archive
/
windows-xp
mirror of https://github.com/tongzx/nt5src
2
0
Fork 0
Code Issues Projects Releases Wiki Activity
Source code of Windows XP (NT5)
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
9 Commits
1 Branch
0 Tags
2.0 GiB
 
 
 
 
 
 
Tree: 75c48ba87f
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '75c48ba87f'
${ noResults }
windows-xp/Source/XPSP1/NT/sdktools/trace/tracectr/callbacks.cpp

5754 lines
176 KiB
Raw Blame History

/*++
Copyright (c) 1997-2000 Microsoft Corporation
Module Name:
callbacks.c
Abstract:
Setting up and handling the callbacks for the events from the
trace file.
Author:
Melur Raghuraman (mraghu) 03-Oct-1997
Environment:
Revision History:
Insung Park (insungp) 05-Jan-2001
Updated DumpEvent() so that by default, it searches WBEM namespace
for the event data layout information.
Functions added/modified: GetArraySize, GetItemType,
GetPropertiesFromWBEM, GetGuidsWbem, GetGuidsFile, and GetGuids.
Insung Park (insungp) 16-Jan-2001
Changes enabling tracerpt to handle an invalid type name array in the WBEM namespace.
Bug fixes for memory corruption (GetPropertiesFromWBEM and GetGuidsWBEM).
--*/
#ifdef __cplusplus
extern "C"{
#endif
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include "cpdata.h"
#include <wbemidl.h>
#include "tracectr.h"
#include "item.h"
#include "guids.h"
#define BUFFER_SIZE 64*1024
#define MAX_BUFFER_SIZE 10*1024*1024
#define MOFWSTR 16360
#define MOFSTR 32720
#define MAXTYPE 256
#define UC(x) ( (UINT)((x) & 0xFF) )
#define NTOHS(x) ( (UC(x) * 256) + UC((x) >> 8) )
//
// IRP Flags from ntos\inc\io.h for Io event processing.
//
#define IRP_NOCACHE 0x00000001
#define IRP_PAGING_IO 0x00000002
#define IRP_SYNCHRONOUS_API 0x00000004
#define IRP_ASSOCIATED_IRP 0x00000008
#define IRP_BUFFERED_IO 0x00000010
#define IRP_DEALLOCATE_BUFFER 0x00000020
#define IRP_SYNCHRONOUS_PAGING_IO 0x00000040
#define IRP_CREATE_OPERATION 0x00000080
#define IRP_READ_OPERATION 0x00000100
#define IRP_WRITE_OPERATION 0x00000200
#define IRP_CLOSE_OPERATION 0x00000400
#define IRP_DEFER_IO_COMPLETION 0x00000800
#define IRP_OB_QUERY_NAME 0x00001000
#define IRP_HOLD_DEVICE_QUEUE 0x00002000
int IdleEndCount = 0;
ULONG PageFaultCount = 0;
ULONG EventCount = 0;
#define EVENT_TRACE_TYPE_SPL_SPOOLJOB EVENT_TRACE_TYPE_START
#define EVENT_TRACE_TYPE_SPL_PRINTJOB EVENT_TRACE_TYPE_DEQUEUE
#define EVENT_TRACE_TYPE_SPL_DELETEJOB EVENT_TRACE_TYPE_END
#define EVENT_TRACE_TYPE_SPL_TRACKTHREAD EVENT_TRACE_TYPE_CHECKPOINT
#define EVENT_TRACE_TYPE_SPL_ENDTRACKTHREAD 0x0A
#define EVENT_TRACE_TYPE_SPL_JOBRENDERED 0x0B
#define EVENT_TRACE_TYPE_SPL_PAUSE 0x0C
#define EVENT_TRACE_TYPE_SPL_RESUME 0x0D
extern PTRACE_CONTEXT_BLOCK TraceContext;
extern ULONG TotalBuffersRead;
ULONG HPFReadCount = 0;
ULONG HPFWriteCount = 0;
ULONG TotalEventsLost = 0;
ULONG TotalEventCount = 0;
ULONG TimerResolution = 10;
ULONGLONG StartTime = 0;
ULONGLONG EndTime = 0;
BOOL fNoEndTime = FALSE;
__int64 ElapseTime;
PCHAR MofData = NULL;
size_t MofLength = 0;
BOOLEAN fIgnorePerfClock = FALSE;
BOOLEAN fRealTimeCircular = FALSE;
ULONG PointerSize = sizeof(PVOID) * 8;
BOOL g_bUserMode = FALSE;
static ULONG NumProc = 0;
ULONGLONG BogusThreads[64];
ULONG BogusCount=0;
ULONG IdleThreadCount=0;
BOOLEAN bCaptureBogusThreads=TRUE;
IWbemServices *pWbemServices = NULL;
void AnsiToUnicode(PCHAR str, PWCHAR wstr);
ULONG
ahextoi( WCHAR *s);
PMOF_VERSION
GetGuids( GUID Guid, SHORT nVersion, CHAR nLevel, SHORT nType, BOOL bKernelEvent );
HRESULT
WbemConnect( IWbemServices** pWbemServices );
ULONG GetArraySize(
IN IWbemQualifierSet *pQualSet
);
ITEM_TYPE
GetItemType(
IN CIMTYPE_ENUMERATION CimType,
IN IWbemQualifierSet *pQualSet
);
PMOF_VERSION
GetPropertiesFromWBEM(
IWbemClassObject *pTraceSubClasses,
GUID Guid,
SHORT nVersion,
CHAR nLevel,
SHORT nType,
BOOL bKernelEvent
);
PMOF_VERSION
GetGuidsWBEM (
GUID Guid,
SHORT nVersion,
CHAR nLevel,
SHORT nType,
BOOL bKernelEvent
);
PMOF_VERSION
GetGuidsFile(
GUID Guid,
SHORT nVersion,
CHAR nLevel,
SHORT nType,
BOOL bKernelEvent
);
VOID
EventCallback(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
);
VOID
AddMofInfo(
PLIST_ENTRY List,
LPWSTR strType,
SHORT nType,
UINT ArraySize
);
VOID
UpdateThreadData(
PJOB_RECORD pJob,
PEVENT_TRACE_HEADER pHeader,
PTHREAD_RECORD pThread
);
VOID
PrintJobCallback(
PEVENT_TRACE pEvent
);
void
WINAPI
DumpEvent(
PEVENT_TRACE pEvent
);
void
DumpMofVersionItem(
PMOF_VERSION pMofVersion
);
extern PWCHAR CpdiGuidToString(PWCHAR s, LPGUID piid);
ULONG Interpolate(ULONGLONG timeStart, ULONG deltaStart,
ULONGLONG timeEnd, ULONG deltaEnd,
ULONGLONG timeMiddle)
{
return deltaStart
+ (deltaEnd - deltaStart) * ((ULONG) (timeMiddle - timeStart))
/ ((ULONG) (timeEnd - timeStart));
}
BOOLEAN
InTimeWindow(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
PEVENT_TRACE_HEADER pHeader = (PEVENT_TRACE_HEADER) & pEvent->Header;
BOOLEAN fResult = (pThread) ? (TRUE) : (FALSE);
if (fResult && fDSOnly)
{
if ( ((ULONGLONG) pHeader->TimeStamp.QuadPart < DSStartTime)
|| ((ULONGLONG) pHeader->TimeStamp.QuadPart > DSEndTime))
{
fResult = FALSE;
}
}
return fResult;
}
VOID
AdjustThreadTime(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
PEVENT_TRACE_HEADER pHeader = (PEVENT_TRACE_HEADER) & pEvent->Header;
if (IsEqualGUID(&pHeader->Guid, &EventTraceGuid))
{
return;
}
else if (!pThread || pThread->DeadFlag)
{
return;
}
else if (fDSOnly)
{
if ( ((ULONGLONG) pHeader->TimeStamp.QuadPart >= DSStartTime)
&& ((ULONGLONG) pHeader->TimeStamp.QuadPart <= DSEndTime))
{
if (pThread->TimeStart < DSStartTime)
{
pThread->TimeStart = DSStartTime;
pThread->KCPUStart = Interpolate(
pThread->TimeEnd, pThread->KCPUStart,
pHeader->TimeStamp.QuadPart, pHeader->KernelTime,
DSStartTime);
pThread->UCPUStart = Interpolate(
pThread->TimeEnd, pThread->UCPUStart,
pHeader->TimeStamp.QuadPart, pHeader->UserTime,
DSStartTime);
}
pThread->KCPUEnd = pHeader->KernelTime;
pThread->UCPUEnd = pHeader->UserTime;
pThread->TimeEnd = (ULONGLONG)pHeader->TimeStamp.QuadPart;
}
else if ((ULONGLONG) pHeader->TimeStamp.QuadPart < DSStartTime)
{
pThread->TimeStart = pThread->TimeEnd
= (ULONGLONG) pHeader->TimeStamp.QuadPart;
pThread->KCPUStart = pThread->KCPUEnd = pHeader->KernelTime;
pThread->UCPUStart = pThread->UCPUEnd = pHeader->UserTime;
}
else if ((ULONGLONG) pHeader->TimeStamp.QuadPart > DSEndTime)
{
if (pThread->TimeEnd < DSEndTime)
{
if (pThread->TimeEnd < DSStartTime)
{
pThread->KCPUStart = Interpolate(
pThread->TimeEnd, pThread->KCPUStart,
pHeader->TimeStamp.QuadPart, pHeader->KernelTime,
DSStartTime);
pThread->UCPUStart = Interpolate(
pThread->TimeEnd, pThread->UCPUStart,
pHeader->TimeStamp.QuadPart, pHeader->UserTime,
DSStartTime);
pThread->TimeStart = DSStartTime;
}
pThread->KCPUEnd = Interpolate(
pThread->TimeEnd, pThread->KCPUEnd,
pHeader->TimeStamp.QuadPart, pHeader->KernelTime,
DSEndTime);
pThread->UCPUEnd = Interpolate(
pThread->TimeEnd, pThread->UCPUEnd,
pHeader->TimeStamp.QuadPart, pHeader->UserTime,
DSEndTime);
pThread->TimeEnd = DSEndTime;
}
}
}
else
{
pThread->TimeEnd = pHeader->TimeStamp.QuadPart;
if (pThread->KCPUEnd <= pHeader->KernelTime)
pThread->KCPUEnd = pHeader->KernelTime;
if (pThread->UCPUEnd <= pHeader->UserTime)
pThread->UCPUEnd = pHeader->UserTime;
}
}
//
// This routine allocates a new MOF_VERSION entry for
// the given type, version and Level.
//
PMOF_VERSION
GetNewMofVersion( SHORT nType, SHORT nVersion, CHAR nLevel )
{
PMOF_VERSION pMofVersion = NULL;
pMofVersion = (PMOF_VERSION)malloc(sizeof(MOF_VERSION));
if( NULL == pMofVersion ){
return NULL;
}
RtlZeroMemory(pMofVersion, sizeof(MOF_VERSION));
InitializeListHead(&pMofVersion->ItemHeader);
pMofVersion->TypeIndex = nType;
pMofVersion->Level = nLevel;
pMofVersion->Version = nVersion;
return pMofVersion;
}
static void reduceA(char *Src)
{
char *Start = Src;
if (!Src)
return;
while (*Src)
{
if ('\t' == *Src)
*Src = ' ';
else if (',' == *Src)
*Src = ' ';
else if ('\n' == *Src)
*Src = ',';
else if ('\r' == *Src)
*Src = ' ';
++Src;
}
--Src;
while ((Start < Src) && ((' ' == *Src) || (',' == *Src)))
{
*Src = 0x00;
--Src;
}
}
static void reduceW(WCHAR *Src)
{
WCHAR *Start = Src;
if (!Src)
return;
while (*Src)
{
if (L'\t' == *Src)
*Src = L' ';
else if (L',' == *Src)
*Src = L' ';
else if (L'\n' == *Src)
*Src = L',';
else if (L'\r' == *Src)
*Src = L' ';
++Src;
}
--Src;
while ((Start < Src) && ((L' ' == *Src) || (L',' == *Src)))
{
*Src = 0x00;
--Src;
}
}
//
// Given a GUID, return a MOF_INFO
//
PMOF_INFO
GetMofInfoHead(
LPCGUID pGuid
)
{
PLIST_ENTRY Head, Next;
PMOF_INFO pMofInfo;
PLIST_ENTRY EventListHead;
if (pGuid == NULL)
return NULL;
// Search the eventList for this Guid and find the head
//
//
// Traverse the list and look for the Mof info head for this Guid.
EventListHead = &CurrentSystem.EventListHead;
Head = EventListHead;
Next = Head->Flink;
while (Head != Next) {
pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
if (IsEqualGUID(&pMofInfo->Guid, pGuid)) {
return pMofInfo;
}
Next = Next->Flink;
}
//
// If not found, add a new entry for this GUID
//
pMofInfo = (PMOF_INFO)malloc(sizeof(MOF_INFO));
if (pMofInfo == NULL) {
return NULL;
}
memset (pMofInfo, 0, sizeof(MOF_INFO));
pMofInfo->Guid = *pGuid;
InitializeListHead(&pMofInfo->VersionHeader);
InitializeListHead(&pMofInfo->DataListHead);
InsertTailList(EventListHead, &pMofInfo->Entry);
return pMofInfo;
}
//
// Locate the mof version information for the given guid
//
PMOF_VERSION
GetMofVersion(
PMOF_INFO pMofInfo,
SHORT nType,
SHORT nVersion,
CHAR nLevel
)
{
PLIST_ENTRY Head, Next;
SHORT nMatchLevel = 0;
SHORT nMatchCheck = 0;
PMOF_VERSION pMofVersion = NULL;
PMOF_VERSION pBestMatch = NULL;
if (pMofInfo == NULL)
return NULL;
//
// Traverse the list and look for the Mof info head for this Guid.
Head = &pMofInfo->VersionHeader;
Next = Head->Flink;
while (Head != Next) {
nMatchCheck = 0;
pMofVersion = CONTAINING_RECORD(Next, MOF_VERSION, Entry);
Next = Next->Flink;
if( pMofVersion->TypeIndex == nType ){
nMatchCheck++;
}
if( pMofVersion->Level == nLevel ){
nMatchCheck++;
}
if( pMofVersion->Version == nVersion ){
nMatchCheck++;
}
if( nMatchCheck == 3 ){ // Exact Match
return pMofVersion;
}
if( nMatchCheck > nMatchLevel ){ // Close Match
nMatchLevel = nMatchCheck;
pBestMatch = pMofVersion;
}
if( pMofVersion->TypeIndex == EVENT_TYPE_DEFAULT && // Total Guess
pBestMatch == NULL ){
pBestMatch = pMofVersion;
}
}
if (pBestMatch != NULL) {
return pBestMatch;
}
//
// If One does not exist, look it up in the file.
//
pMofVersion = GetGuids( pMofInfo->Guid, nVersion, nLevel, nType, 0 );
// If still not found, create a unknown place holder
if( NULL == pMofVersion ){
pMofVersion = GetNewMofVersion( nType, nVersion, nLevel );
if( pMofVersion != NULL ){
InsertTailList( &pMofInfo->VersionHeader, &pMofVersion->Entry );
if (nType == EVENT_TRACE_TYPE_INFO) {
LPWSTR szHeader = L"Header";
pMofVersion->strType = (PWCHAR)malloc((lstrlenW(szHeader)+1)*sizeof(WCHAR));
if( pMofVersion->strType != NULL ){
wcscpy( pMofVersion->strType, szHeader);
}
}
}
}
return pMofVersion;
}
//
// This routine adds a ITEM_DESC entry to all the MOF_VERSION
// structures in the List
//
VOID
AddMofInfo(
PLIST_ENTRY List,
LPWSTR strType,
SHORT nType,
UINT ArraySize
)
{
PITEM_DESC pItem;
PMOF_VERSION pMofVersion;
PLIST_ENTRY Head = List;
PLIST_ENTRY Next = Head->Flink;
//
// Traverse through the list of MOF_VERSIONS
//
while (Head != Next) {
pMofVersion = CONTAINING_RECORD(Next, MOF_VERSION, Entry);
Next = Next->Flink;
if( NULL != pMofVersion ){
//
// ALLOCATE a new ITEM_DESC for the given type
//
pItem = (PITEM_DESC) malloc(sizeof(ITEM_DESC));
if( NULL == pItem ){
return;
}
ZeroMemory( pItem, sizeof(ITEM_DESC) );
pItem->ItemType = (ITEM_TYPE)nType;
pItem->ArraySize = ArraySize;
// All standard datatypes with fixed sizes will be filled here.
switch (nType) {
case ItemChar :
case ItemUChar : pItem->DataSize = sizeof (char); break;
case ItemCharHidden : pItem->DataSize = sizeof (char); break;
case ItemBool : pItem->DataSize = sizeof (BOOL); break;
case ItemWChar : pItem->DataSize = sizeof (WCHAR); break;
case ItemShort :
case ItemPort :
case ItemUShort : pItem->DataSize = sizeof (short); break;
case ItemPtr : pItem->DataSize = PointerSize / 8; break; // BUG when two files (Win64 & Win32) are used.
case ItemLong :
case ItemIPAddr :
case ItemCPUTime :
case ItemULong :
case ItemULongX : pItem->DataSize = sizeof (ULONG); break;
case ItemGuid : pItem->DataSize = sizeof(GUID); break;
case ItemLongLong :
case ItemULongLong : pItem->DataSize = sizeof (__int64); break;
case ItemChar4 : pItem->DataSize = sizeof(char) * 4; break;
case ItemOptArgs :
default : pItem->DataSize = 0;
}
pItem->strDescription = (PWCHAR) malloc( ( lstrlenW(strType)+1)*sizeof(WCHAR));
if( NULL == pItem->strDescription ){
free( pItem );
return;
}
wcscpy(pItem->strDescription, strType);
//
// Insert the new entry into the ItemHeader list for
// this Version, Type, Level combination
//
InsertTailList( &(pMofVersion->ItemHeader), &pItem->Entry);
}
}
}
VOID
DeclareKernelEvents()
{
PMOF_VERSION pMofVersion;
pMofVersion = GetGuids(FileIoGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(DiskIoGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(PageFaultGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(ProcessGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(ImageLoadGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(ThreadGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(TcpIpGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(UdpIpGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(EventTraceConfigGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(RegistryGuid, EVENT_TYPE_DEFAULT, EVENT_VERSION_DEFAULT, EVENT_LEVEL_DEFAULT, TRUE);
pMofVersion = GetGuids(EventTraceGuid, 0, 0, EVENT_TRACE_TYPE_INFO, TRUE);
}
VOID
LogHeaderCallback(
PEVENT_TRACE pEvent
)
{
PEVENT_TRACE_HEADER pHeader;
ULONG BuildNumber;
PPROCESS_FILE_RECORD pFileRec;
PTRACE_LOGFILE_HEADER pEvmInfo;
if (pEvent == NULL)
return;
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_GUIDMAP) {
return;
}
BuildNumber = ((PTRACE_LOGFILE_HEADER)pEvent->MofData)->ProviderVersion;
BuildNumber &= (0xFAFFFFFF);
CurrentSystem.BuildNumber = BuildNumber;
pEvmInfo = (PTRACE_LOGFILE_HEADER) pEvent->MofData;
CurrentSystem.TimerResolution = pEvmInfo->TimerResolution / 10000;
CurrentSystem.NumberOfProcessors = pEvmInfo->NumberOfProcessors;
//
// If Multiple files are given, use the values from the first file.
