microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Other
610 stars 149 forks source link

Only allocate one EventRecordMetadata^ and reuse it for RawProvider events #250

Closed mjeong92 closed 1 week ago

mjeong92 commented 1 week ago

RawProvider::EventNotification created a new managed object EventRecordMetadata for each EVENT_RECORD it received. Since each provider is single threaded, we should be able to reuse a single allocation by replacing the pointers to the user data in EVENT_RECORD native object on a single EventRecordMetadata before raising the event up to the managed layer.

This change makes the user record and the header pointers in EventRecordMetadata accessible internally so that they can be updated from each EVENT_RECORD received in the RawProvider. RawProvider adds a EventRecordMetadata^ member that gets initialized in the constructor and re-used for each EVENT_RECORD by updating the two pointers each time.