Using ETWReloggerTraceEventSource to gather events just from a certain time start/stop doesn't include stacks

[chrdavis]

I wanted to use the relogger to gather all events that occur within a certain start/stop time in a trace and then write that to a new etl file. What I found is that the stacks are not included (ex: CPU stacks).

using (var relogger = new ETWReloggerTraceEventSource(inputFileName, splitFileName)) { relogger.AllEvents += delegate (TraceEvent data) { if (data.TimeStampRelativeMSec >= startTimeMS && data.TimeStampRelativeMSec <= endTimeMS) { relogger.WriteEvent(data); } };

            relogger.Process();
        };

[AloisKraus]

I think that should work, but you need to add the rundown information and dynamic JIT compiled code events from earlier/later times as well + process start/stop events + Image ID events which were added during the merge step to get a working ETL file where symbols can be decoded. Writing such a splitter is more complex than it looks at first glance. But I am pretty sure inside MS something exists. Could someone from MS make it public?

Such a capability would be a great addition to this tool: https://github.com/Siemens-Healthineers/ETWAnalyzer on which I am working.