.Net 4.5 EventSource ETW provider not showing up in provider list

Question

I have been working on using .NET4.5 new feature ETW(EventSource). I have trouble having it show up on the trace provider lists using perfmon->Data Collector Sets. I was able to see the logs using perfview. I was able to generate manifest from EventSource class using its static method GenerateManifest. This will provide the manifest of myevents in EventSource class but it does not contain details about the channels.

My question is how to add channel specific information after generating the manifest file for perfmon tracing session? I also would like to use the Perfmon's Tracing session to enable the provider instead of perfview.

Any input is much appreciated.

Bilbe

have you got this working? I'm in the same situation and a bit lost! – Sneakbox

Answer 1

MS released a Nuget package which registers the EventSource class after build:

http://blogs.msdn.com/b/dotnet/archive/2013/08/09/announcing-the-eventsource-nuget-package-write-to-the-windows-event-log.aspx

Registering your EventSource

When you install the EventSource NuGet package, the build step previously mentioned generates the following files for each EventSource in your application:

<AssemblyName>.<EventSourceTypeName>.etwManifest.man
<AssemblyName>.<EventSourceTypeName>.etwManifest.dll.

These files need to be registered with the operating system to enable channel support. To do this you run the following command after the files are in their final deployed location:

wevtutil.exe im <EtwManifestManFile> /rf:"<EtwManifestDllFile>" /mf:"<EtwManifestDllFile>"

Once this registration command is executed, all subsequent calls to MinimalEventSource.Log.Load(), from any process on that machine, will automatically result in events in the Windows Event log.

After registering it you should see it in all tools which read the installed providers.

Lowborn

You might have to restart the event viewer after you register. – Party

I can see mine inside of Perfmon, but not Event Viewer -> Create Custom View, even after restarting Event Viewer multiple times. – Numismatology

Answer 2

The EventSource implementation prevents you from specifying the channel even if you do modify the manifest. When writing an event to ETW you pass a descriptor block where in the channel id is specified. Unfortunately EventSource does not offer a way to set this through an attribute or otherwise and is always setting this to zero, meaning no channel is used.

EventSource is behaving a bit differently from a normal ETW providers as it does not expose its manifest through a win32 resource but rather sends a "known" ETW event with the manifest as its payload. This is why perfmon is the only ETW enabled tool that recognizes* events send from .NET 4.5 EventSource.

*You can always receive events using perfmon or other tools like it but they wont be able to decode the payload e.g. parameters passed to WriteEvent.

EDIT: See answer to a similar question

Cheers Lars

Deport

Hi Lars, There is a way I found after quite a bit of research and reading to log the events in the event log and view them in event viewer along with the payload decoding... see my document above... – Hotien