runtime: EventSource is not emitting events to the Windows Event Log
EventSource on .NET Core 2.1.300 x64 (Running on Windows 10.0.14393.2368 x64) is not emitting event logs, thus logs cannot be viewed in eventvwr.msc
I’m not sure if it is unavailable by design, or I’m missing something important.
Sample code to reproduce:
EventSourceTest.Logging.dll
using System.Diagnostics.Tracing;
namespace EventSourceTest.Logging
{
[EventSource(Name = "SampleEventSource", Guid = "b10d9bdd-6939-484f-93a9-be419202e3ac")]
public sealed class SampleEventSource : EventSource
{
public static SampleEventSource Log = new SampleEventSource();
[Event(1, Message = "MyEvt1", Level = EventLevel.Critical, Channel = EventChannel.Admin)]
public void MyEvt1(string arg1)
{
WriteEvent(1, arg1);
}
}
}
EventSourceTest.dll
using System;
using EventSourceTest.Logging;
namespace EventSourceTest
{
class Program
{
static void Main(string[] args)
{
SampleEventSource.Log.MyEvt1("test");
}
}
}
Use eventRegister.exe
tool to generate manifest, and use wevtutil
to register the manifest
eventRegister EventSourceTest.Logging.dll
wevtutil im EventSourceTest.EventSourceTest.etwManifest.man /rf:<Full/Path/To/etwManifest.dll> /mf:<Full/Path/To/etwManifest.dll>
When published with dotnet publish -c Release -f net47 -r win-x64
, after running the program, the log shows correctly in Event Viewer. While with dotnet publish -c Release -f netcoreapp2.1 -r win-x64
, nothing appears.
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Reactions: 6
- Comments: 19 (7 by maintainers)
Any progress on this one?
Any updates on this issue?
We have used the event log for a very long time and our customers expects to find their logging information from our products in there.
It is not an option to log directly to the Application Log since we need to provide our own manifest (and make the log appear under “Application and services logs”).
I tried to debug this on .NET 5.0.1.
eventRegister.exe
from Microsoft.Diagnostics.Tracing.EventRegister/1.1.28 could not load EventSourceTest.Logging.dll, so I added code to write the manifest out:and then built a DLL for it:
EventSourceTest.man
Then ran that in WinDbg with dotnet-sos, with breakpoints at
ntdll!EtwEventWriteTransfer
andntdll!EtwEventRegister
.After many
ntdll!EtwEventRegister
calls from other components, I got the one fromSampleEventSource
:The EnableCallback was called with arguments:
Soon after,
ntdll!EtwEventWriteTransfer
was called from withinEventSource.SendManifest
, with arguments:Another
ntdll!EtwEventWriteTransfer
call, now from withinSampleEventSource.MyEvt1
:Keyword = 0x0000f000`00000000 is nonzero (see EVENT_ENABLE_PROPERTY_IGNORE_KEYWORD_0 in ENABLE_TRACE_PARAMETERS) but does not match MatchAnyKeyword = 0x80000000`00000000, so ETW discards the event, I think.
Indeed, if I force EVENT_DESCRIPTOR::Keyword to zero in the debugger, then the event appears in Event Viewer.
I wonder whether older versions of EventSource have implicitly set the 0x80000000`00000000 keyword.
Can verify this as well. Events are captured in event viewer if the target is .NET framework 4.6.2 but is not showing up when target is netcoreapp2.2. This prevents us from logging to event viewer in any of our .net core apps.
I suspect this part of ManifestBuilder.GetChannelKeyword should compare
channelKeyword == 0
rather thanchannelKeyword != 0
: https://github.com/dotnet/runtime/blob/d4d50db6768f729857b27ced3b68067bf30d18de/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/EventSource.cs#L5332-L5344As noted years ago in https://github.com/dotnet/coreclr/pull/6628#commitcomment-20938351.
Well, it seems like there is a channel support in .NET Core. If you add an EventAttribute to your EventSource method and specify the Keywords parameter with the value -9223108154064109568 everything is working, EventViewer starts to see all events.
Don’t ask how I found this constant -9223108154064109568.