//
if (NumProc == 0) {
NumProc = pEvmInfo->NumberOfProcessors;
RtlZeroMemory(&BogusThreads, 64*sizeof(ULONG));
}
//
// With Multiple LogFiles always take the largest time window
//
if ((CurrentSystem.StartTime == (ULONGLONG) 0) ||
((ULONGLONG)pHeader->TimeStamp.QuadPart < CurrentSystem.StartTime))
CurrentSystem.StartTime = pHeader->TimeStamp.QuadPart;
if (DSStartTime == 0)
DSStartTime = CurrentSystem.StartTime;
if (fDSOnly && CurrentSystem.StartTime < DSStartTime)
CurrentSystem.StartTime = DSStartTime;
if ((CurrentSystem.EndTime == (ULONGLONG)0) ||
(CurrentSystem.EndTime < (ULONGLONG)pEvmInfo->EndTime.QuadPart))
CurrentSystem.EndTime = pEvmInfo->EndTime.QuadPart;
if (CurrentSystem.EndTime == 0) {
CurrentSystem.fNoEndTime = TRUE;
}
if (DSEndTime == 0)
DSEndTime = CurrentSystem.EndTime;
if (fDSOnly && CurrentSystem.EndTime > DSEndTime)
CurrentSystem.EndTime = DSEndTime;
pFileRec = (PPROCESS_FILE_RECORD)malloc(sizeof(PROCESS_FILE_RECORD));
if( pFileRec != NULL ){
// Temporary... WMI Should dereference ->LogFileName
LPWSTR pName = (LPWSTR)pEvmInfo;
pName = (LPWSTR)((PCHAR)pName + sizeof( TRACE_LOGFILE_HEADER ));
pFileRec->TraceName = (LPWSTR)malloc( ( lstrlenW( pName )+1 )*sizeof(WCHAR) );
if( pFileRec->TraceName != NULL ){
wcscpy( pFileRec->TraceName, pName );
}
pName += lstrlenW( pName ) + 1;
pFileRec->FileName = (LPWSTR)malloc( ( lstrlenW( pName )+1 )*sizeof(WCHAR) );
if( pFileRec->FileName != NULL ){
wcscpy( pFileRec->FileName, pName );
}
pFileRec->StartTime = pHeader->TimeStamp.QuadPart;
pFileRec->EndTime = pEvmInfo->EndTime.QuadPart;
InsertTailList( &CurrentSystem.ProcessFileListHead, &pFileRec->Entry );
}
}
VOID
IoWriteCallback(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
PEVENT_TRACE_HEADER pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
ULONG DiskNumber= 0;
ULONG BytesWrite=0;
PTDISK_RECORD Disk;
PPROCESS_RECORD pProcess, pDiskProcess;
PPROTO_PROCESS_RECORD pProto;
PFILE_OBJECT fileObj;
PFILE_RECORD pProcFile;
PVOID fDO = NULL;
ULONG IrpFlags = 0;
LONGLONG ByteOffset = 0;
ULONG pFlag = FALSE;
BOOLEAN fValidWrite = (BOOLEAN) (!fDSOnly ||
( ((ULONGLONG) pHeader->TimeStamp.QuadPart >= DSStartTime)
&& ((ULONGLONG) pHeader->TimeStamp.QuadPart <= DSEndTime)));
GetMofData(pEvent, L"DiskNumber", &DiskNumber, sizeof(ULONG));
GetMofData(pEvent, L"IrpFlags", &IrpFlags, sizeof(ULONG));
GetMofData(pEvent, L"TransferSize", &BytesWrite, sizeof(ULONG));
GetMofData(pEvent, L"FileObject", &fDO, sizeof(ULONG));
GetMofData(pEvent, L"ByteOffset", &ByteOffset, sizeof(LONGLONG));
if (((IrpFlags & IRP_PAGING_IO) != 0) ||
((IrpFlags & IRP_SYNCHRONOUS_PAGING_IO) != 0)) {
pFlag = TRUE;
}
if ((Disk = FindGlobalDiskById(DiskNumber)) == NULL) {
if ( !AddDisk(DiskNumber, &Disk) ) {
return;
}
}
BytesWrite /= 1024; // Convert to Kbytes.
if (fValidWrite)
{
Disk->WriteCount++;
Disk->WriteSize += BytesWrite;
}
if (pThread == NULL) {
//
// Logger Thread Creation is MISSED by the collector.
// Also, thread creation between process rundown code (UserMode) and
// logger thread start (kernel mode) are missed.
// So we must handle it here.
//
if (AddThread( pHeader->ThreadId, pEvent, &pThread )) {
/*
#if DBG
DbgPrint("WARNING(%d): Thread %x added to charge IO Write event.\n",
EventCount, pHeader->ThreadId);
#endif
*/
pThread->pProcess = FindProcessById(0, TRUE); // Charge it the system ???
pThread->TimeStart = pHeader->TimeStamp.QuadPart;
pThread->fOrphan = TRUE;
//
// Note: All ThreadStart record at the start of data collection
// have the same TID in the header and in the Aux Fields.
// Real ThreadStart events will have the Parent threadId in the
// header and the new ThreadId in the Aux Field.
//
pThread->KCPUStart = pHeader->KernelTime;
pThread->UCPUStart = pHeader->UserTime;
AdjustThreadTime(pEvent, pThread);
}
else {
/*
#if DBG
DbgPrint("FATBUG(%d): Cannot add thread %x for IO Write Event.\n",
EventCount, pHeader->ThreadId);
#endif
*/
return;
}
}
/*
#if DBG
else if (pThread->fOrphan)
{
DbgPrint("INFO(%d): IO Write Event Thread %x Is Still Orphan.\n",
EventCount, pHeader->ThreadId);
}
else if (pThread->DeadFlag)
{
DbgPrint("INFO(%d): IO Write Event Thread %x Is Already Dead.\n",
EventCount, pHeader->ThreadId);
}
#endif
*/
if (fValidWrite)
{
if (pThread->pMofData != NULL) {
((PMOF_DATA)pThread->pMofData)->WriteCount++;
}
pThread->WriteIO++;
pThread->WriteIOSize += BytesWrite;
}
// 2. Disk->Process
//
pDiskProcess = FindDiskProcessById(Disk, pThread->pProcess->PID);
if (fValidWrite && pDiskProcess != NULL) {
if (pFlag) {
pDiskProcess->HPF++;
pDiskProcess->HPFSize += BytesWrite;
}
else {
pDiskProcess->WriteIO++;
pDiskProcess->WriteIOSize += BytesWrite;
}
}
// Add the I/O to the process that owns the causing thread.
//
pProcess = pThread->pProcess;
if (fValidWrite && (pProcess != NULL ) ) {
pProcess->WriteIO++;
pProcess->WriteIOSize += BytesWrite;
Disk = FindProcessDiskById(pProcess, DiskNumber);
if (Disk != NULL) {
Disk->WriteCount++;
Disk->WriteSize += BytesWrite;
}
}
//
// Thread Local Disk.
//
Disk = FindLocalDiskById(&pThread->DiskListHead, DiskNumber);
if (fValidWrite && Disk != NULL) {
Disk->WriteCount++;
Disk->WriteSize += BytesWrite;
}
//
// Now add this I/O the file it came from
//
if (fValidWrite)
{
fileObj = FindFileInTable(fDO);
if (fileObj == NULL) {
return;
}
if (fileObj->fileRec != NULL) {
fileObj->fileRec->WriteCount++;
fileObj->fileRec->WriteSize += BytesWrite;
pProcFile = FindFileInProcess(pProcess, fileObj->fileRec->FileName);
if (pProcFile != NULL) {
pProcFile->WriteCount++;
pProcFile->WriteSize += BytesWrite;
}
pProto = FindProtoProcessRecord(fileObj->fileRec, pProcess);
if (pProto != NULL) {
pProto->WriteCount++;
pProto->WriteSize += BytesWrite;
}
}
else {
// APC has not happened yet. So Make a copy of the pEvent.
// and Insert it in EventListHead;
AddEvent(fileObj, DiskNumber, BytesWrite, FALSE);
}
}
if (pFlag || (IrpFlags & IRP_ASSOCIATED_IRP) != 0)
{
PHPF_FILE_RECORD pHPFFileRecord = NULL;
HPFWriteCount ++;
if ( fValidWrite
&& AddHPFFileRecord(& pHPFFileRecord, HPFWriteCount, IrpFlags,
DiskNumber, ByteOffset, BytesWrite, fDO))
{
EnterTracelibCritSection();
InsertHeadList(& pThread->HPFWriteListHead,
& pHPFFileRecord->Entry);
LeaveTracelibCritSection();
}
}
}
VOID
PsStartCallback(
PEVENT_TRACE pEvent
)
{
PEVENT_TRACE_HEADER pHeader;
ULONG ProcessId=0;
ULONG ReadId = 0;
PPROCESS_RECORD pProcess;
char ImageName[16];
ULONG returnLength = 16;
CHAR UserName[64];
CHAR Domain[64];
CHAR FullName[256];
ULONG RetLength;
DWORD asize = 0;
DWORD bsize = 0;
ULONG Sid[64];
PULONG pSid = &Sid[0];
SID_NAME_USE Se;
if (pEvent == NULL)
return;
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
RetLength = GetMofData(pEvent, L"ProcessId", &ReadId, sizeof(ULONG));
// if (RetLength == 0) {
// return;
// }
ProcessId = ReadId;
if ( AddProcess(ProcessId, &pProcess) ) {
//
// If the Data Collection Start Time and the Process Start Time
// match, then the PsStart was created by the ProcessRunDown
// Code. So Keep the CPU Times to compute the difference at the
// end. Otherwise, zero the starting CPU Times.
//
pProcess->PID = ProcessId;
RtlZeroMemory(&ImageName, 16 * sizeof(CHAR) );
GetMofData(pEvent, L"ImageFileName", &ImageName, returnLength);
asize = lstrlenA(ImageName);
if (asize > 0) {
pProcess->ImageName = (LPWSTR)malloc((asize + 1) * sizeof(WCHAR));
if (pProcess->ImageName == NULL) {
return;
}
//
// Process hook has the image name as ASCII. So we need to
// convert it to unicode here.
//
AnsiToUnicode(ImageName, pProcess->ImageName);
}
else {
pProcess->ImageName = (LPWSTR)malloc(MAXSTR * sizeof(WCHAR));
if (pProcess->ImageName == NULL) {
return;
}
if (ProcessId == 0)
{
wcscpy(pProcess->ImageName, L"Idle");
}
else
{
wsprintfW(pProcess->ImageName,
L"Unknown(0x%08X)",
ProcessId);
}
}
GetMofData(pEvent, L"UserSID", pSid, 64);
asize = 64; bsize = 64;
if (LookupAccountSidA(NULL,
pSid,
&UserName[0],
&asize,
&Domain[0],
&bsize,
&Se)) {
char* pFullName = &FullName[0];
strcpy(pFullName, "\\\\");
strcat(pFullName, Domain);
strcat(pFullName, "\\");
strcat(pFullName, UserName);
asize = lstrlenA(pFullName);
if (asize > 0) {
pProcess->UserName = (LPWSTR)malloc((asize + 1) * sizeof(WCHAR));
if (pProcess->UserName != NULL) {
AnsiToUnicode(pFullName, pProcess->UserName);
}
}
}
else
{
pProcess->UserName = (LPWSTR)malloc(7 * sizeof(WCHAR));
if (pProcess->UserName != NULL) {
wcscpy(pProcess->UserName, L"system");
}
}
}
}
VOID
PsEndCallback(
PEVENT_TRACE pEvent
)
{
PEVENT_TRACE_HEADER pHeader;
ULONG ProcessId;
ULONG ReadId = 0;
PPROCESS_RECORD pProcess;
char ImageName[16];
ULONG returnLength = 16;
CHAR UserName[64];
CHAR Domain[64];
CHAR FullName[256];
DWORD asize = 0;
DWORD bsize = 0;
ULONG RetLength;
ULONG Sid[64];
PULONG pSid = &Sid[0];
SID_NAME_USE Se;
if (pEvent == NULL)
return;
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
RetLength = GetMofData(pEvent, L"ProcessId", &ReadId, sizeof(ULONG));
// if (RetLength == 0) {
// return;
// }
ProcessId = ReadId;
if ( (pProcess = FindProcessById(ProcessId, TRUE)) != NULL )
{
if (pProcess->DeadFlag)
{
/*
#if DBG
DbgPrint("FATBUG(%d): End Process %x Dead Already!\n",
EventCount, ProcessId);
#endif
*/
return;
}
pProcess->DeadFlag = TRUE;
RtlZeroMemory(&ImageName, 16 * sizeof(CHAR) );
GetMofData(pEvent, L"ImageFileName", &ImageName, returnLength);
asize = lstrlenA(ImageName);
if (asize > 0)
{
if (pProcess->ImageName != NULL) {
free(pProcess->ImageName);
}
pProcess->ImageName = (LPWSTR)malloc((asize + 1) * sizeof(WCHAR));
if (pProcess->ImageName != NULL) {
AnsiToUnicode(ImageName, pProcess->ImageName);
}
}
GetMofData(pEvent, L"UserSID", pSid, 64);
asize = 64; bsize = 64;
if (LookupAccountSidA(NULL,
pSid,
&UserName[0],
&asize,
&Domain[0],
&bsize,
&Se)) {
char* pFullName = &FullName[0];
strcpy(pFullName, "\\\\");
strcat(pFullName, Domain);
strcat(pFullName, "\\");
strcat(pFullName, UserName);
asize = lstrlenA(pFullName);
if (asize > 0)
{
if (pProcess->UserName != NULL)
{
free(pProcess->UserName);
}
pProcess->UserName = (LPWSTR)malloc((asize + 1) * sizeof(WCHAR));
if (pProcess->UserName != NULL) {
AnsiToUnicode(pFullName, pProcess->UserName);
}
}
}
else
{
if (pProcess->UserName != NULL)
{
free(pProcess->UserName);
}
pProcess->UserName = (LPWSTR)malloc(7 * sizeof(WCHAR));
if (pProcess->UserName != NULL) {
wcscpy(pProcess->UserName, L"system");
}
}
}
/*
#if DBG
else {
DbgPrint("WARNING(%d): PsEnd for Unknown process %x Ignored!\n",
EventCount, ProcessId);
}
#endif
*/
}
VOID
ThStartCallback(
PEVENT_TRACE pEvent
)
{
PEVENT_TRACE_HEADER pHeader;
ULONG ProcessorId = pEvent->ClientContext & 0x000000FF;
ULONG ProcessId, ThreadId;
PPROCESS_RECORD pProcess;
PTHREAD_RECORD Thread;
ULONG ReadId = 0;
ULONG RetLength;
if (pEvent == NULL)
{
return;
}
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
RetLength = GetMofData(pEvent, L"TThreadId", &ReadId, sizeof(ULONG));
// if (RetLength == 0) {
// return;
// }
ThreadId = ReadId;
RetLength = GetMofData(pEvent, L"ProcessId", &ReadId, sizeof(ULONG));
// if (RetLength == 0) {
// return;
// }
ProcessId = ReadId;
pProcess = FindProcessById(ProcessId, TRUE);
if (pProcess == NULL)
{
// This should not Happen. The PS hooks are supposed to guarantee
// that the process create happens before the thread creates
// for that process.
//
if (!AddProcess(ProcessId, &pProcess))
{
/*
#if DBG
DbgPrint("FATBUG(%d): Can not find Process Start Record Th %x PID %x\n",
EventCount, ThreadId, ProcessId);
#endif
*/
return;
}
}
if (ThreadId == 0 && ProcessorId == 0)
{
pEvent->ClientContext += CurrentSystem.CurrentThread0 ++;
//ASSERT( CurrentSystem.CurrentThread0 <= CurrentSystem.NumberOfProcessors );
}
Thread = FindGlobalThreadById(ThreadId, pEvent);
if (ThreadId != 0 && Thread != NULL && !Thread->DeadFlag)
{
if (Thread->fOrphan)
{
Thread->fOrphan = FALSE;
/*
#if DBG
DbgPrint("INFO(%d): Attach orphan thread %x to process %x.\n",
EventCount, ThreadId, ProcessId);
#endif
*/
}
else
{
EVENT_TRACE event;
/*
#if DBG
DbgPrint("WARNING(%d): Two active thread have the same TID %x.\n",
EventCount, ThreadId);
#endif
*/
event.Header.TimeStamp.QuadPart = pHeader->TimeStamp.QuadPart;
event.Header.Class.Type = EVENT_TRACE_TYPE_END;
event.Header.ThreadId = ThreadId;
event.Header.UserTime = Thread->UCPUEnd;
event.Header.KernelTime = Thread->KCPUEnd;
//
// If a DCStart event with non-zero KCPU and UCPU is paired up with
// an end Event for the same ThreadId with less CPU Times, the delta
// can come out negative. We correct it here.
//
if (Thread->KCPUEnd < Thread->KCPUStart)
Thread->KCPUEnd = Thread->KCPUStart;
if (Thread->UCPUEnd < Thread->UCPUStart)
Thread->UCPUEnd = Thread->UCPUStart;
ThEndCallback(&event);
if (!AddThread(ThreadId, pEvent, &Thread))
{
/*
#if DBG
DbgPrint("FATBUG(%d): Cannot add global active thread TID %x.\n",
EventCount, ThreadId);
#endif
*/
return;
}
}
}
else if (!AddThread(ThreadId, pEvent, &Thread)) {
/*
#if DBG
DbgPrint("FATBUG(%d): Cannot add global active thread TID %x.\n",
EventCount, ThreadId);
#endif
*/
return;
}
Thread->pProcess = pProcess;
Thread->TimeStart = pHeader->TimeStamp.QuadPart;
// Note: All ThreadStart record at the start of data collection
// have the same TID in the header and in the Aux Fields.
// Real ThreadStart events will have the Parent threadId in the
// header and the new ThreadId in the Aux Field.
//
if ( (ThreadId == pHeader->ThreadId)
|| (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_END))
{
Thread->KCPUStart = pHeader->KernelTime;
Thread->UCPUStart = pHeader->UserTime;
}
else
{
Thread->KCPUStart = 0;
Thread->UCPUStart = 0;
}
//
// For DCStart type, the TID in the pEvent and the new thread
// match. So we can adjust its ThreadTimes.
//
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_START) {
AdjustThreadTime(pEvent, Thread);
}
else {
AdjustThreadTime(pEvent, NULL);
}
{
Thread->KCPU_Trans = 0;
Thread->KCPU_NoTrans = 0;
Thread->UCPU_Trans = 0;
Thread->UCPU_NoTrans = 0;
Thread->TransLevel = 0;
Thread->KCPU_PrevTrans = Thread->KCPUStart;
Thread->UCPU_PrevTrans = Thread->UCPUStart;
}
if (Thread->TID == 0 && CurrentSystem.BuildNumber <= 1877)
{
CurrentSystem.NumberOfProcessors++;
}
}
VOID
ShutdownThreads()
{
int i;
EVENT_TRACE event;
PLIST_ENTRY Head,Next;
PTHREAD_RECORD Thread;
RtlZeroMemory(&event, sizeof(EVENT_TRACE));
event.Header.TimeStamp.QuadPart = CurrentSystem.EndTime;
//
// Move the Thread list from the HashTable to GlobalList
//
for (i=0; i < THREAD_HASH_TABLESIZE; i++) {
Head = &CurrentSystem.ThreadHashList[i];
Next = Head->Flink;
while (Next != Head) {
Thread = CONTAINING_RECORD( Next, THREAD_RECORD, Entry );
Next = Next->Flink;
if (!Thread->DeadFlag){
event.Header.Class.Type = EVENT_TRACE_TYPE_DC_END;
event.Header.ThreadId = Thread->TID;
event.Header.UserTime = Thread->UCPUEnd;
event.Header.KernelTime = Thread->KCPUEnd;
ThEndCallback( &event );
}
}
}
}
VOID
ShutdownProcesses()
{
PLIST_ENTRY pHead = &CurrentSystem.ProcessListHead;
PLIST_ENTRY pNext = pHead->Flink;
PPROCESS_RECORD pProcess;
while (pNext != pHead){
pProcess = CONTAINING_RECORD(pNext, PROCESS_RECORD, Entry);
pNext = pNext->Flink;
if (!pProcess->DeadFlag){
pProcess->DeadFlag = TRUE;
}
}
}
BOOL
StopThreadTrans(
PLIST_ENTRY Head,
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
PTRANS_RECORD pTrans;
PLIST_ENTRY Next = Head->Flink;
while( Head != Next ){
pTrans = CONTAINING_RECORD(Next, TRANS_RECORD, Entry);
Next = Next->Flink;
if( !StopThreadTrans( &pTrans->SubTransListHead, pEvent, pThread ) ){
return FALSE;
}
if( !pTrans->bStarted ){
continue;
}
memcpy( &pEvent->Header.Guid, pTrans->pGuid, sizeof(GUID));
pEvent->Header.Class.Type = EVENT_TRACE_TYPE_END;
EventCallback( pEvent, pThread );
return FALSE; // stopping one will credit all running events
}
return TRUE;
}
VOID
ThEndCallback(
PEVENT_TRACE pEvent
)
{
PEVENT_TRACE_HEADER pHeader;
ULONG ThreadId;
PTHREAD_RECORD Thread;
if (pEvent == NULL)
{
return;
}
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
ThreadId = pHeader->ThreadId;
if (ThreadId == 0)
{
ULONG ProcessorId = pEvent->ClientContext & 0x000000FF;
if (ProcessorId == 0) {
pEvent->ClientContext += (CurrentSystem.NumberOfProcessors
- (CurrentSystem.CurrentThread0 --));
}
}
Thread = FindGlobalThreadById(ThreadId, pEvent);
if (Thread != NULL)
{
if (Thread->DeadFlag)
{
/*
#if DBG
DbgPrint("FATBUG(%d): Thread %x Dead Already\n",
EventCount, ThreadId);
#endif
*/
return;
}
if (Thread->fOrphan)
{
ULONG ReadId = 0;
ULONG ProcessId = 0;
PPROCESS_RECORD pProcess = NULL;
GetMofData(pEvent, L"ProcessId", &ReadId, sizeof(ULONG));
ProcessId = ReadId;
pProcess = FindProcessById(ProcessId, TRUE);
if (pProcess != NULL)
{
Thread->fOrphan = FALSE;
Thread->pProcess = pProcess;
}
/*
#if DBG
DbgPrint("INFO(%d): ThEndCallback() attach orphan thread %X to process %X\n",
EventCount, ThreadId, ProcessId);
#endif
*/
}
//
// Charge any unstopped transactions
//
if ( Thread != NULL
&& pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_END)
{
StopThreadTrans(&Thread->TransListHead, pEvent, Thread );
}
Thread->DeadFlag = TRUE;
if (fDSOnly)
{
if ((ULONGLONG) pHeader->TimeStamp.QuadPart > DSEndTime)
{
Thread->TimeEnd = DSEndTime;
}
else
{
Thread->KCPUEnd = pHeader->KernelTime;
Thread->UCPUEnd = pHeader->UserTime;
Thread->TimeEnd = (ULONGLONG) pHeader->TimeStamp.QuadPart;
}
}
else
{
if (Thread->UCPUEnd < pHeader->UserTime)
Thread->UCPUEnd = pHeader->UserTime;
if (Thread->KCPUEnd < pHeader->KernelTime)
Thread->KCPUEnd = pHeader->KernelTime;
Thread->TimeEnd = pHeader->TimeStamp.QuadPart;
}
if (Thread->TransLevel <= 0)
{
Thread->KCPU_NoTrans += Thread->KCPUEnd - Thread->KCPU_PrevTrans;
Thread->UCPU_NoTrans += Thread->UCPUEnd - Thread->UCPU_PrevTrans;
}
else
{
Thread->KCPU_Trans += Thread->KCPUEnd - Thread->KCPU_PrevTrans;
Thread->UCPU_Trans += Thread->UCPUEnd - Thread->UCPU_PrevTrans;
/*
#if DBG
DbgPrint("WARNING(%d): Active Transactions in Dead Thread %x\n",
EventCount, ThreadId);
#endif
*/
}
}
else
{
/*
#if DBG
DbgPrint("WARNING(%d): No Thread Start for ThreadId %x\n",
EventCount, ThreadId);
#endif
*/
if (AddThread(ThreadId, pEvent, &Thread))
{
Thread->pProcess = FindProcessById(0, FALSE);
Thread->DeadFlag = TRUE;
Thread->fOrphan = TRUE;
Thread->TimeStart = Thread->TimeEnd = pHeader->TimeStamp.QuadPart;
Thread->KCPUStart = Thread->KCPUEnd = pHeader->KernelTime;
Thread->UCPUStart = Thread->UCPUEnd = pHeader->UserTime;
AdjustThreadTime(pEvent, Thread);
}
else
{
/*
#if DBG
DbgPrint("FATBUG(%d): Cannot add thread %x for ThreadEnd Event.\n",
EventCount, ThreadId);
#endif
*/
}
}
}
VOID
IoReadCallback(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
PEVENT_TRACE_HEADER pHeader = (EVENT_TRACE_HEADER*)&pEvent->Header;
ULONG DiskNumber=0;
ULONG BytesRead=0;
ULONG IrpFlags=0;
PTDISK_RECORD Disk;
PPROCESS_RECORD pProcess;
PPROTO_PROCESS_RECORD pProto;
PFILE_OBJECT fileObj;
PFILE_RECORD pProcFile;
PVOID fDO;
BOOLEAN pFlag = FALSE;
PPROCESS_RECORD pDiskProcess;
LONGLONG ByteOffset;
BOOLEAN fValidRead = (BOOLEAN) (!fDSOnly ||
( ((ULONGLONG) pHeader->TimeStamp.QuadPart >= DSStartTime)
&& ((ULONGLONG) pHeader->TimeStamp.QuadPart <= DSEndTime)));
GetMofData(pEvent, L"DiskNumber", &DiskNumber, sizeof(ULONG));
GetMofData(pEvent, L"IrpFlags", &IrpFlags, sizeof(ULONG));
GetMofData(pEvent, L"TransferSize", &BytesRead, sizeof(ULONG));
GetMofData(pEvent, L"FileObject", &fDO, sizeof(ULONG));
GetMofData(pEvent, L"ByteOffset", &ByteOffset, sizeof(ULONGLONG));
BytesRead /= 1024; // Convert to Kbytes
if (((IrpFlags & IRP_PAGING_IO) != 0) ||
((IrpFlags & IRP_SYNCHRONOUS_PAGING_IO) != 0)) {
pFlag = TRUE;
}
//
// TODO: From DiskNumber and Offset get the Logical Disk
// ie., DiskNumber = MapDisk(DiskIndex, Offset);
//
//
// Add the I/O to the DISK
//
if ((Disk = FindGlobalDiskById(DiskNumber)) == NULL) {
if (!AddDisk(DiskNumber, &Disk) ) {
return;
}
}
if (fValidRead)
{
if (pFlag) {
Disk->HPF++;
Disk->HPFSize += BytesRead;
}
else {
Disk->ReadCount++;
Disk->ReadSize += BytesRead;
}
}
//
// Add the I/O to the THREAD
//
if ( pThread == NULL) {
//
// NOTE: Logger Thread Creation is MISSED by the collector.
