Open palenshus opened 2 years ago
Additionally, I tried to follow the instructions at https://github.com/microsoft/perfview/blob/main/documentation/TraceEvent/TraceEventProgrammersGuide.md#building-compile-time-traceeventparser-parsers-using-traceparsergen to generate a manifest for the Win32kTraceLogging
provider, but it didn't work, fails with:
Error: Could not find provider with name Win32kTraceLogging
Using the GUID results in a similar error.
For some type(s) of built-in Windows events, I'm not getting the complete payload, namely AppId/AppVersion, and also I can't figure out how to get PartA data. To demonstrate, here’s a short LINQPad code sample: http://share.linqpad.net/5hsr9t.linq
However, it doesn’t give me the PartA properties, or even the AppId in the data section. Here’s what I get from the library:
And here’s what I get from the TelemetryRealTimeTool:
Any idea why AppId/AppVersion are being stripped replaced? Is it some kind of security feature at work? And is there any way to get PartA event data using the library? Thanks!