Viewing EventSource events using WPA RRS feed

  • Question

  • Hi All,

    I've been having some difficulties getting the events from .NET 4.5 EventSource based providers to show up properly in WPA. PerfView can show them fine, but it lacks the awesome grouping/filtering power of WPA.

    I've been collecting using the most recent versions of PerfView and WPT that I can find:

    PerfView Version / BuildDate: Thu 10/30/2014 6:41:18.79
    Microsoft Windows Performance Analyzer Version 6.3.9600.16384 (winblue_rtm.130821-1623) © 2013

    Collection options were initially: no-merging, everything unticked and *MinProvider in the Additional Providers field and then: Kernel Base, .NET, Cpu Samples and Merge.

    The program I am using to define MinProvider and generate my test events is as follows:
    using System.Diagnostics.Tracing;
    namespace MinProvider
        [EventSource(Name = "MinProvider")]
        public class MinProvider : EventSource
            public static MinProvider Log = new MinProvider();
            public class Tasks
                public const EventTask TestTask = (EventTask) 1;
            [Event(1, Message = "A test task")]
            public void TestTask(int someNumber, string someString)
                WriteEvent(1, someNumber, someString);
        class Program
            static void Main()
                MinProvider.Log.TestTask(42, "something or other");

    When opening the resultant .etl files in PerfView, all expected events show up fine with the passed parameters etc. Opening in WPA however just yields two undecoded events for the "{d4104bf2-6935-5a60-e4dd-cfd75107b200}" provider (which I've confirmed is the Guid-hash corresponding to *MinProvider). One of the events has Id 65,534 (which from PerfView I know contains the embedded manifest information), the other has Id 1 and corresponds to my TestTask event.

    I've also tried manually extracting the provider's XML manifest from the event stream, by selecting Dump Event in PerfView on the MinProvider/ManifestData event then converting the hex payload to a string, putting it into a file and running "wevtutil im". This then results in a
           d4104bf2-6935-5a60-e4dd-cfd75107b200                              : MinProvider
    line appearing in the output of "xperf -providers", however WPA still refuses to decode it (I've tried a reboot after the manifest registration as well). Surely after manifest registration it should just be interpreted like any other Crimson provider?

    Additionally, I've attempted to capture the trace information using both WPR with a custom profile and with "xperf -start MinSession -on d4104bf2-6935-5a60-e4dd-cfd75107b200". In each case, PerfView was perfectly happy to decode the events, yet WPA wouldn't touch them.

    Are there any further steps I can take to troubleshoot this, or is there some obvious step/setting I'm missing?

    From what I can tell from, things should just work with the versions I have installed. Any assistance would be greatly appreciated.
    Tuesday, December 9, 2014 8:59 AM

All replies

  • WPA fails to decode the events because the generated manifest is invalid in this case and the way PerfView decode the event is probably different.

    Basically, when you create an event without an explicit task, EventSource makes a task of that name for the event. 

     Thus you should never have a task name be the same name as a method name (that does not have an explicit Task).

     Indeed our guidance really is to never use Explicit tasks.   Simply give events  names.  Tasks are really only useful for ‘start’ and stop’ events (where you would like to be clear that those two events are related).   For those EventSource allows you to simply use the ‘Start’ and ‘Stop’ suffix, and EventSource makes (shared) task that is used for both. 

    In your case, removing class Tasks will make it work. 

    Monday, July 30, 2018 11:45 PM