TraceEvent for ETW (usage advise)

Jun 3, 2010 at 10:27 AM
Hi, I'm working on a project that need to produce and consume ETW events. I'm considering to write custom code to read ETW events since I could not find any code from the current NET 4.0 BCL that provides this functionality. The only piece of code I could find so far is this one ( until I came over this library. My main questions around this are: 1) Do you have any suggestion on why I may consider using this library over any other custom solution? (Assuming this library covers my requirements) 2) DO you have any plans to include this library on a future version of the framework? Thanks, Hernan
Jun 7, 2010 at 6:38 PM

Hi Hernandelahitte,
TraceEvent provides both low-level libraries for interacting directly ETL files (TraceEventSource, TraceEvent), and a higher level class (TraceLog) that provides a more rich view of the data with organization by thread, process, and module. I'm not really familiar with any other offerings in this space, so I'm not in a good position to provide a competitive analysis. I took a breif look at the description of EventTraceWatcher that you linked to, and it seems focused on providing a simple set of hooks for responding to ETW events in real time.

Without knowing what problem you're trying to solve we can't really tell if TraceEvent would be appropriate for you.

You should not take the presence of TraceEvent on this site as an indication that TraceEvent will be included in future versions of the framework. We are interested in the area, and would love to hear your feedback on this offering, whether or not you find that it meets your needs.


Jun 7, 2010 at 7:28 PM

Thanks Gary for you response. We need basically some code to watch for ETW events in real time that can be shown as a good guidance for ETW trace events from managed code and also provide good performnace in order to eventually be used in porduction environments. Our idea is to include this functionality as part of a bigger reference implementation for monitoring and service composition scenarios.

To recap, we need basic capabilities for watching incoming ETW events implemented in a robust and sound API in managed code. For the time being, the "EventTraceWatcher" sample fills our needs but I just wanted to cross check if there are better options like might be the TraceEvent lib which at first glace looks great to me.