// Also, thread creation between process rundown code (UserMode) and
// logger thread start (kernel mode) are missed.
// So we must handle it here.
//
if (AddThread(pHeader->ThreadId, pEvent, &pThread )) {
/*
#if DBG
DbgPrint("WARNING(%d): Thread %x added to charge IO Read event\n",
EventCount, pHeader->ThreadId);
#endif
*/
pThread->pProcess = FindProcessById(0, TRUE); // Charge it the system ???
pThread->TimeStart = pHeader->TimeStamp.QuadPart;
pThread->fOrphan = TRUE;
//
// Note: All ThreadStart record at the start of data collection
// have the same TID in the header and in the Aux Fields.
// Real ThreadStart events will have the Parent threadId in the
// header and the new ThreadId in the Aux Field.
//
pThread->KCPUStart = pHeader->KernelTime;
pThread->UCPUStart = pHeader->UserTime;
AdjustThreadTime(pEvent, pThread);
}
else {
/*
#if DBG
DbgPrint("FATBUG(%d): Cannot add thread %x for IO Read Event.\n",
EventCount, pHeader->ThreadId);
#endif
*/
return;
}
}
/*
#if DBG
else if (pThread->fOrphan)
{
DbgPrint("INFO(%d): IO Read Event Thread %x Is Still Orphan.\n",
EventCount, pHeader->ThreadId);
}
else if (pThread->DeadFlag)
{
DbgPrint("INFO(%d): IO Read Event Thread %x Is Already Dead.\n",
EventCount, pHeader->ThreadId);
}
#endif
*/
ASSERT(pThread != NULL);
if (fValidRead && pThread->pMofData != NULL) {
((PMOF_DATA)pThread->pMofData)->ReadCount++;
}
if (fValidRead)
{
if (pFlag) {
pThread->HPF++;
pThread->HPFSize += BytesRead;
}
else {
pThread->ReadIO++;
pThread->ReadIOSize += BytesRead;
}
}
//
// 2. Disk->Process
//
pDiskProcess = FindDiskProcessById(Disk, pThread->pProcess->PID);
if (fValidRead && pDiskProcess != NULL) {
if (pFlag) {
pDiskProcess->HPF++;
pDiskProcess->HPFSize += BytesRead;
}
else {
pDiskProcess->ReadIO++;
pDiskProcess->ReadIOSize += BytesRead;
}
}
//
// Add the I/O to the PROCESS
//
pProcess = pThread->pProcess;
if (fValidRead && (pProcess != NULL )) {
pProcess->ReadIO++;
pProcess->ReadIOSize += BytesRead;
Disk = FindProcessDiskById(pProcess, DiskNumber);
if (Disk != NULL) {
if (pFlag) {
Disk->HPF++;
Disk->HPFSize += BytesRead;
}
else {
Disk->ReadCount++;
Disk->ReadSize += BytesRead;
}
}
}
//
// Add the I/O to the FILE
//
if (fValidRead)
{
fileObj = FindFileInTable(fDO);
if (fileObj == NULL) {
return;
}
if (fileObj->fileRec) {
fileObj->fileRec->ReadCount++;
fileObj->fileRec->ReadSize += BytesRead;
pProcFile = FindFileInProcess(pProcess, fileObj->fileRec->FileName);
if (pProcFile != NULL) {
#if 0
if (pFlag) {
pProcFile->HPF++;
pProcFile->HPFSize += BytesRead;
}
else {
#endif
pProcFile->ReadCount++;
pProcFile->ReadSize += BytesRead;
#if 0
}
#endif
}
pProto = FindProtoProcessRecord(fileObj->fileRec, pProcess);
if (pProto != NULL) {
#if 0
if (pFlag) {
pProto->HPF++;
pProto->HPFSize += BytesRead;
}
else {
#endif
pProto->ReadCount++;
pProto->ReadSize += BytesRead;
#if 0
}
#endif
}
}
else {
// APC has not happened yet. So Make a copy of the pEvent.
// and Insert it in EventListHead;
AddEvent(fileObj, DiskNumber, BytesRead, TRUE);
}
}
//
// Do the Drill Down Calls Now. To Save on memory we need to be
// selective about which ones to create.
//
// 2. Thread->Disk
Disk = FindLocalDiskById(&pThread->DiskListHead, DiskNumber);
if (fValidRead && Disk != NULL) {
if (pFlag) {
Disk->HPF++;
Disk->HPFSize += BytesRead;
}
else {
Disk->ReadCount++;
Disk->ReadSize += BytesRead;
}
}
if (pFlag || (IrpFlags & IRP_ASSOCIATED_IRP) != 0)
{
PHPF_FILE_RECORD pHPFFileRecord = NULL;
HPFReadCount ++;
if ( fValidRead
&& AddHPFFileRecord(& pHPFFileRecord, HPFReadCount, IrpFlags,
DiskNumber, ByteOffset, BytesRead, fDO))
{
EnterTracelibCritSection();
InsertHeadList(& pThread->HPFReadListHead,
& pHPFFileRecord->Entry);
LeaveTracelibCritSection();
}
}
}
VOID
HotFileCallback(
PEVENT_TRACE pEvent
)
{
PEVENT_TRACE_HEADER pHeader;
WCHAR FileName[MAXSTR]; // Not Sure if this is sufficient...
PLIST_ENTRY Next, Head;
PFILE_RECORD fileRec, pProcFile = NULL;
PPROTO_FILE_RECORD protoFileRec;
PFILE_OBJECT fileObj;
PVOID fDO;
PTHREAD_RECORD pThread = NULL;
PPROCESS_RECORD pProcess = NULL;
PPROTO_PROCESS_RECORD pProto = NULL;
ULONG RetLength;
if (pEvent == NULL)
return;
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
RtlZeroMemory(&FileName, MAXSTR * sizeof(WCHAR));
GetMofData(pEvent, L"FileObject", &fDO, sizeof(ULONG));
RetLength = GetMofData(pEvent, L"FileName", &FileName, MAXSTR*sizeof(WCHAR));
if (RetLength == 0) {
return;
}
// Remember to Add the DISKNUMBER to the name
//
// When we get a FileName We need to find the FILE_RECORD
//
if ((fileRec = FindFileRecordByName(FileName)) == NULL) {
AddFile(FileName, &fileRec);
}
//
// Get the FileObject from the fileTable and update the information.
//
fileObj = FindFileInTable(fDO);
if (fileObj == NULL) {
return;
}
if (fileObj->fileRec != NULL) {
/*
#if DBG
DbgPrint("BUG: APC for known file %ws\n", FileName);
#endif
*/
}
if ((pThread = FindGlobalThreadById(pHeader->ThreadId, pEvent)) != NULL) {
pProcess = pThread->pProcess;
if (pProcess != NULL) {
pProcFile = FindFileInProcess(pProcess, FileName);
pProto = FindProtoProcessRecord(fileRec, pProcess);
}
}
else {
return;
}
fileObj->fileRec = fileRec;
//
// Walk through the EventList and add it to this file record
//
Head = &fileObj->ProtoFileRecordListHead;
Next = Head->Flink;
while (Next != Head) {
protoFileRec = CONTAINING_RECORD( Next, PROTO_FILE_RECORD, Entry );
fileRec->DiskNumber = protoFileRec->DiskNumber;
if (protoFileRec->ReadFlag) {
fileRec->ReadCount++;
fileRec->ReadSize += protoFileRec->IoSize;
if (pProcFile != NULL) {
pProcFile->ReadCount++;
pProcFile->ReadSize += protoFileRec->IoSize;
}
if (pProto != NULL) {
pProto->ReadCount++;
pProto->ReadSize += protoFileRec->IoSize;
}
}
else {
fileRec->WriteCount++;
fileRec->WriteSize += protoFileRec->IoSize;
if (pProcFile != NULL) {
pProcFile->WriteCount++;
pProcFile->WriteSize += protoFileRec->IoSize;
}
if (pProto != NULL) {
pProto->WriteCount++;
pProto->WriteSize += protoFileRec->IoSize;
}
}
Next = Next->Flink;
RemoveEntryList( &protoFileRec->Entry);
}
//
// If DrillDown Records are appended, we need to handle those too
//
}
VOID
ModuleLoadCallback(PEVENT_TRACE pEvent)
{
PEVENT_TRACE_HEADER pHeader = (PEVENT_TRACE_HEADER) & pEvent->Header;
ULONG lBaseAddress = 0;
ULONG lModuleSize = 0;
WCHAR strModulePath[256];
WCHAR * strModuleName;
ULONG rtnLength = sizeof(WCHAR) * 256;
PLIST_ENTRY pHead = &CurrentSystem.GlobalModuleListHead;
PLIST_ENTRY pNext = pHead->Flink;
PMODULE_RECORD pMatched = NULL;
PMODULE_RECORD pCurrent = NULL;
PTHREAD_RECORD pThread = NULL;
PPROCESS_RECORD pProcess = NULL;
RtlZeroMemory(strModulePath, 256 * sizeof(WCHAR) );
GetMofData(pEvent, L"ImageBase", & lBaseAddress, sizeof(ULONG));
GetMofData(pEvent, L"ImageSize", & lModuleSize, sizeof(ULONG));
GetMofData(pEvent, L"FileName", & strModulePath, rtnLength);
strModuleName = wcsrchr(strModulePath, L'\\');
if (!strModuleName){
strModuleName = strModulePath;
}else{
strModuleName ++;
}
// Check if loaded image is already in SYSTEM_RECORD::GlobalModuleListHead.
// Otherwise, insert new MODULE_RECORD.
//
while (!pMatched && pNext != pHead){
pMatched = CONTAINING_RECORD(pNext, MODULE_RECORD, Entry);
if (_wcsicmp(strModuleName, pMatched->strModuleName)){
pMatched = NULL;
pNext = pNext->Flink;
}
}
if (!pMatched){
if (AddModuleRecord(& pMatched, lBaseAddress, lModuleSize, strModuleName)){
EnterTracelibCritSection();
InsertHeadList(
& CurrentSystem.GlobalModuleListHead,
& pMatched->Entry);
LeaveTracelibCritSection();
pMatched->pProcess = NULL;
pMatched->pGlobalPtr = NULL;
}else{
return;
}
}
ASSERT(pMatched);
// Insert loaded image in PROCESS_RECORD::ModuleListHead
//
if (AddModuleRecord(& pCurrent, lBaseAddress, lModuleSize, strModuleName)){
pCurrent->pGlobalPtr = pMatched;
pThread = FindGlobalThreadById(pHeader->ThreadId, pEvent);
ASSERT(pThread);
if (!pThread){
free( pCurrent );
return;
}
pProcess = pThread->pProcess;
ASSERT(pProcess);
if (!pProcess){
free( pCurrent );
return;
}
EnterTracelibCritSection();
pCurrent->pProcess = pProcess;
InsertHeadList( & pProcess->ModuleListHead, & pCurrent->Entry);
LeaveTracelibCritSection();
}else{
return;
}
}
VOID
ProcessCallback(
PEVENT_TRACE pEvent
)
{
if (pEvent == NULL){
return;
}
if ((pEvent->Header.Class.Type == EVENT_TRACE_TYPE_START) ||
(pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_START)) {
PsStartCallback(pEvent);
}
else if ((pEvent->Header.Class.Type == EVENT_TRACE_TYPE_END) ||
(pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_END)) {
PsEndCallback(pEvent);
}
}
VOID
ThreadCallback(
PEVENT_TRACE pEvent
)
{
if (pEvent == NULL){
return;
}
if ((pEvent->Header.Class.Type == EVENT_TRACE_TYPE_START) ||
(pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_START)) {
ThStartCallback(pEvent);
} else if ((pEvent->Header.Class.Type == EVENT_TRACE_TYPE_END) ||
(pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_END)) {
ThEndCallback(pEvent);
}
}
PMODULE_RECORD
SearchModuleByAddr(
PLIST_ENTRY pModuleListHead,
ULONG lAddress
)
{
PLIST_ENTRY pNext = pModuleListHead->Flink;
PMODULE_RECORD pModule = NULL;
PMODULE_RECORD pCurrent;
while (pNext != pModuleListHead)
{
pCurrent = CONTAINING_RECORD(pNext, MODULE_RECORD, Entry);
pNext = pNext->Flink;
if ( (lAddress >= pCurrent->lBaseAddress)
&& (lAddress < pCurrent->lBaseAddress + pCurrent->lModuleSize))
{
pModule = pCurrent;
break;
}
}
return pModule;
}
void
UpdatePageFaultCount(
PPROCESS_RECORD pProcess,
PMODULE_RECORD pModule,
ULONG lFaultAddr,
UCHAR FaultType)
{
BOOLEAN fFaultInImage = (BOOLEAN) ((lFaultAddr >= pModule->lBaseAddress)
&& (lFaultAddr < pModule->lBaseAddress
+ pModule->lModuleSize));
switch(FaultType)
{
case EVENT_TRACE_TYPE_MM_HPF :
if (fFaultInImage)
{
pProcess->lCodeFaultHF ++;
pModule->lCodeFaultHF ++;
if (pModule->pGlobalPtr)
{
pModule->pGlobalPtr->lCodeFaultHF ++;
}
}
else
{
pProcess->lDataFaultHF ++;
pModule->lDataFaultHF ++;
if (pModule->pGlobalPtr)
{
pModule->pGlobalPtr->lDataFaultHF ++;
}
}
break;
case EVENT_TRACE_TYPE_MM_TF :
if (fFaultInImage)
{
pProcess->lCodeFaultTF ++;
pModule->lCodeFaultTF ++;
if (pModule->pGlobalPtr)
{
pModule->pGlobalPtr->lCodeFaultTF ++;
}
}
else
{
pProcess->lDataFaultTF ++;
pModule->lDataFaultTF ++;
if (pModule->pGlobalPtr)
{
pModule->pGlobalPtr->lDataFaultTF ++;
}
}
break;
case EVENT_TRACE_TYPE_MM_DZF :
if (fFaultInImage)
{
pProcess->lCodeFaultDZF ++;
pModule->lCodeFaultDZF ++;
if (pModule->pGlobalPtr)
{
pModule->pGlobalPtr->lCodeFaultDZF ++;
}
}
else
{
pProcess->lDataFaultDZF ++;
pModule->lDataFaultDZF ++;
if (pModule->pGlobalPtr)
{
pModule->pGlobalPtr->lDataFaultDZF ++;
}
}
break;
case EVENT_TRACE_TYPE_MM_COW :
if (fFaultInImage)
{
pProcess->lCodeFaultCOW ++;
pModule->lCodeFaultCOW ++;
if (pModule->pGlobalPtr)
{
pModule->pGlobalPtr->lCodeFaultCOW ++;
}
}
else
{
pProcess->lDataFaultCOW ++;
pModule->lDataFaultCOW ++;
if (pModule->pGlobalPtr)
{
pModule->pGlobalPtr->lDataFaultCOW ++;
}
}
break;
default :
break;
}
}
PMODULE_RECORD
SearchSysModule(
PPROCESS_RECORD pProcess,
ULONG lPC,
BOOLEAN fActive
)
{
PMODULE_RECORD pModule = NULL;
PPROCESS_RECORD pSysProcess = FindProcessById(0, fActive);
PMODULE_RECORD pCurrent =
SearchModuleByAddr(& pSysProcess->ModuleListHead, lPC);
if (pCurrent)
{
if (AddModuleRecord(& pModule,
pCurrent->lBaseAddress,
pCurrent->lModuleSize,
pCurrent->strModuleName))
{
EnterTracelibCritSection();
InsertHeadList(
& pProcess->ModuleListHead,
& pModule->Entry);
LeaveTracelibCritSection();
pModule->pProcess = pProcess;
pModule->pGlobalPtr = pCurrent->pGlobalPtr;
}
}
return pModule;
}
VOID
PageFaultCallback(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
PEVENT_TRACE_HEADER pHeader;
PPROCESS_RECORD pProcess;
PMOF_DATA pMofData;
ULONG lFaultAddr = 0;
ULONG lPC = 0;
PVOID fDO = NULL;
LONG lByteCount = 0;
LONGLONG lByteOffset = 0;
WCHAR strHotFileName[1024];
ULONG rtnLength = sizeof(WCHAR) * 1024;
BOOLEAN fSpecialHPF = FALSE;
BOOLEAN fFound;
if (pEvent == NULL)
return;
if (!InTimeWindow(pEvent, pThread))
return;
GetMofData(pEvent, L"VirtualAddress", &lFaultAddr, sizeof(ULONG));
GetMofData(pEvent, L"ProgramCounter", &lPC, sizeof(ULONG));
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
if ( pHeader->Class.Type == EVENT_TRACE_TYPE_MM_HPF
&& pEvent->MofLength > 2 * sizeof(ULONG))
{
fSpecialHPF = TRUE;
GetMofData(pEvent, L"FileObject", &fDO, sizeof(ULONG));
GetMofData(pEvent, L"ByteCount", &lByteCount, sizeof(LONG));
GetMofData(pEvent, L"ByteOffset", &lByteOffset, sizeof(LONGLONG));
