it there, however nobody seems to know how to use them nor point me to examples.

So, during my week-long research I've found this C# code and I was wondering if anybody can help me translate that to powershell or knows what's the best way for me to run this code from PS? The code seems to already have what I need (besides the total bandwidth used so far). I'd rather start from scratch in Powershell, but I'd be happy to start converting this code before I find a better answer.

If you can point me to any documentation that you think is helpful, please send the links over.

using System;
using System.Diagnostics;
using System.Threading.Tasks;
using Microsoft.Diagnostics.Tracing.Parsers;
using Microsoft.Diagnostics.Tracing.Session;

namespace ProcessMonitoring
{
public sealed class NetworkPerformanceReporter : IDisposable
{
private DateTime m_EtwStartTime;
private TraceEventSession m_EtwSession;

private readonly Counters m_Counters = new Counters();

private class Counters
{
public long Received;
public long Sent;
}

private NetworkPerformanceReporter() { }

public static NetworkPerformanceReporter Create()
{
var networkPerformancePresenter = new NetworkPerformanceReporter();
networkPerformancePresenter.Initialise();
return networkPerformancePresenter;
}

private void Initialise()
{
// Note that the ETW class blocks processing messages, so should be run on a different thread if you want the application to remain responsive.
Task.Run(() => StartEtwSession());
}

private void StartEtwSession()
{
try
{
var processId = Process.GetCurrentProcess().Id;
ResetCounters();

using (m_EtwSession = new TraceEventSession("MyKernelAndClrEventsSession"))
{
m_EtwSession.EnableKernelProvider(KernelTraceEventParser.Keywords.NetworkTCPIP);

m_EtwSession.Source.Kernel.TcpIpRecv += data =>
{
if (data.ProcessID == processId)
{
lock (m_Counters)
{
m_Counters.Received += data.size;
}
}
};

m_EtwSession.Source.Kernel.TcpIpSend += data =>
{
if (data.ProcessID == processId)
{
lock (m_Counters)
{
m_Counters.Sent += data.size;
}
}
};

m_EtwSession.Source.Process();
}
}
catch
{
ResetCounters(); // Stop reporting figures
// Probably should log the exception
}
}

public NetworkPerformanceData GetNetworkPerformanceData()
{
var timeDifferenceInSeconds = (DateTime.Now - m_EtwStartTime).TotalSeconds;

NetworkPerformanceData networkData;

lock (m_Counters)
{
networkData = new NetworkPerformanceData
{
BytesReceived = Convert.ToInt64(m_Counters.Received / timeDifferenceInSeconds),
BytesSent = Convert.ToInt64(m_Counters.Sent / timeDifferenceInSeconds)
};

}

// Reset the counters to get a fresh reading for next time this is called.
ResetCounters();

return networkData;
}

private void ResetCounters()
{
lock (m_Counters)
{
m_Counters.Sent = 0;
m_Counters.Received = 0;
}
m_EtwStartTime = DateTime.Now;
}

public void Dispose()
{
m_EtwSession?.Dispose();
}
}

public sealed class NetworkPerformanceData
{
public long BytesReceived { get; set; }
public long BytesSent { get; set; }
}
}



I appreciate any help I can get here.

Thank you

Continue reading...