0

In my Win10 UWP app, I am using The FileLoggingSession to log various events in my app. I would like to make use of LoggingFields to add custom fields to my log message.

We are using Microsoft Message Analyzer to view the logs. However, the custom fields get displayed all garbled.

Here is the code I am using for custom fields:

var channel = new LoggingChannel("MyChannel");
var fields = new LoggingFields();

fields.AddString("Source", Source);
fields.AddString("Class", LogClass);
fields.AddString("Message", Message);
channel.LogEvent("MyEvent", fields, LoggingLevel.Information);

When I read the log via Message Analyzer and then export to csv this is an example of what I see in my source field GetPolicy()献㎬䠀逆ྠ where it should just be GetPolicy().

However if I use tracerpt to extract the information to xml it does come out correct: <Data Name="Source">GetPolicy()</Data>

Michael Sabin
  • 1,679
  • 1
  • 20
  • 33
  • Have you tested this? My understanding is that: If you use LoggingFields to add fields in log file, and if your log file type is supported by Message Analyzer, then all the fields should be presented properly in Message Analyzer. Please let me know your update. Thanks. – Fangfang Wu - MSFT Dec 15 '15 at 09:47
  • Ok I see it. In the field chooser, I look for my Channel name, and I will see the Event I created and then it has all of the fields. However, I do notice that in Message Analyzer the event fields are garbled with extra unicode characters before and after. – Michael Sabin Dec 15 '15 at 17:41
  • Could you please post your code here about how you call LoggingFields? I suppose there is something wrong in the field format. – Fangfang Wu - MSFT Dec 16 '15 at 01:37
  • I updated the post... – Michael Sabin Dec 16 '15 at 15:02

1 Answers1

0

The event encoding system used by LoggingChannel.LogEvent (TraceLogging) is relatively new, and I suspect that not all of the ETW decoding tools have caught up with it yet. What happens if you use another tool, like tracerpt, wpa, or xperf, to decode?

One thing that is especially tricky about the TraceLogging encoding system is that events don't really have unique event ids, so the decoding tool just sees a bunch of events with event id 0. If the decoder just uses tdh apis directly, this won't be a problem. But if the tool tries to cache the decoding information, it will get confused. I suspect that Message Analyzer is caching the decoding information from the first event it sees, then using that for all the remaining events. Caching should not be used when decoding TraceLogging events.

If this is still a problem with the latest Message Analyzer, it's probably a bug that can be fixed for the next version.

Doug Cook - MSFT
  • 121
  • 6