GetMofData(pEvent, L"FileName", &strHotFileName, rtnLength);
}
if (pThread == NULL)
{
if (AddThread(pHeader->ThreadId, pEvent, &pThread ))
{
/*
#if DBG
DbgPrint("WARNING(%d): Thread %x added to charge PageFault event\n",
EventCount, pHeader->ThreadId);
#endif
*/
pThread->pProcess = FindProcessById(0, TRUE);
pThread->TimeStart = pHeader->TimeStamp.QuadPart;
pThread->fOrphan = TRUE;
pThread->KCPUStart = pHeader->KernelTime;
pThread->UCPUStart = pHeader->UserTime;
AdjustThreadTime(pEvent, pThread);
}
else
{
/*
#if DBG
DbgPrint("FATBUG(%d): Cannot add thread %x for PageFault Event.\n",
EventCount, pHeader->ThreadId);
#endif
*/
return;
}
}
/*
#if DBG
else if (pThread->fOrphan)
{
DbgPrint("INFO(%d): PageFault Event Thread %x Is Still Orphan.\n",
EventCount, pHeader->ThreadId);
}
else if (pThread->DeadFlag)
{
DbgPrint("INFO(%d): PageFault Event Thread %x Is Already Dead.\n",
EventCount, pHeader->ThreadId);
}
#endif
*/
pMofData = (PMOF_DATA)pThread->pMofData;
if (pMofData && !fSpecialHPF)
{
switch(pHeader->Class.Type)
{
case EVENT_TRACE_TYPE_MM_TF : pMofData->MmTf++; break;
case EVENT_TRACE_TYPE_MM_DZF : pMofData->MmDzf++; break;
case EVENT_TRACE_TYPE_MM_COW : pMofData->MmCow++; break;
case EVENT_TRACE_TYPE_MM_GPF : pMofData->MmGpf++; break;
}
}
// Update loaded image MODULE_RECORD::lFaultCount
//
pProcess = pThread->pProcess;
if (pProcess != NULL)
{
PMODULE_RECORD pModule = SearchModuleByAddr(
& pProcess->ModuleListHead,
lPC);
fFound = FALSE;
if (fSpecialHPF)
{
PHPF_RECORD pHPFRecord = NULL;
PageFaultCount ++;
if (AddHPFRecord(& pHPFRecord, lFaultAddr,
fDO, lByteCount, lByteOffset))
{
PLIST_ENTRY pHead = & pThread->HPFReadListHead;
PLIST_ENTRY pNext = pHead->Flink;
PHPF_FILE_RECORD pHPFFileRecord;
PHPF_FILE_RECORD pHPFThreadRead;
LONG lTotalByte = 0;
BOOLEAN fAssociatedIrp = TRUE;
EnterTracelibCritSection();
pHPFRecord->RecordID = PageFaultCount;
InsertHeadList(& pProcess->HPFListHead, & pHPFRecord->Entry);
while (fAssociatedIrp && pNext != pHead)
{
pHPFThreadRead = CONTAINING_RECORD(pNext,
HPF_FILE_RECORD,
Entry);
pNext = pNext->Flink;
fAssociatedIrp = (BOOLEAN) ((pHPFThreadRead->IrpFlags
& IRP_ASSOCIATED_IRP) != 0);
if (!fAssociatedIrp && fDO != pHPFThreadRead->fDO)
{
fAssociatedIrp = TRUE;
continue;
}
if (AddHPFFileRecord(& pHPFFileRecord,
pHPFThreadRead->RecordID,
pHPFThreadRead->IrpFlags,
pHPFThreadRead->DiskNumber,
pHPFThreadRead->ByteOffset,
pHPFThreadRead->BytesCount,
pHPFThreadRead->fDO))
{
lTotalByte += pHPFThreadRead->BytesCount;
InsertHeadList(& pHPFRecord->HPFReadListHead,
& pHPFFileRecord->Entry);
}
RemoveEntryList(& pHPFThreadRead->Entry);
free(pHPFThreadRead);
}
LeaveTracelibCritSection();
}
goto Cleanup;
}
else if (pHeader->Class.Type == EVENT_TRACE_TYPE_MM_HPF)
{
PLIST_ENTRY pHead = & pProcess->HPFListHead;
PLIST_ENTRY pNext = pHead->Flink;
PHPF_RECORD pHPFRecord;
while (pNext != pHead)
{
pHPFRecord = CONTAINING_RECORD(pNext, HPF_RECORD, Entry);
pNext = pNext->Flink;
if (pHPFRecord->lFaultAddress == lFaultAddr)
{
pHPFRecord->lProgramCounter = lPC;
break;
}
}
}
if (pModule)
{
UpdatePageFaultCount(
pProcess, pModule, lFaultAddr, pHeader->Class.Type);
fFound = TRUE;
}
if (!fFound && pProcess->PID != 0)
{
PMODULE_RECORD pModule = SearchSysModule(pProcess, lPC, TRUE);
if (pModule)
{
UpdatePageFaultCount(
pProcess, pModule, lFaultAddr, pHeader->Class.Type);
fFound = TRUE;
}
}
if (!fFound)
{
PLIST_ENTRY pModuleHead = & pProcess->ModuleListHead;
PLIST_ENTRY pModuleNext = pModuleHead->Flink;
PMODULE_RECORD pModule;
while (pModuleNext != pModuleHead)
{
pModule = CONTAINING_RECORD(pModuleNext,
MODULE_RECORD,
Entry);
pModuleNext = pModuleNext->Flink;
if (!_wcsicmp(pModule->strModuleName, L"other"))
{
if ( pModule->lBaseAddress == 0
&& pModule->lModuleSize == 0)
{
pModule->lBaseAddress = lPC;
pModule->lModuleSize = 1;
}
else if (pModule->lBaseAddress > lPC)
{
pModule->lModuleSize += pModule->lBaseAddress - lPC;
pModule->lBaseAddress = lPC;
}
else if ( pModule->lModuleSize
< lPC - pModule->lBaseAddress + 1)
{
pModule->lModuleSize =
lPC - pModule->lBaseAddress + 1;
}
UpdatePageFaultCount(
pProcess,
pModule,
lFaultAddr,
pHeader->Class.Type);
break;
}
}
}
}
else
{
/*
#if DBG
DbgPrint("ERROR - PageFaultCallback(0x%08I64x,0x%08I64x,0x%08x,0x%08x) cannot find process\n",
pHeader->ThreadId,
pThread->pProcess->PID,
lPC,
lFaultAddr);
#endif
*/
}
Cleanup:
return;
}
VOID
DiskIoCallback(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
if (pEvent == NULL)
return;
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_IO_READ) {
IoReadCallback(pEvent, pThread);
}
else {
IoWriteCallback(pEvent, pThread);
}
}
VOID
TcpIpCallback(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
PEVENT_TRACE_HEADER pHeader;
PPROCESS_RECORD pProcess;
ULONG size = 0;
if (pEvent == NULL)
return;
pHeader = (EVENT_TRACE_HEADER*)&pEvent->Header;
if (!InTimeWindow(pEvent, pThread))
return;
if (pThread == NULL)
{
if (AddThread(pHeader->ThreadId, pEvent, &pThread ))
{
/*
#if DBG
DbgPrint("WARNING(%d): Thread %x added to charge TCP/IP event\n",
EventCount, pHeader->ThreadId);
#endif
*/
pThread->pProcess = FindProcessById(0, TRUE);
pThread->TimeStart = pHeader->TimeStamp.QuadPart;
pThread->fOrphan = TRUE;
pThread->KCPUStart = pHeader->KernelTime;
pThread->UCPUStart = pHeader->UserTime;
AdjustThreadTime(pEvent, pThread);
}
else
{
/*
#if DBG
DbgPrint("FATBUG(%d): Cannot add thread %x for TCP/IP Event.\n",
EventCount, pHeader->ThreadId);
#endif
*/
return;
}
}
/*
#if DBG
else if (pThread->fOrphan)
{
DbgPrint("INFO(%d): TCP/IP Event Thread %x Is Still Orphan.\n",
EventCount, pHeader->ThreadId);
}
else if (pThread->DeadFlag)
{
DbgPrint("INFO(%d): TCP/IP Event Thread %x Is Already Dead.\n",
EventCount, pHeader->ThreadId);
}
#endif
*/
if (GetMofData(pEvent, L"size", &size, sizeof(ULONG)) > 0) {
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SEND ) {
pThread->SendCount++;
pThread->SendSize += size;
if (pThread->pMofData != NULL) {
((PMOF_DATA)pThread->pMofData)->SendCount++;
}
if ( (pProcess = pThread->pProcess) != NULL ) {
pProcess->SendCount++;
pProcess->SendSize += size;
}
} else if( pEvent->Header.Class.Type == EVENT_TRACE_TYPE_RECEIVE ) {
pThread->RecvCount++;
pThread->RecvSize += size;
if (pThread->pMofData != NULL) {
((PMOF_DATA)pThread->pMofData)->RecvCount++;
}
if ( (pProcess = pThread->pProcess) != NULL ) {
pProcess->RecvCount++;
pProcess->RecvSize += size;
}
}
}
}
PFILE_OBJECT
FindFileInTable (
IN PVOID fDO
)
{
PFILE_OBJECT thisFile, lastFile = NULL;
PFILE_OBJECT *fileTable;
UINT i;
fileTable = CurrentSystem.FileTable;
for (i = 0; i < MAX_FILE_TABLE_SIZE; i++) {
thisFile = fileTable[i];
fileTable[i] = lastFile;
lastFile = thisFile;
if ((thisFile != NULL) && (thisFile->fDO == fDO)) {
fileTable[0] = thisFile;
return thisFile;
}
}
if (lastFile == NULL) {
lastFile = (PFILE_OBJECT) malloc( sizeof(FILE_OBJECT));
if (lastFile == NULL) {
return NULL;
}
}
fileTable[0] = lastFile;
lastFile->fDO = fDO;
lastFile->fileRec = NULL;
InitializeListHead( &lastFile->ProtoFileRecordListHead );
return lastFile;
}
//
// TODO: Redo the EventList as FILE_RECORDS with Unknown Filenames
// The current implementation will create a proto record for
// evenry I/O and if the APC never arrives, it can choke the
// system!
//
VOID
AddEvent(
IN PFILE_OBJECT fileObject,
IN ULONG DiskNumber,
IN ULONG IoSize,
IN BOOLEAN ReadFlag
)
{
PPROTO_FILE_RECORD protoFileRec;
if (fileObject->fileRec != NULL) {
/*
#if DBG
DbgPrint("BUG: FileObject is NONNULL in AddEvent\n");
#endif
*/
}
protoFileRec = (PPROTO_FILE_RECORD) malloc(sizeof(PROTO_FILE_RECORD));
if (protoFileRec == NULL) {
return;
}
protoFileRec->ReadFlag = ReadFlag;
protoFileRec->IoSize = IoSize;
protoFileRec->DiskNumber = DiskNumber;
InsertHeadList( &fileObject->ProtoFileRecordListHead, &protoFileRec->Entry);
// Currently NOT Keeping track of the DrillDown data for the File
// if APC has not happened yet. Some Events may be lost.
}
ULONG
GetMofData(
PEVENT_TRACE pEvent,
WCHAR *strName,
PVOID ReturnValue,
ULONG ReturnLength
)
{
PITEM_DESC pAuxInfo;
PUCHAR pData = (PUCHAR) pEvent->MofData;
ULONG RequiredLength = 0;
BOOLEAN AddNull = FALSE;
PLIST_ENTRY Head, Next;
PMOF_INFO pMofInfo;
PMOF_VERSION pMofVersion;
if (pEvent == NULL)
return 0;
if (strName == NULL)
return 0;
if (lstrlenW(strName) <= 0)
return 0;
pMofInfo = GetMofInfoHead(&pEvent->Header.Guid);
if (pMofInfo == NULL)
return 0;
pMofVersion = GetMofVersion(pMofInfo,
pEvent->Header.Class.Type,
pEvent->Header.Class.Version,
pEvent->Header.Class.Level
);
if (pMofVersion == NULL)
return 0;
Head = &pMofVersion->ItemHeader;
Next = Head->Flink;
while (Head != Next) {
pAuxInfo = CONTAINING_RECORD(Next, ITEM_DESC, Entry);
if ( (ULONG) (pData-(PUCHAR)pEvent->MofData) >= pEvent->MofLength)
return 0;
switch (pAuxInfo->ItemType) {
case ItemShort:
case ItemUShort:
{
RequiredLength = 2;
}
break;
case ItemULong:
case ItemULongX:
{
RequiredLength = 4;
}
break;
case ItemLongLong:
case ItemULongLong:
{
RequiredLength = 8;
}
break;
case ItemPString :
pData += sizeof(USHORT);
case ItemString :
RequiredLength = lstrlenA((PCHAR)pData) + 1;
break;
case ItemWString :
//
// FileNames etc are not NULL Terminated and only the buffer
// is copied. To find its length, we can't use wcslen.
// The Length is computed from the assumption that this string
// is the last item for this event and the size of the event
// should help determine the size of this string.
RequiredLength = pEvent->MofLength -
(ULONG) (pData - (PUCHAR) pEvent->MofData);
AddNull = TRUE;
break;
case ItemSid :
{
PULONG pSid;
pSid = (PULONG) pData;
if (*pSid == 0) {
RequiredLength = 4;
}
else {
pData += 8; // skip the TOKEN_USER structure
RequiredLength = 8 + (4*pData[1]);
}
}
break;
case ItemPtr :
{
RequiredLength = PointerSize / 8;
if ( (RequiredLength != 4) && (RequiredLength != 8) ) {
RequiredLength = 4;
}
break;
}
default : RequiredLength = pAuxInfo->DataSize;
}
if (!wcscmp(pAuxInfo->strDescription, strName)) {
if (RequiredLength == 0) return 0;
//
// Make Sure there is enough room to copy
//
if (RequiredLength > ReturnLength) {
/*
#if DBG
DbgPrint("RequiredLength %d Space Available %d\n", RequiredLength, ReturnLength);
#endif
*/
return RequiredLength;
}
memcpy(ReturnValue, pData, RequiredLength);
if (AddNull) {
WCHAR* ws;
ws = (WCHAR*) ReturnValue;
ws[RequiredLength/2] = 0;
}
return 0;
}
else {
}
pData += RequiredLength;
Next = Next->Flink;
}
return RequiredLength;
}
ULONG
GetDeltaWithTimeWindow(BOOLEAN fKCPU, PTHREAD_RECORD pThread,
ULONGLONG timeStart, ULONGLONG timeEnd,
ULONG DeltaStart, ULONG DeltaEnd)
{
ULONG lResult = 0;
ULONG lDeltaStart, lDeltaEnd;
UNREFERENCED_PARAMETER(pThread);
if (!fDSOnly)
{
lResult = (DeltaEnd > DeltaStart) ? (DeltaEnd - DeltaStart) : (0);
}
else if ((timeStart >= DSEndTime) || (timeEnd <= DSStartTime))
{
lResult = 0;
}
else if (fKCPU)
{
lDeltaStart = (timeStart < DSStartTime)
? Interpolate(timeStart, DeltaStart,
timeEnd, DeltaEnd,
DSStartTime)
: DeltaStart;
lDeltaEnd = (timeEnd > DSEndTime)
? Interpolate(timeStart, DeltaStart,
timeEnd, DeltaEnd,
DSEndTime)
: DeltaEnd;
lResult = (lDeltaEnd > lDeltaStart) ? (lDeltaEnd - lDeltaStart) : (0);
}
else
{
lDeltaStart = (timeStart < DSStartTime)
? Interpolate(timeStart, DeltaStart,
timeEnd, DeltaEnd,
DSStartTime)
: DeltaStart;
lDeltaEnd = (timeEnd > DSEndTime)
? Interpolate(timeStart, DeltaStart,
timeEnd, DeltaEnd,
DSEndTime)
: DeltaEnd;
lResult = (lDeltaEnd > lDeltaStart) ? (lDeltaEnd - lDeltaStart) : (0);
}
return lResult;
}
// Generic Event Callback. Get the Transaction Response Time.
//
VOID
EventCallback(
PEVENT_TRACE pEvent,
PTHREAD_RECORD pThread
)
{
PMOF_INFO pMofInfo;
PMOF_DATA pMofData;
PEVENT_TRACE_HEADER pHeader;
PPROCESS_RECORD pProcess;
PTRANS_RECORD pThreadTrans = NULL;
ULONGLONG delta;
if (pEvent == NULL)
return;
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
//
// Ignore Process/Thread Start/End transactions. Only go after
// User Defined Transactions.
//
pMofInfo = GetMofInfoHead(&pHeader->Guid);
if (pMofInfo == NULL){
return;
}
if ( pMofInfo->bKernelEvent ){
return;
}
if (IsEqualGUID( &pMofInfo->Guid, &EventTraceGuid ) ||
pEvent->Header.Class.Type == EVENT_TRACE_TYPE_GUIDMAP) {
return;
}
if (pThread == NULL) {
if (AddThread( pHeader->ThreadId, pEvent, &pThread )) {
/*
#if DBG
DbgPrint("WARNING(%d): Thread %x added to charge Event.\n",
EventCount, pHeader->ThreadId);
#endif
*/
pThread->pProcess = FindProcessById(0, TRUE); // Charge it the system ???
