Halloween Spooktacular Day 2: Reboot Your Machine

You think I'm joking? I'm not joking.

As described in the announcement, the hints are ordered from least to most helpful, so today’s hint isn’t much — but depending on your installation of Windows, it might save you a lot of time:

As you try to collect PMCs via the ETW API, at some point you’ll have to call TraceSetInformation. Despite your best efforts, you may find it fails no matter what you do.

While it could be a bug in your code, it could also be because another program on your machine has already requested PMC collection. Since the CPU can only collect a small number of PMCs at once, the ETW API prevents you from selecting PMCs if another ETW trace is already collecting them.

The only way to fix this problem is to stop the other trace. You may be able to do this by hunting it down using Windows administrative tools. Another option is, of course, to reboot your machine.

Worse still, depending on your installation, even rebooting might offer limited reprieve. Although most of our Windows machines don’t have this problem, on one of our systems here, Windows spins up a rogue PMC-collecting trace on its own about a minute after Windows boots.

You think I’m joking, but I’m not. I had to diff periodic listings of the traces running on the machine to figure this out.

So, that’s today’s hint: if TraceSetInformation returns an error code indicating someone else is using the PMCs, try rebooting your machine and running your code immediately after login. If it works, it means you had a rogue trace blocking your PMC collection, and you’ll have to track down which application or service was starting it.

And along those lines, I’ll include a bonus hint: if you try to list your PMC sources with wpr -pmcsources, and it only returns “Timer”, that means you’re running with virtualization on a CPU for which Windows doesn’t support PMC collection while virtualized. You’ll have to disable virtualization (either in the “Windows Features” settings, or in your BIOS) to collect PMCs!

Once again, you think I’m joking, but I’m not.

Now, if this all sounds horrifying to you, well, what did you expect? This is the Event Tracing for Windows API! When I said it was the worst API ever made, I wasn’t kidding. Nobody gazes upon its true form and emerges unscathed.

That concludes today’s hints. Until tomorrow, good luck making progress on the Spooktacular Challenge!

I will post additional hints here every day until Halloween. If you’d like the rest of the Spooktacular Challenge to be delivered automatically to your inbox, you can select a subscription option here: