Sometimes I get ETW traces which cannot be loaded by WPA. Initially I found these on Windows Server 2022 on a VMWare machine. I suspected some issue how VMWare virtualizes things on newer OSes but I did get this error also on my new non virtual Windows 11 box. After asking around it turned out that this is side effect of .NET 7 processes. When a .NET 7 process is running and you use WPR profiles you will get unreadable traces back.
When you try to process them with TraceProcessing Library you get something like
C:\Temp>etwanalyzer -extract all -fd test.etl
1 - files found to extract.
Error: One or more errors occurred. (The request is not supported. (0x80070032)) Check C:\Utils\ETWAnalyzer\ETWAnalyzer_Trace.log for full details, or use -debug switch to get full output.
Error: EventSink {39cda801-59d8-472d-bc00-601a4150c4c4} returned HRESULT 0x80070032 on:
Event#: 294800 (T#0:#294800)
TimeStamp: 6644961, Process: 12172, Thread: 8008, Cpu: 10
ProviderId: {a669021c-c450-4609-a035-5af59af4df18}
EventDescriptor: 0x0096 0x0001 0x2a 0x01 0x00 0x05 0x0000000000020000
UserDataLength: 405The default wpr profiles are affected, but for some reason my custom WPR Profiles (https://github.com/Alois-xx/FileWriter/blob/master/MultiProfile.wprp) are not. The only way to solve this is to use either custom WPR profiles or to kill all .NET 7.0 processes. But which ones?
With ETWAnalyzer it is easy
Etwanalyzer -fd c:\temp\extract\ManySlowCalls_MAGNON.03-07-2023.23-21-41.json -dump version -dll *coreclr* -versionfilter *7.0* 
Ahh PhoneExperienceHost.exe is the bad guy. As workaround all you need to do is to kill PhoneExperienceHost and you should get analyzable ETW traces again.
A future WPA/TraceProcessing version should contain the fix, but until then you need to use one of the workarounds.
Alois Kraus 
I have a WPR file recorded by Windows Perf Recorder. It shows the 0x80070032 error. How can I trace the root of the issue? It shows that the same provider Id as yours is the problem:
Error: EventSink {39cda801-59d8-472d-bc00-601a4150c4c4} returned HRESULT 0x80070032 on:
Event#: 3168061 (T#0:#3168061)
TimeStamp: 32649621, Process: 7100, Thread: 19276, Cpu: 5
ProviderId: {a669021c-c450-4609-a035-5af59af4df18}
EventDescriptor: 0x0096 0x0001 0x2a 0x01 0x00 0x05 0x0000000000020000
UserDataLength: 77
But it does not generate the json file that I can use to figure out which specific process is causing bad data.
LikeLike
Which version of ETWAnalyzer are you using? The latest one should not have the issue. For WPA you can use the Preview version from Windows Store. See this post with more background Infos: https://devblogs.microsoft.com/performance-diagnostics/etw-trace-processing-fails-with-error-code-0x80070032/
LikeLike