With these command lines:
set _NT_SYMBOL_PATH=srv*C:\symbols*http://msdl.microsoft.com/downloads/symbols XPerf -on FILE_IO XPerf -d trace.etl XPerf -symbols verbose -i trace.etl > output.csv
I get the following output:
XPerf: warning: applying restriction of access for trace processing xperf: Using symbol path: srv*C:\symbols*http://msdl.microsoft.com/downloads/symbols xperf: Using executable path: srv*C:\symbols*http://msdl.microsoft.com/downloads/symbols xperf: Using SymCache path: \SymCache xperf: SymCache engine version: v1.1 xperf: Minimum accepted SymCache version: v1.1
xperf: Minimum accepted SymCache version: v1.1 [1/2] 100.0% [2/2] 100.0%
Warning: This trace does not contain the information needed to perform proper symbol decoding.
It was most likely stopped improperly. Please consult the documentation for information on how
to stop trace sessions (for example XPerf -stop <logger names> -d <merged.etl>)
If you still have access to the machine on which this trace was collected, you can have XPerf
add the required symbol information by running the following on that machine:
XPerf -merge <trace1.etl> <trace2.etl> ... <merged.etl>
Running this command on any machine other than the one on which the trace was collected will
result in incorrect symbol decoding.
What am I doing wrong?
Now you can parse trace_with_correct_symbol_decoding_info.etl with your original command:
The merge command not only merges multiple etl files, it also "adds image identification information required for safe symbol decoding."