Hello
I cannot see Event Id column when I process my.etl file to csv form (etl is gothered using xperf in user mode, Admin rights):
xperf -i my.etl -o my.csv -a dumper
in the output I can see rows with MYPROVIDER as following:
UnknownEvent/Crimson, TimeStamp, Process Name ( PID), ThreadID, CPU,
ProviderId, Id, Task, Opcode, Version, Channel, Level, Keyword, UserDataLength
InvalidEvent/Crimson, TimeStamp, Process Name ( PID), ThreadID, CPU,
ProviderId, Id, Task, Opcode, Version, Channel, Level, Keyword, UserDataLength
MYPROVIDER//Begin, TimeStamp, Process Name ( PID), ThreadID, CPU, etw:ActivityId, etw:Related ActivityId, etw:UserSid, etw:SessionId
I checked if EventIds are embedded in my.etl.file and they are in:
xperf -i my.etl -a eventmetadata
Provider {34f354cd-ae54-4cf8-82d4-5c2ed9076f9c}, Id 10, Version 0: No metadata found.
Provider {34f354cd-ae54-4cf8-82d4-5c2ed9076f9c}, Id 11, Version 0: No metadata found.
Additionally I opened my.etl in EventViewer (under Windows7) and this tool displays EventId.
So what is the problem with converting using xperf.exe?