Why are the channels "Debug" and "Analytic" not available for my ETW-EventSource implementation?

Question

I am using Microsoft EventSource Library to implement a logging mechanism for my web application.

This library provides four logging event channels: "Admin", "Operational", "Debug" and "Analytic". The Admin and the Operational channel are working fine, the channels are visible and I am able to log events.

For some reason the Debug and the Analytic channel do not appear in the Event Viewer as you can see in this screenshot:

You can see my EventSource implementation below. Additionally I have uploaded the full Visual Studio project including a console test application here.

Does anyone know why only Admin and Operational is available?

public static partial class WebAppEventSourceHandler
{
    [EventSource(Name = "Company-MyProject-WebApp")]
    private sealed class WebAppEventSource : EventSource
    {
        [Event(1, Message = "Instance: [{0}] Exception Type: [{1}] Exception Message: [{2}] Exception Stack Trace: [{3}] Inner Exception Type: [{4}] Inner Exception Message: [{5}] Inner Exception Stack Trace: [{6}]",
            Channel = EventChannel.Admin, Level = EventLevel.Critical, Version = 1)]
        internal void UnhandledException(string instance, string exceptionType, string exceptionMessage, string exceptionStackTrace,
            string innerExceptionType, string innerExceptionMessage, string innerExceptionStackTrace)
        {
            WriteEvent(1, instance, exceptionType, exceptionMessage, exceptionStackTrace, innerExceptionMessage,
                innerExceptionType, innerExceptionMessage, innerExceptionStackTrace);
        }

        [Event(2, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Client Message: [{3}] Server Message: [{4}] Parameter: [{5}]",
            Channel = EventChannel.Admin, Level = EventLevel.Error, Version = 1)]
        internal void LogControllerActionError(string instance, string controller, string action,
            string clientSideMessage, string serverSideMessage, string parameter)
        {
            WriteEvent(2, instance, controller, action, clientSideMessage, serverSideMessage, parameter);
        }

        [Event(3, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Client Message: [{3}] Server Message: [{4}] Parameter: [{5}]",
            Channel = EventChannel.Operational, Level = EventLevel.Warning, Version = 1)]
        internal void LogControllerActionWarning(string instance, string controller, string action,
            string clientSideMessage, string serverSideMessage, string parameter)
        {
            WriteEvent(3, instance, controller, action, clientSideMessage, serverSideMessage, parameter);
        }

        [Event(4, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Message: [{3}] Server Parameter: [{4}]",
            Channel = EventChannel.Operational, Level = EventLevel.Informational, Version = 1)]
        internal void LogControllerActionInfo(string instance, string controller, string action,
            string message, string parameter)
        {
            WriteEvent(4, instance, controller, action, message, parameter);
        }

        [Event(5, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Message: [{3}] Server Parameter: [{4}]",
            Channel = EventChannel.Debug, Level = EventLevel.Verbose, Version = 1)]
        internal void LogControllerActionDebug(string instance, string controller, string action,
            string message, string parameter)
        {
            WriteEvent(5, instance, controller, action, message, parameter);
        }

        [Event(6, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Message: [{3}] Server Parameter: [{4}]",
            Channel = EventChannel.Analytic, Level = EventLevel.Verbose, Version = 1)]
        internal void LogControllerActionAnalytic(string instance, string controller, string action,
            string message, string parameter)
        {
            WriteEvent(6, instance, controller, action, message, parameter);
        }
    }
}

I used this cmd snippet to register the eventsource:

C:\CustomEventSources>wevtutil.exe im EventSourceExample.Company-MyProject-WebApp.etwManifest.man /rf:"C:\CustomEventSources\EventSourceExample.Company-MyProject-WebApp.etwManifest.dll" /mf:"C:\CustomEventSources\EventSourceExample.Company-MyProject-WebApp.etwManifest.dll"

Have you activated the option to show analytic logs in the Eventviewer options? — magicandre1981, Mar 04 '16 at 16:19
Thanks. That's it. I did't know I have to activate it explicitly. — Philipp Stauss, Mar 04 '16 at 21:36

score 3 · Accepted Answer · answered Mar 05 '16 at 07:29

By default the Analytic and Debug are disabled:

Analytic and Debug logs are disabled by default. When enabled, they can quickly fill with a large number of entries. For this reason, you will probably want to turn them on for a specified period to gather some troubleshooting data and then turn them off again. You can perform this procedure by using either the Windows interface or a command line.

You have to manually show them in the Eventviewer options:

Start Event Viewer.

Click the View menu. If Show Analytic and Debug Logs is selected, Analytic and Debug logs are already visible. No further action is required. If Show Analytic and Debug Logs is not selected, select Show Analytic and Debug Logs to make these logs visible.

Why are the channels "Debug" and "Analytic" not available for my ETW-EventSource implementation?

1 Answers1