Halloween Spooktacular Day 12: Find Another PMC Event Type

If you’ve managed to get PMC collection via ETW working, and you’ve managed to get TraceEvent-based insertion of events at profiling start/stop points, you are tantalizingly close to completing the challenge. But if you’ve gotten that far, you’ve no doubt also noticed a glaring problem: TraceEvent-inserted events don’t support PMC collection.

It would be wonderful if they did, but of course, this is Event Tracing for Windows. Nothing is ever wonderful in Event Tracing for Windows! If you try to add your own registered event GUID to your TraceSetInformation setup, ETW will just laugh and ignore you. Only kernel events support PMC sampling — and only a subset of kernel events at that!

Which brings us to today’s hint: in order to make forward progress, you’ll have to figure out some way to reliably record a PMC-enabled kernel event to compliment the user events you record via TraceEvent. This will require you to find a kernel event type that satisfies two separate requirements: it must be able to have PMCs attached to it via TraceSetInformation, and you must be able to reliably force one to be recorded at each of your stop and start points.

That concludes today’s hint. Until tomorrow, good luck making progress on the Spooktacular Challenge!

I will post additional hints here every day until Halloween. If you’d like the rest of the Spooktacular Challenge to be delivered automatically to your inbox, you can select a subscription option here: