2.5.0.0

ETWAnalyzer 2.5.0.0

• Update to released version 1.11.108 of TraceProcessing which is no longer beta.
• -dump Process Added -MinMaxStart filter to filter processes by start time in etw session time.
• -dump CPU now also supports -smi switch which will print for each executable the file version, description and directory from where it was started.
• -dump CPU with -sortby xx and -topn changed behavior. We use now the -TopN processes what is used by the -SortBy clause. Previously we sorted only by CPU. The old behavior has on the + side that the -TopN processes stay stable regardless of sort order. The new sort behavior is more consistent, although it might produce surprising output.
• When -ShowTotal is used the Json files files and the processes inside file processes are sorted by their totals.
  Improved total output formatting a lot to be more readable and also include ready times which are now color coded red.
• Document that -Dump File can also sort by file operation count

Fixes

• -dump Process will throw InvalidOperationException when no lines are to print because max will throw.
• NullReferenceException in MachineDetailsExtractor when user SID was null.