Specifying different eventID and task category values using ETW / EventSource Library for the event viewer

问题

We're using the NuGet pacakge of the Microsoft EventSource Library (1.0.24) to log events for the event viewer.

Given the following method definitions, for example, of a class inherited from EventSource, the resulting event viewer entries appear with the Task Category fields populated as specified by the Task = XYZ parameter:

public sealed class EventLogEventSource : EventSource
{
    static public EventLogEventSource Log = new EventLogEventSource();

    ...  
    [Event( 1, Keywords = Keywords.Debug, Message = "Custom Message={0}",
        Channel = EventChannel.Admin, Task = Tasks.CustomCategory1, Opcode = EventOpcode.Extension )]
    public void CustomEvent1( string strMessage ) { WriteEvent( 1, strMessage ); }

    [Event( 2, Keywords = Keywords.Debug, Message = "Custom Message={0}",
        Channel = EventChannel.Admin, Task = Tasks.CustomCategory2, Opcode = EventOpcode.Extension )]
    public void CustomEvent2( string strMessage ) { WriteEvent( 2, strMessage ); 
    ...  
}  

public class Tasks
{
    public const EventTask CustomCategory1 = (EventTask)0x1;
    public const EventTask CustomCategory2 = (EventTask)0x2;
}  

...  
EventLogEventSource.Log.CustomEvent1( "test1" );
EventLogEventSource.Log.CustomEvent2( "test2" );
...

The framework allows one to very easily and declaratively define all the relevant details to be included with each logged entry.

Although this works well, we would also like to be able to vary the eventID values when writing to the event log under the same category. For example, the earlier .Net incarnation of writing to the event log (EventLog Class), provides a more flexible interface to control the eventIDs and task categories:

public void WriteEntry( message, EventLogEntryType type, int eventID, short category )

Is there something analogous in ETW / EventSource to write to the event log with the ability to specify EventID values for the same category?

As an example of what we're trying to achieve, here's a snapshot of the logged events with different Event IDs for the same Task Category (Server):

回答1:

The key to being able to specify different Event ID values for the same task category at run time is the declaration of custom EventOpcode values. These distinct opcodes can then be mapped to the method declarations for the same EventTask attribute value.

As indicated in Microsoft.Diagnostics.Tracing.EventOpcode enum, Custom values must be in the range from 11 through 239.

For example, here's how custom opcodes would be declared:

public class Opcodes
{
    public const EventOpcode Test111 = (EventOpcode)0x0b;
    public const EventOpcode Test555 = (EventOpcode)0x0c;
    public const EventOpcode TestGeneric = (EventOpcode)0x0d;
}

Now, using the sample method declarations from the original post, here are additional methods for the same task:

[Event( 111, Keywords = Keywords.Debug, Message = "Custom Message={0}",
    Channel = EventChannel.Admin, Task = Tasks.CustomCategory1, Opcode = Opcodes.Test111 )]
public void CustomEvent3( string strMessage ) { WriteEvent( 1111, strMessage ); }  

[Event( 555, Keywords = Keywords.Debug, Message = "Custom Message={0}",
    Channel = EventChannel.Admin, Task = Tasks.CustomCategory1, Opcode = Opcodes.Test555 )]
public void CustomEvent4( string strMessage ) { WriteEvent( 555, strMessage ); }  

[Event( 999, Keywords = Keywords.Debug, Message = "Custom Message={0}",
    Channel = EventChannel.Admin, Task = Tasks.CustomCategory1, Opcode = Opcodes.TestGeneric )]
public void CustomEventGeneric( int eventID, string strMessage ) { WriteEvent( eventID, strMessage ); }

In order to write to the event log with eventID values chosen at run-time, the CustomEventGeneric() could be used:

EventLogEventSource.Log.CustomEventGeneric( 1, "test for EventID=1" );
EventLogEventSource.Log.CustomEventGeneric( 2, "test for EventID=2" );
EventLogEventSource.Log.CustomEventGeneric( 111, "test for EventID=111" );
EventLogEventSource.Log.CustomEventGeneric( 555, "test for EventID=555" );

It is important to realize that the first parameter values must all be in the set of previously defined event methods of EventLogEventSource class. In other words, the following call will result in a run-time exception:

EventLogEventSource.Log.CustomEventGeneric( 123, "test for EventID=123" );  // EventID=123 is NOT DEFINED!

So to summarize:

one must know in advance all the EventID values that need to be supported.

task / opcode pairs must be unique when declaring the event methods.

there have to be as many event method declarations as there are combinations of task / opcode values supported.

来源：https://stackoverflow.com/questions/24292571/specifying-different-eventid-and-task-category-values-using-etw-eventsource-li

标签

.net

etw