Conclusion

We only looked at very little of ETF's and WPA's functionality—only enough to get you started. This tool is so powerful! An example ETW trace is included with this book's resources for you to browse through; maybe you will detect that a little problem occurred when starting the example program I didn't tell you about!

ETW enables programs to emit custom events, which can be very convenient when we want to mark some boundaries in the program to make finding the relevant information easier. Example implementation for user event is provided with UI for ETW, so consult it for further information.

But where ETW really shines is the analysis of UI hangs. This is something that your typical sampling profiler cannot do. Windows, from version 7 up, includes an ETW provider in the kernel, which will generate an event when the application doesn't check its message pump for longer than 200 milliseconds. UI for ETW enables this provider by default, and we can see those events in the UI Delays graph from the System Activity window of the WPA. This can prove very useful when analyzing hangs in your GUI.

If you want to learn more about ETW, and maybe read a series of non-trivial performance investigation cases solved using ETW, have a look at his Random ASCII blog (available at https://randomascii.wordpress.com, beginning with the ETW Central blogpost).