EventSource.IsEnabled(EventLevel,EventKeywords) always returns true.

May 16, 2014 at 10:33 PM
I am using SLAB out of process and I am trying to test to see if a sync has been registered for a particular Eventlevel and EventKeyword and it always returns true, if the only thing that is different in SemanticLogging-svc.xml is the EventKeyword.

Here is the code
public partial class WFSAppEventSource : EventSource
    #region ETW Event Constant Definitions
    /// <summary>
    /// Note: each keyword is an int that is the power of 2, up to 64bit
    /// </summary>
    public class Keywords
        public const EventKeywords Diagnostic = (EventKeywords)0x0001;
        public const EventKeywords Perf = (EventKeywords)0x0002;
        public const EventKeywords DataAccess = (EventKeywords)0x0004;
        public const EventKeywords Audit = (EventKeywords)0x0008;

    [Event(71, Message = "Property Added for {3}:{4} [NewValue: {5}]", Level = EventLevel.Informational, Keywords = Keywords.Audit)]
    internal void PropertyAdded(string MachineName, string ApplicationName, string UserIdentity, string ProductName, string PropertyName, string NewValue)
        if (this.IsEnabled(EventLevel.Informational, Keywords.Audit)) //Always return true.
            this.WriteEvent(71, MachineName, ApplicationName, UserIdentity, ProductName, PropertyName, NewValue);

Here is the SemanticLogging-svc.xml

<!-- The service identity should have security permissions to access the resource according to each event sink -->
<flatFileSink name="svcRuntime" fileName="c:\Logger\loggingTest.txt" >
    <!-- The below settings shows a simple configuration sample for the buit-in non-transient fault tracing -->
    <!-- Remove this eventSource if you'd like, and add your own configuration according to the documentation -->
    <!-- The name attribute is from the EventSource.Name Property -->
    <eventSource name="WFS" level="Informational" matchAnyKeyword="1"/>
  <!--[Add any built-in or custom formatter here if the sink supports text formatters]-->
  <!--<wfs:Log4NetTextFormatter xsi:type="Log4NetTextFormatterElement" />-->
Any help would be appreciated. Thanks.
May 20, 2014 at 8:42 AM
I'm not seeing the same behavior as you describe. Can you outline the steps in detail?

The only thing that I'm seeing is that if you are running the out-of-process service and only the matchAnyKeyword is changed (while the service is running) that the changes do not appear to propagate to the IsEnabled call. Is that the same as your scenario? Changing some sink data (e.g. flat file name) or restarting the service seemed to resolve that. I'm not sure why the value does not appear to be updated -- the service looks to be sending an ETW message with the correct keyword value.

Randy Levy
Enterprise Library support engineer
Support How-to