1

Using the Microsoft.Diagnostics.Tracing EventSource library (not to be mistaken for the System.Diagnostics.Tracing), it is possible to log certain messages to the event viewer by adding an Attribute to the Event annotation called 'Channel'. However this dumps the output to the 'Windows Logs\Application' area. How can I get this to log to 'Applications and Service Logs\MyApp\MyFeature' ?

Example code:

[EventSource(Name = "MyDemoApp")]
   public sealed class MyDemoEventSource : EventSource
   {
      private MyDemoEventSource () { }
...    
public const EventTask MyDemoTask = (EventTask) 12345;
...

[Event(12345,
     Message = "My Demo Error: {0}",
     Level = EventLevel.Warning,
     Channel = EventChannel.Admin,
     Task = Tasks.MyDemoTask,
     Keywords = Keywords.Rule,
     Opcode = Opcodes.Fail)]
    private void SomethingWentWrong(string ErrorMessage)
    {
        WriteEvent(12345, ErrorMessage);
    }
Dech
  • 1,582
  • 4
  • 17
  • 32
  • What happens if you change `EventSource` to: `[EventSource(Name = "MyApp-MyFeature")]` ? – Matthew Watson Feb 29 '16 at 14:14
  • Unfortunately it does not help, it still dumps the message to the same location. – Dech Feb 29 '16 at 14:18
  • 1
    Is this of any help? (It's three years old, so may be totally out of date) https://blogs.msdn.microsoft.com/dotnet/2013/08/09/announcing-the-eventsource-nuget-package-write-to-the-windows-event-log/ – Matthew Watson Feb 29 '16 at 14:19
  • I was missing a step in that guide: `In order for the windows event viewer to know that there is a new source of events to log, it is necessary that you register your EventSource with the operating system, typically when your application is deployed or installed. This operations requires administrator permissions. The artifacts needed for registration (a manifest file and a resource DLL) are generated at build time through a build step injected in your project (when you add the NuGet package reference).` However, I can not get it work as expected. – Dech Feb 29 '16 at 16:00
  • I'm also trying to get it to work out of interest's sake - it's something we were thinking about using some time. But I, likewise, can't get it to work yet. It creates the event log, but doesn't write to it. – Matthew Watson Feb 29 '16 at 16:06
  • Incidentally I found a later blog: https://blogs.msdn.microsoft.com/dotnet/2014/01/30/microsoft-diagnostics-tracing-eventsource-is-now-stable/ – Matthew Watson Feb 29 '16 at 16:06
  • 2
    I got it working: When you install the Nuget packagem, it also installs two ".docx" files that give you more information. In my case, I hadn't FULLY qualified the DLL paths I was passing for the /rf: and /mf: parameters of the `wevtutil.exe` utility. When I started using the full paths, it started working. – Matthew Watson Feb 29 '16 at 16:32
  • I got it writing something to both the Application and the expected folder (still not quite right) but I think it had something to do with using 'logman' to create a trace log and then start the log collector (not sure if this is necessary but seemed to help. `logman create trace YourTraceSessionName -p "{yourEventSourceNameAsGUID}" -o c:\out.etl` then `logman start YourTraceSessionName` – Dech Feb 29 '16 at 16:32
  • In my case I didn't need to do that - I just used their basic `MinimalEventSource` example from the .docx files and used `"Matthew-Test-EventLog"` as the event source name (and unregistered and reregistered the event source using `wevtutil.exe`). – Matthew Watson Feb 29 '16 at 16:35
  • At pluralsight.com you can a find a very good introduction which I used to learn how to use etw-eventsource: https://www.pluralsight.com/courses/event-tracing-windows-etw-dotnet – Philipp Stauss Mar 01 '16 at 09:04

1 Answers1

1

With thanks to Matthew Watson for pointing me in the direction of this article, the solution to the problem is contained within:

https://blogs.msdn.microsoft.com/dotnet/2014/01/30/microsoft-diagnostics-tracing-eventsource-is-now-stable/

*Remember to register your EventSource as this is the step that actually creates the entries in the Event Viewer, a unique name is required (if your company/product already has an entry in the Event Viewer for other purposes make sure you use a new name).

Dech
  • 1,582
  • 4
  • 17
  • 32