-
Notifications
You must be signed in to change notification settings - Fork 147
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
The object_manager_provider does not support DuplicateHandle events #212
Comments
Update: If it may be of any help, when I inspect errors using
I suppose 1168 refers to |
jstarink
changed the title
The object_manager_provider does not receive DuplicateHandle events in the callback
The object_manager_provider does not support DuplicateHandle events
Jun 30, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Summary
I am trying to track object creation, destruction and duplication on a live Windows 10 machine. According to the MOF definitions on MSDN, these events correspond to opcodes 32, 33 and 34 respectively:
According to the examples,
object_manager_provider
is the struct to go for when tracking these events. And indeed, I can receive and parse events with opcode 32 and 33. However, events with opcode 34 seem to never be reported by the callback. Am I missing something, should I enable some extra flags/options, or could this be a bug?To Reproduce
I use the following source code, which is heavily inspired by the provided examples:
krabstest.cpp
As a test application, I have a basic program that creates a new file object, duplicates it 10 times, then closes all duplicated handles, and finally closes the main handle.
testerapp.cpp
When running this with admin rights on a Windows 10 Pro N x64 machine, version 22H2, build 19045.3086, I only get the following output:
Notice how a single file object creation (
12c
) is directly followed up by 11 handle closure events, without any report of the file handle being duplicated.Additional Context
It is maybe worth mentioning that other libraries that consume ETW events do seem to be able to report on object duplication. For example, using
Microsoft.Diagnostics.Tracing.TraceEvent
of the perfview project, reporting on handle duplication works fine:The text was updated successfully, but these errors were encountered: