ETW ProcessTrace() trying to reserve 1GB of memory on XP? -


i'm writing application uses nt kernel logger via etw trace functions. consumes in real-time mode. works fine on windows 7 test machine on xp vm getting regular out of memory exceptions.

using apimonitor (amazing tool btw) tracked down call ntallocatevirtualmemory() processtrace() win32 api call itself. trying allocate 1gb of contiguous memory, can seen in screenshot.

api-monitor

has encountered before? cannot conceive why need allocate memory. additionally, call occurring deep within processtrace() call stack in undocumented win32 api function (wmimofenumerateresourcesa()), seems i'm not going able influence it. has encountered before? i'd appreciate potential solutions.

i need support xp/2003 , on 32-bit versions can't assume 1gb of contiguous memory available. real-time processing requirement. however, workarounds using file-backed logging doesn't involve losing events consider e.g. i'd "real-time" process new events added .etl files instead, if possible.


Comments

Popular posts from this blog

java - Jmockit String final length method mocking Issue -

asp.net - Razor Page Hosted on IIS 6 Fails Every Morning -

c++ - wxwidget compiling on windows command prompt -