Classes
class	ActiveUserSession
	Provides system inspection facilities for active and expired user logon sessions. More...
struct	DiskInfo
	Rate or aggregate count of disk read and write operations. More...
struct	EtwEvent
	Represents an individual Event Tracing for Windows (ETW) event record. More...
struct	EtwEventLevelCounts
	Aggregate counts of events partitioned by severity level within a channel. More...
class	EtwLogReader
	High-performance reader and real-time subscriber for Windows Event Log / ETW channels. More...
class	EventLog
	Provides interaction with Windows event logs and Linux syslog services. More...
class	EventLogEntry
	Encapsulates a single record in the event log. More...
struct	MemoryInfo
	Snapshot of physical and virtual memory utilization for the system or a specific process. More...
struct	NetworkConnectionInfo
	Telemetry describing an active TCP or UDP socket endpoint. More...
struct	NetworkUsageInfo
	Network throughput counters for bytes transmitted and received. More...
class	Process
	Provides access to local processes, starting/stopping processes, and querying process snapshots. More...
class	ProcessBatchEventArgs
	Event arguments containing a batch of process snapshots. More...
class	ProcessEventArgs
	Event arguments containing a single process snapshot. More...
struct	ProcessInfo
	Comprehensive telemetry snapshot for an operating system process. More...
struct	ProcessNetworkConnectionInfo
	Collection of open ports and active connections attributed to a specific process. More...
class	ProcessStartInfo
	Specifies a set of values that are used when you start a process. More...
class	ProcessStreamer
	Streams system process updates asynchronously with batching and event notifications. More...
class	ProcessStreamErrorEventArgs
	Event arguments containing error information encountered during streaming. More...
struct	ProcessStreamOptions
	Configuration options controlling the execution of a ProcessStreamer. More...
struct	RdpSessionInfo
	Contains extended telemetry for a Remote Desktop Protocol (RDP) session. More...
struct	ServiceInfo
	Telemetry snapshot for a system background service or daemon. More...
class	Stopwatch
	Provides a set of methods and properties that you can use to accurately measure elapsed time. More...
class	SystemMetrics
	Provides cross-platform diagnostic counters for CPU, memory, disk, network, processes, and services. More...
class	TerminalSession
	Provides querying and enumeration of Terminal Services and RDP sessions. More...
struct	UserSessionInfo
	Encapsulates details about an operating system interactive user session. More...

Typedefs
using	TimeProviderPtr = SmartPointer<TimeProvider>

Enumerations
enum class	EtwEventLevel { All = 0 , Critical = 1 , Error = 2 , Warning = 3 , Info = 4 , Verbose = 5 }
	Filter levels corresponding to standard Windows ETW severity classifications. More...
enum class	EventLogEntryType { Error = 1 , Warning = 2 , Information = 4 , SuccessAudit = 8 , FailureAudit = 16 }
	Defines the event type of an event log entry. More...
enum class	ProcessMetricsDetail { FastDiscoveryOnly = 0 , Progressive = 1 , FullSynchronized = 2 }
	Granularity level for streaming process metrics discovery. More...
enum class	RdpSessionState { Active , Connected , ConnectQuery , Shadow , Disconnected , Idle , Listen , Reset , Down , Init , Unknown }
	Represents the operational connection state of a Remote Desktop or Terminal session. More...

Functions
static std::wstring	BuildCommandLine (const ProcessStartInfo &info)
static std::wstring	BuildLevelQuery (EtwEventLevel level)
static void	CollectTier1Processes (std::vector< ProcessInfo > &vecProcs, int iSessionId)
	Collect process snapshot using Toolhelp32 on Windows.
static bool	CreateWin32Process (const ProcessStartInfo &info, PROCESS_INFORMATION &pi)
static void	DeepEnrichProc (ProcessInfo &proc, bool bIncludeNetwork)
static void	EnumerateWin32Processes (Collections::Generic::List< SmartPointer< Process > > &lstProcs)
static void	ExtractLevelAndTime (PEVT_VARIANT pValues, EtwEvent &evt)
static void	ExtractProviderAndId (PEVT_VARIANT pValues, EtwEvent &evt)
static void	FastPopulateProc (PROCESSENTRY32W *pe32, ProcessInfo &proc)
	Populate fast tier-1 process metadata on Windows.
static void	FilterChannelEvents (const std::vector< EtwEvent > &events, EtwEventLevel level, int iStartIndex, int iMaxEvents, Collections::Generic::List< EtwEvent > &lstEvents)
static bool	FindProcessInSnapshot (int iProcessId, String &sOutName)
static void	HandleQueryFailure (DWORD err)
static void	KillProcessPlatform (void *pHandle)
static WORD	MapEventLogEntryTypeToWin32 (EventLogEntryType eType)
static bool	MatchEventLevelFilter (const EtwEvent &evt, EtwEventLevel level)
static bool	MatchProcessName (const String &sCandidate, const String &sTarget)
static HANDLE	OpenWin32EventLogHandle (const String &sLogName)
static void	PopulateEventProperties (EVT_HANDLE hContext, EVT_HANDLE hEvt, EtwEvent &evt)
static void	PopulateSessionInfo (const WTS_SESSION_INFOW &wtsInfo, UserSessionInfo &session)
static bool	QueryProcessNameById (int iProcessId, String &sOutName, HANDLE &hOutProc)
static bool	QueryWin32LogRecordCount (const std::wstring &wChannel, unsigned long long &uCount)
static bool	RefreshProcessPlatform (void *pHandle, int &iExitCode)
static HANDLE	RegisterWin32EventSourceHandle (const String &sSource)
static bool	RenderSystemProperties (EVT_HANDLE hContext, EVT_HANDLE hEvt, std::vector< BYTE > &vBuffer)
static bool	StartProcessPlatform (const ProcessStartInfo &info, int &iId, void *&pHandle, bool &bExited)
static void	ValidateWin32ReportResult (BOOL bReported, DWORD dwErr, const String &sSource)
static bool	WaitForExitPlatform (void *pHandle, int iMilliseconds)

