Capturing multiple kernel events in a single realtime session

[oguzhanf]

I'm trying to get both network and process events in two seperate kernel sessions that I created. I initially tried to use EnableKernelProvider on a single session and that failed with provider has to be enabled on the second call. Code looks like below:

 networksession.EnableKernelProvider(KernelTraceEventParser.Keywords.NetworkTCPIP);
           kernelsession.EnableKernelProvider(KernelTraceEventParser.Keywords.Process);
            kernelsession.Source.Kernel.ProcessStart += Kernel_ProcessStart;
            kernelsession.Source.Kernel.ProcessStop += Kernel_ProcessStop;
            networksession.Source.Kernel.TcpIpSend += Kernel_TcpIpSend;
            networksession.Source.Kernel.TcpIpRecv += Kernel_TcpIpRecv;
            kernelsession.Source.Process();
            networksession.Source.Process();

With this, the only callbacks I'm able to get is the process events, the TCPIP Send and receive callbacks are not called at all. Any ideas on how to program for this?

[brianrob]

You should not need a second kernel session. In fact, several versions of Windows only support having one kernel session. Can you share the failure that you got for the second call to EnableKernelProvider?

[oguzhanf]

I get the following:

'The kernel provider must be enabled first and only once in a session.'

[brianrob]

Ah, thanks for sharing the code. You will want to change the line to:

networksession.EnableKernelProvider(KernelTraceEventParser.Keywords.NetworkTCPIP | KernelTraceEventParser.Keywords.Process);

You can OR the keywords together to make a single call.

[oguzhanf]

Thanks Brian, I thought of that somehow but didn't put it down, I am in shame. I will self-isolate in the mountains and self-reflect for a while before I go back into coding again :)

[brianrob]

Glad that did it. No worries. Come on back. :)