the EventSourceData.etl file size is zero unless explicitly stop the session, but EventSourceData.etl can constantly get bigger

[Kieran Yu (KieranYu)]

I'm running the samples: 11_SimpleEventSourceFile, and made a little change, set session.CircularBufferMB and session.BufferSizeMB.

1. i called session.Flush() , however the file size is still zero;
2. the defallt value of flushtimer is 60 second, however, it doesn't flush the event data to the file, the file size is still zero;
3. only when the session is stopped, the file size is gonna > 0;
4. i found others meet the same question （https://stackoverflow.com/questions/55784112/logman-flush-buffers-to-file-periodically）

in the circular file mode with max file size, how can i flush the event data to the file ? or what's the occasion does the event data flush to the file except stop the session ?

The perfView's PerfViewData.etl file can constant get bigger and bigger, i see it also in circular file mode with max size 800 M, What's the main diffence lead to this compare with EventSourceData.etl ?

[Brian Robbins (brianrob)]

This is by design per ETW documentation. Calling Flush is only applicable for real-time sessions that don't have a circular buffer specified (those sessions that are started with EVENT_TRACE_BUFFERING_MODE).

From https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-controltracea:

[in] ControlCode

Requested control function. You can specify one of the following values:

EVENT_TRACE_CONTROL_FLUSH: Flushes the session's active buffers.

This can be used with an in-memory session (a session started with the EVENT_TRACE_BUFFERING_MODE flag) to write the data from the trace to a file.

You do not normally need to flush file-based or real-time sessions because ETW will automatically flush a buffer when it is full (i.e. when it does not have room for the next event), when the trace session's FlushTimer expires, or when the trace session is closed.

[Kieran Yu (KieranYu)]

Brian Robbins (@brianrob)
Thanks for replying,
i feel a little confused with "You do not normally need to flush file-based or real-time sessions because ETW will automatically flush a buffer when it is full (i.e. when it does not have room for the next event), when the trace session's FlushTimer expires, or when the trace session is closed."

1. when the trace session is closed, the flush did happen;
2. however, i have used a provider to writing the events to the file-based session constantly with a lot of events, i think it's so much over the buffers, i don't see the flush happen( as the note, the full or flush timer expires can flush the events). what's the reason ? thanks

[Brian Robbins (brianrob)]

I can't say for sure why you're not seeing the events flush - this is an internal implementation detail of ETW. Just based on the public documentation for ETW, it appears that flush does not have an impact on file-based sessions.