Managing trace buffers

As mentioned above, you can use TraceEvent() to manage the instrumented kernel's buffers, but it's probably easier to run tracelogger in daemon mode and let it look after the buffers. Nevertheless, here's a summary of how to do it with TraceEvent():

• To allocate the buffers, use the _NTO_TRACE_ALLOCBUFFER command, specifying the number of buffers to allocate per CPU and the base address of the array of trace buffers in the user address space:

  TraceEvent(_NTO_TRACE_ALLOCBUFFER, bufnum, baseaddr);
  

  Allocated trace buffers can store 1024 simple trace events.

  This command returns the virtual address of the start of the buffers.

• To free the buffers, use the _NTO_TRACE_DEALLOCBUFFER command. It doesn't take any additional arguments:

  TraceEvent(_NTO_TRACE_DEALLOCBUFFER);
  

  All events stored in the trace buffers are lost.

• To flush the buffers, regardless of the number of trace events they contain, use the _NTO_TRACE_FLUSHBUFFER command:

  TraceEvent(_NTO_TRACE_FLUSHBUFFER);
  

• To get the number of simple trace events currently stored in the trace buffers of the CPU that the calling thread is running on, use the _NTO_TRACE_QUERYEVENTS command:

  num_events = TraceEvent(_NTO_TRACE_QUERYEVENTS);