0xrawsec/golang-etw

golang-etw's Issues

Potential performance limitations

Many, many thanks for your work, it is very much appreciated.

I am consuming events from a rather high-throughput provider, Microsoft-Windows-DNSServer, and have noticed some performance issues with that provider and "realtime" mode trace sessions. Once I get above ~8000 ETW events/sec, I begin to see a very significant rise in the number of events lost (viewed through Performance Monitor).

This happens with both golang-etw-created sessions and with manually created sessions, and both with / without a consumer application.

If I manually create a "Buffered" mode trace session, then I can happily max MS Windows DNS Server out at around 30k DNS requests/sec without losing any events.

Additionally, I have noticed that even with a very simple consumer application (taken from your example, and with the JSON marshalling removed), CPU consumption reaches very high levels (~60-70%) at loads of around 20k ETW events/sec. I'm running this on an AWS EC2 t3.large (2 cores, 8GB), for comparison.

Have you noticed any similar performance, and would you give any consideration to implementing a Buffering mode session trace consumer?

how to trace the provider "Microsoft-Windows-Security-Auditing"

I use golang-etw to trace "Microsoft-Windows-Security-Auditing", but I can't get any event.

can you export ActivityId and relatedActivityID?

ActivityId is in e.EventRec.EventHeader.ActivityId.
relatedActivityID is in e.EventRec.ExtendedData.DataPtr when e.EventRec.ExtendedData.ExtType equal EVENT_HEADER_EXT_TYPE_RELATED_ACTIVITYID (0x0001)