Halloween Spooktacular Day 7: Look for PMCs in the ExtendedData

Even if you’ve gotten all the incantations right, and you’re at the point where you’re receiving EVENT_RECORDs from ETW, it may still not be obvious where the PMC data actually is.

That’s today’s hint: when you receive an event from ETW, you must search its ExtendedData array to find the PMC data.

Check the ExtType of each member of the ExtendedData array. When you find one set to EVENT_HEADER_EXT_TYPE_PMC_COUNTERS, that’s the PMC data:

for(u32 EDIndex = 0; EDIndex < Event->ExtendedDataCount; ++EDIndex)
{
    EVENT_HEADER_EXTENDED_DATA_ITEM *Item = Event->ExtendedData + EDIndex;
    if(Item->ExtType == EVENT_HEADER_EXT_TYPE_PMC_COUNTERS)
    {
        EVENT_EXTENDED_ITEM_PMC_COUNTERS *PMC = (EVENT_EXTENDED_ITEM_PMC_COUNTERS *)Item->DataPtr;
        // ... counter data is in the PMC->Counter array ...
    }
}

Mercifully, once you’ve found the PMC data, it’s format is simple: EVENT_EXTENDED_ITEM_PMC_COUNTERS is nothing more than an array of 64-bit values. These are the PMC counter values, in the same order you listed them when you called TraceSetInformation to select them.

That concludes today’s hint. Until tomorrow, good luck making progress on the Spooktacular Challenge!

I will post additional hints here every day until Halloween. If you’d like the rest of the Spooktacular Challenge to be delivered automatically to your inbox, you can select a subscription option here: