Monitoring ETW logs on remote computer

Question

The usage of Microsoft.Diagnostics.Tracing.TraceEvent library makes it easy to work with ETW logs on local machine - but is there really a way to do the same for remote server? This is how do I get the events of interest on local machine. Really interested how would one achieve the same result in case of events being generated for different machine.

 public LoggingEventArgs ListenForEvent(string eventName, int level, int maxWaitTimeInSec = 30)
    {
        if (!(TraceEventSession.IsElevated() ?? false))
        {                
            _logger.Error("To turn on ETW events you need to be Administrator.");
            return null;
        }

        LoggingEventArgs result = null;

        _logger.Info("Creating a '{0}' session", _sessionName);
        using (var session = new TraceEventSession(_sessionName))
        {
            _timer = ConstructTimerForSession(session, maxWaitTimeInSec);

            TargetEventReceived += delegate (object sender, LoggingEventArgs e)
            {
                //if level is not negative, check for specific level of incoming event. 
                //Otherwise track all levels
                bool condition = level > 0 ? e.Level == level : true;                    
                if (condition)
                {
                    result = e;
                    StopListeningForEvents(session);
                }
            };

            AddCallbackForProviderEvent(session, _providerName, eventName);

            StartListeningForEvents(session, _providerName, _timer);
        }
        return result;
    }

run your cmdline tool via PsExec remotely: https://technet.microsoft.com/en-us/sysinternals/pxexec — magicandre1981, Jul 29 '16 at 15:13

score 0 · Accepted Answer · answered Aug 10 '16 at 20:18

0

This probably isn't exactly what you are looking for but your best bet is to use the Semantic Logging Application Block (SLAB) out of process option which installs an agent on the remote machine. Then the SLAB process can write your logs to a remote SQL server or remote file.

answered Aug 10 '16 at 20:18

Mark

5,223
11
51
81

Looks promising, thank you for pointing this option out! Will definitely give it a try, although I seem like giving up this idea of remote machine monitor at all - doesn't look like the 100% valid thing one would do - more like breaking the concept of eventing – Galina Bezobrazova Aug 15 '16 at 10:43

Monitoring ETW logs on remote computer

1 Answers1