pThread->TimeStart = pHeader->TimeStamp.QuadPart;
pThread->KCPUStart = pHeader->KernelTime;
pThread->UCPUStart = pHeader->UserTime;
pThread->fOrphan = TRUE;
AdjustThreadTime(pEvent, pThread);
}
else
{
/*
#if DBG
DbgPrint("FATBUG(%d): Cannot add thread %x for Event.\n",
EventCount, pHeader->ThreadId);
#endif
*/
return;
}
}
/*
#if DBG
else if (pThread->fOrphan)
{
DbgPrint("INFO(%d): Generic Event Thread %x Is Still Orphan.\n",
EventCount, pHeader->ThreadId);
}
else if (pThread->DeadFlag)
{
DbgPrint("INFO(%d): Generic Event Thread %x Is Already Dead.\n",
EventCount, pHeader->ThreadId);
}
#endif
*/
if (pMofInfo->strSortField == NULL){
pMofData = FindMofData(pMofInfo, NULL);
}
else if ( (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_START)
|| (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_START)){
WCHAR strSortKey[MAXSTR];
RtlZeroMemory(strSortKey, MAXSTR * sizeof(WCHAR) );
GetMofData(pEvent, pMofInfo->strSortField, &strSortKey, MAXSTR);
pMofData = FindMofData(pMofInfo, strSortKey );
wcscpy(pThread->strSortKey, strSortKey );
}else{
pMofData = FindMofData( pMofInfo, pThread->strSortKey );
}
pProcess = pThread->pProcess;
if ( (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_START)
|| (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_START)){
pThreadTrans = FindTransByList(& pThread->TransListHead,
& pMofInfo->Guid,
pThread->TransLevel);
}
else
{
LONG i = pThread->TransLevel - 1;
while (i >= 0)
{
if (IsEqualGUID(& pHeader->Guid,
pThread->TransStack[i]->pGuid))
{
pThreadTrans = pThread->TransStack[i];
break;
}
i --;
}
if (i < 0)
{
pThreadTrans = FindTransByList(& pThread->TransListHead,
&pMofInfo->Guid,
(pThread->TransLevel >= 0) ? (pThread->TransLevel) : (0));
if (pThread->TransLevel < 0)
{
pThread->TransLevel = 0;
pThread->TransStack[pThread->TransLevel] = pThreadTrans;
pThread->TransLevel ++;
}
}
}
if (pMofData == NULL) {
return;
}
if (pMofData->PrevClockTime == 0)
{
pMofData->PrevClockTime = pHeader->TimeStamp.QuadPart;
}
delta = (pHeader->TimeStamp.QuadPart - pMofData->PrevClockTime);
pMofData->TotalResponseTime += (delta * pMofData->InProgressCount) / 10000;
// Update the Clock
pMofData->PrevClockTime = pHeader->TimeStamp.QuadPart;
if ( (pHeader->Class.Type == EVENT_TRACE_TYPE_START)
|| (pHeader->Class.Type == EVENT_TRACE_TYPE_DC_START))
{
if (pThread->TransLevel < 0)
{
pThread->TransLevel = 0;
}
if (pThread->TransLevel == 0)
{
LONG lDelta;
lDelta = pHeader->KernelTime - pThread->KCPU_PrevTrans;
if (lDelta > 0)
{
pThread->KCPU_NoTrans += lDelta;
pThread->KCPU_PrevTrans = pHeader->KernelTime;
}
lDelta = pHeader->UserTime - pThread->UCPU_PrevTrans;
if (lDelta > 0)
{
pThread->UCPU_NoTrans += lDelta;
pThread->UCPU_PrevTrans = pHeader->UserTime;
}
}
else
{
PTRANS_RECORD pTransPrev =
pThread->TransStack[pThread->TransLevel - 1];
PMOF_INFO pMofInfoPrev = GetMofInfoHead(pTransPrev->pGuid);
PMOF_DATA pMofDataPrev = NULL;
ULONG DeltaCPU;
if (pMofInfoPrev != NULL)
{
pMofDataPrev = FindMofData(pMofInfoPrev, NULL);
}
if (pMofDataPrev)
{
DeltaCPU = GetDeltaWithTimeWindow(
TRUE,
pThread,
pThread->Time_PrevEvent,
(ULONGLONG) pHeader->TimeStamp.QuadPart,
pThread->KCPU_PrevEvent,
pHeader->KernelTime);
DeltaCPU = DeltaCPU * CurrentSystem.TimerResolution;
pTransPrev->KCpu += DeltaCPU;
pMofDataPrev->KernelCPU += DeltaCPU;
if (pMofDataPrev->MaxKCpu < 0)
{
pMofDataPrev->MaxKCpu = DeltaCPU;
pMofDataPrev->MinKCpu = DeltaCPU;
}
if (DeltaCPU > (ULONG) pMofDataPrev->MaxKCpu)
{
pMofDataPrev->MaxKCpu = DeltaCPU;
}
if (DeltaCPU < (ULONG) pMofDataPrev->MinKCpu)
{
pMofDataPrev->MinKCpu = DeltaCPU;
}
DeltaCPU = GetDeltaWithTimeWindow(
FALSE,
pThread,
pThread->Time_PrevEvent,
(ULONGLONG) pHeader->TimeStamp.QuadPart,
pThread->UCPU_PrevEvent,
pHeader->UserTime);
DeltaCPU = DeltaCPU * CurrentSystem.TimerResolution;
pTransPrev->UCpu += DeltaCPU;
pMofDataPrev->UserCPU += DeltaCPU;
if (pMofDataPrev->MaxUCpu < 0)
{
pMofDataPrev->MaxUCpu = DeltaCPU;
pMofDataPrev->MinUCpu = DeltaCPU;
}
if (DeltaCPU > (ULONG) pMofDataPrev->MaxUCpu)
{
pMofDataPrev->MaxUCpu = DeltaCPU;
}
if (DeltaCPU < (ULONG) pMofDataPrev->MinUCpu)
{
pMofDataPrev->MinUCpu = DeltaCPU;
}
}
}
if( pThreadTrans != NULL ){
if( ! pThreadTrans->bStarted ){
pThreadTrans->bStarted = TRUE;
pMofData->InProgressCount ++;
if (pHeader->Class.Type == EVENT_TRACE_TYPE_START) {
pThread->RefCount ++;
pThreadTrans->RefCount ++;
}
else {
pThreadTrans->RefCount1 ++;
}
pThread->pMofData = pMofData;
pThread->TransStack[pThread->TransLevel] = pThreadTrans;
pThread->TransLevel ++;
}
}
pThread->Time_PrevEvent = (ULONGLONG) pHeader->TimeStamp.QuadPart;
pThread->KCPU_PrevEvent = pHeader->KernelTime;
pThread->UCPU_PrevEvent = pHeader->UserTime;
pThread->DeltaReadIO = pThread->ReadIO;
pThread->DeltaWriteIO = pThread->WriteIO;
pThread->DeltaSend = pThread->SendCount;
pThread->DeltaRecv = pThread->RecvCount;
}
else if ( (pHeader->Class.Type == EVENT_TRACE_TYPE_END)
|| (pHeader->Class.Type == EVENT_TRACE_TYPE_DC_END))
{
ULONG DeltaCPU;
BOOLEAN fSwitch = TRUE;
if( pThreadTrans != NULL ){
if (pThreadTrans->bStarted){
PTRANS_RECORD pTransCurrent;
PMOF_INFO pMofInfoCurrent;
PMOF_DATA pMofDataCurrent;
BOOLEAN fCharged = FALSE;
if (pThread->TransLevel <= 0)
{
pThread->TransLevel = 0;
}
else {
do
{
pThread->TransLevel --;
pTransCurrent = pThread->TransStack[pThread->TransLevel];
if (pTransCurrent->bStarted)
{
pTransCurrent->bStarted = FALSE;
}
pMofInfoCurrent = GetMofInfoHead( pTransCurrent->pGuid );
pMofDataCurrent = NULL;
if (pMofInfoCurrent != NULL)
{
pMofDataCurrent = FindMofData(pMofInfoCurrent, NULL);
}
if (!pMofDataCurrent)
continue;
pMofDataCurrent->InProgressCount--;
if (pMofDataCurrent->InProgressCount < 0){
pMofDataCurrent->InProgressCount = 0;
}
pMofDataCurrent->CompleteCount++;
pMofDataCurrent->AverageResponseTime
= (pMofDataCurrent->CompleteCount > 0)
? ( (LONG) pMofDataCurrent->TotalResponseTime
/ pMofDataCurrent->CompleteCount)
: 0;
if (fCharged)
continue;
DeltaCPU = GetDeltaWithTimeWindow(
TRUE,
pThread,
pThread->Time_PrevEvent,
(ULONGLONG) pHeader->TimeStamp.QuadPart,
pThread->KCPU_PrevEvent,
pHeader->KernelTime);
DeltaCPU = DeltaCPU * CurrentSystem.TimerResolution;
pTransCurrent->KCpu += DeltaCPU;
pMofDataCurrent->KernelCPU += DeltaCPU;
if (pMofDataCurrent->MaxKCpu < 0)
{
pMofDataCurrent->MaxKCpu = DeltaCPU;
pMofDataCurrent->MinKCpu = DeltaCPU;
}
if (DeltaCPU > (ULONG) pMofDataCurrent->MaxKCpu)
{
pMofDataCurrent->MaxKCpu = DeltaCPU;
}
if (DeltaCPU < (ULONG) pMofDataCurrent->MinKCpu)
{
pMofDataCurrent->MinKCpu = DeltaCPU;
}
DeltaCPU = GetDeltaWithTimeWindow(
FALSE,
pThread,
pThread->Time_PrevEvent,
(ULONGLONG) pHeader->TimeStamp.QuadPart,
pThread->UCPU_PrevEvent,
pHeader->UserTime);
DeltaCPU = DeltaCPU * CurrentSystem.TimerResolution;
pTransCurrent->UCpu += DeltaCPU;
pMofDataCurrent->UserCPU += DeltaCPU;
if(pMofDataCurrent->MaxUCpu < 0)
{
pMofDataCurrent->MaxUCpu = DeltaCPU;
pMofDataCurrent->MinUCpu = DeltaCPU;
}
if (DeltaCPU > (ULONG) pMofDataCurrent->MaxUCpu)
{
pMofDataCurrent->MaxUCpu = DeltaCPU;
}
fCharged = TRUE;
}while ( pThread->TransLevel > 0 &&
!IsEqualGUID(& pHeader->Guid, pTransCurrent->pGuid));
}
pThread->Time_PrevEvent = (ULONGLONG) pHeader->TimeStamp.QuadPart;
pThread->KCPU_PrevEvent = pHeader->KernelTime;
pThread->UCPU_PrevEvent = pHeader->UserTime;
}
else
{
DeltaCPU = GetDeltaWithTimeWindow(
TRUE,
pThread,
(ULONGLONG) pHeader->TimeStamp.QuadPart,
(ULONGLONG) pHeader->TimeStamp.QuadPart,
pHeader->KernelTime,
pHeader->KernelTime);
DeltaCPU = DeltaCPU * CurrentSystem.TimerResolution;
pThreadTrans->KCpu += DeltaCPU;
pMofData->KernelCPU += DeltaCPU;
if (pMofData->MaxKCpu < 0)
{
pMofData->MaxKCpu = DeltaCPU;
pMofData->MinKCpu = DeltaCPU;
}
if (DeltaCPU > (ULONG) pMofData->MaxKCpu)
{
pMofData->MaxKCpu = DeltaCPU;
}
if (DeltaCPU < (ULONG) pMofData->MinKCpu)
{
pMofData->MinKCpu = DeltaCPU;
}
DeltaCPU = GetDeltaWithTimeWindow(
FALSE,
pThread,
(ULONGLONG) pHeader->TimeStamp.QuadPart,
(ULONGLONG) pHeader->TimeStamp.QuadPart,
pHeader->UserTime,
pHeader->UserTime);
DeltaCPU = DeltaCPU * CurrentSystem.TimerResolution;
pThreadTrans->UCpu += DeltaCPU;
pMofData->UserCPU += DeltaCPU;
if(pMofData->MaxUCpu < 0)
{
pMofData->MaxUCpu = DeltaCPU;
pMofData->MinUCpu = DeltaCPU;
}
if (DeltaCPU > (ULONG) pMofData->MaxUCpu)
{
pMofData->MaxUCpu = DeltaCPU;
}
if (DeltaCPU < (ULONG) pMofData->MinUCpu)
{
pMofData->MinUCpu = DeltaCPU;
}
fSwitch = FALSE;
}
}
pMofData->ReadCount += (pThread->ReadIO - pThread->DeltaReadIO);
pMofData->WriteCount += (pThread->WriteIO - pThread->DeltaWriteIO);
pMofData->SendCount += (pThread->SendCount - pThread->DeltaSend);
pMofData->RecvCount += (pThread->RecvCount - pThread->DeltaRecv);
pThread->pMofData = NULL;
if (fSwitch && pThread->TransLevel <= 0)
{
LONG lDelta;
if (pThread->TransLevel < 0)
{
pThread->TransLevel = 0;
}
lDelta = pHeader->KernelTime - pThread->KCPU_PrevTrans;
if (lDelta > 0)
{
pThread->KCPU_Trans += lDelta;
pThread->KCPU_PrevTrans = pHeader->KernelTime;
}
lDelta = pHeader->UserTime - pThread->UCPU_PrevTrans;
if (lDelta > 0)
{
pThread->UCPU_Trans += lDelta;
pThread->UCPU_PrevTrans = pHeader->UserTime;
}
}
}
}
ULONG
ThreadRunDown(
IN PSYSTEM_PROCESS_INFORMATION pProcessInfo
)
{
PSYSTEM_THREAD_INFORMATION pThreadInfo;
ULONG i;
EVENT_TRACE Event;
HANDLE EventInfo[2];
PEVENT_TRACE_HEADER pWnode;
ULONG TimerResolution = 1; // How do I get this??
RtlZeroMemory(&Event, sizeof(EVENT_TRACE));
pWnode = &Event.Header;
pWnode->Size = sizeof(EVENT_TRACE_HEADER) + 2 * sizeof(HANDLE);
pWnode->Class.Type = EVENT_TRACE_TYPE_DC_START;
Event.MofData = EventInfo;
Event.MofLength = 2 * sizeof(HANDLE);
GetSystemTimeAsFileTime((struct _FILETIME *)&pWnode->TimeStamp);
RtlCopyMemory(&pWnode->Guid, &ThreadGuid, sizeof(GUID));
pThreadInfo = (PSYSTEM_THREAD_INFORMATION) (pProcessInfo+1);
for (i=0; i < pProcessInfo->NumberOfThreads; i++) {
EventInfo[0] = pThreadInfo->ClientId.UniqueThread;
EventInfo[1] = pThreadInfo->ClientId.UniqueProcess;
pWnode->KernelTime = (ULONG) (pThreadInfo->KernelTime.QuadPart
/ TimerResolution);
pWnode->UserTime = (ULONG) (pThreadInfo->UserTime.QuadPart
/ TimerResolution);
ThreadCallback(&Event);
pThreadInfo += 1;
}
return ERROR_SUCCESS;
}
ULONG
ProcessRunDown(
)
{
PSYSTEM_PROCESS_INFORMATION pProcessInfo;
PSYSTEM_THREAD_INFORMATION pThreadInfo;
char* LargeBuffer1;
NTSTATUS status;
ULONG ReturnLength;
ULONG CurrentBufferSize;
ULONG TotalOffset = 0;
OBJECT_ATTRIBUTES objectAttributes;
EVENT_TRACE Event;
ULONG_PTR AuxInfo[64];
PEVENT_TRACE_HEADER pWnode;
RtlZeroMemory(&Event, sizeof(EVENT_TRACE));
pWnode = &Event.Header;
pWnode->Size = sizeof(EVENT_TRACE_HEADER) + 2 * sizeof(HANDLE);
pWnode->Class.Type = EVENT_TRACE_TYPE_DC_START;
Event.MofData = AuxInfo;
Event.MofLength = 2 * sizeof(HANDLE);
GetSystemTimeAsFileTime((struct _FILETIME *)&pWnode->TimeStamp);
RtlCopyMemory(&pWnode->Guid, &ProcessGuid, sizeof(GUID));
LargeBuffer1 = (LPSTR)VirtualAlloc (NULL,
MAX_BUFFER_SIZE,
MEM_RESERVE,
PAGE_READWRITE);
if (LargeBuffer1 == NULL) {
return ERROR_MORE_DATA;
}
if (VirtualAlloc (LargeBuffer1,
BUFFER_SIZE,
MEM_COMMIT,
PAGE_READWRITE) == NULL) {
return ERROR_MORE_DATA;
}
CurrentBufferSize = BUFFER_SIZE;
retry:
status = NtQuerySystemInformation(
SystemProcessInformation,
LargeBuffer1,
CurrentBufferSize,
&ReturnLength
);
if (status == STATUS_INFO_LENGTH_MISMATCH) {
//
// Increase buffer size.
//
CurrentBufferSize += 8192;
if (VirtualAlloc (LargeBuffer1,
CurrentBufferSize,
MEM_COMMIT,
PAGE_READWRITE) == NULL) {
return ERROR_MORE_DATA;
}
goto retry;
}
if (!NT_SUCCESS(status)) {
return(status);
}
TotalOffset = 0;
pProcessInfo = (SYSTEM_PROCESS_INFORMATION *) LargeBuffer1;
while (pProcessInfo != NULL) {
ULONG Size;
ULONG Length = 0;
ULONG SidLength = 0;
PUCHAR AuxPtr;
ANSI_STRING s;
HANDLE Token;
HANDLE pProcess;
PCLIENT_ID Cid;
ULONG TempInfo[128];
s.Buffer = NULL;
s.Length = 0;
Size = sizeof(EVENT_TRACE_HEADER) + 2 * sizeof(ULONG_PTR);
pThreadInfo = (PSYSTEM_THREAD_INFORMATION) (pProcessInfo+1);
if (pProcessInfo->NumberOfThreads > 0) {
Cid = (PCLIENT_ID) &pThreadInfo->ClientId;
}
else {
Cid = NULL;
}
if ( pProcessInfo->ImageName.Buffer &&
pProcessInfo->ImageName.Length > 0 ) {
RtlUnicodeStringToAnsiString(
&s,
(PUNICODE_STRING)&pProcessInfo->ImageName,
TRUE);
Length = s.Length + 1;
}
else {
Length = 1;
}
InitializeObjectAttributes(
&objectAttributes, 0, 0, NULL, NULL);
status = NtOpenProcess(
&pProcess,
PROCESS_QUERY_INFORMATION,
&objectAttributes,
Cid);
if (NT_SUCCESS(status)) {
status = NtOpenProcessToken(
pProcess,
TOKEN_READ,
&Token);
if (NT_SUCCESS(status)) {
status = NtQueryInformationToken(
Token,
TokenUser,
TempInfo,
256,
&SidLength);
NtClose(Token);
}
NtClose(pProcess);
}
if ( (!NT_SUCCESS(status)) || SidLength <= 0) {
TempInfo[0] = 0;
SidLength = sizeof(ULONG);
}
Size += Length + SidLength;
AuxInfo[0] = (ULONG_PTR) pProcessInfo->UniqueProcessId;
AuxInfo[1] = (ULONG_PTR) pProcessInfo->InheritedFromUniqueProcessId;
AuxPtr = (PUCHAR) &AuxInfo[2];
RtlCopyMemory(AuxPtr, &TempInfo, SidLength);
AuxPtr += SidLength;
if ( Length > 1) {
RtlCopyMemory(AuxPtr, s.Buffer, Length);
AuxPtr += Length;
RtlFreeAnsiString(&s);
}
*AuxPtr = '\0';
AuxPtr++;
Event.MofLength = Size - sizeof(EVENT_TRACE_HEADER);
ProcessCallback(&Event);
ThreadRunDown(pProcessInfo);
if (pProcessInfo->NextEntryOffset == 0) {
break;
}
TotalOffset += pProcessInfo->NextEntryOffset;
pProcessInfo = (PSYSTEM_PROCESS_INFORMATION)&LargeBuffer1[TotalOffset];
}
VirtualFree(LargeBuffer1, 0, MEM_RELEASE);
return status;
}
//
// This routine moves the temporary MOF_VERSION list
// into the VersionHeader list for this GUID (MofInfo)
//
void
FlushMofVersionList( PMOF_INFO pMofInfo, PLIST_ENTRY ListHead )
{
PMOF_VERSION pMofVersion;
PLIST_ENTRY Head = ListHead;
PLIST_ENTRY Next = Head->Flink;
while( Head != Next ){
pMofVersion = CONTAINING_RECORD(Next, MOF_VERSION, Entry);
Next = Next->Flink;
RemoveEntryList(&pMofVersion->Entry);
if (pMofInfo != NULL) {
InsertTailList( &pMofInfo->VersionHeader, &pMofVersion->Entry);
}
else {
free(pMofVersion);
//
// Really should not hit this case
//
/*
#if DBG
DbgPrint("TRACECTR: FlushMofVersionList. MofInfo ptr is NULL\n");
ASSERT (pMofInfo != NULL);
#endif
*/
}
}
}
void
DumpMofVersionItem(
PMOF_VERSION pMofVersion
)
{
PLIST_ENTRY Head = &pMofVersion->ItemHeader;
PLIST_ENTRY Next = Head->Flink;
PITEM_DESC pItem;
DbgPrint("MOF_VERSION: Version %d Level %d Type %d strType %ws\n",
pMofVersion->Version,
pMofVersion->Level,
pMofVersion->TypeIndex,
pMofVersion->strType);
while( Head != Next ){
pItem = CONTAINING_RECORD(Next, ITEM_DESC, Entry);
Next = Next->Flink;
DbgPrint("Name %ws Size %d ItemType %d\n", pItem->strDescription, pItem->DataSize, pItem->ItemType);
}
}
void
DumpMofList()
{
PMOF_INFO pMofInfo;
PLIST_ENTRY Head = &CurrentSystem.EventListHead;
PLIST_ENTRY Next = Head->Flink;
while( Head != Next ){
pMofInfo = CONTAINING_RECORD(Next, MOF_INFO, Entry);
Next = Next->Flink;
//
// Count the MOF Fields for this Guid and Type
//
DbgPrint("Name %ws KernelEvent %d\n", pMofInfo->strDescription,
pMofInfo->bKernelEvent);
}
}
PMOF_VERSION
GetGuids( GUID Guid, SHORT nVersion, CHAR nLevel, SHORT nType, BOOL bKernelEvent )
{
if ( TraceContext->Flags & TRACE_USE_WBEM ){
return GetGuidsWBEM( Guid, nVersion, nLevel, nType, bKernelEvent );
}else{
return GetGuidsFile( Guid, nVersion, nLevel, nType, bKernelEvent );
}
}
HRESULT
WbemConnect( IWbemServices** pWbemServices )
{
IWbemLocator *pLocator = NULL;
BSTR bszNamespace = SysAllocString( L"root\\wmi" );
HRESULT hr = CoInitialize(0);
hr = CoCreateInstance(
CLSID_WbemLocator,
0,
CLSCTX_INPROC_SERVER,
IID_IWbemLocator,
(LPVOID *) &pLocator
);
CHECK_HR( hr );
hr = pLocator->ConnectServer(
bszNamespace,
NULL,
NULL,
NULL,
0L,
NULL,
NULL,
pWbemServices
);
CHECK_HR( hr );
hr = CoSetProxyBlanket(
*pWbemServices,
RPC_C_AUTHN_WINNT,
RPC_C_AUTHZ_NONE,
NULL,
RPC_C_AUTHN_LEVEL_PKT,
RPC_C_IMP_LEVEL_IMPERSONATE,
NULL,
EOAC_NONE
);
cleanup:
SysFreeString( bszNamespace );
if( pLocator ){
pLocator->Release();
pLocator = NULL;
}
return hr;
}
ULONG GetArraySize(
IN IWbemQualifierSet *pQualSet
)
{
ULONG ArraySize = 1;
VARIANT pVal;
BSTR bszMaxLen;
HRESULT hRes;
if (pQualSet == NULL){
return ArraySize;
}
bszMaxLen = SysAllocString(L"MAX");
VariantInit(&pVal);
hRes = pQualSet->Get(bszMaxLen,
0,
&pVal,
0);
SysFreeString(bszMaxLen);
if (ERROR_SUCCESS == hRes && pVal.vt == VT_I4 ){
ArraySize = pVal.lVal;
}
VariantClear(&pVal);
return ArraySize;
}
ITEM_TYPE
GetItemType(
IN CIMTYPE_ENUMERATION CimType,
IN IWbemQualifierSet *pQualSet
)
{
ITEM_TYPE Type = ItemUnknown;;
VARIANT pVal;
HRESULT hRes;
BSTR bszQualName;
WCHAR strFormat[10];
WCHAR strTermination[30];
WCHAR strTemp[30];
BOOLEAN IsPointer = FALSE;
strFormat[0] = '\0';
strTermination[0] = '\0';
strTemp[0] = '\0';
if (pQualSet == NULL)
return ItemUnknown;
bszQualName = SysAllocString(L"format");
VariantInit(&pVal);
hRes = pQualSet->Get(bszQualName,
0,
&pVal,
0);
SysFreeString(bszQualName);
if (ERROR_SUCCESS == hRes && NULL != pVal.bstrVal)
wcscpy(strFormat, pVal.bstrVal);
bszQualName = SysAllocString(L"StringTermination");
VariantClear(&pVal);
hRes = pQualSet->Get(bszQualName,
0,
&pVal,
0);
SysFreeString(bszQualName);
if (ERROR_SUCCESS == hRes && NULL != pVal.bstrVal)
wcscpy(strTermination, pVal.bstrVal);
bszQualName = SysAllocString(L"pointer");
VariantClear(&pVal);
hRes = pQualSet->Get(bszQualName,
0,
&pVal,
0);
SysFreeString(bszQualName);
if (ERROR_SUCCESS == hRes)
IsPointer = TRUE;
// Major fix required to get rid of temp
bszQualName = SysAllocString(L"extension");
VariantClear(&pVal);
hRes = pQualSet->Get(bszQualName,
0,
&pVal,
0);
SysFreeString(bszQualName);
if (ERROR_SUCCESS == hRes && NULL != pVal.bstrVal)
wcscpy(strTemp, pVal.bstrVal);
VariantClear(&pVal);
CimType = (CIMTYPE_ENUMERATION)(CimType & (~CIM_FLAG_ARRAY));
switch (CimType) {
case CIM_EMPTY:
Type = ItemUnknown;
break;
case CIM_SINT8:
Type = ItemCharShort;
if (!_wcsicmp(strFormat, L"c")){
Type = ItemChar;
}
break;
case CIM_UINT8:
Type = ItemUChar;
if (!_wcsicmp(strTemp, L"NoPrint")) {
Type = ItemCharHidden;
}
break;
case CIM_SINT16:
Type = ItemShort;
break;
case CIM_UINT16:
Type = ItemUShort;
break;
case CIM_SINT32:
Type = ItemLong;
break;
case CIM_UINT32:
Type = ItemULong;
if (!_wcsicmp(strFormat, L"x")){
Type = ItemULongX;
}
break;
case CIM_SINT64:
Type = ItemLongLong;
break;
case CIM_UINT64:
Type = ItemULongLong;
break;
case CIM_BOOLEAN:
// ItemBool
Type = ItemBool;
break;
case CIM_STRING:
if (!_wcsicmp(strTermination, L"NullTerminated")) {
if (!_wcsicmp(strFormat, L"w"))
Type = ItemWString;
else
Type = ItemString;
}
else if (!_wcsicmp(strTermination, L"Counted")) {
if (!_wcsicmp(strFormat, L"w"))
Type = ItemPWString;
else
Type = ItemPString;
}
else if (!_wcsicmp(strTermination, L"ReverseCounted")) {
if (!_wcsicmp(strFormat, L"w"))
Type = ItemDSWString;
else
Type = ItemDSString;
}
else if (!_wcsicmp(strTermination, L"NotCounted")) {
Type = ItemNWString;
}else{
Type = ItemString;
}
break;
case CIM_CHAR16:
// ItemWChar
Type = ItemWChar;
break;
// Major fix required for executing methods from WBEM
case CIM_OBJECT :
if (!_wcsicmp(strTemp, L"Port"))
Type = ItemPort;
else if (!_wcsicmp(strTemp, L"RString"))
Type = ItemRString;
else if (!_wcsicmp(strTemp, L"RWString"))
Type = ItemRWString;
else if (!_wcsicmp(strTemp, L"IPAddr"))
Type = ItemIPAddr;
else if (!_wcsicmp(strTemp, L"Sid"))
Type = ItemSid;
else if (!_wcsicmp(strTemp, L"Guid"))
Type = ItemGuid;
else if (!_wcsicmp(strTemp, L"Variant"))
Type = ItemVariant;
else
Type = ItemUnknown;
break;
case CIM_REAL32:
case CIM_REAL64:
case CIM_DATETIME:
case CIM_REFERENCE:
case CIM_ILLEGAL:
default:
Type = ItemUnknown;
break;
}
if (IsPointer)
Type = ItemPtr;
return Type;
}
PMOF_VERSION
GetPropertiesFromWBEM(
// IWbemServices *pWbemServices,
IWbemClassObject *pTraceSubClasses,
GUID Guid,
SHORT nVersion,
CHAR nLevel,
SHORT nType,
BOOL bKernelEvent
)
{
IEnumWbemClassObject *pEnumTraceSubSubClasses = NULL;
IWbemClassObject *pTraceSubSubClasses = NULL;
IWbemQualifierSet *pQualSet = NULL;
PMOF_INFO pMofInfo = NULL;
PMOF_VERSION pMofLookup = NULL, pMofVersion = NULL;
BSTR bszClassName = NULL;
BSTR bszSubClassName = NULL;
BSTR bszWmiDataId = NULL;
BSTR bszEventType = NULL;
BSTR bszEventTypeName = NULL;
BSTR bszFriendlyName = NULL;
BSTR bszPropName = NULL;
TCHAR strClassName[MAXSTR];
TCHAR strType[MAXSTR];
LONG pVarType;
SHORT nEventType = EVENT_TYPE_DEFAULT;
LIST_ENTRY ListHead;
HRESULT hRes;
VARIANT pVal;
VARIANT pTypeVal;
VARIANT pTypeNameVal;
VARIANT pClassName;
ULONG lEventTypeWbem; // when types are in an array.
