ETW receiver with control path and session

rust/otap-dataflow/Cargo.toml

@@ -217,6 +217,7 @@ xxhash-rust = { version = "0.8", features = ["xxh3"] }
 zip = "=8.6.0"
 byte-unit = { version = "5.2.0", features = ["serde"] }
 cpu-time = "1.0.0"
+one_collect = { git = "https://github.com/microsoft/one-collect.git", rev = "cfe3f78" }
 
 azure_core = {version = "0.35.0", default-features = false }
 azure_identity = {version = "0.35.0", default-features = false }
@@ -302,6 +303,8 @@ contrib-processors = ["otap-df-contrib-nodes/contrib-processors"]
 condense-attributes-processor = ["otap-df-contrib-nodes/condense-attributes-processor"]
 recordset-kql-processor = ["otap-df-contrib-nodes/recordset-kql-processor"]
 resource-validator-processor = ["otap-df-contrib-nodes/resource-validator-processor"]
+# Contrib receivers (opt-in) - Windows-only
+etw-receiver = ["otap-df-contrib-nodes/etw-receiver"]
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tarpaulin_include)'] }

rust/otap-dataflow/configs/etw-console.yaml

@@ -0,0 +1,39 @@
+# ETW to Console pipeline
+#
+# Subscribes to Windows ETW providers and prints events to the console.
+#
+# Usage (run as Administrator for ETW access):
+#   cargo run --features etw-receiver -- -c configs/etw-console.yaml
+#
+# The receiver captures raw ETW events from the configured providers
+# and emits summary as an internal log/event. Full Arrow encoding is a TODO.
+
+
+version: otel_dataflow/v1
+engine: { }
+policies:
+  resources:
+    core_allocation:
+      type: core_count
+      count: 4
+groups:
+  default:
+    pipelines:
+      main:
+        nodes:
+          etw:
+            type: receiver:etw
+            config:
+              session_name: "OtelArrowETW"
+              providers:
+                # Microsoft-Windows-Kernel-Process
+                - guid: "22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716"
+                  level: information
+          console:
+            type: exporter:console
+            config: {}
+
+        connections:
+          - from: etw
+            to: console
+

rust/otap-dataflow/crates/contrib-nodes/Cargo.toml

@@ -55,15 +55,17 @@ reqwest = { workspace = true, optional = true, features = ["rustls-no-provider"]
 sysinfo = { workspace = true, optional = true }
 urlencoding = { workspace = true, optional = true }
 
+[target.'cfg(windows)'.dependencies]
+one_collect = { workspace = true, optional = true }
+
 [target.'cfg(target_os = "linux")'.dependencies]
-# TODO: Remove this pinned git dependency once one-collect is upstream in the
-# normal dependency graph and no longer needs to be pulled directly here. The
-# pinned commit is from 2026-04-10.
-one_collect = { git = "https://github.com/microsoft/one-collect.git", rev = "9292caacaddf9ff9e4fbdf77bc62b5ec25494c84", features = ["scripting"], optional = true }
+one_collect = { workspace = true, optional = true }
 tracepoint_decode = { workspace = true, optional = true }
 
 [features]
+etw-receiver = ["dep:one_collect"]
 contrib-receivers = [
+    "etw-receiver",
     "user_events-receiver",
 ]
 user_events-receiver = [