Managed Stack Traces Are Missing
All tools I have seen so far miss managed methods. ProcmonV2 does display empty lines, ProcmonV1 does not support stacks at all, but TraceEvent has support for managed stacks.
Nice tool but the selling point for me would be to have managed stack traces which also the original sysinternals procmon cannot resolve.
Yes, this is where PerfView can help.
I know. But if you want to track e.g. a specific registry key write you either need to record for many hours a lot of data, or you use the Realtime ETW provider as your tool to keep only the interesting events. PerfView only supports etlx files of 4 GB in size. This is easily reached within minutes when one records all registry events with stack traces. Do you have any plans to support CLR stacktraces?
It's good idea, for sure. I'll add it to my backlog... we'll see.