#etw — Public Fediverse posts

Microsoft's ETW MCP lets Copilot dig through Windows performance traces

https://betanews.com/article/microsoft-etw-mcp-windows-trace-analysis/

#windowsdev #ai #mcp #etw #performance #tracing #devtools

@BlumeEvolution @steffensmile @Teh_Doc_Inan @solaris

a) das Beispiel teure Kaffeemaschine für Kaffeebohnen (arme Studis müssen Pads nehmen) ist nicht lebenspraktisch, da Studis ja auch gemahlenen Kaffee, Filtertüren, preiswerte Kaffeemaschinen benutzen können (Kaffeesatz als Dünger für Pflanzen)☕

b) vielen Vermietern fehlen die Mittel zur Umrüstung auf...🏘️ 💶

c) Besitzer*innen #ETW müssen sich Abstimmungsergebnissen beugen - sitzen also auch in Fallen (#Heizung #Gemeinschaftseigentum)

No Agent, No Problem: Discovering Remote #EDR

#Windows #ETW

https://jonny-johnson.medium.com/no-agent-no-problem-discovering-remote-edr-8ca60596559f

PerfView and TraceEvent 3.1.18

https://github.com/microsoft/perfview/releases/tag/v3.1.18

#dotnet #perf #etw #lttng #performance

Три слона, на которых держится логирование в Windows

Продолжаем наш цикл статей о типах и методах работы сборщиков данных с конечных точек, или, как принято их называть – агентов. В первой статье мы познакомились с этой сущностью и изучили основные нюансы сбора данных с их помощью. Так как мы в рамках разработки своих продуктов занимаемся и лог-менеджментом, и сбором событий, то хочется поделиться продолжением нашей обширной аналитики в quickstart формате. Поэтому в этом выпуске подробнее разберем функционал и используемые инструменты источников на ОС Windows.

https://habr.com/ru/companies/securityvison/articles/862352/

#Логирование #сбор_событий #eventlog #журналы_windows #журналы_событий #sysmon #event_tracing_for_windows #event_logging #event_log #etw

New blog post! Stack walk profiling NodeJS in Windows: https://blogs.igalia.com/dape/2023/03/14/stack-walk-profiling-nodejs-in-windows/ #etw #webperf cc @igalia (1/4)

Last blog post in my native call stack profiling series just published. This time about the work I did this year in #V8 #Windows #ETW stack walk support: https://blogs.igalia.com/dape/2022/12/21/native-call-stack-profiling-3-3-2022-work-in-v8/

In march, V8 ETW support was broken. After fixing a small regression, we could proceed improving readability of the traces, and improving initialization. This @igalia work was sponsored by #Bloomberg.

The overhead in V8 is very small now, making the traces more accurate. This work is available in V8 10.9.0.

#WebPerf

Just published the second blog post in my native call stack profiling series, about Event Tracing for Windows and #Chromium: https://blogs.igalia.com/dape/2022/11/29/native-call-stack-profiling-2-3-event-tracing-for-windows-and-chromium/

#ETW is the native tracing/profiling tool in #Windows. It samples stack traces for further analysis. #V8 assists providing information of the JIT-compiled functions, then available for stack walk analysis.

Big thanks to @[email protected], for his series of blog posts about performance analysis, and for writing #UIForETW. https://github.com/google/UIforETW

Just published: Solving #Windows Log Collection Challenges with Event Tracing https://nxlog.co/whitepapers/windows-event-tracing #etw

Event Tracing for Windows (ETW) logs kernel, application and other system activity. ETW provides better data and uses less resources.

I also added a section with an example of messing around with ETW for another reason to do ETW data centralization.

This part had to be taken out though: https://infosec.exchange/@superruserr/103514722074754232

@maxg See https://www.youtube.com/watch?v=gj_bOp7JYUU #splunk #logging #etw

Intrusion Detection with #ETW

https://blog.zacbrown.org/2017/04/11/hidden-treasure-intrusion-detection-with-etw-part-1

https://blog.zacbrown.org/2017/05/9/hidden-treasure-intrusion-detection-with-etw-part-2

#infosec

A few tries at sending test #ETW events (from Microsoft-Windows-DNSServer provider) to #Splunk over Syslog. Now just need to find a scenario to show various ETW traces etc.