ETW: Setting EventSource name yields EventId 806/807

128 views Asked by At

I am utilizing ETW. I am running the console log. When I instantiate my EventSource to attempt to log my events to a log file I am greeted with 806/807 warning codes and my logs do not persist. (These warnings are generated whether I add the 'EventSource' attribute or not.

If however, I use the default constructor, not passing the name of my event source and using the default attribute value my logs are generated as expected without warning

Example implementation:

using Microsoft.Diagnostics.Tracing;

[EventSource(Name = "MyApi")]
public sealed class MyEventSource : EventSource
{
    public MyEventSource(string name):base(name){
    }

    private static readonly Lazy<MyEventSource> _instance = new Lazy<MyEventSource>(() => new MyEventSource());

    public static MyEventSource Log => _instance.Value;
...
}

Ideally, I'd like to avoid having to hardcode my EventSource name as an attribute and simply use the available overloaded constructor and pass my name into the constructor.

I found some useful information from a previous post but unfortunately did not solve my issues Risk of missing events from ETW logging with EventSource

1

There are 1 answers

0
Stringfellow On

You could use the dynamically defined events available in EventSource v4.6. https://blogs.msdn.microsoft.com/vancem/2015/10/02/dynamically-defined-events-in-eventsource-v4-6/

Example from article:

EventSource Logger = new EventSoruce("MinimalEventSource");

Logger.Write("Load", new { ImageBase=10L, Name="AFile.dll" } );

EventKeywords Loader = (EventKeywords)0x1;
Logger.Write("Load", 
    new EventSourceOptions() { Level = EventLevel.Warning, Keywords = Loader }, 
    new { ImageBase = 10L, Name = "AFile.dll" }
    );