CODEWITHSUNDEEP
c#azure-service-fabricetw
gperrego
gperrego

Reputation: 354

Viewing/Collecting Service Fabric ETW Events OnPrem

We are trying to view Service ETW Events in an OnPrem cluster. The long term plan will be to install an ElasticSearch cluster to send the events to. I don't have time to build that out this week, instead I need to understand why my App is blowing up.

We have installed Microsoft Message Analyzer on one of the node servers and I can connect with a live session to view the Cluster ETW Events Service Fabric System Provider.

I would like to be able to view the Application ETW Events. I've followed the instructions in the article here:

https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-diagnostic-collect-logs-without-an-agent

This article seems to focus on 3 files, eventFlowConfig.json, Program.cs and ServiceEventSource.cs.

EventFlowConfig.Json has:

    "inputs": [
    {
      "type": "EventSource",
      "sources": [
        { "providerName": "Microsoft-ServiceFabric-Services" },
        { "providerName": "Microsoft-ServiceFabric-Actors" },
        { "providerName": "TMHP-CacheApp-CacheAPI"  }
      ]
    }
  ],
  "filters": [
    {
      "type": "drop",
      "include": "Level == Verbose"
    }
   ],
   "outputs": [
    {
      "type": "StdOutput"
    }

In program.cs I have: 

  using (var diagnosticsPipeline = ServiceFabricDiagnosticPipelineFactory.CreatePipeline("CacheApp-CacheAPI-DiagnosticsPipeline"))
                {

                    ServiceRuntime.RegisterServiceAsync("EndpointType",
                    context => new Endpoint(context)).GetAwaiter().GetResult();

                    ServiceEventSource.Current.ServiceTypeRegistered(Process.GetCurrentProcess().Id, typeof(Endpoint).Name);
                    // Prevents this host process from terminating so services keeps running. 
                    Thread.Sleep(Timeout.Infinite);
                }

ServiceEventSource.cs has:

 [EventSource(Name = "TMHP-CacheApp-CacheAPI")]

I package and deploy fine, but using MSMA I don't know how to attach to the Application Provider? I think I would be adding a "Custom Provider" but it asks for a GUID. Is there someway to find this Guid? I'm assuming I want to add the customer provider for my specific ServiceFabric Application of type:

"TMHP-CacheApp-CacheAPI"

Thanks in advance, Greg

Upvotes: 2

Views: 1774

Answers (2)

Todd Abel
Todd Abel

Reputation: 439

I'd recommend that you use PerFView instead, Vance has an article on how to view EventSource based events in PerfView https://blogs.msdn.microsoft.com/vancem/2012/07/09/introduction-tutorial-logging-etw-events-in-c-system-diagnostics-tracing-eventsource/ The '*' in front of the EventSource name is important.

Here's some instructions for how to view actor events, your custom EventSource should be the same pattern.

The Actor and ReliableServices are EventSource based so to view them in PerfView you have to follow the instructions on Vance’s blog. Don't forget the '*'!!!

  1. Start PerfView with a command line like this: perfview /onlyproviders=*Microsoft-ServiceFabric-Actors
  2. You can collect using Collect | Collect | Start Collection. Make sure that the Advanced Options | Additional Providers field contains =*Microsoft-ServiceFabric-Actors
  3. When you finish collecting they are viewable under Events

enter image description here

Upvotes: 4

yoape
yoape

Reputation: 3315

The Guid of a .NET EventSource based Event Provider is actually based on the name of the provider, it is generated using a hash algorithm. This blog post has a short description of it: https://blogs.msdn.microsoft.com/dcook/2015/09/08/etw-provider-names-and-guids/. You can use the supplied ETWGuid.exe to generate the Guid for your provider:

C:\code> .\EtwGuid.exe TMHP-CacheApp-CacheAPI

TRACELOGGING_DEFINE_PROVIDER(
    g_hMyProvider,
    "TMHP-CacheApp-CacheAPI",
    // {9deef099-8d1a-568a-1618-08ffbb7146b3}
    (0x9deef099,0x8d1a,0x568a,0x16,0x18,0x08,0xff,0xbb,0x71,0x46,0xb3));

So the Guid for TMHP-CacheApp-CacheAPI would be 9deef099-8d1a-568a-1618-08ffbb7146b3. This only works for .NET EventSources btw, other Event Providers may have other ways of setting the guid for a provider.

You can then look for that provider in your Microsoft Message Analyzer, PerfView or any other tool for ETW viewing.

As for the Microsoft supplied Event Providers you have three built-in you should look at for Service Fabric:

Upvotes: 1

Related Questions