Viewing ETW traces for WCF service using a non-default ETW provider ID


WCF 4.0 emits traces to Event Tracing for Windows (ETW). Please see for more details. By default the ETW traces are emitted using the default provider ID ({C651F5F6-1C0D-492E-8AE1-B4EFD7C9D503}). The .NET Framework 4 registers an ETW manifest for this provider ID. If a manifest is registered the ETW events can be decoded and viewed in the Windows Event viewer.

WCF allows events to be emitted on a non-default provider ID by changing the provider ID in the config. In this case the events are non-decodable in the event viewer since a manifest is not registered for this provider ID.

More Information

WCF allows events to be emitted on a specific provider ID by changing configuration as follows
    <diagnostics etwProviderId="52A3165D-4AD9-405C-B1E8-7D9A257EAC9F" /> 


Now since the manifest with provider ID 52A3165D-4AD9-405C-B1E8-7D9A257EAC9F is not registered the events are not decodable. To read the events there are 2 options:

Option 1:

1)    Create and start  an ETW session that listens for events with the specific provider ID

> logman create trace myETWSession -o "C:\Temp\mylog.etl" -ets -p {52A3165D-4AD9-405C-B1E8-7D9A257EAC9F} -mode Append -ft 1
> Logman start myETWSessionconfiguration> 

2)    When ready to view the logs stop the session

> Logman stop myETWSession

3)    Copy the ETW manifest file from .NET Framework 4 directory to the logs directory and modify the provider id in the manifest.  Copy from the .Net Framework 4 directory to c:\Temp.

4)    Modify the provider id in to 52A3165D-4AD9-405C-B1E8-7D9A257EAC9F
In the manifest located in C:\Temp change the guid <provider name="Microsoft-Windows-Application Server-Applications" guid="{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}" …..>

5)     Format the trace file with this command.tracerpt -l <tracefile name>.etl -import -of EVTX

6)    Open the generated evtx file in Event Viewer

Option 2:

Register the ETW manifest with the non-default provider id as described in
under the section "Registering an application-specific provider ID"


Id. de artículo: 2120508 - Última revisión: 25 abr. 2012 - Revisión: 1