Event Tracing for Windows (ETW) increase session buffer size

Question

I'm using ETW for tracing events of some custom applications (written in C++) I'm developing. The providers are manifest-based providers. During some test sessions, I saw some events are missing and, debugging, I found out that the EventWrite method return the error ERROR_MORE_DATA that as defined in the Windows Doc Page means that

The session buffer size is too small for the event

Looking at this page seems to be possibile defining a bufferSize property. Using those informations, I updated the manifest:

OLD MANIFEST

<provider name="IconisTrace-IFMO" guid="{038CA124-E20D-4c13-BC62-F158E89222EA}" symbol="TraceIconisTraceIFMO" resourceFileName="_ICONIS_PATH\ICONIS\Bin\IcATSR_Trace_ResOffline.dll" messageFileName="_ICONIS_PATH\ICONIS\Bin\IcATSR_Trace_ResOffline.dll" message="$(string.Provider.Name.IFMO)">
  <events>
          <event keywords="Error" value="1" version="0" level="win:Error" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Warning" value="2" version="0" level="win:Warning" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Functional" value="3" version="0" level="win:Informational" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Informative" value="4" version="0" level="win:Verbose" template="template_function_trace" channel="c1" message="$(string.Event.String)"/>
          <event keywords="Begin" value="5" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Exit" value="6" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Debug" value="7" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="_S2KTrace" value="8" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Performance" value="9" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
      </events>
    <levels>
    </levels>
    <tasks>
      <task name="IFMO" symbol="IFMOTracingEntry" value="3" eventGUID="{2AAB6C5E-4FCC-493d-9606-E430DFEEB829}">
      </task>
    </tasks>
    <opcodes>
    </opcodes>
      <keywords>
          <keyword name="Error" mask="0x1" message="$(string.Keyword.Error)"/>
          <keyword name="Warning" mask="0x2" message="$(string.Keyword.Warning)"/>
          <keyword name="Functional" mask="0x4" message="$(string.Keyword.Functional)"/>
          <keyword name="Informative" mask="0x8" message="$(string.Keyword.Informative)"/>
          <keyword name="Begin" mask="0x10" message="$(string.Keyword.Begin)"/>
          <keyword name="Exit" mask="0x20" message="$(string.Keyword.Exit)"/>
          <keyword name="Debug" mask="0x40" message="$(string.Keyword.Debug)"/>
          <keyword name="_S2KTrace" mask="0x80" message="$(string.Keyword._S2KTrace)"/>
          <keyword name="Performance" mask="0x100" message="$(string.Keyword.Performance)"/>
      </keywords>
    <templates>
      <template tid="template_function_trace">
        <data name="FileName" inType="win:UnicodeString" outType="xs:string"/>
        <data name="LineNum" inType="win:Int32" outType="xs:int"/>
        <data name="OutputString" inType="win:UnicodeString" outType="xs:string"/>
      </template>
    </templates>
  </provider>

NEW MANIFEST

<provider name="IconisTrace-IFMO" guid="{038CA124-E20D-4c13-BC62-F158E89222EA}" symbol="TraceIconisTraceIFMO" resourceFileName="_ICONIS_PATH\ICONIS\Bin\IcATSR_Trace_ResOffline.dll" messageFileName="_ICONIS_PATH\ICONIS\Bin\IcATSR_Trace_ResOffline.dll" message="$(string.Provider.Name.IFMO)">
  <channels>
    <channel name="IconisTrace-IFMO/Operational" chid="c1" type="Operational" enabled="true">
      <publishing>
        <bufferSize>0x80</bufferSize>
      </publishing>
    </channel>
  </channels>
  <events>
          <event keywords="Error" value="1" version="0" level="win:Error" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Warning" value="2" version="0" level="win:Warning" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Functional" value="3" version="0" level="win:Informational" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Informative" value="4" version="0" level="win:Verbose" template="template_function_trace" channel="c1" message="$(string.Event.String)"/>
          <event keywords="Begin" value="5" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Exit" value="6" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Debug" value="7" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="_S2KTrace" value="8" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
          <event keywords="Performance" value="9" version="0" level="win:Verbose" template="template_function_trace" message="$(string.Event.String)"/>
      </events>
    <levels>
    </levels>
    <tasks>
      <task name="IFMO" symbol="IFMOTracingEntry" value="3" eventGUID="{2AAB6C5E-4FCC-493d-9606-E430DFEEB829}">
      </task>
    </tasks>
    <opcodes>
    </opcodes>
      <keywords>
          <keyword name="Error" mask="0x1" message="$(string.Keyword.Error)"/>
          <keyword name="Warning" mask="0x2" message="$(string.Keyword.Warning)"/>
          <keyword name="Functional" mask="0x4" message="$(string.Keyword.Functional)"/>
          <keyword name="Informative" mask="0x8" message="$(string.Keyword.Informative)"/>
          <keyword name="Begin" mask="0x10" message="$(string.Keyword.Begin)"/>
          <keyword name="Exit" mask="0x20" message="$(string.Keyword.Exit)"/>
          <keyword name="Debug" mask="0x40" message="$(string.Keyword.Debug)"/>
          <keyword name="_S2KTrace" mask="0x80" message="$(string.Keyword._S2KTrace)"/>
          <keyword name="Performance" mask="0x100" message="$(string.Keyword.Performance)"/>
      </keywords>
    <templates>
      <template tid="template_function_trace">
        <data name="FileName" inType="win:UnicodeString" outType="xs:string"/>
        <data name="LineNum" inType="win:Int32" outType="xs:int"/>
        <data name="OutputString" inType="win:UnicodeString" outType="xs:string"/>
      </template>
    </templates>
  </provider>

The differences between the two version are that in the NEW MANIFEST I add the following elements:

<channels>
    <channel name="Alstom-Iconis-IconisTrace-IFMO/Operational" chid="c1" type="Operational" enabled="true">
      <publishing>
        <bufferSize>0x80</bufferSize>
      </publishing>
    </channel>
</channels>

and added the attribute channel="c1" in the line <event keywords="Informative" value="4"...

Unfortunately, I still continue to have the same error.

Here the questions:

Does this change make any sense? Is it the correct way to face this problem? I have some doubts beacuse in this doc page there is a note that says:

[!Note] Regardless of buffer size, ETW cannot collect events larger than 64KB.

The manifest is correctly compiled with the command mc.exe -um OfflineProviders.man and several files are generated; but when I try to register the manifest using wevtutil.exe im OfflineProviders.man I get the follwing error

The value for channel property BufferSize contains an invalid value. The parameter is incorrect.

Why do I get this error? Does the error explain why I still continue to have missing events?

score 0 · Answer 1 · answered Aug 09 '22 at 01:54

Look into the trace session buffer configuration when starting the trace. The trace controller, sets up an ETW trace session which sets up the trace buffers within it, and allows for configuration of the buffers such as the size, and number as well as the flush interval.

Event Tracing for Windows (ETW) increase session buffer size

1 Answers1