

        static void Main()
        {
            ProcessTraceData firstProcess = null;
            using (var source = new ETWTraceEventSource("MyEventData.etl"))
            {
                source.Kernel.ProcessStart += delegate(ProcessTraceData data) {
                    Console.WriteLine("Process {0} Command Line {1}", data.ProcessName, data.CommandLine);
                    if (firstProcess == null)
                        firstProcess = (ProcessTraceData) data.Clone();   // Subtle Error without Clone()
                };
                source.Process();
                Console.WriteLine("The first process was {0} Command Line {1}", firstProcess.ProcessName);
            }
        }




