Perfview doesn't display provider name, event name and message? Manifest data is not available in all split etl files.

[amruthrajv-dev]

We are generating some etw log files for our application. I use Perfview to read the .etl files. Some times Perfview shows events like the below screenshot. It does not show the proper provider name/event name and the message. Instead I can see the GUID. I am not able to find out in what scenario this happens. I cannot suspect the event source because this doesn't happen with all .etl files. Image ETL files generated using the same session with the below MultiFileMB configuration for generating multiple etl split files. Some split files are showing proper data, some are not as shown in the below image. Session.MultiFileMB = 10; Image I tried dumping the corrupted and not corrupted events from Perfview. Proper events are having <PrettyPrint> information and the TemplateType is DynamicTraceEventData, however in the corrupted events I am not getting <PrettyPrint> information. Also the TemplateType is UnhandledTraceEvent. Image

We also observed that, the so called corrupted files doesn't have the manifest data. This can be clearly verified from the above screenshots. Most of the time, manifest data is available only with the first split file.

We can see that the number of lost events is 0. That means no events are lost. I also observed that doing a merge with all these splitted files makes all corrupted data readable. If you open the merged file in perfview, I am able to see all data properly. I assume, this is because manifest data is not available. Any of the splitted file merged with the split file having manifest data (generally it's the first split file) will make everything readable.

This issue was also discussed in this thread.

[github-actions[bot]]

Due to lack of recent activity, this issue has been labeled as 'stale'. It will be closed if no further activity occurs within 30 more days. Any new comment will remove the label.

[github-actions[bot]]

This issue will now be closed since it has been labeled 'stale' without activity for 30 days.