ULONG HUGEP *pTypeData;
BSTR HUGEP *pTypeNameData;
SAFEARRAY *PropArray = NULL;
SAFEARRAY *TypeArray = NULL;
SAFEARRAY *TypeNameArray = NULL;
long lLower, lUpper, lCount, IdIndex;
long lTypeLower, lTypeUpper;
long lTypeNameLower, lTypeNameUpper;
ULONG ArraySize;
ITEM_TYPE ItemType;
InitializeListHead(&ListHead);
VariantInit(&pVal);
VariantInit(&pTypeVal);
VariantInit(&pTypeNameVal);
VariantInit(&pClassName);
pMofInfo = GetMofInfoHead( &Guid );
if( NULL == pMofInfo ){
return NULL;
}
pMofInfo->bKernelEvent = bKernelEvent;
bszClassName = SysAllocString(L"__CLASS");
bszWmiDataId = SysAllocString(L"WmiDataId");
bszEventType = SysAllocString(L"EventType");
bszEventTypeName = SysAllocString(L"EventTypeName");
bszFriendlyName = SysAllocString(L"DisplayName");
hRes = pTraceSubClasses->Get(bszClassName, // property name
0L,
&pVal, // output to this variant
NULL,
NULL);
if (ERROR_SUCCESS == hRes){
if (pQualSet) {
pQualSet->Release();
pQualSet = NULL;
}
// Get Qualifier Set to obtain the friendly name.
pTraceSubClasses->GetQualifierSet(&pQualSet);
hRes = pQualSet->Get(bszFriendlyName,
0,
&pClassName,
0);
if (ERROR_SUCCESS == hRes && pClassName.bstrVal != NULL) {
wcscpy(strClassName, pClassName.bstrVal);
pMofInfo->strDescription = (LPTSTR)malloc((_tcslen(strClassName) + 1) * sizeof(TCHAR));
if (NULL != pMofInfo->strDescription) {
_tcscpy(pMofInfo->strDescription, strClassName);
}
}else{
strClassName[0] = L'\0';
}
// Put Event Header
pMofVersion = GetNewMofVersion(
EVENT_TYPE_DEFAULT,
EVENT_VERSION_DEFAULT,
EVENT_LEVEL_DEFAULT
);
if (pMofVersion != NULL) {
pMofLookup = pMofVersion;
InsertTailList(&ListHead, &pMofVersion->Entry);
}
else{
goto cleanup;
}
// Create an enumerator to find derived classes.
bszSubClassName = SysAllocString(pVal.bstrVal);
hRes = pWbemServices->CreateClassEnum (
bszSubClassName, // class name
WBEM_FLAG_SHALLOW | WBEM_FLAG_USE_AMENDED_QUALIFIERS, // shallow search
NULL,
&pEnumTraceSubSubClasses
);
SysFreeString ( bszSubClassName );
if (ERROR_SUCCESS == hRes) {
ULONG uReturnedSub = 1;
while(uReturnedSub == 1){
// For each event in the subclass
pTraceSubSubClasses = NULL;
hRes = pEnumTraceSubSubClasses->Next((-1), // timeout in infinite seconds
1, // return just one instance
&pTraceSubSubClasses, // pointer to a Sub class
&uReturnedSub); // number obtained: one or zero
if (ERROR_SUCCESS == hRes && uReturnedSub == 1) {
if (pQualSet) {
pQualSet->Release();
pQualSet = NULL;
}
// Get Qualifier Set.
pTraceSubSubClasses->GetQualifierSet(&pQualSet);
// Get Type number among Qualifiers
VariantClear(&pTypeVal);
hRes = pQualSet->Get(bszEventType,
0,
&pTypeVal,
0);
if (ERROR_SUCCESS == hRes) {
TypeArray = NULL;
TypeNameArray = NULL;
if (pTypeVal.vt & VT_ARRAY) { // EventType is an array
TypeArray = pTypeVal.parray;
VariantClear(&pTypeNameVal);
hRes = pQualSet->Get(bszEventTypeName,
0,
&pTypeNameVal,
0);
if ((ERROR_SUCCESS == hRes) && (pTypeNameVal.vt & VT_ARRAY)) {
TypeNameArray = pTypeNameVal.parray;
}
if (TypeArray != NULL) {
hRes = SafeArrayGetLBound(TypeArray, 1, &lTypeLower);
if (ERROR_SUCCESS != hRes) {
break;
}
hRes = SafeArrayGetUBound(TypeArray, 1, &lTypeUpper);
if (ERROR_SUCCESS != hRes) {
break;
}
if (lTypeUpper < 0) {
break;
}
SafeArrayAccessData(TypeArray, (void HUGEP **)&pTypeData );
if (TypeNameArray != NULL) {
hRes = SafeArrayGetLBound(TypeNameArray, 1, &lTypeNameLower);
if (ERROR_SUCCESS != hRes) {
break;
}
hRes = SafeArrayGetUBound(TypeNameArray, 1, &lTypeNameUpper);
if (ERROR_SUCCESS != hRes) {
break;
}
if (lTypeNameUpper < 0)
break;
SafeArrayAccessData(TypeNameArray, (void HUGEP **)&pTypeNameData );
}
for (lCount = lTypeLower; lCount <= lTypeUpper; lCount++) {
lEventTypeWbem = pTypeData[lCount];
nEventType = (SHORT)lEventTypeWbem;
pMofVersion = GetNewMofVersion(nEventType, nVersion, nLevel);
if (pMofVersion != NULL) {
InsertTailList(&ListHead, &pMofVersion->Entry);
if (nType == nEventType) {
// Type matched
pMofLookup = pMofVersion;
}
if (TypeNameArray != NULL) {
if ((lCount >= lTypeNameLower) && (lCount <= lTypeNameUpper)) {
pMofVersion->strType = (LPTSTR)malloc((_tcslen(pTypeNameData[lCount]) + 1) * sizeof(TCHAR));
if (pMofVersion->strType != NULL){
wcscpy(pMofVersion->strType, (LPWSTR)(pTypeNameData[lCount]));
}
}
}
}
}
SafeArrayUnaccessData(TypeArray);
SafeArrayDestroy(TypeArray);
VariantInit(&pTypeVal);
if (TypeNameArray != NULL) {
SafeArrayUnaccessData(TypeNameArray);
SafeArrayDestroy(TypeNameArray);
VariantInit(&pTypeNameVal);
}
}
else {
//
// If the Types or TypeName is not found, then bail
//
break;
}
}
else { // EventType is scalar
hRes = VariantChangeType(&pTypeVal, &pTypeVal, 0, VT_I2);
if (ERROR_SUCCESS == hRes)
nEventType = (SHORT)V_I2(&pTypeVal);
else
nEventType = (SHORT)V_I4(&pTypeVal);
VariantClear(&pTypeNameVal);
hRes = pQualSet->Get(bszEventTypeName,
0,
&pTypeNameVal,
0);
if (ERROR_SUCCESS == hRes) {
wcscpy(strType, pTypeNameVal.bstrVal);
}
else{
strType[0] = '\0';
}
pMofVersion = GetNewMofVersion(nEventType, nVersion, nLevel);
if (pMofVersion != NULL) {
InsertTailList(&ListHead, &pMofVersion->Entry);
if (nType == nEventType) {
// Type matched
pMofLookup = pMofVersion;
}
pMofVersion->strType = (LPTSTR)malloc((_tcslen(strType) + 1) * sizeof(TCHAR));
if (pMofVersion->strType != NULL){
_tcscpy(pMofVersion->strType, strType);
}
}
}
// Get event layout
VariantClear(&pVal);
IdIndex = 1;
V_VT(&pVal) = VT_I4;
V_I4(&pVal) = IdIndex;
// For each property
PropArray = NULL;
while (pTraceSubSubClasses->GetNames(bszWmiDataId, // only properties with WmiDataId qualifier
WBEM_FLAG_ONLY_IF_IDENTICAL,
&pVal, // WmiDataId number starting from 1
&PropArray) == WBEM_NO_ERROR) {
hRes = SafeArrayGetLBound(PropArray, 1, &lLower);
if (ERROR_SUCCESS != hRes) {
break;
}
hRes = SafeArrayGetUBound(PropArray, 1, &lUpper);
if (ERROR_SUCCESS != hRes) {
break;
}
if (lUpper < 0)
break;
// This loop will iterate just once.
for (lCount = lLower; lCount <= lUpper; lCount++) {
hRes = SafeArrayGetElement(PropArray, &lCount, &bszPropName);
if (ERROR_SUCCESS != hRes) {
break;
}
hRes = pTraceSubSubClasses->Get(bszPropName, // Property name
0L,
NULL,
&pVarType, // CIMTYPE of the property
NULL);
if (ERROR_SUCCESS != hRes) {
break;
}
// Get the Qualifier set for the property
if (pQualSet) {
pQualSet->Release();
pQualSet = NULL;
}
hRes = pTraceSubSubClasses->GetPropertyQualifierSet(bszPropName,
&pQualSet);
if (ERROR_SUCCESS != hRes) {
break;
}
ItemType = GetItemType((CIMTYPE_ENUMERATION)pVarType, pQualSet);
if( pVarType & CIM_FLAG_ARRAY ){
ArraySize = GetArraySize(pQualSet);
}else{
ArraySize = 1;
}
AddMofInfo(&ListHead,
bszPropName,
ItemType,
ArraySize);
}
SafeArrayDestroy(PropArray);
PropArray = NULL;
V_I4(&pVal) = ++IdIndex;
} // end enumerating through WmiDataId
FlushMofVersionList(pMofInfo, &ListHead);
} // if getting event type was successful
} // if enumeration returned a subclass successfully
} // end enumerating subclasses
} // if enumeration was created successfully
} // if getting class name was successful
cleanup:
VariantClear(&pVal);
VariantClear(&pTypeVal);
VariantClear(&pClassName);
SysFreeString(bszClassName);
SysFreeString(bszWmiDataId);
SysFreeString(bszEventType);
SysFreeString(bszEventTypeName);
SysFreeString(bszFriendlyName);
// Should not free bszPropName becuase it is already freed by SafeArrayDestroy
FlushMofVersionList(pMofInfo, &ListHead);
return pMofLookup;
}
PMOF_VERSION
GetGuidsWBEM ( GUID Guid, SHORT nVersion, CHAR nLevel, SHORT nType, BOOL bKernelEvent )
{
IEnumWbemClassObject *pEnumTraceSubClasses = NULL, *pEnumTraceSubSubClasses = NULL;
IWbemClassObject *pTraceSubClasses = NULL, *pTraceSubSubClasses = NULL;
IWbemQualifierSet *pQualSet = NULL;
BSTR bszInstance = NULL;
BSTR bszPropertyName = NULL;
BSTR bszSubClassName = NULL;
BSTR bszGuid = NULL;
BSTR bszVersion = NULL;
TCHAR strGuid[MAXSTR], strTargetGuid[MAXSTR];
HRESULT hRes;
VARIANT pVal;
VARIANT pGuidVal;
VARIANT pVersionVal;
UINT nCounter=0;
BOOLEAN MatchFound;
SHORT nEventVersion = EVENT_VERSION_DEFAULT;
PMOF_VERSION pMofLookup = NULL;
VariantInit(&pVal);
VariantInit(&pGuidVal);
VariantInit(&pVersionVal);
if (NULL == pWbemServices) {
hRes = WbemConnect( &pWbemServices );
CHECK_HR( hRes );
}
// Convert traget GUID to string for later comparison
CpdiGuidToString(strTargetGuid, &Guid);
bszInstance = SysAllocString(L"EventTrace");
bszPropertyName = SysAllocString(L"__CLASS");
bszGuid = SysAllocString(L"Guid");
bszVersion = SysAllocString(L"EventVersion");
pEnumTraceSubClasses = NULL;
// Get an enumerator for all classes under "EventTace".
hRes = pWbemServices->CreateClassEnum (
bszInstance,
WBEM_FLAG_SHALLOW | WBEM_FLAG_USE_AMENDED_QUALIFIERS,
NULL,
&pEnumTraceSubClasses );
SysFreeString (bszInstance);
if (ERROR_SUCCESS == hRes) {
ULONG uReturned = 1;
MatchFound = FALSE;
while (uReturned == 1) {
pTraceSubClasses = NULL;
// Get the next ClassObject.
hRes = pEnumTraceSubClasses->Next((-1), // timeout in infinite seconds
1, // return just one instance
&pTraceSubClasses, // pointer to Event Trace Sub Class
&uReturned); // number obtained: one or zero
if (ERROR_SUCCESS == hRes && (uReturned == 1)) {
// Get the class name
hRes = pTraceSubClasses->Get(bszPropertyName, // property name
0L,
&pVal, // output to this variant
NULL,
NULL);
if (ERROR_SUCCESS == hRes){
bszSubClassName = SysAllocString(pVal.bstrVal);
// Create an enumerator to find derived classes.
hRes = pWbemServices->CreateClassEnum (
bszSubClassName,
WBEM_FLAG_SHALLOW | WBEM_FLAG_USE_AMENDED_QUALIFIERS,
NULL,
&pEnumTraceSubSubClasses
);
SysFreeString ( bszSubClassName );
VariantClear(&pVal);
if (ERROR_SUCCESS == hRes) {
ULONG uReturnedSub = 1;
MatchFound = FALSE;
while(uReturnedSub == 1){
pTraceSubSubClasses = NULL;
// enumerate through the resultset.
hRes = pEnumTraceSubSubClasses->Next((-1), // timeout in infinite seconds
1, // return just one instance
&pTraceSubSubClasses, // pointer to a Sub class
&uReturnedSub); // number obtained: one or zero
if (ERROR_SUCCESS == hRes && uReturnedSub == 1) {
// Get the subclass name
hRes = pTraceSubSubClasses->Get(bszPropertyName, // Class name
0L,
&pVal, // output to this variant
NULL,
NULL);
VariantClear(&pVal);
if (ERROR_SUCCESS == hRes){
// Get Qualifier Set.
if (pQualSet) {
pQualSet->Release();
pQualSet = NULL;
}
pTraceSubSubClasses->GetQualifierSet (&pQualSet );
// Get GUID among Qualifiers
hRes = pQualSet->Get(bszGuid,
0,
&pGuidVal,
0);
if (ERROR_SUCCESS == hRes) {
_tcscpy(strGuid, (LPTSTR)V_BSTR(&pGuidVal));
VariantClear ( &pGuidVal );
if (!_tcsstr(strGuid, _T("{")))
_stprintf(strGuid , _T("{%s}"), strGuid);
if (!_tcsicmp(strTargetGuid, strGuid)) {
hRes = pQualSet->Get(bszVersion,
0,
&pVersionVal,
0);
if (ERROR_SUCCESS == hRes) {
hRes = VariantChangeType(&pVersionVal, &pVersionVal, 0, VT_I2);
if (ERROR_SUCCESS == hRes)
nEventVersion = (SHORT)V_I2(&pVersionVal);
else
nEventVersion = (SHORT)V_I4(&pVersionVal);
VariantClear(&pVersionVal);
if (nVersion == nEventVersion) {
//_tprintf(_T("Match Found: \t%s\t, version %d\n"), strGuid, nVersion);
// Match is found.
