List files accessed per-process with xperf?

With xperf I can generate a trace and get a "flat" listing of all files read like so:

xperf -on FileIO+FILE_IO+FILE_IO_INIT+FILENAME -stackwalk FileRead+FileWrite+FileDelete

xperf -start FileIOSession -heap -PidNewProcess "C:\Python27\x86\python.exe scratchy.py" -WaitForNewProcess -BufferSize 1024 -MinBuffers 128 -MaxBuffers 512 -stackwalk HeapAlloc+HeapRealloc -f 开发者_如何学C./tempheap.etl

xperf -stop FileIOSession -stop -d fileio.etl

xperf -i fileio.etl -o fio_output.txt -a filename

Unfortunately, the fio_output.txt file contains a list of every file imaginable that was accessed (from my web browser, IDE, etc). More frustratingly, if I manually open xperfview and open the File I/O Summary Table, I can see my process (python.exe in this case) and the one file it reads (for test purposes) but can't seem to find a way to output that same data on the CLI which is what I need--an unattended, automated method of generating file access info.

If you want to view this data then you should load the trace into WPA, open the file I/O table, and arrange the columns appropriately. Since you want to group by process you should have the process column first, then the orange bar, and then whatever data columns you want.

If you want to export the data to programmatically parse it then you should use wpaexporter.exe, new in WPT 8.1. See this blog post which I wrote describing how to do this: https://randomascii.wordpress.com/2013/11/04/exporting-arbitrary-data-from-xperf-etl-files/ Using wpaexporter lets you decide exactly what data columns you want to export instead of being constrained by the limited set of trace processing actions that xperf.exe gives you.

I suspect you can get this data out from tracerpt.exe instead - I'd give that a try