使用ETW/EventSource库为事件查看器指定不同的eventID和任务类别值 [英] Specifying different eventID and task category values using ETW / EventSource Library for the event viewer

问题描述

我们正在使用Microsoft EventSource库(1.0.24)的NuGet功能记录事件查看器的事件.

We're using the NuGet pacakge of the Microsoft EventSource Library (1.0.24) to log events for the event viewer.

例如，考虑到以下方法定义，该类是从EventSource继承的类，则出现的事件查看器条目将显示由Task = XYZ参数指定填充的任务类别"字段:

Given the following method definitions, for example, of a class inherited from EventSource, the resulting event viewer entries appear with the Task Category fields populated as specified by the Task = XYZ parameter:

public sealed class EventLogEventSource : EventSource
{
    static public EventLogEventSource Log = new EventLogEventSource();

    ...  
    [Event( 1, Keywords = Keywords.Debug, Message = "Custom Message={0}",
        Channel = EventChannel.Admin, Task = Tasks.CustomCategory1, Opcode = EventOpcode.Extension )]
    public void CustomEvent1( string strMessage ) { WriteEvent( 1, strMessage ); }

    [Event( 2, Keywords = Keywords.Debug, Message = "Custom Message={0}",
        Channel = EventChannel.Admin, Task = Tasks.CustomCategory2, Opcode = EventOpcode.Extension )]
    public void CustomEvent2( string strMessage ) { WriteEvent( 2, strMessage ); 
    ...  
}  

public class Tasks
{
    public const EventTask CustomCategory1 = (EventTask)0x1;
    public const EventTask CustomCategory2 = (EventTask)0x2;
}  

...  
EventLogEventSource.Log.CustomEvent1( "test1" );
EventLogEventSource.Log.CustomEvent2( "test2" );
...  

该框架允许非常容易且声明式地定义要包含在每个登录条目中的所有相关详细信息.

The framework allows one to very easily and declaratively define all the relevant details to be included with each logged entry.

尽管这很好用，但我们也希望能够在写入同一类别下的事件日志时更改eventID的值.例如，写入事件日志的早期.Net化身(

Although this works well, we would also like to be able to vary the eventID values when writing to the event log under the same category. For example, the earlier .Net incarnation of writing to the event log (EventLog Class), provides a more flexible interface to control the eventIDs and task categories:

public void WriteEntry( message, EventLogEntryType type, int eventID, short category )  

在ETW/EventSource中是否有类似的东西可以写入事件日志，并且可以为同一类别指定EventID值?

Is there something analogous in ETW / EventSource to write to the event log with the ability to specify EventID values for the same category?

作为我们要实现的目标的一个示例，这是相同任务类别(服务器)具有不同事件ID的已记录事件的快照:

As an example of what we're trying to achieve, here's a snapshot of the logged events with different Event IDs for the same Task Category (Server):

推荐答案

在运行时能够为同一任务类别指定不同事件ID值的关键是自定义EventOpcode值的声明.然后可以将这些不同的操作码映射到相同EventTask属性值的方法声明.

The key to being able to specify different Event ID values for the same task category at run time is the declaration of custom EventOpcode values. These distinct opcodes can then be mapped to the method declarations for the same EventTask attribute value.

如Microsoft.Diagnostics.Tracing.EventOpcode枚举中所述，自定义值必须在11到239之间..

As indicated in Microsoft.Diagnostics.Tracing.EventOpcode enum, Custom values must be in the range from 11 through 239.

例如，以下是声明自定义操作码的方式:

For example, here's how custom opcodes would be declared:

public class Opcodes
{
    public const EventOpcode Test111 = (EventOpcode)0x0b;
    public const EventOpcode Test555 = (EventOpcode)0x0c;
    public const EventOpcode TestGeneric = (EventOpcode)0x0d;
}  

现在，使用原始文章中的示例方法声明，以下是用于同一任务的其他方法:

Now, using the sample method declarations from the original post, here are additional methods for the same task:

[Event( 111, Keywords = Keywords.Debug, Message = "Custom Message={0}",
    Channel = EventChannel.Admin, Task = Tasks.CustomCategory1, Opcode = Opcodes.Test111 )]
public void CustomEvent3( string strMessage ) { WriteEvent( 1111, strMessage ); }  

[Event( 555, Keywords = Keywords.Debug, Message = "Custom Message={0}",
    Channel = EventChannel.Admin, Task = Tasks.CustomCategory1, Opcode = Opcodes.Test555 )]
public void CustomEvent4( string strMessage ) { WriteEvent( 555, strMessage ); }  

[Event( 999, Keywords = Keywords.Debug, Message = "Custom Message={0}",
    Channel = EventChannel.Admin, Task = Tasks.CustomCategory1, Opcode = Opcodes.TestGeneric )]
public void CustomEventGeneric( int eventID, string strMessage ) { WriteEvent( eventID, strMessage ); }  

为了使用运行时选择的eventID值写入事件日志，可以使用CustomEventGeneric():

In order to write to the event log with eventID values chosen at run-time, the CustomEventGeneric() could be used:

EventLogEventSource.Log.CustomEventGeneric( 1, "test for EventID=1" );
EventLogEventSource.Log.CustomEventGeneric( 2, "test for EventID=2" );
EventLogEventSource.Log.CustomEventGeneric( 111, "test for EventID=111" );
EventLogEventSource.Log.CustomEventGeneric( 555, "test for EventID=555" );

重要的是要认识到，第一个参数值必须全部在EventLogEventSource类的先前定义的事件方法集中.换句话说，以下调用将导致运行时异常:

It is important to realize that the first parameter values must all be in the set of previously defined event methods of EventLogEventSource class. In other words, the following call will result in a run-time exception:

EventLogEventSource.Log.CustomEventGeneric( 123, "test for EventID=123" );  // EventID=123 is NOT DEFINED!  

所以总结一下:

一个人必须事先知道所有需要支持的EventID值.

声明事件方法时，

任务/操作码对必须唯一.

事件方法的声明必须与支持的任务/操作码值的组合一样多.

这篇关于使用ETW/EventSource库为事件查看器指定不同的eventID和任务类别值的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！