EventSource events show empty in Windows Performance Analyzer

880 Views Asked by At

I can successfully generate ETW events with EventSource in a C# console app; however if I store the events in a an ETL file and use Windows Performance Analyzer, the columns corresponding to the payload values, the event name and the provider name show are empty.

QUESTION

Are there any extra configurations for the EventSource that would allow the columns in WPA to get populated?

Notes:

  • There is another question posted here: "How do you view ETW events created by EventSource using Windows Performance Analyzer?", I believe that that question is not a duplicate of mine, as I can see the rows representing the events in WPA, it's just that the events are empty.
  • If I analyze the ETL with PerView.exe, I can see that the raw data for the event is present
  • If I create the event from C++ using a library I have at hand, the resulting ETW events show correctly in WPA
  • Having empty columns in WPA is not a big issue, my real problem is that a second application written in C++ that is expecting the events to have a payload and an event name is not being able to identify the events. I believe that the empty columns in WPA and the C++ app not being to identify the events are two related symptoms, and given that the WPA having empty columns is something that anyone could reproduce by simply running the steps I describe below, that's why I mentioned that issue as the main symptom in the introduction of my question.

Minimal code:

using System.Diagnostics.Tracing;
namespace EtwConsoleApp {
    class Program {
        static void Main(string[] args) {
            MyEventSource.Instance.MyEvent("x");
            MyEventSource.Instance.MyEvent("y");
            MyEventSource.Instance.MyEvent("z");
        }
    }

    [EventSource(Guid = "56ff7ff6-0418-4501-945f-c12737bc1c70")]
    sealed class MyEventSource : EventSource {
        [Event(1, Level = EventLevel.Verbose, Opcode = EventOpcode.Info)]
        public void MyEvent(string value) {
            this.WriteEvent(1, value);
        }

        public static MyEventSource Instance = new MyEventSource();
    }
}

See the empty rows in WPA:

  • Open an elevated CMD
  • logman create trace MySession -p {56ff7ff6-0418-4501-945f-c12737bc1c70} -o MySession.etl
  • logman start MySession
  • Run C# console application
  • logman stop MySession
  • Open the ETL with WPA, you will see the three rows corresponding to the three events from the code, however the rows are empty
  • Open the ETL with PerfView, you will see that the raw data is present (you can dump an event to the console in PerfView by pressing ALT+D when the event is selected)
2

There are 2 best solutions below

3
On

System.Diagnostics.Tracing.EventSource from .NET 4.5 does not produce events that are correctly visualized by WPA.

Solution was to use: Microsoft.Diagnostics.Tracing.EventSource

Another solution is to use: System.Diagnostics.Tracing.EventSource from .NET 4.6 (which in my case was not possible)

0
On

System.Diagnostics.Tracing shows that you use the inbox version of the .net framework 4.5. Try the Nuget version Microsoft.Diagnostics.Tracing.EventSource which gets updated more often to get new features.