ETW - Windows 8.1 - EventWrittenEventArgs Payload Missing Data

Question

I've had some ETW code in a PCL that's referenced and being used in a Windows 8.1 app that's been working for months. Specifically, this line of code:

WriteEvent((int)errorId, message, (useSysLog ? sysLogErrorId : SysLogSeverity.NotSpecified));

has been sending an array of objects to the Payload property of the EventWrittenEventArgs in my OnEventWritten function of my EventListener.

I would get a Payload with a Count of 2 and it would contain a string and a SysLogSeverity instance.

I've recently upgraded my Visual Studio to 2015 and now, my Payload only contains a single property - the string. The SysLogSeverity is no longer coming through in OnEventWritten.

Could upgrading to VS2015 be my problem? The library the ETW code is in didn't change when the upgrade took place. I've checked the git history of my project and no assembly versions have changed.

I'm at a loss for why this is happening and would really appreciate any ideas on how to debug this/what could be going on.

Update:

Here's what my helper method looks like that's calling the WriteEvent function:

[NonEvent]
    private void _WriteEvent(int errorId, string message, SysLogSeverity sysLogSeverity)
    {
        if (_errorLevelsMap.ContainsKey((ErrorIds)errorId))
        {
            sysLogSeverity = _errorLevelsMap[(ErrorIds)errorId];
        }

        if (this.IsEnabled())
        {
            WriteEvent((int)errorId, message, sysLogSeverity);
        }
    }

Here's the definition of _errorLevelsMap:

    private readonly Dictionary<ErrorIds, SysLogSeverity> _errorLevelsMap = new Dictionary<ErrorIds, SysLogSeverity>
    {
        { ErrorIds.Critical, SysLogSeverity.Critical },
        { ErrorIds.Error, SysLogSeverity.Error },
        { ErrorIds.Informational, SysLogSeverity.Informational },
        { ErrorIds.Verbose, SysLogSeverity.Debug },
        { ErrorIds.Warning, SysLogSeverity.Warning }
    };

The signatures match and still, the Payload only contains the message; not the sysLogErrorId.

Thanks!

magicandre1981 · Accepted Answer · 2015-09-18T17:00:36.717

0

You need to have the same amount of parameters in the method which calls WriteEvent, because the EventSource library generate the manifest based on those parameters and not the parameters that you pass to WriteEvent.

From the _EventSourceUsersGuide.docx (page 6):

The number and types of arguments passed to the ETW method must exactly match the types passed to the WriteEvent overload it calls.

edited Sep 18 '15 at 17:00

answered Sep 18 '15 at 16:50

magicandre1981

27,895
5
86
127

Oh my. That's very interesting. Currently, the signatures don't match. I'll try that in a little bit. Do you know if that is a new requirement? – Jason Anderson Sep 18 '15 at 18:07
I never used the internal EcentSource of .net I always used the NuGet version and here it was always required. https://www.nuget.org/packages/Microsoft.Diagnostics.Tracing.EventSource – magicandre1981 Sep 19 '15 at 04:57
I forgot to mention the ETW code is in a PCL; I can't use the nuget package. I'll update the OP. – Jason Anderson Sep 21 '15 at 01:40
the nuget package does include portable version. Get rid of this helper functions and call them outside of the Event and remove [NonEvent]. – magicandre1981 Sep 21 '15 at 03:54
It is fixed but only after I followed your suggestion. Prior to updating to VS 2015, the code wasn't enforcing that constraint. After updating (and even after uninstalling 2015), it was enforcing that constraint. I updated the code exactly how you said and it started working again. Thanks! – Jason Anderson Oct 16 '15 at 17:18
1

VS2015 installs .net 4.6 which includes now the newer EventSource class that was shipped on NuGet. And this one requires this rule. I never used the integrated one only the NuGet version to always get the most up2date version. – magicandre1981 Oct 17 '15 at 06:13

ETW - Windows 8.1 - EventWrittenEventArgs Payload Missing Data

1 Answers1