如何从 ETL 文件中获取文件版本信息

问题描述

限时删除！！

使用 Microsoft TraceEvent Library 可以解析 ETL 文件由 xperf、WPR 或 PerfView.

With the Microsoft TraceEvent Library it is possible to parse ETL files which are generated by xperf, WPR or PerfView.

我发现 TracEvent 中的 Event ImageIDFileVersion 显示了文件版本，而 Event ImageGroup 显示了文件的文件路径.现在我需要将两个事件映射到一起，并且需要一种方法来确保两个事件都指向 ETL 跟踪文件中的同一个文件.

I found out that the Event ImageIDFileVersion in TracEvent shows me the file version and the Event ImageGroup shows me the file paths of files. Now I need to map both events together and need a way to make sure both events point to the same file in the ETL trace file.

推荐答案

重要信息来自 ImageGroup 和 ImageIDFileVersion 事件，因此为事件分配方法:

The important information come from the ImageGroup and ImageIDFileVersion events, so assign methods to the events:

using (_source = new ETWTraceEventSource(dataFileName))
{
     var kernelParser = new KernelTraceEventParser(_source);

     _source.Kernel.ImageGroup += KernelOnImageGroup;

     var symbolParser = new SymbolTraceEventParser(_source);

     symbolParser.ImageIDFileVersion += SymbolParserOnImageIdFileVersion;

     // go into a loop processing events can calling the callbacks.  This will return when the all the events
     // In the file are processed, or the StopProcessing() call is made.
     _source.Process();
}

基本上 FileVersionTraceData 事件出现在相应的 Image* 事件之前，并且具有相同的时间戳.所以时间戳用作相关器.

Basically the FileVersionTraceData event comes before the corresponding Image*event, and has the same timestamp. So the Timestamp is used as the correlator.

当 ImageIDFileVersion 事件发生时，您必须将当前数据克隆到另一个 FileVersionTraceData 对象中以存储它以备后用:

When the ImageIDFileVersion events occurs, you have to clone the current data into an other FileVersionTraceData object to store it for later use:

void SymbolParserOnImageIdFileVersion(FileVersionTraceData data)
{
     lastFileVersionData = (FileVersionTraceData)data.Clone();
}

此后，第二个事件 ImageGroup 被命中.在这里，您必须将时间戳 (TimeStampRelativeMSec) 与存储的数据进行比较，如果时间戳匹配，两个事件都指向同一个文件.

After this the second Event ImageGroup is hit. Here you must compare the timestamp (TimeStampRelativeMSec) with the stored data and if the timestamp matches both events point to the same file.

void KernelOnImageGroup(ImageLoadTraceData imageLoadTraceData)
{
     var fileName = imageLoadTraceData.FileName;
     {
          if (!string.IsNullOrEmpty(fileName))
          {
                if (lastFileVersionData != null && lastFileVersionData.TimeStampRelativeMSec == imageLoadTraceData.TimeStampRelativeMSec)
                {
                     var fileVersion = lastFileVersionData.FileVersion;
                     var origFileName = lastFileVersionData.OrigFileName;
                     Console.WriteLine("found File {0} with File Version {1}", origFileName, fileVersion);
                }
          }
      }
 }

现在您已从 ETL 文件中解析出文件版本.重要的一点是时间戳被用作相关器来找到正确的数据.这花了我一段时间，并在 Vance Morrison 的帮助下发现时间戳用作相关器以及如何找到文件版本.

Now you have the fileversion parsed from an ETL file. The important point is that the Timestamp is used as the correlator to find the correct data. This took me a while and the help of Vance Morrison to figure out that Timestamp is used as the correlator and how to find the file version.

这篇关于如何从 ETL 文件中获取文件版本信息的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！

1403页，肝出来的..