






sealed class MinimalEventSource : EventSource

    public static MinimalEventSource Log = new MinimalEventSource();

defines a new ETW provider called 'MinimalEventSource' (by default the name of your subclass of EventSource) and defines a event called 'Load' which has a payload which consists of long value called 'ImageBase' and a string called 'Name'.    So for (the text in blue), we are just specifing what we want (what the 'shape' of the event is).   Ideally this is all that we would specify, however to 'hook it up' we need to write a SMALL amount of 'boiler plate' code.  This code is purple above where we pass the data to the 'WriteEvent' function, along with the 'Event ID' (this number starts at 1, and increases for each event you add to your provider).    EventSource does the rest.   That is not so bad!

The code in green simply creates a global variable called 'Log' which holds our EventSource (typically you only make one for the whole app).    Now we can generate events simply by typing 

MinimalEventSource.Log.Load(10, "MyFile");

TADA!   you have just written the code necessary to write your very first ETW event.     So, how do you turn it on.    This is where PerfVIew comes into play.   If you are not familiar with PerfView check out the Tutorial Videos.   Perfview has some special support for EventSources that make it particularly easy to use .    Lets assume we compiled the code above into an application called 'EventSourceDemo.exe'.   To run that program with the 'MinimalEventSource turned on we can do

PerfView /OnlyProviders=*MinimalEventSource run eventSourceDemo.exe

This command turns on MinimalEventSource (do not forget the *, that * indicates is important and I will explain it in a later posting).   The /OnlyProviders tells PerfView to ONLY turn on the listed providers (normally it turns on a default set of CLR and Kernel Events).   The 'run' command then specifies that the rest of the command line should be executed as a command while those providers are active.   The result is a file (because we did not specify it is called 'PerfViewData.etl').   After creating that file PerfView immediately opens it.    The result is probably a display that looks like this

 On the left, you wee the PerfViewData.etl file that was just created.  If you open it you see various 'Views' of the data in that file. The one we care about right now is is the 'Events' view.   Double clicking on that brings up the Event Viewer.  



  • Extract the files in the ZIP file below.
  • Download PerfView.exe from the PerfView Download Site.
  • Open up the 'events' view and take a look at the events generated. 


There is a lot more to say, as we have only done the 'hello world' version of event logging so far.   However I hope I have at least piqued your interest.   EventSource (and PerfView) make it truly easy to log events to ETW and thus leverage the power of all those existing OS events.   If you are not adveneros to dowload it right now, you shoudl at least watch the video of me doing so. 


See Also  

  1. EventSource Spec
  2. Why use ETW EventSource
  3. End-to-End example using EventSource and TraceEvent