Hacker News Reader

Comment by muststopmyths | Hacker News Reader

Microsoft had a poorly documented tool called tracewpp that did this. Blindingly fast logging with very little runtime overhead.

It was hard to figure out how to use it without documentation so it wasn’t very popular. No idea if they still ship it in the DDK.

It was a preprocessor that converted logging macros into string table references so there was no runtime formatting. You decoded the binary logs with another tool after the fact.

Vaguely remember some open source cross platform tool that did something similar but the name escapes me now.

View on HN

I think the Windows event log works like this. Sadly it's very opaque and difficult to use for non admin apps (you need admin rights to install your logs for the first time. Afterwards you can run with less privileges.)

If you're thinking of ETW (event tracing for Windows) and not the actual Windows EventLog itself, then you're right. traceWPP used ETW under the hood to record logging as ETW events in a file.

The Windows Event Log also used (uses?) this idea of pre-defined messages and you just supplied an event ID and data to fill in the blanks in the message.

Originally there was only one system-wide application event log and you needed to be admin to install your message definitions but it all changed in Vista (IIRC). I'd lost interest by then so I don't know how it works now. I do know that the event log viewer is orders of magnitude slower than it was before the refit.

It’s not the same system. The message catalog based method requires entering your message strings in .mc files during compilation. It is an aid for localization and display is up to the application as to time and method of output.

ETW is for high speed general purpose logging of low-level events with multiple collection mechanisms including realtime capture.

> It was a preprocessor that converted logging macros into string table references so there was no runtime formatting. You decoded the binary logs with another tool after the fact.

Is be curious how that stacks up against something like zstd with a predefined dictionary.

Apple’s os_log API also works this way.

Reply on news.ycombinator.com