Leveraging ETW for Low-Overhead Production Monitoring

In this lesson, you will learn how to tap into Event Tracing for Windows (ETW) to capture system-level performance data without incurring the heavy overhead of traditional debuggers.

Beyond Application-Level Telemetry

While EventCounters and ActivitySources are excellent for application-specific metrics, they live within your process's memory space. When you need to understand how your code interacts with the underlying OS—such as disk I/O latency, page faults, or context switching—you must move to the kernel level. ETW is the underlying infrastructure that allows you to collect these events with minimal impact on performance, as the data is buffered by the kernel and consumed asynchronously by a separate process.

Collecting Kernel Events

To capture kernel-level diagnostic events in C#, we typically interact with the Microsoft.Diagnostics.Tracing.TraceEvent library. Instead of instrumenting your code, you act as an observer, listening to the system's "heartbeat."

Consider this conceptual approach to starting a session that captures disk I/O events:

using Microsoft.Diagnostics.Tracing.Session;
using Microsoft.Diagnostics.Tracing.Parsers;

// Create a session to collect kernel events
using (var session = new TraceEventSession("MyKernelSession"))
{
    // Enable the Disk IO provider
    session.EnableKernelProvider(KernelTraceEventParser.Keywords.DiskIO);

    session.Source.Kernel.DiskRead += data => {
        Console.WriteLine($"Read requested: {data.ByteSize} bytes at {data.Offset}");
    };

    // Process events asynchronously
    session.Source.Process();
}

Why This is "Low-Overhead"

The "low-overhead" nature of ETW comes from the fact that providers (like the OS kernel) do not perform complex logic when an event occurs. They simply write a tiny, structured payload into a circular kernel buffer. The diagnostic tool you write acts as a consumer, pulling these events from the buffer and processing them on a background thread. Because the application being monitored isn't doing the heavy lifting of serialization or I/O, the performance hit is negligible, making this safe for production environments.

By leveraging ETW, you gain the ability to correlate application performance issues with system-wide bottlenecks that would otherwise remain invisible.

Key Takeaway: ETW provides a high-performance, asynchronous pipeline for collecting kernel-level diagnostics, allowing you to monitor system-wide resource contention without slowing down your production workload.