What is it?

ETWControler allows you to troubleshoot performance problems in distributed systems. The main use cases are:

  • A client and a server responds to user input (e.g. a online game). You want to know if the sporadic hangs are due to
    • Client Machine
    • Network
    • Server
  • You want to know what consequences the user input causes on your local machine.

In a distributed world performance troubleshooting has just got much harder. Now we have at least two computers and the Internet involved. Sane developers blame for all performance problems, which involve a remote server, the network which can be true or not. It is nearly impossible to correlate user input of one computer (lets say a keyboard press) with the associated network traffic and the following actions on a remote server, since most of the time the network traffic is encrypted or too hard to follow because of the huge amount of data transferred.

This is where ETWControler comes into the game. The name ETWControler stems from Event Tracing for Windows. ETW is the most detailed and fastest profiling facility on Windows. If you do not know it you have one more reason to learn how to make use of it. ETWControler as the name suggests controls simultaneously profiling on two machines. It can start/stop at the same time ETW tracing on the local and remote machine making it an ideal buddy to capture data on one or more systems.


It allows you to simultaneously capture and correlate profiling information from the client, network and server. If the user presses a key or a mouse button it can be sent to the remote server over a dedicated port. ETWControler comes with a built in keyboard and mouse logger which writes the captured keyboard and mouse events locally to ETW and sends them over a configurable port in plain text (no encryption!) over the wire to the remote server where another instance of ETWControler receives the user events and logs them also as ETW events.

Additionally there is a "Slow" button which can be assigned to a mouse or keyboard hot key which logs a user configurable message to the local computer, network stream and the remote machine. With this hotkey you can create marker events where you did experience sluggish behavior or other interesting incidents. This makes it very easy to identify in the network stream the exact time point where a slowdown did happen and you can look with e.g. Wireshark directly at the plain text data and search for your user defined message in a multi GB network trace stream.

Sure you can wade through GB network traces if you wish but I want to get my hands out of the network trace analyzer as fast as possible. These marker events on a dedicated port make searching and marking of strategic events trivial. Every logged event gets a unique number which allows you to search for specific mouse/keyboard events as well. The data flow is shown below:


Currently ETWControler does not start or stop Wireshark captures. You need to start network capturing on the network devices by yourself. But now you can correlate with the help of the keyboard and the Slow Marker events both ETW traces and the network trace without any trouble. That makes it much easier to find the point of interest in any captured ETW and/or network stream. You can e.g. watch your network load during an integration test and insert at interesting spikes marker events to check if the network performance did drop due to network issues or if the server or the client was busy doing something else (e.g. the virus scanner was active or your application did perform a garbage collection).



Last edited Jan 25, 2014 at 12:03 PM by Alois, version 15