none
Microsoft.Diagnostics.Tracing.EventSource: Multiple sources/one event log RRS feed

  • Question

  • I'm trying to implement better event log usage in my software and the goal is to do the following:

    Multiple Sources all writing to one or more channels of a single event log.  Meaning, one event log with the usual channels but the entries identified with different sources.

    For example for "MyCompany-MyProduct":

    MyCompany/MyProduct/Admin

    MyCompany/MyProduct/Analytic

    etc.

    I can use the EventSource class to do this for one source but there doesn't appear to be a great way to have multiple sources write to the same log and the channels associated with the log.

    [EventSource(Name="MyCompany-MyProduct")]
        public sealed class MyEventSource : EventSource
        {
            static public MyEventSource Log = new MyEventSource();
    
            [Event(1, Channel=EventChannel.Admin, Opcode=EventOpcode.Info, Message="Message: {0}", Keywords=EventKeywords.None)]
            [System.ComponentModel.Description("Admin Message")]
            public void WriteAdminMessage(string message)
            {
                
                WriteEvent(1, message);
            }
        }

    I tried using the EventLog class in System.Diagnostics and I can almost write to that channel "MyCompany-MyProduct/Admin" but the event viewer than adds a log with that name to the top-level of the Application logs area and compromises the channel name registered from the EventSource manifest.

    EventLog eventLog = new EventLog("MyCompany-MyProduct/Admin");
    eventLog.Source = "MyOtherProduct";
    eventLog.WriteEntry("Testing again...");

    Worst case, I may have to write my own managed wrapper of the unmanaged event api but I'd rather not do that.

    Any suggestions would be appreciated.

    Monday, January 12, 2015 7:16 PM

Answers

  • Hello Kyle,

    From your description, what I understand is that you are trying to write multiple source to the same event log. If I am correct, unfortunately, this seems to be not possible, the document on MSND says:

    The source must be unique on the local computer; a new source name cannot match an existing source name or an existing event log name. Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.

    Regards.


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    Tuesday, January 13, 2015 6:16 AM
    Moderator
  • Yeah, I assumed when I read that it meant that the ETW mechanism for writing to the log forced  the log name and source name to be unique.  However, I know you can use the EventLog class in System.Diagnostics to write directly to the log there I can use two different sources and one log name.

                EventSourceCreationData createSourceAData = new EventSourceCreationData("SourceA", "MyCompany-MyProduct");
                EventLog.CreateEventSource(createSourceAData);
    
                EventLog eventLog = new EventLog("MyCompany-MyProduct");
                eventLog.Source = "SourceA";
                eventLog.WriteEntry("testing");
    
                EventSourceCreationData createSourceBData = new EventSourceCreationData("SourceB", "MyCompany-MyProduct");
                EventLog.CreateEventSource(createSourceBData);
    
                EventLog eventLog2 = new EventLog("MyCompany-MyProduct");
                eventLog2.Source = "SourceB";
                eventLog2.WriteEntry("still testing");

    What doesn't work from that method is the use of channels.  I thought I might be able to write directly to the event log but still using the ETW channel concept.  Even if I still had to go through and register an ETW provider manifest to create the log and channels, I could them write to those channels from other code and control the source name.

    It's sounding like that may not be possible though.  Thanks.

    Tuesday, January 13, 2015 1:57 PM

All replies

  • Hello Kyle,

    From your description, what I understand is that you are trying to write multiple source to the same event log. If I am correct, unfortunately, this seems to be not possible, the document on MSND says:

    The source must be unique on the local computer; a new source name cannot match an existing source name or an existing event log name. Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.

    Regards.


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    Tuesday, January 13, 2015 6:16 AM
    Moderator
  • Yeah, I assumed when I read that it meant that the ETW mechanism for writing to the log forced  the log name and source name to be unique.  However, I know you can use the EventLog class in System.Diagnostics to write directly to the log there I can use two different sources and one log name.

                EventSourceCreationData createSourceAData = new EventSourceCreationData("SourceA", "MyCompany-MyProduct");
                EventLog.CreateEventSource(createSourceAData);
    
                EventLog eventLog = new EventLog("MyCompany-MyProduct");
                eventLog.Source = "SourceA";
                eventLog.WriteEntry("testing");
    
                EventSourceCreationData createSourceBData = new EventSourceCreationData("SourceB", "MyCompany-MyProduct");
                EventLog.CreateEventSource(createSourceBData);
    
                EventLog eventLog2 = new EventLog("MyCompany-MyProduct");
                eventLog2.Source = "SourceB";
                eventLog2.WriteEntry("still testing");

    What doesn't work from that method is the use of channels.  I thought I might be able to write directly to the event log but still using the ETW channel concept.  Even if I still had to go through and register an ETW provider manifest to create the log and channels, I could them write to those channels from other code and control the source name.

    It's sounding like that may not be possible though.  Thanks.

    Tuesday, January 13, 2015 1:57 PM