Halloween Spooktacular Day 5: Call TraceSetInformation Twice

As suggested in the first hint, you will need to tell ETW which PMCs to collect using TraceSetInformation. It’s tricky figuring out how it’s supposed to work, but even if you do, you will find that you still don’t get any PMCs with your ETW events. Why not?

Well, one reason is because ETW also needs to know which events should trigger PMC collection. Unlike timestamps — which all ETW events get — ETW will only attach PMC data to an event if you explicitly ask it to do so for that type of event.

And that’s today’s hint: you must call TraceSetInformation with TracePmcCounterListInfo to select which PMCs you want to collect, but you must also call TraceSetInformation a second time — this time with TracePmcEventListInfo — to select which events you want PMCs collected for:

CLASSIC_EVENT_ID EventIDs[] =
{
    // events to enable go here
};    

ULONG Status = TraceSetInformation(TraceHandle, TracePmcEventListInfo, EventIDs, sizeof(EventIDs));

That concludes today’s hint. Until tomorrow, good luck making progress on the Spooktacular Challenge!

I will post additional hints here every day until Halloween. If you’d like the rest of the Spooktacular Challenge to be delivered automatically to your inbox, you can select a subscription option here: