etw的信息提取

https://docs.microsoft.com/en-us/windows-hardware/test/wpt/xperf-actions
xperf -tle –i myetw.etl -o providers.csv -a dumper -provider {CA80A0D7-6CA2-4F62-B22D-D0F88D79AE4B}


https://docs.microsoft.com/en-us/windows-hardware/test/weg/instrumenting-your-code-with-etw

Copy your component to the location that was specified in your manifest by the resourceFileName attribute:
 
xcopy /y MyProviderBinary.exe %temp%
 
Register the providers:
 
wevtutil um etwmanifest.man
wetvutil im etwmanifest.man
 
Verify that the provider is visible:
 
logman query providers
 
Your provider name/GUID will appear in the list.
1.Start tracing:
  xperf -start MySession -on MyEventProvider -f MySession.etl
  # In that command line, -start gives the event collection session a name, and -on tells ETW that you want to collect events from your provider in this session. (There can be multiple -on arguments.)
2.Execute your workload.
3.Stop tracing:
  xperf -stop MySession
@echo off
echo "clean session.."
xperf -stop app_session -d app_tmp.etl
xperf -stop -d base_tmp.etl
if exist app_tmp.etl (del app_tmp.etl)
if exist base_tmp.etl (del base_tmp.etl)
 
echo "open session.."
set now=%date:~0,4%%date:~5,2%%date:~8,2%_%time:~0,2%%time:~3,2%%time:~6,2%
set now=%now: =0%
echo %now%
xperf -start -on Base
xperf -start app_session -on CA80A0D7-6CA2-4F62-B22D-D0F88D79AE4B
 
echo "请启动prometheus应用。"
 
timeout 100
 
xperf -stop app_session -d  app_tmp.etl
xperf -stop -d base_tmp.etl
xperf -merge base_tmp.etl app_tmp.etl prometheus_%now%.etl
 
xperf -tle -i abc_%now%.etl -o hardfaults_%now%.csv -a hardfault -file -bytes
xperf -tle -i abc_%now%.etl -o time_%now%.csv -a dumper -provider {CA80A0D7-6CA2-4F62-B22D-D0F88D79AE4B}
xperf -tle -i abc_%now%.etl -o pagefaults_%now%.csv -a dumper -provider {3D6FA8D3-FE05-11D0-9DDA-00C04FD7BA7C}
rem start wpa.exe abc_%now%.etl
<?xml version="1.0" encoding="UTF-16"?>
<instrumentationManifest xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="http://schemas.microsoft.com/win/2004/08/events/trace">
	<instrumentation>
		<events>
			<provider name="abc" guid="{CA80A0D7-6CA2-4F62-B22D-D0F88D79AE4B}" symbol="promethus" resourceFileName="res" messageFileName="msg" parameterFileName="param">
				<events>
					<event symbol="wps_startup_begin" value="101" version="0" task="wps_startup">
					</event>
					<event symbol="wps_startup_end" value="102" version="0" task="wps_startup">
					</event>
					<event symbol="et_startup_begin" value="201" version="0" task="et_startup">
					</event>
					<event symbol="et_startup_end" value="202" version="0" task="et_startup">
					</event>
					<event symbol="wpp_startup_begin" value="301" version="0" task="wpp_startup">
					</event>
					<event symbol="wpp_startup_end" value="302" version="0" task="wpp_startup">
					</event>
				</events>
				<tasks>
					<task name="wps_startup" symbol="wps_startup" value="100" eventGUID="{71B0722D-DBC8-4DBE-A10D-04C788F213FC}">
					</task>
					<task name="et_startup" symbol="et_startup" value="200" eventGUID="{57B29ED7-B587-44E4-8A42-D59E9E700583}">
					</task>
					<task name="wpp_startup" symbol="wpp_startup" value="300" eventGUID="{9BDFBC62-FAF6-4F54-9819-23B059E61E79}">
					</task>
				</tasks>
			</provider>
		</events>
	</instrumentation>
</instrumentationManifest>