TraceEvent: Getting allocation stacks on Linux

[ocoanet]

I am trying to create a simple OS independent allocation detection program. The detection program:

• runs a target program using "dotnet-trace" and
• analyses the trace file to get allocations and allocations call stacks.

I can get allocation events (ClrTraceEventParser.GCSampledObjectAllocation) by using the allocations keywords. However, I cannot get stack events (ClrTraceEventParser.ClrStackWalk) by using the ClrTraceEventParser.Keywords.Stack keyword. TraceLog is still able to retrieve stack information from the allocation events using TraceLog.ProcessExtendedData, but the code is internal and seems to be Windows-specific. Also, I would like to avoid converting my event pipe files to ETLX because it consumes too much memory and crashes on low-memory containers.

My questions are:

• What is the effect of the ClrTraceEventParser.Keywords.Stack keyword on Linux?
• Is it possible to attach stack traces to allocation events on Linux?
• Is there is a way to get stack walk events (ClrTraceEventParser.ClrStackWalk) on Linux?

[ocoanet]

I did additional tests on Linux and it turns out that the trace events contain extended data with stack traces. So, ProcessExtendedData is also useful on Linux even though the data structures used in this method seem to be Windows-specific.

I will probably close this issue because it somehow answers most of my questions. However, it would be nice if I could get the confirmation that:

• The ClrTraceEventParser.Keywords.Stack keyword effect is to capture stack traces and include them in the trace event extended data (on Windows and Linux).
• There is no clean way to read extended data from event pipe traces without using TraceLog (converting the traces to to ETLX).

Also, it would be interesting to know if ClrTraceEventParser.ClrStackWalk can be used to get stacks with dotnet-trace.