How to properly define Keywords in Microsoft.Diagnostics.Tracing.EventSource?

473 views Asked by At

I am using the Microsoft.Diagnostics.Tracing.EventSource nuget package to write events to the eventlog. When defining keywords in my custom class inheriting from EventSource like this:

public class Keywords
{
    public const EventKeywords Page = ( EventKeywords ) 0x1;
    public const EventKeywords DataBase = ( EventKeywords ) 0x2;
    public const EventKeywords Diagnostic = ( EventKeywords ) 0x4;
    public const EventKeywords Perf = ( EventKeywords ) 0x8;
}

I get a manifest file containing the following xml:

<keywords>
    <keyword name="DataBase" message="$(string.keyword_DataBase)" mask="0x1"/>
    <keyword name="Page" message="$(string.keyword_Page)" mask="0x2"/>
    <keyword name="Diagnostic" message="$(string.keyword_Diagnostic)" mask="0x4"/>
    <keyword name="Perf" message="$(string.keyword_Perf)" mask="0x8"/>
    <keyword name="Session3" message="$(string.keyword_Session3)" mask="0x100000000000"/>
    <keyword name="Session2" message="$(string.keyword_Session2)" mask="0x200000000000"/>
    <keyword name="Session1" message="$(string.keyword_Session1)" mask="0x400000000000"/>
    <keyword name="Session0" message="$(string.keyword_Session0)" mask="0x800000000000"/>
</keywords>

I don't understand where the session keywords come from. It is quite annoying because these magically created keywords show up in the eventlog when I use this code to generate an event:

[Event( 202, Message = "Writing Eventlog With keywords etc. {0}", Level = EventLevel.Verbose, Keywords = Keywords.Perf, Task = EventTask.None, Opcode = EventOpcode.Info, Channel = EventChannel.Debug )]
public void DebugWithKeywordEtc( string message )
{
    this.WriteEvent( 202, message );
}

The keywords of the logged message read Session0,Session1,Session2,Session3,Perf, which derives from the keywords value in the event's xml <Keywords>0x4000f08000000000</Keywords>.

I have already authored a manifest file myself (using ecmangen) and in that manifest, the keywords section looks like this

<keywords>
    <keyword name="DataBase" message="$(string.keyword_DataBase)" mask="0x1"/>
    <keyword name="Page" message="$(string.keyword_Page)" mask="0x2"/>
    <keyword name="Diagnostic" message="$(string.keyword_Diagnostic)" mask="0x4"/>
    <keyword name="Perf" message="$(string.keyword_Perf)" mask="0x8"/>
</keywords>

which results in this event xml: <Keywords>0x8000000000000001</Keywords>. This result is displayed perfectly fine.

1

There are 1 answers

0
Doug Cook - MSFT On

EventSource automatically defines and reserves those keywords for its own use. Unfortunately I don't know how to disable this behavior.