性能计数器与ETW [英] Performance counter vs ETW

问题描述

性能计数器是ETW的一部分吗?如果不是，那么两者之间有什么区别?

Are performance counters part of ETW? If not, what is the difference between the two?

推荐答案

性能计数器和ETW是不同的技术.性能计数器不会通过ETW公开.

Performance counters and ETW are distinct technologies. Performance counters are not exposed through ETW.

基本区别:性能计数器提供有关系统行为的高级度量(考虑计时器和字节读取以及分配的对象)，而ETW是诊断跟踪和日志记录工具(考虑Debug.WriteLine消息，但功能更丰富，结构更详细).

The basic difference: performance counters provide high-level metrics on system behavior (think timers and bytes read and objects allocated) while ETW is a diagnostic tracing and logging facility (think Debug.WriteLine messages, but richer and more structured).

当前，ETW和性能计数器均得到Windows的全面支持，作为开发人员，您可以编写代码以生成和两种技术的数据.

Currently, both ETW and performance counters have full support from Windows, and as a developer, you can write code to produce and consume data for both technologies.

性能计数器

性能计数器，也称为作为PDH(性能数据助手)计数器，它们是简单的数字量度，可为您提供有关特定系统行为方式的高级摘要.例如，% Processor Time是一个性能计数器，它告诉您有多少处理器时间用于执行用户模式代码.作为更复杂的示例，.NET CLR Jit类别中的# of Methods Jitted告诉您自应用程序启动以来JIT编译了多少.NET方法.

Performance counters, also known as PDH (Performance Data Helper) counters, are simple numeric metrics that give you a high-level summary of how a particular system is behaving. For example, % Processor Time is a performance counter that tells you how much of the processor's time is being used to execute user-mode code. As a more complex example, # of Methods Jitted in the .NET CLR Jit category tells you how many .NET methods were JIT compiled since the start of an application.

性能计数器通常用于监视系统运行状况并诊断特定的性能问题.当发生严重错误时，它们可以很好地指示问题，但是对于导致特定问题发生的原因，它们没有提供太多详细信息.

Performance counters are generally used to monitor system health and to diagnose specific performance issues. They are a good indicator of issues when something goes wildly wrong, but they don't give you much detail as to why a particular issue is happening.

要查看Windows性能计数器，只需运行perfmon.在Vista +上，您可能需要单击性能监视器"节点以查看计数器图表.要以编程方式访问性能计数器，请查看 System.Diagnostics.PerformanceCounter PDH库中的类>用于本机代码.

To view Windows performance counters, you can simply run perfmon. On Vista+, you might need to click on the "Performance Monitor" node to see the counter chart. To programmatically access performance counters, look at the System.Diagnostics.PerformanceCounter class in .NET or the PDH library for native code.

Windows事件跟踪(ETW)

ETW是Windows内置的跟踪系统.本质上，任何组件(例如用户应用程序，甚至Windows内核本身)都可以发送有关该组件关心的特定事件的诊断跟踪信息.例如，当进程启动和停止，加载和卸载映像(例如DLL)，创建或销毁线程，甚至线程进行上下文切换时，内核都会发出ETW事件.记录的数据采用序列化格式，该格式由其他组件描述，从而允许诊断工具读取和理解会话期间记录的ETW事件.有关框线图，请参见此处一切如何协同工作.

ETW is a tracing system built into Windows. Essentially, any component (e.g. a user application, or even the Windows kernel itself) can send out diagnostic trace information about specific events that occur that the component cares about. For example, the kernel sends out ETW events when a process starts and stops, when an image (e.g. DLL) is loaded and unloaded, when a thread is created or destroyed, or even when a thread does a context switch. The logged data is in a serialized format that's described by the component elsewhere, allowing diagnostic tools to read and understand the ETW events logged during a session. See here for a boxes-and-lines diagram of how everything works together.

ETW意味着速度很快，并且在未启用日志记录时不会严重影响系统的性能.从Vista开始，ETW遍及整个Windows，供应用程序开发人员使用(具体来说，您的应用程序可以是记录事件的ETW提供程序). ETW是事件日志的基础，性能分析器，调试器或系统监视器可以使用ETW.

ETW is meant to be fast and should not materially impact the system's performance when logging is not enabled. Starting with Vista, ETW is pervasive throughout Windows and is intended for use by application developers (meaning, specifically, your application can be an ETW provider that logs events). ETW is the basis for the Event Log, and can be used by performance profilers, debuggers, or system monitors.

在我的其他SO帖子此处一些与ETW接口的资源.

See my other SO post here for some resources on interfacing with ETW.

这篇关于性能计数器与ETW的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！