Reputation: 180
I am working on an LOB (side-loading) app and I need to log events, crashes to ETW (Event Viewer logs). I see that most suggest writing own file IO wrapper.
With Windows 8.1, we have new logging capabilities in "Windows.Foundation.Diagnostics" which has classes for "LoggingChannel" and "LoggingSession". But the code sample for them still write to the isolated local storage as files:
http://code.msdn.microsoft.com/windowsapps/LoggingSession-Sample-ccd52336
Also, earlier than 8.1, we have "EventSource" and "EventListener" and as per a sample project (http://code.msdn.microsoft.com/windowsapps/Logging-Sample-for-Windows-0b9dffd7/sourcecode?fileId=67472&pathId=1214683397), it also writes to the sample isolated storage as files.
So, my questions are:
Can we utilize new "Windows.Foundation.Diagnostics" classes to write to ETW?
Are ("LoggingChannel" and "LoggingSession") equivalent to ("EventSource" and "EventListener") ultimately?
Will I still have to write C++ component for writing to ETW?
Forum of Microsoft just gave this answer: It is not designed with such thing in mind.
I also tried using PInvoke for consuming EventRegister, EventWrite C++ functions. The code runs but I have no idea where find the log. The EventRegister only takes GUID as input and I don't know if it can be mapped to EventViewer application.
Upvotes: 2
Views: 792
Reputation: 141
Short answer to the questions:
A few other comments based on things you mentioned:
Note that EventRegister and EventWrite (and LoggingChannel) are for sending data to ETW. You can send anything you want to ETW, but by default ETW will just ignore it and throw it all away. ETW is the system for routing events from the provider to anybody who is interested in the event. If nobody is interested in the event, it gets thrown away by default.
LoggingChannel writes events out to ETW, but ETW will just drop them unless there is a session to record them. From within your app, you can record the events using LoggingSession. From outside your app, you can record the events using a tool such as xperf or tracelog.
You can use Windows.Foundation.Diagnostics.LoggingChannel from Windows 8.1 to write ETW events with some limitations. In particular: all events from all apps will always use the same provider GUID (4bd2826e-54a1-4ba9-bf63-92b73ea1ac4a), there is no way to access the keyword, channel, task, or opcode features of ETW, and you can only write very simple events. The Windows 8.1 LoggingChannel API is mainly focused on providing a simple string-based logging facility.
Windows 10 adds a bunch of new features, removing many of the limitations. You can use a different provider GUID (so it is easier to record just the events from your app), you can set keywords, tasks, and opcodes, and you can write strongly-typed events (i.e. events with strongly-typed field values instead of just a flat string). The Windows 10 LoggingChannel API allows you to use LoggingChannel for fairly advanced ETW scenarios, though it still works for simple logging.
Upvotes: 1