Questions tagged [etw-eventsource]

Event Tracing for Windows (ETW) is a fast, scalable logging mechanism built into the Windows operating system. The EventSource class simplifies writing ETW provider as simple as writing just a few lines of code instead of creating a XML manifest, using the tool (MC.exe) to generate source code and registering the provider using the tool WEVTUTIL when the application was deployed.

Event Tracing for Windows (ETW) is a fast, scalable logging mechanism built into the Windows operating system. The EventSource class simplifies writing ETW provider as simple as writing just a few lines of code instead of creating a XML manifest, using the tool (MC.exe) to generate source code and registering the provider using the tool WEVTUTIL when the application was deployed.

Small Demo Example:

sealed class MinimalEventSource : EventSource
{
    public void Load(long ImageBase, string Name) { WriteEvent(1, ImageBase, Name); }

    public static MinimalEventSource Log = new MinimalEventSource();
}

Calling in code:

MinimalEventSource.Log.Load(10, “MyFile”);
68 questions
1
vote
0 answers

Add Field To All ETW Events In EventSource

Currently, my ETW events are defined like this: public class MyEventSource: EventSource { [Event(1, Level=Info)] public void WriteMyEvent(string Message) { WriteEvent(1, Message); } [Event(2, Level=Info)] public void…
Dagrooms
  • 1,507
  • 2
  • 16
  • 42
1
vote
0 answers

How to implement continuous logging with C# EventSource and ETW?

We implement structured logging with System.Diagnostics.Tracing.EventSource, and use the inline provider manifests when collecting traces to avoid the installation headaches with EventRegister and wevtutil. We have designed our EventSources to log…
abarger
  • 599
  • 7
  • 21
1
vote
0 answers

How to log multiple fields in EventSource

I am using EventSource to log event. I need to record 30 fields for one event. It works if I pass all 30 fields as string one by one as shown below. I was able to log those events. But when I trying to pass a string[] into the WriteEvent(). The…
Yuchao Zhou
  • 1,062
  • 14
  • 19
1
vote
1 answer

How to store DateTime in EventSource via WriteEventCore

This is my current code: [NonEvent] unsafe void InsertViaWriteEventCore( int eventId, DateTime startDateTime, DateTime endDateTime) { const int eventDataCount = 2; { EventData* data =…
Alfan
  • 235
  • 2
  • 10
1
vote
1 answer

OpCode is being attached to event name in out-of-process Semantic logging (SALB) c#

I am doing an out-of-process semantic logging with elastic search. When i browsed the events using kibana, i could see the events are coming. But the event name showing as "Event name + OpCode". That is events OpCode is being attached to the Event…
Binu Vijayan
  • 803
  • 1
  • 9
  • 24
1
vote
1 answer

Why does my custom EventSource works on Windows 8.1 and is messed up on Windows Server 2012 R2?

I have build a custom EventSource by using Visual Studio 2015 and the nuget package Microsoft Event Source Library (latest version 1.1.28). I have installed the manifest by using wevtutil.exe on my Windows 8.1 work station and on a Windows Server…
1
vote
1 answer

How to update EventSource schema

During the development of my custom EventSource I need to change the count and types of an event's parameters. Since I've used this EventSource for a while, it had already registered its events dynamically. Is it possible to change or delete this…
Attila Cseh
  • 235
  • 2
  • 13
1
vote
1 answer

Why are the channels "Debug" and "Analytic" not available for my ETW-EventSource implementation?

I am using Microsoft EventSource Library to implement a logging mechanism for my web application. This library provides four logging event channels: "Admin", "Operational", "Debug" and "Analytic". The Admin and the Operational channel are working…
Philipp Stauss
  • 721
  • 7
  • 22
1
vote
1 answer

Microsoft TraceEvent - How to log to the Event Viewer

Using the Microsoft.Diagnostics.Tracing EventSource library (not to be mistaken for the System.Diagnostics.Tracing), it is possible to log certain messages to the event viewer by adding an Attribute to the Event annotation called 'Channel'. However…
Dech
  • 1,582
  • 4
  • 17
  • 32
1
vote
2 answers

System.Diagnostics - Eventsource with empty message

I'm using System.Diagnostics to get some messages using EventSource, to trace them as a log. It appears that some informations are missing, as for example the EventMessage and the Message (they are empty), while the EventId and the Level are…
1
vote
2 answers

How to serialize user defined objects to WriteEvent?

From MSDN documentation, Write-event supports only int and string param types. I want to pass a user-created ct to Write-event, how to get this functionality? What would be the right serializer to achieve this functionality?
the rock
  • 11
  • 1
1
vote
1 answer

EventSource logs on mono

I am using EventSource to log events in my library. That library is cross platform meaning it could be used by linux/mac users. I know how EventSource works on windows. Users can view default logs using tools like PerfView or Logman tool or…
ezile
  • 571
  • 2
  • 6
  • 20
1
vote
2 answers

ETW Logging - TraceEventSession overwrites file

I have an IIS application which uses TraceEventSession to capture ETW messages and forward them onto a log file: - TraceEventSession _etwSession = new TraceEventSession( "MyEtwLog", @"C:\Logs\MyEtwLog.etl") { 100 }; _etwSession.EnableProvider( …
Phil Lambert
  • 1,047
  • 9
  • 16
1
vote
1 answer

When using EventSource, should I log two events, or compute the duration and log only one?

Assume I have some method that I want to trace performance information for. Using System.Diagnostics.Tracing.EventSource, I can see two logical ways of doing this; first, one could write two events, one at the start, and one at the end, and then the…
Mark
  • 11,257
  • 11
  • 61
  • 97
1
vote
1 answer

Why do strings not show in the event log for my custom log events?

I am using the new .NET EventSource API from nuget. I have built my application, and installed the manifest and resource DLL using wevtutil.exe. My event log entries include the following text when I view them in Event Viewer: The description for…
Olly
  • 5,966
  • 31
  • 60