Add caller file name to WSLCCreateSession event (#40381)
Uses QueryFullProcessImageNameW to get the calling process file name for the WSLCCreateSession event. This will allow for a better bucketization of usage statistics.
JohnMcPMS committed
May 1, 2026 at 15:31 UTC
d242a69ef5820f20934a2e2216aa8dface16e670
1 file changed
+11
src/windows/service/exe/WSLCSessionManager.cpp
+11
@@ -191,11 +191,21 @@ void WSLCSessionManagerImpl::CreateSession(const WSLCSessionSettings* Settings,
191
Settings = &defaultSettings->Settings;
192
}
193
194
+ std::wstring callerFileName;
195
+
196
HRESULT creationResult = wil::ResultFromException([&]() {
197
// Get caller info.
198
const auto callerProcess = wslutil::OpenCallingProcess(PROCESS_QUERY_LIMITED_INFORMATION);
199
const ULONG sessionId = m_nextSessionId++;
200
const DWORD creatorPid = GetProcessId(callerProcess.get());
201
+
202
+ // Query the full image path of the calling process and extract just the file name.
203
+ std::wstring callerFilePath;
204
+ if (SUCCEEDED_LOG(wil::QueryFullProcessImageNameW<std::wstring>(callerProcess.get(), 0, callerFilePath)))
205
+ {
206
+ callerFileName = std::filesystem::path(callerFilePath).filename().wstring();
207
+ }
208
+
209
const auto userToken = wsl::windows::common::security::GetUserToken(TokenImpersonation);
210
211
// Create the VM in the SYSTEM service (privileged).
@@ -234,6 +244,7 @@ void WSLCSessionManagerImpl::CreateSession(const WSLCSessionSettings* Settings,
244
TraceLoggingValue(creationResult, "Result"),
245
TraceLoggingValue(tokenInfo.Elevated, "Elevated"),
246
TraceLoggingValue(static_cast<uint32_t>(Flags), "Flags"),
247
+ TraceLoggingValue(callerFileName.c_str(), "CallerFileName"),
248
TraceLoggingLevel(WINEVENT_LEVEL_INFO));
249
250
THROW_IF_FAILED_MSG(creationResult, "Failed to create session: %ls", resolvedDisplayName.c_str());