Question

启动我的应用程序时，我需要启动日志记录会话。我编写了日志记录init / deinit函数，*。etl文件已创建，但在会话后为空。我正在使用WPP跟踪（用于内核以及用户空间）。我不知道我做错了什么。我已经阅读了很多有关此API的文章和文档，但无法提出解决方案。

我正在使用VERBOSE标志编写与我的应用程序相关的所有内容，还为跟踪会话（ToolSessionGuid）和与我的应用程序相关的GUID（GUID_APP）定义了guid。

这是我对Init / deinit函数的实现：

void traceLoggerDeinit(TRACEHANDLE* sessionHandle, EVENT_TRACE_PROPERTIES* sessionProperties) {
    if (!sessionHandle)
        return;
    if (*sessionHandle) {
        uint64_t retval = EnableTraceEx2(*sessionHandle, (GUID*)&GUID_APP, EVENT_CONTROL_CODE_DISABLE_PROVIDER, TRACE_LEVEL_INFORMATION, 0, 0, 0, NULL);
        if (retval != ERROR_SUCCESS)
            traceErr("Failed to disable trace, error %llu", retval);
        retval = ControlTrace(*sessionHandle, LOGSESSION_NAME, sessionProperties, EVENT_TRACE_CONTROL_STOP);
        if (retval != ERROR_SUCCESS)
            traceErr("Failed to stop trace, error %llu", retval);
    }
    sessionHandle = nullptr;
}

uint64_t traceLoggerInit(TRACEHANDLE* sessionHandle, EVENT_TRACE_PROPERTIES* sessionProperties, uint32_t bufferSize)
{
    sessionProperties->Wnode.BufferSize = bufferSize;
    sessionProperties->Wnode.Flags = WNODE_FLAG_TRACED_GUID;
    sessionProperties->Wnode.ClientContext = 1;
    sessionProperties->Wnode.Guid = ToolSessionGuid;
    sessionProperties->LogFileMode = EVENT_TRACE_FILE_MODE_SEQUENTIAL;
    sessionProperties->MaximumFileSize = 1;
    sessionProperties->LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
    sessionProperties->LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + sizeof(LOGSESSION_NAME);
    StringCbCopy((wchar_t*)((char*)sessionProperties + sessionProperties->LogFileNameOffset), sizeof(LOGFILE_PATH), LOGFILE_PATH);

    uint64_t retval = StartTrace((TRACEHANDLE*)sessionHandle, LOGSESSION_NAME, sessionProperties);
    if (retval == ERROR_ALREADY_EXISTS) {
        traceErr("Trace logging already enabled. Disabling and enabling again");
        return ERROR_ALREADY_EXISTS;
    }
    if (retval != ERROR_SUCCESS) {
        traceErr("StartTrace() failed, error %llu", retval);
        return -1;
    }

    retval = EnableTraceEx2(*sessionHandle, (GUID*)&GUID_APP, EVENT_CONTROL_CODE_ENABLE_PROVIDER, TRACE_LEVEL_VERBOSE, 0, 0, 0, NULL);
    if (retval != ERROR_SUCCESS) {
        traceErr("EnableTrace() failed, error %llu", retval);
        return -1;
    }

    return 0;
}

在主函数中，我正在初始化结构和句柄：

uint32_t size = sizeof(EVENT_TRACE_PROPERTIES) + sizeof(LOGFILE_PATH) + sizeof(LOGSESSION_NAME) + 1024 * sizeof(wchar_t);
TRACEHANDLE sessionHandle = 0;
EVENT_TRACE_PROPERTIES* sessionProperties = (EVENT_TRACE_PROPERTIES*)malloc(size);
if (!sessionProperties) {
    traceErr("Unable to allocate %lu bytes for properties structure", size);
    return -1;
}
memset(sessionProperties, 0, size);

uint64_t retVal = traceLoggerInit(&sessionHandle, sessionProperties, size);
if (retVal == ERROR_ALREADY_EXISTS) {
    traceLoggerDeinit(&sessionHandle, sessionProperties);
    retVal = traceLoggerInit(&sessionHandle, sessionProperties, size);
    if (retVal != 0) {
        traceErr("Failed to enable trace Logging");
        traceLoggerDeinit(&sessionHandle, sessionProperties);
        free(sessionProperties);
        return -1;
    }
}
if (retVal != 0) {
    traceErr("Failed to enable trace Logging");
    traceLoggerDeinit(&sessionHandle, sessionProperties);
    free(sessionProperties);
    return -1;
}

然后使用wpp trace做一些事情，并使用deinit函数关闭会话：

Evntrace API：在StartTrace（）之后（使用WPP跟踪）不写入日志

0 个答案: