2.5.9.0

New Features

-Dump CPU

• Enable sorting in CPU total mode with -sortBy First/Last to sort by process start/end time.
  E.g. ETWAnalyzer -dump cpu -sortBy First -NewProcess 1

-Dump TCP

• Added -zerotime support
  • You can shift printed times (connect/disconnect/retransmit) by e.g. relative to e.g. a process start event. This is useful to compare several
    ETL files.
• Added -ProcessFmt support
  • Enable printing process start/end times in -dump TCP output.
• Added to CSV output Process start/end and duration.

-Dump Memory

• Added -ProcessFmt support to also print process start/end/duration timings besides executable name.

Breaking

-Dump File

• Removed from -dump file -MinMax. The other options -MinMax[Read/Write/Total][Size/Time] and -MinMaxTotalCount are the now much better alternatives.
• Units of KB are like in -dump Disk SI units with 1000 bytes and not 1024 bytes. This was done to stay consistent with -Dump Disk.

Enhancements

-Dump File

• When -SortBy criteria is used a dynamic column is added which shows the values by which the sort is done.
• The same is true for totals which are also properly aggregated.
• When -FileOperation filter is used like Read then all other columns which are not dealing with read data are nulled out. That way you can filter by read count with
  -FileOperation Read -MinMaxTotalCount 100 -SortBy Count

Fixes

• Add Nuget package Microsoft.Windows.EventTracing.Processing.Toolkit 1.11.0 to work around error 0x80070032 when loading ETLs with .NET 7.0 Rejit events.
• -Dump Disk total flush time unit was us and not s.
• -Dump Memory -smi would NullRef when no module data is present.
• -Dump Tcp Fixed output alignment when IP addresses were shorter than headline.
• Improved help for enum parsing when no enum value was present. Now all allowed values are printed in help.