c# - 为什么通道“调试”和“分析”不适用于我的 ETW-EventSource 实现？

Question

我正在使用Microsoft EventSource 库为我的 Web 应用程序实现日志记录机制。

这个库提供了四个日志事件通道：“Admin”、“Operational”、“Debug”和“Analytic”。Admin 和 Operational 频道工作正常，频道可见，我可以记录事件。

出于某种原因，调试和分析通道没有出现在事件查看器中，如您在此屏幕截图中所见：

你可以在下面看到我的 EventSource 实现。此外，我已经上传了完整的 Visual Studio 项目，包括一个控制台测试应用程序。

有谁知道为什么只有 Admin 和 Operational 可用？

public static partial class WebAppEventSourceHandler
{
    [EventSource(Name = "Company-MyProject-WebApp")]
    private sealed class WebAppEventSource : EventSource
    {
        [Event(1, Message = "Instance: [{0}] Exception Type: [{1}] Exception Message: [{2}] Exception Stack Trace: [{3}] Inner Exception Type: [{4}] Inner Exception Message: [{5}] Inner Exception Stack Trace: [{6}]",
            Channel = EventChannel.Admin, Level = EventLevel.Critical, Version = 1)]
        internal void UnhandledException(string instance, string exceptionType, string exceptionMessage, string exceptionStackTrace,
            string innerExceptionType, string innerExceptionMessage, string innerExceptionStackTrace)
        {
            WriteEvent(1, instance, exceptionType, exceptionMessage, exceptionStackTrace, innerExceptionMessage,
                innerExceptionType, innerExceptionMessage, innerExceptionStackTrace);
        }

        [Event(2, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Client Message: [{3}] Server Message: [{4}] Parameter: [{5}]",
            Channel = EventChannel.Admin, Level = EventLevel.Error, Version = 1)]
        internal void LogControllerActionError(string instance, string controller, string action,
            string clientSideMessage, string serverSideMessage, string parameter)
        {
            WriteEvent(2, instance, controller, action, clientSideMessage, serverSideMessage, parameter);
        }

        [Event(3, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Client Message: [{3}] Server Message: [{4}] Parameter: [{5}]",
            Channel = EventChannel.Operational, Level = EventLevel.Warning, Version = 1)]
        internal void LogControllerActionWarning(string instance, string controller, string action,
            string clientSideMessage, string serverSideMessage, string parameter)
        {
            WriteEvent(3, instance, controller, action, clientSideMessage, serverSideMessage, parameter);
        }

        [Event(4, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Message: [{3}] Server Parameter: [{4}]",
            Channel = EventChannel.Operational, Level = EventLevel.Informational, Version = 1)]
        internal void LogControllerActionInfo(string instance, string controller, string action,
            string message, string parameter)
        {
            WriteEvent(4, instance, controller, action, message, parameter);
        }

        [Event(5, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Message: [{3}] Server Parameter: [{4}]",
            Channel = EventChannel.Debug, Level = EventLevel.Verbose, Version = 1)]
        internal void LogControllerActionDebug(string instance, string controller, string action,
            string message, string parameter)
        {
            WriteEvent(5, instance, controller, action, message, parameter);
        }

        [Event(6, Message = "Instance: [{0}] Controller: [{1}] Action: [{2}] Message: [{3}] Server Parameter: [{4}]",
            Channel = EventChannel.Analytic, Level = EventLevel.Verbose, Version = 1)]
        internal void LogControllerActionAnalytic(string instance, string controller, string action,
            string message, string parameter)
        {
            WriteEvent(6, instance, controller, action, message, parameter);
        }
    }
}

我使用这个 cmd 片段来注册事件源：

C:\CustomEventSources>wevtutil.exe im EventSourceExample.Company-MyProject-WebApp.etwManifest.man /rf:"C:\CustomEventSources\EventSourceExample.Company-MyProject-WebApp.etwManifest.dll" /mf:"C:\CustomEventSources\ EventSourceExample.Company-MyProject-WebApp.etwManifest.dll"

Answer 1

默认情况下，分析和调试被禁用：

默认情况下禁用分析和调试日志。启用后，它们可以快速填充大量条目。出于这个原因，您可能希望将它们打开一段时间以收集一些故障排除数据，然后再次将其关闭。您可以使用 Windows 界面或命令行来执行此过程。

您必须在 Eventviewer 选项中手动显示它们：

1. 启动事件查看器。
2. 单击View菜单。如果Show Analytic and Debug Logs选中，分析和调试日志已经可见。不需要采取进一步行动。如果Show Analytic and Debug Logs未选中，则选择Show Analytic and Debug Logs使这些日志可见。