Variables
static std::map< String, std::vector< EtwEvent > >	s_mapChannelEvents
static std::map< String, std::vector< EventLogStoreEntry > >	s_mapLogEntries
static std::map< int, ProcessCpuSample >	s_mapProcessCpuSamples
static std::map< String, String >	s_mapSourceToLog
static std::mutex	s_mtxEtw
static std::mutex	s_mtxEventLog
static std::vector< String >	s_vRegisteredChannels

Typedef Documentation

◆ TimeProviderPtr

using DotNetDupe::System::Diagnostics::TimeProviderPtr = SmartPointer<TimeProvider>

Definition at line 12 of file Stopwatch.h.

Enumeration Type Documentation

◆ EtwEventLevel

enum class DotNetDupe::System::Diagnostics::EtwEventLevel

strong

Filter levels corresponding to standard Windows ETW severity classifications.

Enumerator
All	All events regardless of level.
Critical	Abnormal exit or severe failure requiring immediate intervention.
Error	Significant problem that indicates a runtime failure.
Warning	Non-critical condition that indicates potential future problems.
Info	Normal operational informational events.
Verbose	Detailed developer or diagnostic trace information.

Definition at line 34 of file EtwLogReader.h.

◆ EventLogEntryType

enum class DotNetDupe::System::Diagnostics::EventLogEntryType

strong

Defines the event type of an event log entry.

Modeled after .NET System.Diagnostics.EventLogEntryType.

Enumerator
Error	An error event indicating significant problem.
Warning	A warning event indicating a potential problem.
Information	An informational event representing successful milestones.
SuccessAudit	An audit event tracking successful security access.
FailureAudit	An audit event tracking failed security access.

Definition at line 22 of file EventLog.h.

◆ ProcessMetricsDetail

enum class DotNetDupe::System::Diagnostics::ProcessMetricsDetail

strong

Granularity level for streaming process metrics discovery.

Enumerator
FastDiscoveryOnly	Minimal discovery retrieving PID, name, and paths without deep inspection.
Progressive	Background progressive enrichment of CPU, memory, and disk usage.
FullSynchronized	Full synchronous inspection including open ports and network sockets.

Definition at line 10 of file ProcessStreamOptions.h.

◆ RdpSessionState

enum class DotNetDupe::System::Diagnostics::RdpSessionState

strong

Represents the operational connection state of a Remote Desktop or Terminal session.

Enumerator
Active	User is logged on and actively interacting with the session.
Connected	Client is connected to terminal session but logon not yet completed.
ConnectQuery	Session is in process of connecting to client.
Shadow	Session is being shadowed by another session.
Disconnected	Session is disconnected but state preserved for reconnection.
Idle	Session is waiting for connection.
Listen	Session is listening for incoming client connections.
Reset	Session is being reset.
Down	Session is down or non-operational.
Init	Session is initializing.
Unknown	State could not be determined.

Definition at line 15 of file TerminalSession.h.

Function Documentation

◆ BuildCommandLine()

std::wstring DotNetDupe::System::Diagnostics::BuildCommandLine ( const ProcessStartInfo & info )

static

Definition at line 58 of file Process.cpp.

References DotNetDupe::System::Diagnostics::ProcessStartInfo::Arguments, BuildCommandLine(), DotNetDupe::System::Diagnostics::ProcessStartInfo::FileName, DotNetDupe::System::String::GetLength(), DotNetDupe::System::String::GetRawString(), and DotNetDupe::System::Internal::StringConvertInternal::Utf8ToWChar().

Referenced by BuildCommandLine(), and CreateWin32Process().

◆ BuildLevelQuery()

std::wstring DotNetDupe::System::Diagnostics::BuildLevelQuery ( EtwEventLevel level )

static

Step: Build XPath query string for the requested severity level.

Definition at line 194 of file EtwLogReader.cpp.

