How to create Trace (ETW) Provider Logs for Windows Component Debugging using Perfmon

How to create Trace (ETW) Provider Logs for Windows Component Debugging Using Perfmon?

 

In some scenarios we have timeouts or issues waiting on code execution from different windows components and cannot catch the exceptions.
This document describes step by step how you can create a Trace Log using Perfmon in order to get Event Tracing for Windows traces of different components.

Step-by-step guide

  1. Press 'Win' + R and type 'Perfmon' to start 'Perfmon'
  2. Click on the 'User Defined' folder under 'Data Collector Sets'
  3. Click on the 'New Data Collector' icon
  4. Name your 'Collector' and select 'Create manually' (Advanced)
  5. Press 'Next'
  6. Check the 'Event trace data checkbox'
  7. Press 'Next'
  8. Click 'Add next' to 'Providers'
  9. Select your providers from the list and press 'OK'. You can add multiple ones
  10.  Select the provider from the list and edit the 'Properties' by pressing 'Edit' next to each one. Leave them as the default and this will collect all the information

  11. Provider Properties

    <div class="confluence-information-macro-body" style="margin: 0px;padding: 0px;">
    <p style="margin: 0px;padding: 0px;">Each provider has a set of 5 properties. All of these can be explored with the WPExplorer which reads the provider metadata: <a href="https://lallouslab.net/2016/01/25/windows-events-providers-explorer/" target="_blank">Windows Events Providers Explorer</a></p>
    
    <ul style="margin: 4px 0px 0px;padding: 0px 0px 0px 40px;list-style-type: disc;"><li>Keywords(Any) - Filter messages containing any of the keywords from that provider and direct them into the trace</li><li style="margin-top: 4px;">Keywords(All) -&nbsp;Filter messages containing All of the keywords from that provider and direct them into the trace</li><li style="margin-top: 4px;">Level
    	<ul style="margin: 0px;padding: 0px 0px 0px 40px;list-style-type: disc;"><li>LogAlways<span style="color: rgb(23, 23, 23);" uipath_custom_id="23">&nbsp;(0x0)</span></li><li style="margin-top: 4px;">Critical<span style="color: rgb(23, 23, 23);" uipath_custom_id="24">&nbsp;(0x1)</span></li><li style="margin-top: 4px;">Error<span style="color: rgb(23, 23, 23);" uipath_custom_id="25">&nbsp;(0x2)</span></li><li style="margin-top: 4px;">Warning<span style="color: rgb(23, 23, 23);" uipath_custom_id="26">&nbsp;(0x3)</span></li><li style="margin-top: 4px;">Information<span style="color: rgb(23, 23, 23);" uipath_custom_id="27">&nbsp;(0x4)</span></li><li style="margin-top: 4px;">Verbose<span style="color: rgb(23, 23, 23);" uipath_custom_id="28">&nbsp;(0x5)</span></li></ul>
    	</li><li style="margin-top: 4px;">Properties -&nbsp;<span uipath_custom_id="29">optional ETW properties that can be specified when writing the event.</span></li><li style="margin-top: 4px;">Filter - Additional filtering&nbsp;</li></ul>
    </div>
    </div>
    </li><li style="margin-top: 4px;">Press 'Next'</li><li style="margin-top: 4px;">Select where the data will be saved. Make sure the user under which the provider will run has access to that folder path<br>	<span class="confluence-embedded-file-wrapper confluence-embedded-manual-size" style="display: inline-block;max-width: 100%;" uipath_custom_id="30"><img class="confluence-embedded-image" height="250" src="https://uipath.atlassian.net/wiki/download/thumbnails/2136612306/image2020-4-3_11-45-2.png?version=1&amp;modificationDate=1585903503503&amp;cacheVersion=1&amp;api=v2&amp;width=319&amp;height=250" style="margin: 0px 2px;padding: 0px;border: 0px;cursor: move;display: block;max-width: calc(100% - 4px);"></span></li><li style="margin-top: 4px;">Press 'Next'</li><li style="margin-top: 4px;">Select an user under which the 'Data Collector' set will 'run'. Note this user needs access if you're monitoring processes or services outside of the user's session or privileges. If possible use a Local Administrator user account<br>	<img alt="" src="https://uipath-survey.secure.force.com/CaseView/servlet/rtaImage?eid=ka01Q0000019RsX&amp;feoid=00N1Q00000Tffpw&amp;refid=0EM1Q0000024eNJ" style="width: 436.991px;height: 341.991px;"></li><li style="margin-top: 4px;">Select 'Start' this data collector set now and press 'Finish'</li><li style="margin-top: 4px;">Click on the 'Data Collector' under 'User Defined'. Press the 'Play' button to start collecting<br>	<span class="confluence-embedded-file-wrapper confluence-embedded-manual-size" style="display: inline-block;max-width: 100%;" uipath_custom_id="31"><img class="confluence-embedded-image" src="https://uipath.atlassian.net/wiki/download/thumbnails/2136612306/image2020-4-3_11-51-47.png?version=1&amp;modificationDate=1585903908728&amp;cacheVersion=1&amp;api=v2&amp;width=600&amp;height=168" style="margin: 0px 2px;padding: 0px;border: 0px;cursor: move;display: block;max-width: calc(100% - 4px);" width="600"></span></li><li style="margin-top: 4px;">Replicate your problem</li><li style="margin-top: 4px;">Open&nbsp;'Perfmon' after replicating the issue and click the collector under the 'User defined'. Press 'Stop' to stop collecting<br>	<img alt="" src="https://uipath-survey.secure.force.com/CaseView/servlet/rtaImage?eid=ka01Q0000019RsX&amp;feoid=00N1Q00000Tffpw&amp;refid=0EM1Q0000024eNT" style="width: 532.986px;height: 150.995px;"></li><li style="margin-top: 4px;">The logs (.etl) will be in the Output folder</li></ol>
    
    • You can use PerfView or EventViewer to view the logs.