What log viewer tools can read the XML created by System.Diagnostics.EventSchemaTraceListener?

Question

I am in the process of converting our logging implementation to use System.Diagnostics.TraceSource. We want to take advantage of activity tracing and we want to read multiple log files from multiple servers with tools like WCF’s SvcTraceViewer & LogParser.

I have converted our code to use TraceSource and now I am in the process of evaluating performance of trace listeners. Ultimately, we want to take advantage of ETW (etw), but it will be a few months before we move to Windows Server 2008, so we cannot use EventProviderTraceListener yet.

From the documentation, it is clear that EventSchemaTraceListener is the best performing trace listener that produces text file output. Previously, I had been using XmlWriterTraceListener and I was able to open up the logs created by it with SvcTraceViewer. Unfortunately, EventSchemaTraceListener outputs different XML, and although SvcTraceViewer does open and convert the file, it doesn’t do a great job and important fields are lost (like the text of the log message).

Is there a tool other than EventViewer on Vista & Windows 7 for reading the log files created by EventSchemaTraceListener? I was hoping to use SvcTraceViewer because it does a nice job of filtering and following activity transfers.

I could write an XSLT transform to convert the XML to the format expected by SvcTraceViewer. If that is the only way to do this, I will probably do that, but I was hoping that there was already a tool to read the newer format output by EventSchemaTraceListener.

Lookthrough

Answer 1

I think what you want is TraceView. It's available as part of the DDK. (Not sure why it's not just part of the Platform SDK.)

Maybe not exactly what you're looking for, but the schema for the output XML file is called event.xsd. You can get it by downloading the Platform SDK.

Scanlon

Answer 2

Please check the site www.xpolog.com. I think you will get a clear idea.

Dewey

Thanks. Looks promising but I was hoping to use free tools like WCF's svctraceviewer or logparser. – Lookthrough

Answer 3

I'm pretty sure hopeful that the Windows Event Viewer (eventvwr.exe) can read these files.

When you save as XML from event viewer it uses the same schema namespace <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>

But the problem is I have yet to find a way to successfully reopen them in Event Viewer. It tries to import them but gives an error. Will report back if I find out more...

Quinquennial

Answer 4

Have you tried Microsoft Log Parser?

Quoting the download page:

Log parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows® operating system such as the Event Log, the Registry, the file system, and Active Directory®.

Note that I'm not a user of this tool (yet) - an evaluation of this has been on my TODO list for a while.

Given that it looks like it can handle practically any XML file format, I believe it'll do what you need.

Claret

Answer 5

While I know this doesn't acutally answer your question, I think you should take a look at Log4Net. A lot of projects have used this logging framework with great success. It's very easy to use and pretty easy to extend and free software.

Preference

I know it doesn't answer the question - I said that in the response. I just think that instrumenting your assemblies with Log4Net might be a better approach and is at least worth considering. – Preference

The question mentions "multiple log files from multiple servers", which I guess means they are using the correlation features of WCF Service Trace Viewer (correlating traces across tiers) -- something that log4net does not (directly) support. – Robet