// Now put all events in this subtree into the list
MatchFound = TRUE;
pMofLookup = GetPropertiesFromWBEM( pTraceSubSubClasses,
Guid,
nVersion,
nLevel,
nType,
bKernelEvent
);
break;
}
}
else {
// if there is no version number for this event
MatchFound = TRUE;
//_tprintf(_T("Close Match Found: \t%s\t, version %d\n"), strGuid, nEventVersion);
pMofLookup = GetPropertiesFromWBEM( pTraceSubSubClasses,
Guid,
EVENT_VERSION_DEFAULT,
nLevel,
nType,
bKernelEvent
);
break;
}
}
}
}
}
} // end while enumerating sub classes
if (MatchFound) {
break;
}
if (pEnumTraceSubSubClasses) {
pEnumTraceSubSubClasses->Release();
pEnumTraceSubSubClasses = NULL;
}
} // if creating enumeration was successful
} // if getting class name was successful
}
nCounter++;
// if match is found, break out of the top level search
if (MatchFound)
break;
} // end while enumerating top classes
if( pEnumTraceSubClasses ){
pEnumTraceSubClasses->Release();
pEnumTraceSubClasses = NULL;
}
} // if creating enumeration for top level is successful
cleanup:
VariantClear(&pGuidVal);
VariantClear(&pVersionVal);
SysFreeString(bszGuid);
SysFreeString(bszPropertyName);
SysFreeString(bszVersion);
if (pEnumTraceSubClasses){
pEnumTraceSubClasses->Release();
pEnumTraceSubClasses = NULL;
}
if (pEnumTraceSubSubClasses){
pEnumTraceSubSubClasses->Release();
pEnumTraceSubSubClasses = NULL;
}
if (pQualSet) {
pQualSet->Release();
pQualSet = NULL;
}
return pMofLookup;
}
PMOF_VERSION
GetGuidsFile( GUID Guid, SHORT nVersion, CHAR nLevel, SHORT nType, BOOL bKernelEvent )
{
FILE *f = NULL;
WCHAR line[MAXSTR];
WCHAR buffer[MAXSTR];
PMOF_INFO pMofInfo = NULL;
PMOF_VERSION pMofLookup = NULL;
PMOF_VERSION pMofVersion = NULL;
UINT i;
LPWSTR s;
UINT typeCount = 0;
BOOL bInInfo = FALSE;
BOOL bInGuid = FALSE;
SHORT nTypeIndex;
CHAR nLevelIndex = -1;
SHORT nVersionIndex = -1;
SHORT nMatchLevel = 0;
GUID guid;
LIST_ENTRY ListHead;
InitializeListHead( &ListHead );
//
// If MofFileName is given, use it. Otherwise, look for
// the default file mofdata.guid
//
if (TraceContext->MofFileName != NULL) {
f = _wfopen( TraceContext->MofFileName, L"r" );
if( !f ){
return NULL;
}
}else{
return NULL;
}
while ( fgetws(line, MAXSTR, f) != NULL ) {
UINT Index;
if(line[0] == '/'){
continue;
}
if(line[0] == '{' && bInGuid ){
bInInfo = TRUE;
}
else if ( line[0] == '}' && bInGuid ){
bInInfo = FALSE;
FlushMofVersionList( pMofInfo, &ListHead );
}
else if( bInInfo && bInGuid ){
ITEM_TYPE type;
LPWSTR strValue;
Index = 1;
strValue = wcstok(line, L"\n\t\r,");
s = wcstok( NULL, L" \n\t\r,[");
if(s != NULL && strValue != NULL ){
PWCHAR t;
while (*strValue == ' ') { // skip leading blanks
strValue++;
}
t = wcstok(NULL, L"]" );
if (t != NULL) {
Index = _wtoi(t);
}
if(! _wcsicmp(s,STR_ItemChar)) type = ItemChar;
else if(! _wcsicmp(s,STR_ItemCharHidden)) type = ItemCharHidden;
else if(! _wcsicmp(s,STR_ItemUChar)) type = ItemUChar;
else if(! _wcsicmp(s,STR_ItemCharShort))type = ItemCharShort;
else if(! _wcsicmp(s,STR_ItemCharSign)) type = ItemCharSign;
else if(! _wcsicmp(s,STR_ItemShort)) type = ItemShort;
else if(! _wcsicmp(s,STR_ItemUShort)) type = ItemUShort;
else if(! _wcsicmp(s,STR_ItemLong)) type = ItemLong;
else if(! _wcsicmp(s,STR_ItemULong)) type = ItemULong;
else if(! _wcsicmp(s,STR_ItemULongX)) type = ItemULongX;
else if(! _wcsicmp(s,STR_ItemLongLong)) type = ItemLongLong;
else if(! _wcsicmp(s,STR_ItemULongLong)) type = ItemULongLong;
else if(! _wcsicmp(s,STR_ItemString)) type = ItemString;
else if(! _wcsicmp(s,STR_ItemWString)) type = ItemWString;
else if(! _wcsicmp(s,STR_ItemRString)) type = ItemRString;
else if(! _wcsicmp(s,STR_ItemRWString)) type = ItemRWString;
else if(! _wcsicmp(s,STR_ItemPString)) type = ItemPString;
else if(! _wcsicmp(s,STR_ItemMLString)) type = ItemMLString;
else if(! _wcsicmp(s,STR_ItemNWString)) type = ItemNWString;
else if(! _wcsicmp(s,STR_ItemPWString)) type = ItemPWString;
else if(! _wcsicmp(s,STR_ItemDSString)) type = ItemDSString;
else if(! _wcsicmp(s,STR_ItemDSWString)) type = ItemDSWString;
else if(! _wcsicmp(s,STR_ItemSid)) type = ItemSid;
else if(! _wcsicmp(s,STR_ItemChar4)) type = ItemChar4;
else if(! _wcsicmp(s,STR_ItemIPAddr)) type = ItemIPAddr;
else if(! _wcsicmp(s,STR_ItemPort)) type = ItemPort;
else if(! _wcsicmp(s,STR_ItemPtr)) type = ItemPtr;
else if(! _wcsicmp(s,STR_ItemGuid)) type = ItemGuid;
else if(! _wcsicmp(s,STR_ItemOptArgs)) type = ItemOptArgs;
else if(! _wcsicmp(s,STR_ItemCPUTime)) type = ItemCPUTime;
else if(! _wcsicmp(s,STR_ItemVariant)) type = ItemVariant;
else if(! _wcsicmp(s,STR_ItemBool)) type = ItemBool;
else type = ItemUnknown;
AddMofInfo( &ListHead, strValue, (SHORT)type, Index );
}
}
else if( line[0] == '#' && bInGuid ){
LPWSTR strType;
LPWSTR strValue;
s = wcstok( line, L" \t");
if( NULL == s ){
continue;
}
if( line[1] == 'l' || line[1] == 'L' ){ // level
strValue = wcstok( NULL, L" \t\n\r" );
if( strValue != NULL ){
nLevelIndex = (CHAR)_wtoi( strValue );
}
}else if( line[1] == 'v' || line[1] == 'V' ){ // version
strValue = wcstok( NULL, L" \t\n\r" );
if( strValue != NULL ){
nVersionIndex = (SHORT)_wtoi( strValue );
}
typeCount = 0;
}else if( line[1] == 't' || line[1] == 'T' ){ // type
SHORT nMatchCheck = 0;
strType = wcstok( NULL, L" \t\n\r" );
strValue = wcstok( NULL, L"\"\n,\r" );
if( strType && strValue ){
nTypeIndex = (SHORT)_wtoi( strValue );
}else{
continue;
}
typeCount++;
if(typeCount >= MAXTYPE){
//fwprintf(stderr, L"Warning: Too many types defined\n");
}
pMofVersion = GetNewMofVersion( nTypeIndex, nVersionIndex, nLevelIndex );
if( NULL != pMofVersion ){
InsertTailList( (&ListHead), &pMofVersion->Entry);
pMofVersion->strType = (LPWSTR)malloc( ( lstrlenW(strType)+1) * sizeof(WCHAR) );
if( NULL != pMofVersion->strType ){
wcscpy( pMofVersion->strType, strType );
}
if( nTypeIndex == nType ){
nMatchCheck = 1;
if( nLevelIndex == nLevel ){
nMatchCheck++;
}
if( nVersionIndex == nVersion ){
nMatchCheck++;
}
}
if( nMatchCheck > nMatchLevel ){
nMatchLevel = nMatchCheck;
pMofLookup = pMofVersion;
}
}
}
}
else if ( (line[0] >= '0' && line[0] <= '9')
|| (line[0] >= 'a' && line[0] <= 'f')
|| (line[0] >= 'A' && line[0] <= 'F')) {
LPWSTR strName = NULL;
bInGuid = FALSE;
typeCount = 0;
wcsncpy(buffer, line, 8);
buffer[8] = 0;
guid.Data1 = ahextoi(&buffer[0]);
wcsncpy(buffer, &line[9], 4);
buffer[4] = 0;
guid.Data2 = (USHORT) ahextoi(&buffer[0]);
wcsncpy(buffer, &line[14], 4);
buffer[4] = 0;
guid.Data3 = (USHORT) ahextoi(buffer);
for (i=0; i<2; i++) {
wcsncpy(buffer, &line[19 + (i*2)], 2);
buffer[2] = 0;
guid.Data4[i] = (UCHAR) ahextoi(buffer);
}
for (i=2; i<8; i++) {
wcsncpy(buffer, &line[20 + (i*2)], 2);
buffer[2] = 0;
guid.Data4[i] = (UCHAR) ahextoi(buffer);
}
if( ! IsEqualGUID( &Guid, &guid ) ){
continue;
}
s = &line[36];
strName = wcstok( s, L" \n\t\r" );
if( NULL == strName ){ // Must have a name for the Guid.
continue;
}
bInGuid = TRUE;
FlushMofVersionList(pMofInfo, &ListHead );
pMofInfo = GetMofInfoHead( &Guid);
if (pMofInfo == NULL) {
return NULL;
}
pMofInfo->bKernelEvent = bKernelEvent;
pMofInfo->strDescription = (LPWSTR)malloc(( lstrlenW(strName)+1) * sizeof(WCHAR));
if( NULL != pMofInfo->strDescription ){
wcscpy(pMofInfo->strDescription, strName);
}
pMofVersion = GetNewMofVersion(
EVENT_TYPE_DEFAULT,
EVENT_VERSION_DEFAULT,
EVENT_LEVEL_DEFAULT
);
if (pMofVersion == NULL) {
return NULL;
}
pMofLookup = pMofVersion;
InsertTailList( (&ListHead), &pMofVersion->Entry);
}
}
FlushMofVersionList(pMofInfo, &ListHead );
fclose(f);
return pMofLookup;
}
VOID
UpdateThreadData(
PJOB_RECORD pJob,
PEVENT_TRACE_HEADER pHeader,
PTHREAD_RECORD pThread
)
{
unsigned long i = 0;
BOOLEAN bFound = FALSE;
if ( (pJob == NULL) || (pHeader == NULL) || (pThread == NULL) ) {
return;
}
for (i = 0; i < pJob->NumberOfThreads; i++) {
if (pJob->ThreadData[i].ThreadId == pHeader->ThreadId) {
bFound = TRUE;
break;
}
}
if ((i < MAX_THREADS) && !bFound) {
pJob->ThreadData[i].ThreadId = pHeader->ThreadId;
pJob->NumberOfThreads++;
bFound = TRUE;
}
if (bFound) {
//
// TODO: There is potential for double counting if the same thread
// came back and did more work for this job after having done work for an other
// job in between.
//
if (pJob->ThreadData[i].PrevKCPUTime > 0)
pJob->ThreadData[i].KCPUTime += pHeader->KernelTime * CurrentSystem.TimerResolution - pJob->ThreadData[i].PrevKCPUTime;
if (pJob->ThreadData[i].PrevUCPUTime > 0)
pJob->ThreadData[i].UCPUTime += pHeader->UserTime * CurrentSystem.TimerResolution - pJob->ThreadData[i].PrevUCPUTime;
if (pJob->ThreadData[i].PrevReadIO > 0)
pJob->ThreadData[i].ReadIO += pThread->ReadIO - pJob->ThreadData[i].PrevReadIO;
if (pJob->ThreadData[i].PrevWriteIO > 0)
pJob->ThreadData[i].WriteIO += pThread->WriteIO - pJob->ThreadData[i].PrevWriteIO;
pJob->ThreadData[i].PrevKCPUTime = pHeader->KernelTime * CurrentSystem.TimerResolution;
pJob->ThreadData[i].PrevUCPUTime = pHeader->UserTime * CurrentSystem.TimerResolution;
pJob->ThreadData[i].PrevReadIO = pThread->ReadIO;
pJob->ThreadData[i].PrevWriteIO = pThread->WriteIO;
}
}
VOID
PrintJobCallback(
PEVENT_TRACE pEvent
)
{
PTHREAD_RECORD pThread;
PEVENT_TRACE_HEADER pHeader;
PMOF_INFO pMofInfo;
ULONG JobId = 0;
PJOB_RECORD pJob;
if (pEvent == NULL)
return;
pHeader = (PEVENT_TRACE_HEADER)&pEvent->Header;
//
// Ignore Process/Thread Start/End transactions. Only go after
// User Defined Transactions.
//
pMofInfo = GetMofInfoHead( &pEvent->Header.Guid );
if (pMofInfo == NULL){
return;
}
if (!IsEqualGUID(&pEvent->Header.Guid, &ThreadGuid))
GetMofData(pEvent, L"JobId", &JobId, sizeof(ULONG));
pThread = FindGlobalThreadById(pHeader->ThreadId, pEvent);
if (JobId == 0) {
if (pThread == NULL) return;
JobId = pThread->JobId; // if Current Job Id is 0, use the cached one.
}
else {
if (pThread != NULL) {
if (JobId != pThread->JobId) {
pJob = FindJobRecord(pThread->JobId);
UpdateThreadData(pJob, pHeader, pThread);
}
pThread->JobId = JobId;
}
}
if (JobId == 0) return; // To filter all th termination without print jobs.
pJob = FindJobRecord(JobId);
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_SPOOLJOB) {
if (pJob) {
// A job id is being reused before it was deleted from the last
// use. We must have missed a delete event, so just through the old
// job away.
EnterTracelibCritSection();
RemoveEntryList( &pJob->Entry );
LeaveTracelibCritSection();
free (pJob);
}
pJob = AddJobRecord(JobId);
if (pJob != NULL) {
pJob->StartTime = pEvent->Header.TimeStamp.QuadPart;
}
}
if (pJob == NULL) // if a Start event is lost for this job, this could happen.
return;
UpdateThreadData(pJob, pHeader, pThread);
// If you see any of these things then stop tracking resources on the
// thread.
if ((pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_ENDTRACKTHREAD) ||
(pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_DELETEJOB) ||
(pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_PAUSE) ||
(pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_RESUME)) {
if (pThread != NULL)
pThread->JobId = 0;
}
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_PAUSE) {
pJob->PauseStartTime = pEvent->Header.TimeStamp.QuadPart;
}
else if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_RESUME) {
pJob->PauseTime += (pEvent->Header.TimeStamp.QuadPart - pJob->PauseStartTime) / 10000;
pJob->PauseStartTime = 0;
}
else if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_PRINTJOB) {
pJob->PrintJobTime = pEvent->Header.TimeStamp.QuadPart;
}
else if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_DELETEJOB) {
unsigned long i;
pJob->EndTime = pEvent->Header.TimeStamp.QuadPart;
pJob->ResponseTime += (pEvent->Header.TimeStamp.QuadPart - pJob->StartTime) / 10000; // in msec
GetMofData(pEvent, L"JobSize", &pJob->JobSize, sizeof(ULONG));
GetMofData(pEvent, L"DataType", &pJob->DataType, sizeof(ULONG));
GetMofData(pEvent, L"Pages", &pJob->Pages, sizeof(ULONG));
GetMofData(pEvent, L"PagesPerSide", &pJob->PagesPerSide, sizeof(ULONG));
GetMofData(pEvent, L"FilesOpened", &pJob->FilesOpened, sizeof(SHORT));
pJob->KCPUTime = 0;
pJob->UCPUTime = 0;
pJob->ReadIO = 0;
pJob->WriteIO = 0;
for (i=0; i < pJob->NumberOfThreads; i++) {
pJob->KCPUTime += pJob->ThreadData[i].KCPUTime;
pJob->UCPUTime += pJob->ThreadData[i].UCPUTime;
pJob->ReadIO += pJob->ThreadData[i].ReadIO;
pJob->WriteIO += pJob->ThreadData[i].WriteIO;
}
DeleteJobRecord(pJob, (TraceContext->Flags & TRACE_SPOOLER));
}
else if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_SPL_JOBRENDERED) {
GetMofData(pEvent, L"GdiJobSize", &pJob->GdiJobSize, sizeof(ULONG));
GetMofData(pEvent, L"ICMMethod", &pJob->ICMMethod, sizeof(ULONG));
GetMofData(pEvent, L"Color", &pJob->Color, sizeof(SHORT));
GetMofData(pEvent, L"XRes", &pJob->XRes, sizeof(SHORT));
GetMofData(pEvent, L"YRes", &pJob->YRes, sizeof(SHORT));
GetMofData(pEvent, L"Quality", &pJob->Quality, sizeof(SHORT));
GetMofData(pEvent, L"Copies", &pJob->Copies, sizeof(SHORT));
GetMofData(pEvent, L"TTOption", &pJob->TTOption, sizeof(SHORT));
}
}
VOID
GeneralEventCallback(
PEVENT_TRACE pEvent
)
{
PTHREAD_RECORD pThread;
if ((pEvent == NULL) || (TraceContext == NULL))
return;
// If the ThreadId is -1 or the FieldTypeFlags in the event
// shows there is no CPU Time, ignore the event. This can happen
// when PERFINFO headers are found in kernel data.
//
if ( (pEvent->Header.ThreadId == -1) ||
(pEvent->Header.FieldTypeFlags & EVENT_TRACE_USE_NOCPUTIME) ) {
if (TraceContext->Flags & (TRACE_DUMP|TRACE_SUMMARY)) {
DumpEvent(pEvent);
}
return;
}
//
// Notes: This code is here to fix up the Event Record for the
// Idle Threads. Since Idle threads are not guaranteed to have
// Cid initialized, we could end up with bogus thread Ids.
//
// Assumption: In DC_START records, the first process record must
// be the idle process followed by idle threads.
//
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_START) {
if (bCaptureBogusThreads) {
//
// Here we will convert the next N threads into idle threads
// N = Number of Processors.
if (IsEqualGUID(&pEvent->Header.Guid, &ThreadGuid)) {
if (pEvent->Header.ThreadId != 0) {
PULONG Ptr;
BogusThreads[BogusCount++] = pEvent->Header.ThreadId;
pEvent->Header.ThreadId = 0;
//
// Assumption: The first two ULONGs are the
// ThreadId and ProcessId in this record. If that changes
// this will corrupt memory!
//
Ptr = (PULONG)pEvent->MofData;
*Ptr = 0;
Ptr++;
*Ptr = 0;
}
}
//
// Once all the idle threads are seen, no need to capture anymore
//
if (IdleThreadCount++ == NumProc) bCaptureBogusThreads = FALSE;
}
} else {
//
// This is the TimeConsuming Part. We need to do this only if
// we found bogus threads earlier.
//
if (BogusCount > 0) {
ULONG i;
for (i=0; i < BogusCount; i++) {
if (pEvent->Header.ThreadId == BogusThreads[i]) {
pEvent->Header.ThreadId = 0;
//
// If DC_END records also fix up the Mof for Thread End
//
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_DC_END) {
PULONG Ptr;
Ptr = (PULONG)pEvent->MofData;
*Ptr = 0;
Ptr++;
*Ptr = 0;
}
}
}
}
}
//
// After the above code we should not see any threadId's over 64K
//
/*
#if DBG
if (pEvent->Header.ThreadId > 65536)
DbgPrint("%d: Bad ThreadId %x Found\n", EventCount+1,
pEvent->Header.ThreadId);
#endif
*/
//
// Dump the event in csv file, if required.
