Add process_start_key() to read ProcessStartKey from extended data - #271
Merged
Merged
Conversation
Add support for reading EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY from ETW extended data items, enabled via EVENT_ENABLE_PROPERTY_PROCESS_START_KEY. The ProcessStartKey uniquely identifies a process instance across a boot session (unlike PID which can be recycled). Changes: - Native C++: schema::process_start_key() in schema.hpp - Managed .NET: TryGetProcessStartKey() on IEventRecordMetadata/EventRecordMetadata - Test support: extended_data_builder::add_process_start_key() - New example: UserTrace008_ProcessStartKey.cs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Suhas Venkatesha Murthy (vmurthysuhas)
force-pushed
the
users/suvenka/processStartKey
branch
from
March 7, 2026 00:32
b282cf5 to
73060aa
Compare
The CI runner has .NET SDK 10.0.x pre-installed, which fails to resolve the .NET 8.0 AppHost packs needed by the NetCore project. Pin the SDK to the 8.0.x feature band using global.json with rollForward=latestFeature, and add the setup-dotnet action to install the matching SDK on CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Suhas Venkatesha Murthy (vmurthysuhas)
force-pushed
the
users/suvenka/processStartKey
branch
from
March 7, 2026 00:36
73060aa to
a16f78a
Compare
Kyle Reed (kylereedmsft)
left a comment
Kyle Reed (kylereedmsft)
left a comment
Member
There was a problem hiding this comment.
Added some notes. Need to be extra careful with pointers.
- Add null check on DataPtr before dereference in schema.hpp and EventRecordMetadata.hpp - Change add_process_start_key to take const ULONG64& so caller owns the lifetime of the pointed-to object Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Kyle Reed (kylereedmsft)
previously approved these changes
Mar 7, 2026
Kyle Reed (kylereedmsft)
left a comment
Kyle Reed (kylereedmsft)
left a comment
Member
There was a problem hiding this comment.
It would be good to add some unit tests. Approving this.
- Native tests: build/pack, raw value roundtrip, schema read, not-present case - Managed tests: TryGetProcessStartKey roundtrip, not-present case - Add AddProcessStartKey to RecordBuilder and record_builder for test support Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Kyle Reed (kylereedmsft)
approved these changes
Mar 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add support for reading EVENT_HEADER_EXT_TYPE_PROCESS_START_KEY from ETW extended data items, enabled via EVENT_ENABLE_PROPERTY_PROCESS_START_KEY. The ProcessStartKey uniquely identifies a process instance across a boot session (unlike PID which can be recycled).
Changes: