EtwToPprof

EtwToPprof exports ETW traces to pprof protobuf format. It uses the .NET TraceProcessing API to process ETW traces.

This tool was built for processing ETW traces from Chrome, so the default values of the flags are based on that use case. It uses _NT_SYMCACHE_PATH and _NT_SYMBOL_PATH for symbolizing traces if set, otherwise it uses WPA defaults.

Building

Build with the .NET 10 SDK:

dotnet build -c Release

Nuget dependencies (included in solution)

• CommandLineParser v2.8.0
• Google.Protobuf v3.11.4
• Microsoft.Windows.EventTracing.Processing.All v1.0.0

Examples

Export to specified pprof profile using default options:

EtwToPprof -o profile.pb.gz trace.etl

Export samples from specified process names:

EtwToPprof -p viz_perftests.exe,dwm.exe trace.etl

Export samples from all processes from 10s to 30s:

EtwToPprof -p * --timeEnd 30 --timeStart 10 trace.etl

Export inlined functions and thread/process ids:

EtwToPprof --includeInlinedFunctions --includeProcessAndThreadIds trace.etl

Merge all chrome.exe processes under a single heading:

EtwToPprof --noSplitChromeProcesses trace.etl

List all loaded images with their Breakpad build IDs:

EtwToPprof --listImageIds trace.etl

Command line flags

-o, --outputFileName            (Default: profile.pb.gz) Output file name for gzipped pprof profile.

-p, --processFilter             (Default: chrome.exe,dwm.exe,audiodg.exe) Filter for process names (comma-separated) to be included in the exported profile. All processes will be exported if set to *.

--includeInlinedFunctions       (Default: false) Whether inlined functions should be included in the exported profile (slow).

--stripSourceFileNamePrefix     (Default: ^c:/b/s/w/ir/cache/builder/) Prefix regex to strip out of source file names in the exported profile.

--timeStart                     Start of time range to export in seconds

--timeEnd                       End of time range to export in seconds

--includeProcessIds             (Default: false) Whether process ids are included in the exported profile.

--includeProcessAndThreadIds    (Default: false) Whether process and thread ids are included in the exported profile.

--splitChromeProcesses          (Default: true) Whether chrome.exe processes are split by type (parsed from command line).

--noSplitChromeProcesses        (Default: false) Merge all chrome.exe processes under a single heading.

--loadSymbols                   (Default: true) Whether symbols should be loaded.

--listImageIds                  (Default: false) List all unique image (module) names with Breakpad build IDs and exit.

--help                          Display this help screen.

--version                       Display version information.

etlFileName (pos. 0)            Required. ETL trace file name.

Offline Symbolization

Profiles include Mapping entries with Breakpad-format build IDs and RVA-based addresses. Unsymbolized frames are emitted as bare locations (address + mapping only) so that pprof symbolization servers can resolve them using symbol servers without requiring local PDBs.

Disclaimer:

This is not an officially supported Google product.