How to get "Size(column value) of Total Commit (Process View)" using Microsoft.Windows.EventTracing

Question

Is there a way to get 'Size' column of "Total Commit-Process View" (Which is shown in WPA) using "Microsoft.Windows.EventTracing".

I am generated ETL file(using WPR), and in the "Size' column of the 'Total Commit(Process View), i get Size value in the WPA.

I would like to get the same result using "Microsoft.Windows.EventTracing" c# code.

Can someone through some pointers.

Thanks Santhi

Answer 1

Here's a code example that will print the total commit for each process:

using Microsoft.Windows.EventTracing;
using Microsoft.Windows.EventTracing.Memory;

static class Program
{
    private record ProcessCommitSize(int Pid, long Size);

    static void Main(string[] args)
    {
        using (ITraceProcessor trace = TraceProcessor.Create(@"PATH_TO_FILE"))
        {
            IPendingResult<ICommitDataSource> pendingCommitData = trace.UseCommitData();

            trace.Process();

            ICommitDataSource commitData = pendingCommitData.Result;

            var commitLifetimes =
                commitData
                    .CommitLifetimes
                    .Where(c => c.Process != null)
                    .Select(c => new ProcessCommitSize(c.Process.Id, c.AddressRange.Size.Bytes));

            var copyOnWriteLifetimes =
                commitData
                    .CopyOnWriteLifetimes
                    .Where(c => c.Process != null)
                    .Select(c => new ProcessCommitSize(c.Process.Id, c.AddressRange.Size.Bytes));

            var pageFileSectionLifetimes =
                commitData
                    .PageFileSectionLifetimes
                    .Where(c => c.CreatingProcess != null)
                    .Select(c => new ProcessCommitSize(c.CreatingProcess.Id, c.Size.Bytes));

            // These correspond to the "Unknown (Private)" commit types shown in WPA
            var privateCommitRemainders =
                commitData
                    .PrivateCommitRemainders
                    .Where(r => r.Process != null)
                    .Select(r => new ProcessCommitSize(r.Process.Id, r.UnaccountedBytes.Bytes));

            var allCommits =
                commitLifetimes
                    .Concat(copyOnWriteLifetimes)
                    .Concat(pageFileSectionLifetimes)
                    .Concat(privateCommitRemainders)
                    .GroupBy(f => f.Pid)
                    .OrderBy(g => g.Key);

            foreach (var processCommitSizeGroup in allCommits)
            {
                Console.WriteLine($"Process ID {processCommitSizeGroup.Key}: {processCommitSizeGroup.Sum(f => f.Size)} (count: {processCommitSizeGroup.Count()})");
            }
        }
    }
}

Note that these numbers will be slightly different from what WPA shows by default. The "Size" column of this table has a default aggregation of "Peak Outstanding," and the above code would be similar to if you changed the aggregation to "Sum." To get different aggregations, change the processCommitSizeGroup.Sum call to a function that performs the correct aggregation.