//
if (TraceContext->Flags & (TRACE_DUMP|TRACE_SUMMARY)) {
DumpEvent(pEvent);
}
else {
PMOF_INFO pMofInfo;
PMOF_VERSION pMofVersion = NULL;
pMofInfo = GetMofInfoHead( &pEvent->Header.Guid );
if (pMofInfo == NULL){
return;
}
pMofInfo->EventCount++;
pMofVersion = GetMofVersion(pMofInfo,
pEvent->Header.Class.Type,
pEvent->Header.Class.Version,
pEvent->Header.Class.Level
);
}
if ( (TraceContext->Flags & TRACE_REDUCE) == 0 ) {
return;
}
//
// TODO: This may prevent DiskIO write events and TCP receive events to
// get ignored
//
if (pEvent->Header.ThreadId == 0) {
if ( (pEvent->Header.Class.Type != EVENT_TRACE_TYPE_START)
&& (pEvent->Header.Class.Type != EVENT_TRACE_TYPE_DC_START)
&& (pEvent->Header.Class.Type != EVENT_TRACE_TYPE_END)
&& (pEvent->Header.Class.Type != EVENT_TRACE_TYPE_DC_END)
)
{
EventCount++;
return;
}
}
pThread = FindGlobalThreadById(pEvent->Header.ThreadId, pEvent);
if ( CurrentSystem.fNoEndTime
&& CurrentSystem.EndTime < (ULONGLONG) pEvent->Header.TimeStamp.QuadPart)
{
CurrentSystem.EndTime = pEvent->Header.TimeStamp.QuadPart;
if (fDSOnly && CurrentSystem.EndTime > DSEndTime)
CurrentSystem.EndTime = DSEndTime;
}
EventCount ++;
if (IsEqualGUID(&pEvent->Header.Guid, &EventTraceGuid))
{
AdjustThreadTime(pEvent, pThread);
LogHeaderCallback(pEvent);
}
else if (IsEqualGUID(&pEvent->Header.Guid, &ProcessGuid))
{
AdjustThreadTime(pEvent, pThread);
ProcessCallback(pEvent);
}
else if (IsEqualGUID(&pEvent->Header.Guid, &ThreadGuid))
{
if (pEvent->Header.Class.Type == EVENT_TRACE_TYPE_START)
{
AdjustThreadTime(pEvent, pThread);
}
ThreadCallback(pEvent);
}
else if (pEvent->Header.ThreadId != 0)
{
AdjustThreadTime(pEvent, pThread);
if (IsEqualGUID(&pEvent->Header.Guid, &DiskIoGuid))
{
DiskIoCallback(pEvent, pThread);
}
else if (IsEqualGUID(&pEvent->Header.Guid, &FileIoGuid))
{
HotFileCallback(pEvent);
}
else if (IsEqualGUID(&pEvent->Header.Guid, &ImageLoadGuid))
{
ModuleLoadCallback(pEvent);
}
else if (IsEqualGUID(&pEvent->Header.Guid, &TcpIpGuid))
{
TcpIpCallback(pEvent, pThread);
}
else if (IsEqualGUID(&pEvent->Header.Guid, &UdpIpGuid))
{
TcpIpCallback(pEvent, pThread);
}
else if (IsEqualGUID(&pEvent->Header.Guid, &PageFaultGuid))
{
PageFaultCallback(pEvent, pThread);
}
else if (IsEqualGUID(&pEvent->Header.Guid, &EventTraceConfigGuid)) {
// Ignore for now.
// We need to pick this up for a Hardwareconfig report.
//
}
else
{
//
// This is a hack specific to Print Servers.
// Need to come up with a general solution. MKR.
//
if (IsEqualGUID(&pEvent->Header.Guid, &PrintJobGuid) ||
IsEqualGUID(&pEvent->Header.Guid, &RenderedJobGuid)) {
PrintJobCallback(pEvent);
}
EventCallback(pEvent, pThread);
}
}
}
ULONG ahextoi( WCHAR *s)
{
int len;
ULONG num, base, hex;
len = lstrlenW(s);
hex = 0; base = 1; num = 0;
while (--len >= 0) {
if ( (s[len] == 'x' || s[len] == 'X') &&
(s[len-1] == '0') )
break;
if (s[len] >= '0' && s[len] <= '9')
num = s[len] - '0';
else if (s[len] >= 'a' && s[len] <= 'f')
num = (s[len] - 'a') + 10;
else if (s[len] >= 'A' && s[len] <= 'F')
num = (s[len] - 'A') + 10;
else
continue;
hex += num * base;
base = base * 16;
}
return hex;
}
void AnsiToUnicode(PCHAR str, PWCHAR wstr)
{
int len, i;
PUCHAR AnsiChar;
if (str == NULL || wstr == NULL)
return;
len = strlen(str);
for (i=0; i<len; i++)
{
AnsiChar = (PUCHAR) &str[i];
wstr[i] = (WCHAR) RtlAnsiCharToUnicodeChar(&AnsiChar);
}
wstr[len] = 0;
}
void
WINAPI
DumpEvent(
PEVENT_TRACE pEvent
)
{
PEVENT_TRACE_HEADER pHeader;
ULONG i;
PITEM_DESC pItem;
char str[MOFSTR];
WCHAR wstr[MOFWSTR];
PCHAR ptr;
ULONG ulongword;
LONG longword;
USHORT ushortword;
SHORT shortword;
PMOF_INFO pMofInfo;
PMOF_VERSION pMofVersion;
PLIST_ENTRY Head, Next;
char iChar;
WCHAR iwChar;
ULONG MofDataUsed;
FILE* DumpFile = NULL;
TotalEventCount++;
if (pEvent == NULL) {
return;
}
pHeader = (PEVENT_TRACE_HEADER) &pEvent->Header;
if( IsEqualGUID(&pEvent->Header.Guid, &EventTraceGuid) &&
pEvent->Header.Class.Type == EVENT_TRACE_TYPE_INFO ) {
PTRACE_LOGFILE_HEADER head = (PTRACE_LOGFILE_HEADER)pEvent->MofData;
if( NULL != head ){
g_bUserMode = (head->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE);
if(head->TimerResolution > 0){
TimerResolution = head->TimerResolution / 10000;
}
StartTime = head->StartTime.QuadPart;
EndTime = head->EndTime.QuadPart;
fNoEndTime = (EndTime == 0);
PointerSize = head->PointerSize;
if (PointerSize < 16){ // minimum is 16 bits
PointerSize = 32; // defaults = 32 bits
}
}
}
if (fNoEndTime && EndTime < (ULONGLONG) pHeader->TimeStamp.QuadPart) {
EndTime = pHeader->TimeStamp.QuadPart;
}
if (MofData == NULL) {
MofLength = pEvent->MofLength + sizeof(UNICODE_NULL);
MofData = (LPSTR)malloc(MofLength);
}
else if ((pEvent->MofLength + sizeof(UNICODE_NULL)) > MofLength) {
MofLength = pEvent->MofLength + sizeof(UNICODE_NULL);
MofData = (LPSTR)realloc(MofData, MofLength);
}
if (MofData == NULL) {
return;
}
if ((pEvent->MofData == NULL) && (0 != pEvent->MofLength)) {
return;
}
if (pEvent->MofData != NULL) {
memcpy(MofData, pEvent->MofData, pEvent->MofLength);
}
MofData[pEvent->MofLength] = 0;
MofData[pEvent->MofLength+1] = 0;
ptr = MofData;
MofDataUsed = 0;
pMofInfo = GetMofInfoHead( &pEvent->Header.Guid );
if (pMofInfo == NULL) {
return;
}
pMofInfo->EventCount++;
pMofVersion = GetMofVersion(pMofInfo,
pEvent->Header.Class.Type,
pEvent->Header.Class.Version,
pEvent->Header.Class.Level
);
if( NULL == pMofVersion ){
return;
}
pMofVersion->EventCountByType++;
if( !(TraceContext->Flags & TRACE_DUMP) ){
return;
}
DumpFile = TraceContext->hDumpFile;
if( pMofInfo->strDescription != NULL ){
fwprintf( DumpFile, L"%12s, ", pMofInfo->strDescription );
}else{
fwprintf( DumpFile, L"%12s, ", CpdiGuidToString( wstr, &pMofInfo->Guid ) );
}
if(pMofVersion->strType != NULL && wcslen(pMofVersion->strType) ){
fwprintf( DumpFile, L"%10s, ", pMofVersion->strType );
}else{
fwprintf( DumpFile, L"%10d, ", pEvent->Header.Class.Type );
}
if( TraceContext->Flags & TRACE_EXTENDED_FMT ){
fwprintf( DumpFile, L"%8d,%8d,%8d, ",
pEvent->Header.Class.Type,
pEvent->Header.Class.Level,
pEvent->Header.Class.Version
);
}
// Thread ID
fwprintf( DumpFile, L"0x%04X, ", pHeader->ThreadId );
// System Time
fwprintf( DumpFile, L"%20I64u, ", pHeader->TimeStamp.QuadPart);
if( g_bUserMode == FALSE ){
// Kernel Time
fwprintf(DumpFile, L"%10lu, ", pHeader->KernelTime * TimerResolution);
// User Time
fwprintf(DumpFile, L"%10lu, ", pHeader->UserTime * TimerResolution);
}else{
// processor Time
fwprintf(DumpFile, L"%I64u, ", pHeader->ProcessorTime);
}
Head = &pMofVersion->ItemHeader;
Next = Head->Flink;
if ((Head == Next) && (pEvent->MofLength > 0)) {
fwprintf(DumpFile, L"DataSize=%d, ", pEvent->MofLength);
}
while (Head != Next) {
pItem = CONTAINING_RECORD(Next, ITEM_DESC, Entry);
Next = Next->Flink;
MofDataUsed = (ULONG) (ptr - MofData);
if (MofDataUsed >= pEvent->MofLength){
break;
}
switch (pItem->ItemType)
{
case ItemChar:
case ItemUChar:
for (i=0;i<pItem->ArraySize;i++){
iChar = *((PCHAR) ptr);
fwprintf(DumpFile, L"%c", iChar);
ptr += sizeof(CHAR);
}
fwprintf(DumpFile, L", " );
break;
case ItemCharHidden:
ptr += sizeof(CHAR) * pItem->ArraySize;
break;
case ItemWChar:
for(i=0;i<pItem->ArraySize;i++){
iwChar = *((PWCHAR) ptr);
fwprintf(DumpFile, L"%wc", iwChar);
ptr += sizeof(WCHAR);
}
fwprintf(DumpFile, L", ");
break;
case ItemCharSign:
{
char sign[5];
memcpy(&sign, ptr, sizeof(CHAR) * 2);
sign[2] = '\0';
strcpy(str, sign);
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MOFWSTR);
fwprintf(DumpFile, L"\"%ws\", ", wstr);
ptr += sizeof(CHAR) * 2;
break;
}
case ItemCharShort:
iChar = *((PCHAR) ptr);
fwprintf(DumpFile, L"%d, ", iChar);
ptr += sizeof(CHAR);
break;
case ItemShort:
shortword = * ((PSHORT) ptr);
fwprintf(DumpFile, L"%6d, ", shortword);
ptr += sizeof (SHORT);
break;
case ItemUShort:
ushortword = *((PUSHORT) ptr);
fwprintf(DumpFile, L"%6u, ", ushortword);
ptr += sizeof (USHORT);
break;
case ItemLong:
longword = *((PLONG) ptr);
fwprintf(DumpFile, L"%8d, ", longword);
ptr += sizeof (LONG);
break;
case ItemULong:
ulongword = *((PULONG) ptr);
fwprintf(DumpFile, L"%8lu, ", ulongword);
ptr += sizeof (ULONG);
break;
case ItemULongX:
ulongword = *((PULONG) ptr);
fwprintf(DumpFile, L"0x%08X, ", ulongword);
ptr += sizeof (ULONG);
break;
case ItemPtr :
{
unsigned __int64 pointer;
if (PointerSize == 64) {
pointer = *((unsigned __int64 *) ptr);
fwprintf(DumpFile, L"0x%X, ", pointer);
}
else { // assumes 32 bit otherwise
ulongword = *((PULONG) ptr);
fwprintf(DumpFile, L"0x%08X, ", ulongword);
}
ptr += PointerSize / 8;
//
// If target source is Win64, then use Ptr, else use ulongword
//
break;
}
case ItemIPAddr:
{
ulongword = *((PULONG) ptr);
// Convert it to readable form
//
fwprintf(DumpFile, L"%03d.%03d.%03d.%03d, ",
(ulongword >> 0) & 0xff,
(ulongword >> 8) & 0xff,
(ulongword >> 16) & 0xff,
(ulongword >> 24) & 0xff);
ptr += sizeof (ULONG);
break;
}
case ItemPort:
{
fwprintf(DumpFile, L"%u, ", NTOHS((USHORT) *ptr));
ptr += sizeof (USHORT);
break;
}
case ItemLongLong:
{
LONGLONG n64;
n64 = *((LONGLONG*) ptr);
ptr += sizeof(LONGLONG);
fwprintf(DumpFile, L"%16I64d, ", n64);
break;
}
case ItemULongLong:
{
ULONGLONG n64;
n64 = *((ULONGLONG*) ptr);
ptr += sizeof(ULONGLONG);
fwprintf(DumpFile, L"%16I64u, ", n64);
break;
}
case ItemString:
case ItemRString:
{
USHORT pLen = (USHORT)strlen((CHAR*) ptr);
if (pLen > 0)
{
strcpy(str, ptr);
if (pItem->ItemType == ItemRString)
{
reduceA(str);
}
for (i=pLen-1; i>0; i--) {
if (str[i] == 0xFF)
str[i] = 0;
else break;
}
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MOFWSTR);
fwprintf(DumpFile, L"\"%ws\", ", wstr);
}
ptr += (pLen + 1);
break;
}
case ItemRWString:
case ItemWString:
{
size_t pLen = 0;
size_t i;
if (*(WCHAR *) ptr)
{
if (pItem->ItemType == ItemRWString)
{
reduceW((WCHAR *) ptr);
}
pLen = ((lstrlenW((WCHAR*)ptr) + 1) * sizeof(WCHAR));
memcpy(wstr, ptr, pLen);
for (i = (pLen/2)-1; i > 0; i--)
{
if (((USHORT) wstr[i] == (USHORT) 0xFFFF))
{
wstr[i] = (USHORT) 0;
}
else break;
}
wstr[pLen / 2] = wstr[(pLen / 2) + 1]= '\0';
fwprintf(DumpFile, L"\"%ws\", ", wstr);
}
ptr += pLen;
break;
}
case ItemDSString: // Counted String
{
USHORT pLen = (USHORT)(256 * ((USHORT) * ptr) + ((USHORT) * (ptr + 1)));
ptr += sizeof(USHORT);
if (pLen > (pEvent->MofLength - MofDataUsed - 1)) {
pLen = (USHORT) (pEvent->MofLength - MofDataUsed - 1);
}
if (pLen > 0)
{
strcpy(str, ptr);
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MOFWSTR);
fwprintf(DumpFile, L"\"%ws\", ", wstr);
}
ptr += (pLen + 1);
break;
}
case ItemPString: // Counted String
{
USHORT pLen = * ((USHORT *) ptr);
ptr += sizeof(USHORT);
if (pLen > (pEvent->MofLength - MofDataUsed)) {
pLen = (USHORT) (pEvent->MofLength - MofDataUsed);
}
if (pLen > MOFSTR * sizeof(CHAR)) {
pLen = MOFSTR * sizeof(CHAR);
}
if (pLen > 0) {
memcpy(str, ptr, pLen);
str[pLen] = '\0';
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MOFWSTR);
fwprintf(DumpFile, L"\"%ws\", ", wstr);
}
ptr += pLen;
break;
}
case ItemDSWString: // DS Counted Wide Strings
case ItemPWString: // Counted Wide Strings
{
USHORT pLen = (USHORT)(( pItem->ItemType == ItemDSWString)
? (256 * ((USHORT) * ptr) + ((USHORT) * (ptr + 1)))
: (* ((USHORT *) ptr)));
ptr += sizeof(USHORT);
if (pLen > (pEvent->MofLength - MofDataUsed)) {
pLen = (USHORT) (pEvent->MofLength - MofDataUsed);
}
if (pLen > MOFWSTR * sizeof(WCHAR)) {
pLen = MOFWSTR * sizeof(WCHAR);
}
if (pLen > 0) {
memcpy(wstr, ptr, pLen);
wstr[pLen / sizeof(WCHAR)] = L'\0';
fwprintf(DumpFile, L"\"%ws\", ", wstr);
}
ptr += pLen;
break;
}
case ItemNWString: // Non Null Terminated String
{
USHORT Size;
Size = (USHORT)(pEvent->MofLength - (ULONG)(ptr - MofData));
if( Size > MOFSTR )
{
Size = MOFSTR;
}
if (Size > 0)
{
memcpy(wstr, ptr, Size);
wstr[Size / 2] = '\0';
fwprintf(DumpFile, L"\"%ws\", ", wstr);
}
ptr += Size;
break;
}
case ItemMLString: // Multi Line String
{
USHORT pLen;
char * src, * dest;
BOOL inQ = FALSE;
BOOL skip = FALSE;
UINT lineCount = 0;
ptr += sizeof(UCHAR) * 2;
pLen = (USHORT)strlen(ptr);
if (pLen > 0)
{
src = ptr;
dest = str;
while (* src != '\0'){
if (* src == '\n'){
if (!lineCount){
* dest++ = ' ';
}
lineCount++;
}else if (* src == '\"'){
if (inQ){
char strCount[32];
char * cpy;
sprintf(strCount, "{%dx}", lineCount);
cpy = & strCount[0];
while (* cpy != '\0'){
* dest ++ = * cpy ++;
}
}
inQ = !inQ;
}else if (!skip){
*dest++ = *src;
}
skip = (lineCount > 1 && inQ);
src++;
}
*dest = '\0';
MultiByteToWideChar(CP_ACP, 0, str, -1, wstr, MOFWSTR);
fwprintf(DumpFile, L"\"%ws\", ", wstr);
}
ptr += (pLen);
break;
}
case ItemSid:
{
WCHAR UserName[64];
WCHAR Domain[64];
WCHAR FullName[256];
ULONG asize = 0;
ULONG bsize = 0;
ULONG Sid[64];
PULONG pSid = & Sid[0];
SID_NAME_USE Se;
ULONG nSidLength;
pSid = (PULONG) ptr;
if (*pSid == 0){
ptr += 4;
fwprintf(DumpFile, L"%4d, ", *pSid);
}
else
{
ptr += 8; // skip the TOKEN_USER structure
nSidLength = 8 + (4*ptr[1]);
asize = 64;
bsize = 64;
if (LookupAccountSidW(
NULL,
(PSID) ptr,
(LPWSTR) & UserName[0],
& asize,
(LPWSTR) & Domain[0],
& bsize,
& Se))
{
LPWSTR pFullName = &FullName[0];
swprintf( pFullName, L"\\\\%s\\%s", Domain, UserName);
asize = (ULONG) lstrlenW(pFullName);
if (asize > 0){
fwprintf(DumpFile, L"\"%s\", ", pFullName);
}
}
else
{
fwprintf(DumpFile, L"\"System\", " );
}
SetLastError( ERROR_SUCCESS );
ptr += nSidLength;
}
break;
}
case ItemChar4:
fwprintf(DumpFile,
L"%c%c%c%c, ",
*ptr, ptr[1], ptr[2], ptr[3]);
ptr += 4 * sizeof(CHAR);
break;
case ItemGuid:
{
WCHAR s[64];
fwprintf(DumpFile, L"%s, ", CpdiGuidToString(&s[0], (LPGUID)ptr));
ptr += sizeof(GUID);
break;
}
case ItemCPUTime:
{
ulongword = * ((PULONG) ptr);
fwprintf(DumpFile, L"%8lu, ", ulongword * TimerResolution);
ptr += sizeof (ULONG);
break;
}
case ItemOptArgs:
{
DWORD dwOptArgs = * ((PLONG) ptr);
DWORD dwMofLen = pEvent->MofLength + sizeof(UNICODE_NULL);
DWORD dwMofUsed = MofDataUsed + sizeof(DWORD);
DWORD dwType;
DWORD i;
LPWSTR wszString;
LPSTR aszString;
LONG lValue32;
LONGLONG lValue64;
ptr += sizeof(LONG);
for (i = 0; i < 8; i ++) {
if (dwMofUsed > dwMofLen) {
break;
}
dwType = (dwOptArgs >> (i * 4)) & 0x0000000F;
switch (dwType) {
case 0: // LONG
dwMofUsed += sizeof(LONG);
if (dwMofUsed <= dwMofLen) {
lValue32 = * ((LONG *) ptr);
ptr += sizeof(LONG);
fwprintf(DumpFile, L"%d,", lValue32);
}
break;
case 1: // WSTR
wszString = (LPWSTR) ptr;
dwMofUsed += sizeof(WCHAR) * (lstrlenW(wszString) + 1);
if (dwMofUsed <= dwMofLen) {
fwprintf(DumpFile, L"\"%ws\",", wszString);
ptr += sizeof(WCHAR) * (lstrlenW(wszString) + 1);
}
break;
case 2: // STR
aszString = (LPSTR) ptr;
dwMofUsed += sizeof(CHAR) * (lstrlenA(aszString) + 1);
if (dwMofUsed <= dwMofLen) {
fwprintf(DumpFile, L"\"%s\",", aszString);
ptr += sizeof(CHAR) * (lstrlenA(aszString) + 1);
}
break;
case 3: // LONG64
dwMofUsed += sizeof(LONGLONG);
if (dwMofUsed <= dwMofLen) {
lValue64 = * ((LONGLONG *) ptr);
ptr += sizeof(LONGLONG);
fwprintf(DumpFile, L"%I64d,", lValue64);
}
break;
}
}
break;
}
case ItemVariant:
{
//
// Variable Size. First ULONG gives the sizee and the rest is blob
//
ulongword = *((PULONG) ptr);
ptr += sizeof(ULONG);
fwprintf(DumpFile, L"DataSize=%d, ", ulongword);
// No need to dump the contents of the Blob itself.
ptr += ulongword;
break;
}
case ItemBool:
{
BOOL Flag = (BOOL)*ptr;
fwprintf(DumpFile, L"%5s, " , (Flag) ? L"TRUE" : L"FALSE" );
ptr += sizeof(BOOL);
break;
}
default:
ptr += sizeof (int);
}
}
//Instance ID, Parent Instance ID
fwprintf(DumpFile, L"%d, %d\n", pEvent->InstanceId, pEvent->ParentInstanceId );
}
#ifdef __cplusplus
}
#endif