How do I collect an ETL trace for WF/WCF ?

Using Logman

Logman is a built-in tool in the Windows OS. To collect ETW events, here is a command to create a circular ETL file of 500MB max size:
logman  start WCFETWTracing -p "Microsoft-Windows-Application Server-Applications"  -nb 256 1024 -bs 512 -ets -ct perf -f bincirc -max 500 -o mywcftrace.etl
Here is the command to stop the collection:
logman stop WCFETWTracing -ets
Here the "WCFETWTracing" is the tracing collection name. The "mywcftrace.etl" is the name of the trace file. You can choose any names here. You can use this sample trace to view the events.

Using xperf

You can download xperf from the external web site or you can get it from the internal xperf site. It has more options than logman can do and you can use it to consume ETL files as well. Here is the command to create a circular ETL file of 500MB max size:

Quick Commands to collect trace (the PROC_THREAD group enables process name enumeration)
xperf.exe -on PROC_THREAD
xperf.exe -start WCFSession -on "c651f5f6-1c0d-492e-8ae1-b4efd7c9d503:0xffffffff:5" -f WCFSession.etl

xperf.exe -stop WCFSession
xperf -d kernel.etl
xperf -merge WCFSession.etl kernel.etl Output.etl
Command with stacks and cswitch for wait and stack analysis with circular buffers :
xperf -on PROC_THREAD+LOADER+DISK_IO+CSWITCH+DISPATCHER -stackwalk ReadyThread+CSwitch -Filemode Circular -MaxFile 500 -f kernel.etl
xperf -start WCFETWTracing -on C651F5F6-1C0D-492E-8AE1-B4EFD7C9D503:0xF000000000000000:0x4 -f mywcftrace0.etl -buffersize 512 -minbuffers 256 -maxbuffers 1024 -Filemode Circular -MaxFile 250
Here is the command to stop the collection:
xperf -stop WCFETWTracing
xperf -stop
xperf -merge kernel.etl mywcftrace0.etl Merged.etl
Note that the above commands merge two traces into a single one. Here we also collected kernel events to get more detailed events. The last command merge the events for both the kernel and the user mode to obtain a single events. You can merge multiple ETL files into a single one if they are collected together with correlated information. This is commonly used for cross-machine scenarios too.

Where is the Manifest?

The manifest is located in your framework installation directory -



Realtime - You can also collect a realtime session for debugging.

Sample Trace

Download the sample - wcf.etl  and to view this sample trace run the following command

SvcPerf.exe wcf.etl %windir%\Microsoft.Net\Framework\v4.0.30319\

Last edited Jan 24, 2013 at 4:46 AM by sajay, version 7


No comments yet.