ETW filter by event ID using TraceEvent

Question

I'm emitting the ETW events using the Microsoft.Diagnostics.Tracing.EventSource nuget version 1.1.28 and tracing the events on the fly using the Microsoft.Diagnostics.Tracing.TraceEvent nuget version 1.0.41. What I'm trying to do is filter the events that will be traced by the event id and I can't seem to get it to work, so I've created a simple test project to test this out on a machine with Windows 10 Enterprise using .NET framework version 4.6

My event source code:

[EventSource(Name = ProviderName)]
public sealed class EtwDemoEventSource : EventSource
{
    private static Lazy<EtwDemoEventSource> instance = new Lazy<EtwDemoEventSource>(() => new EtwDemoEventSource());
    public const string ProviderName = "EtwDemoEventSource";

    private EtwDemoEventSource() { }

    public static EtwDemoEventSource Log
    {
        get
        {
            return instance.Value;
        }
    }

    [Event(1, Message = "Foo event raised.")]
    public void FooEvent()
    {
        WriteEvent(1);
    }

    [Event(2, Message = "Bar event raised.")]
    public void BarEvent()
    {
        WriteEvent(2);
    }
}

I have one console app which emits these events using the event source:

class Program
{
    static void Main(string[] args)
    {
        Console.WriteLine("Start emitting events.");
        EtwDemoEventSource.Log.FooEvent();
        EtwDemoEventSource.Log.BarEvent();
        Console.WriteLine("Finish emitting events.");
        Console.ReadLine();
    }
}

And another app which traces the events:

class Program
{
    static void Main(string[] args)
    {
        using (var session= new TraceEventSession("EtwTraceEventSession"))
        {
            Console.WriteLine("Start collecting events.");
            session.Source.Dynamic.All += te => Console.WriteLine(te.FormattedMessage);
            session.EnableProvider(EtwDemoEventSource.ProviderName, options: new TraceEventProviderOptions { EventIDsToEnable = new int[] { 1 } });
            Console.CancelKeyPress += (sender, cargs) => session.Stop();
            session.Source.Process();
            Console.WriteLine("Finish collecting events.");
        }
    }
}

If you look at the EnableProvider method in the trace app, I've found that the TraceEventProviderOptions has an EventIDsToEnable property which seems to suit my use case, but running the trace app with that code (first I run the trace app, then the app which emits the events) produces no events traced. If I remove the TraceEventProviderOptions then all the events are traced properly, also if I use the EventIDsToDisable property it works as expected.

Have I made an error in assuming how EventIDsToEnable property should affect event filtering (I can't seem to find much documentation on it) or should I be using it in a different manner?

ETW filter by event ID using TraceEvent

0 Answers0