Add a PID whitelist + blacklist
2 new params : pid_whitelist and pid_blacklist which are lists of PID to whitelist/blacklist
If the whitelist is not empty, only events from PID in the whitelist will be kept
If the blacklist is not empty, events from PID in it won't be kept
One can dynamically add/remove PIDs from the whitelist and blacklist during the session (if a new process is spawed and we want to blacklist it, it's possible this way)
On windows 7, ProcessID/ThreadID in ETW header is not always set (it can be 0xFFFFFFFF for image load from Kernel Trace for instance). This seems to be a bug as it's working as intended (PID/TID with correct value) on Windows 10.
The idea for this PR stems from processes generating lot of noise (lot of ETW events) that we want to filter out. We could filter those in the callbacks but a lot of CPU is wasted formatting/converting values (TdhFormatProperty..) for events we will discard anyway. With this, we can filter those ASAP.
a = ETW(..., pid_blacklist=[512])
a.start()
...
[PID 1000 : new process we don't want]
a.add_pid_blacklist(1000)
[PID 1000 ends, we want events from new processes with this PID if it is reused]
a.remove_pid_blacklist(1000)
Would it be possible to bump version to 0.2.1 for instance and publish a new version to pypi?
Add a PID whitelist + blacklist 2 new params :
pid_whitelist
andpid_blacklist
which are lists of PID to whitelist/blacklistIf the whitelist is not empty, only events from PID in the whitelist will be kept If the blacklist is not empty, events from PID in it won't be kept
One can dynamically add/remove PIDs from the whitelist and blacklist during the session (if a new process is spawed and we want to blacklist it, it's possible this way)
On windows 7, ProcessID/ThreadID in ETW header is not always set (it can be 0xFFFFFFFF for image load from Kernel Trace for instance). This seems to be a bug as it's working as intended (PID/TID with correct value) on Windows 10.
The idea for this PR stems from processes generating lot of noise (lot of ETW events) that we want to filter out. We could filter those in the callbacks but a lot of CPU is wasted formatting/converting values (
TdhFormatProperty
..) for events we will discard anyway. With this, we can filter those ASAP.Would it be possible to bump version to 0.2.1 for instance and publish a new version to pypi?