I did some short episodes on Defrag Tools. Altogether, there will be 3 and I will update the blog (updated) with the third after it airs. These provide simple background information to help new Message Analyzer users. I hope you find them useful.
I would like to use MA to real-time monitor ETW events published by my application. However, MA doesn't seem to be able to handle the inline manifests generated by the .NET EventSource class. I would like to be able to specify just the provider id (guid) to start a trace session but MA doesn't accept that. If it could, then it would need to handle the manifest event specially to get the schema for the rest of the provider's events.
If you are on the machine and capturing with Message Analyzer, we should save the manifest information we gather from the system inside of the .matp file (Message Analyzer Parsed). This means we should maintain the same parsing when you bring to another machine that doesn't have the component installed.
If you took a trace using Netsh or logman, and only have a raw ETL. Then you need to register the manifest on the machine reading the trace. This means running "Wevtutil –I blah.man", which will require all dependent DLLs to be installed on the machine. These dependencies are normally part of the manifest file.
You need to start creating more video trainings for Message Analyzer. Defrag Tools videos are short and they don't go deep.