How to capture EventSource.WriteEvent in EventViwer?

Question

I create events like this:

   using System.Diagnostics.Tracing;

    [EventSource(Name = "MyProject-Foo")]
    class FooEventWriter : EventSource
    {   
          [Event(1, Level = EventLevel.Error, Message = "Failed to do foo operation. Error: {0}")]
          public void WriteEventWhenFooErrorOccured(string errorMessage)
          {
              if (IsEnabled())
              {
                  WriteEvent(errorMessage);
              }
           }
    }

How can I see those events in EvenViwer?

EventViewer is an older style tool that requires an event provider to register a manifest. This might be a duplicate of [this question](https://stackoverflow.com/questions/38054541/eventsource-in-net-4-6-event-viewer). — Mike Zboray, Apr 05 '18 at 04:58

mipnw · Answer 1 · 2018-04-05T04:47:19.920

If you want to write to the Windows Event Log, so your events are visible with the tool you mentioned, EventViewer, you can do something like this:

    public static void Main()
    {
        // Create the source, if it does not already exist (requires running elevated or you'll get a SecurityException)
        if(!EventLog.SourceExists("MySource"))
        {
            //An event log source should not be created and immediately used.
            //There is a latency time to enable the source, it should be created
            //prior to executing the application that uses the source.
            //Execute this sample a second time to use the new source.
            EventLog.CreateEventSource("MySource", "MyNewLog");
            Console.WriteLine("CreatedEventSource");
            Console.WriteLine("Exiting, execute the application a second time to use the source.");
            // The source is created.  Exit the application to allow it to be registered.
            return;
        }

        // Create an EventLog instance and assign its source.
        EventLog myLog = new EventLog();
        myLog.Source = "MySource";

        // Write an informational entry to the event log.    
        myLog.WriteEntry("Writing to event log.");
    }
}

When you're done testing EventLog MyNewLog, you can delete it at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\MyNewLog

If you actually trace with Event Tracing for Windows (ETW) which is what your code sample looks like, (Windows Event Log is built on top of ETW), then you need to trace with a tool like Xperf. It's much more powerful, but also requires more knowledge to configure, start & stop, and view your traces.

UPDATE:

You might be able to collect ETW events inside the Event Log. Read Part 2 – Exploring and Decoding ETW Providers using Event Log Channels

The code in your example is Event Tracing for Windows (ETW). Your question asks how to see events in EventViewer, a tool that shows you the Windows Event Log. The example I gave you is a quick way to write to the Windows Event Log so your events will be visible in EventViewer. EventViewer is built on top of ETW. If all you do is raise ETW events, not write to the EventLog, you will need to start your traces with another tool like xperf, not EventViewer. — mipnw, Apr 05 '18 at 04:23

How to capture EventSource.WriteEvent in EventViwer?

1 Answers1