ETW support?

Topics: Logging Application Block
Feb 27, 2011 at 5:26 PM

Has anyone successfully used (via Entlib Logging) the System.Diagnostics.EventProviderTraceListener or created an Entlib custom listener that supports Event Tracing for Windows (ETW)?

After some initial reading on ETW, it seems there is opportunity for leveraging ETW within the logging block beyond just listeners. For example, the whole TraceManager concept covers activity tracing concepts that ETW is also designed to handle, no?

 I'm a bit surprised that EntLib 5 doesn't include some deep integration with ETW after all these years.

Feb 27, 2011 at 10:01 PM

I'm not familiar with ETW but with a bit of reading, I'd say if it's going to be used with EntLib, yes, it's more of a tracing feature rather than a trace listener.  Being not thoroughly familiar with it, I can't say how feasible it is to incorporate this in EntLib but if you really like this, you can log it in the Issue Tracker as a feature request.

 

Sarah Urmeneta
Global Technologies and Solutions
Avanade, Inc.
entlib.support@avanade.com

Feb 27, 2011 at 10:01 PM

I'm not familiar with ETW but with a bit of reading, I'd say if it's going to be used with EntLib, yes, it's more of a tracing feature rather than a trace listener.  Being not thoroughly familiar with it, I can't say how feasible it is to incorporate this in EntLib but if you really like this, you can log it in the Issue Tracker as a feature request.

 

Sarah Urmeneta
Global Technologies and Solutions
Avanade, Inc.
entlib.support@avanade.com

Feb 28, 2011 at 2:31 AM

We've looked at implementing an ETW listener several times. The issue is that the model for ETW is very different from that of the logging block. ETW is more about having predefined templates for message logging, whereas the Entlib logging block is designed around allowing freeform log messages. As such, it'd be pretty hard to just drop in an ETW listener in config and have it work. That mismatch means a lot of work to use Entlib when you're probably better off just using ETW directly.

Feb 28, 2011 at 3:00 AM

Thanks to both of you for responding on a Sunday :)

Sigh. I'm currently considering logging options for BizTalk solutions, and we use EntLib as a internal standard outside BizTalk.

http://blogs.msdn.com/b/asgisv/archive/2010/05/11/best-practices-for-instrumenting-high-performance-biztalk-solutions.aspx suggests ETW from a logging performance perspective.

I was really hoping I could blend the best of both worlds - stick with the same EntLib Logging block interfaces for custom BizTalk solutions but weave in ETW logging if required.

LogEntry surely represents a predefined template for message logging? :)

I think for the majority of our BizTalk applications, EntLib logging performance will be sufficient but imagine how much better I'd sleep if I knew I could just change some configuration and jump up 2 orders of magnitude in log events/s.

Mar 1, 2011 at 2:37 AM

Shawn,

FYI, another p&p project - Composite Services - has implemented an ETW trace listener. They've posted their first drop here. Take a look. Please let us know if it addresses your needs.

Grigori

Mar 16, 2011 at 5:52 PM
gmelnik wrote:

Shawn,

FYI, another p&p project - Composite Services - has implemented an ETW trace listener. They've posted their first drop here. Take a look. Please let us know if it addresses your needs.

Grigori


I'm surprised nobody referenced the fist part of my question: using the built-in ETW-enabled EventProviderTraceListener class. After some confusion on my part, I was able to wire this listener into EntLib as a generic "System Diagnostics Trace Listener".

Perhaps my tests were flawed, but I only saw about 30% performance increase using this built-in ETW listener compared to the simple rolling flat-file listener. I expected a much greater leap in events/second throughput using ETW (on the order of 500%+).    :(

Perhaps I'll give the Composite Services listener a try, but I am curious why they implemented their own if the built-in implemenation (type EventProviderTraceListener) has existed since the introduction of .NET 3.5.

Mar 16, 2011 at 8:27 PM

I've inquired with the Composite Services team and here's their answer:

ETW trace listener writes to ETW.  Comp Services implement ETW event collector service that reads and processes the events from ETW .

Mar 16, 2011 at 10:51 PM

From my application’s perspective it needs a write to ETW component first and foremost (my app is generating log messages). I can setup data collectors separately using the provided ETW tools or perhaps the Composite Services team’s component.

I think one place this gets confusing is how ETW further decouples event providers (generators of events) from the data collectors (sessions?) that active receive the events and do something with them, like write them to a file. This sounds similar to System.Diagnostics/EntLib trace sources and trace listeners.

However, in our case the trace listener EventProviderTraceListener, as the name suggests, is a trace creator for ETW, not a listener in the System.Diagnostics/EntLib sense of the word?

I didn’t see an astonishing performance improvement using EventProviderTraceListener bolted onto EntLib as a listener. However its performance is better than the other available EntLib logging options.

If I get time to push this experiment further, I may try creating a dedicated ETW listener (i.e. event writer) for EntLib, perhaps combined with an ETW schema definition for LogEntry to make viewing easier. I’ll let ya know how it turns out.

From: gmelnik [email removed]
Sent: Wednesday, March 16, 2011 1:28 PM
To: Shawn Talbert
Subject: Re: ETW support? [entlib:247767]

From: gmelnik

I've inquired with the Composite Services team and here's their answer:

ETW trace listener writes to ETW. Comp Services implement ETW event collector service that reads and processes the events from ETW .