References BuildLevelQuery(), Critical, Error, Info, Verbose, and Warning.

Referenced by BuildLevelQuery().

◆ CollectTier1Processes()

void DotNetDupe::System::Diagnostics::CollectTier1Processes	(	std::vector< ProcessInfo > &	vecProcs,
		int	iSessionId )

static

Collect process snapshot using Toolhelp32 on Windows.

Definition at line 55 of file ProcessStreamer.cpp.

References DotNetDupe::System::SystemException::SystemException(), CollectTier1Processes(), FastPopulateProc(), DotNetDupe::System::Diagnostics::ProcessInfo::iProcessId, and DotNetDupe::System::Diagnostics::ProcessInfo::iSessionId.

Referenced by CollectTier1Processes().

◆ CreateWin32Process()

bool DotNetDupe::System::Diagnostics::CreateWin32Process	(	const ProcessStartInfo &	info,
		PROCESS_INFORMATION &	pi )

static

Definition at line 68 of file Process.cpp.

References DotNetDupe::System::UnauthorizedAccessException::UnauthorizedAccessException(), BuildCommandLine(), DotNetDupe::System::Diagnostics::ProcessStartInfo::CreateNoWindow, and CreateWin32Process().

Referenced by CreateWin32Process(), and StartProcessPlatform().

◆ DeepEnrichProc()

void DotNetDupe::System::Diagnostics::DeepEnrichProc	(	ProcessInfo &	proc,
		bool	bIncludeNetwork )

static

Deep enrichment helper.

Definition at line 105 of file ProcessStreamer.cpp.

References DeepEnrichProc(), and DotNetDupe::System::Diagnostics::SystemMetrics::EnrichProcessInfo().

Referenced by DeepEnrichProc().

◆ EnumerateWin32Processes()

void DotNetDupe::System::Diagnostics::EnumerateWin32Processes ( Collections::Generic::List< SmartPointer< Process > > & lstProcs )

static

Take atomic kernel snapshot of all active system processes via Toolhelp32.

Iterate snapshot entries via Process32FirstW and Process32NextW.

Release snapshot handle.

Definition at line 331 of file Process.cpp.

References EnumerateWin32Processes(), and DotNetDupe::System::SmartPointer< T >::NewShared().

Referenced by EnumerateWin32Processes(), and DotNetDupe::System::Diagnostics::Process::GetProcesses().

◆ ExtractLevelAndTime()

void DotNetDupe::System::Diagnostics::ExtractLevelAndTime	(	PEVT_VARIANT	pValues,
		EtwEvent &	evt )

static

Step: Extract event level and creation FILETIME.

Definition at line 79 of file EtwLogReader.cpp.

References DotNetDupe::System::DateTimeOffset::DateTimeOffset(), DotNetDupe::System::Diagnostics::EtwEvent::dtTimeCreated, ExtractLevelAndTime(), and DotNetDupe::System::Diagnostics::EtwEvent::iLevel.

Referenced by ExtractLevelAndTime(), and PopulateEventProperties().

◆ ExtractProviderAndId()

void DotNetDupe::System::Diagnostics::ExtractProviderAndId	(	PEVT_VARIANT	pValues,
		EtwEvent &	evt )

static

Step: Extract publishing provider name and event ID.

Definition at line 66 of file EtwLogReader.cpp.

References DotNetDupe::System::String::String(), ExtractProviderAndId(), DotNetDupe::System::Diagnostics::EtwEvent::iEventId, DotNetDupe::System::Diagnostics::EtwEvent::sProviderName, and DotNetDupe::System::Utils::StringConvert::WCharToUtf8().

Referenced by ExtractProviderAndId(), and PopulateEventProperties().

◆ FastPopulateProc()

void DotNetDupe::System::Diagnostics::FastPopulateProc	(	PROCESSENTRY32W *	pe32,
		ProcessInfo &	proc )

static

Populate fast tier-1 process metadata on Windows.

Definition at line 34 of file ProcessStreamer.cpp.

References DotNetDupe::System::String::String(), FastPopulateProc(), DotNetDupe::System::Diagnostics::ProcessInfo::iProcessId, DotNetDupe::System::Diagnostics::ProcessInfo::iSessionId, DotNetDupe::System::Diagnostics::MemoryInfo::lPhysicalMemoryBytes, DotNetDupe::System::Diagnostics::MemoryInfo::lPrivateBytes, DotNetDupe::System::Diagnostics::ProcessInfo::memory, DotNetDupe::System::Diagnostics::ProcessInfo::sName, and DotNetDupe::System::Diagnostics::ProcessInfo::sPath.

Referenced by CollectTier1Processes(), and FastPopulateProc().

◆ FilterChannelEvents()

void DotNetDupe::System::Diagnostics::FilterChannelEvents	(	const std::vector< EtwEvent > &	events,
		EtwEventLevel	level,
		int	iStartIndex,
		int	iMaxEvents,
		Collections::Generic::List< EtwEvent > &	lstEvents )