Cannot read EventProviderTraceListener logs with code RRS feed

  • Question

  • My question is related with ETW and https://www.nuget.org/packages/Microsoft.Diagnostics.Tracing.TraceEvent/ library.

    Since there is no dedicated ETW forum, I am asking here.

    I am using following code to read ETW logs for "ASP.NET Events" and other registered provideers successfully.

    using (var session = new TraceEventSession("TraceSessionTest"))
                    // Set up Ctrl-C to stop the session
                    Console.CancelKeyPress +=
                    (object s, ConsoleCancelEventArgs args) => session.Stop();
                   session.EnableProvider("ASP.NET Events");
                   using (var source = new ETWTraceEventSource("ObserveProcs", TraceEventSourceType.Session))
                        // Hook up the parser that knows about EventSources
                        DynamicTraceEventParser dynamicTraceEventParser = new DynamicTraceEventParser(source);
                        dynamicTraceEventParser.All += delegate (TraceEvent traceEvent2)
                            Console.WriteLine("\n -------- Event: {0}", traceEvent2);

    What I would like to do is that tracing outgoing requests from certain application.
    To do that I have added following configuration to that certain application config file.

        <!--<trace autoflush="true"/>-->
        <trace autoflush="true" indentsize="4">
            <remove name="Default" />
            <add name="EtwListener"
                 type="System.Diagnostics.Eventing.EventProviderTraceListener, System.Core, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089"
                 initializeData="{BDE5930E-34C9-4E2F-A6EC-89E1F1EA69CC}" />
          <source name="System.Net">
              <!--<add name="MyTraceFile"/>
              <add name="MyConsole"/>-->
              <add name="ETWListener" initializeData="{BDE5930E-34C9-4E2F-A6EC-89E1F1EA69CC}"
                   type="System.Diagnostics.Eventing.EventProviderTraceListener, System.Core, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089"
                   traceOutputOptions="LogicalOperationStack, DateTime, Timestamp, Callstack"/>
          <!--<add name="MyTraceFile" type="System.Diagnostics.TextWriterTraceListener" initializeData="System.Net.trace.log" traceOutputOptions="Timestamp"/>
          <add name="MyConsole" type="System.Diagnostics.ConsoleTraceListener"/>-->
          <add name="ETWListener" type="System.Diagnostics.Eventing.EventProviderTraceListener, System.Core, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089"
               initializeData="{BDE5930E-34C9-4E2F-A6EC-89E1F1EA69CC}" />
          <add name="System.Net" value="Information"/>

    I am able to see trace logs with logman with following commands;

    logman start "hellosession" -p '{BDE5930E-34C9-4E2F-A6EC-89E1F1EA69CC}' -o "hello.etl" -ets
    --Made some request from the application to trigger some HttpWebRequest operation.
    logman stop "hellosession" -ets
    tracerpt hello.etl -of csv -o hello1.csv

    But I am not able to see/read logs with code (change on code for provider guid - stated on initializeData)

    session.EnableProvider(new Guid("{BDE5930E-34C9-4E2F-A6EC-89E1F1EA69CC}"), TraceEventLevel.Verbose);

    I assume this is not registered provider so that I can not see it provider list with "logman query provider".
    Is there any other thing I need to subscribe EventProviderTraceListener from code?

    Update: I can get exception trace logs like:

    <Event MSec="447529,4150" PID="22260" PName=        "" TID="20412" IsClassic="False" ProviderName="Provider(bde5930e-34c9-4e2f-a6ec-89e1f1ea69cc)" FormattedMessage="[20412] Exception in HttpWebRequest#2155438::GetResponse - The remote server returned an error: (400) Bad Request.."/>

    I have asked same question on perfview github repository here:


    Tuesday, November 27, 2018 12:20 PM

All replies

  • Hi mehmetim,

    Thank you for posting here.

    For your question, you could try the suggestions in the link below.


    If you need further help, you could post a new thread in StackOverFlow.


    Best Regards,


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Wednesday, November 28, 2018 6:21 AM
  • Hi Wendy,

    Thank you for your reply.

    I have already successfully read ETW events as I stated in my question.

    My problem is specific case of reading ETW events. It works with logman (cmd) but does not work with code (https://www.nuget.org/packages/Microsoft.Diagnostics.Tracing.TraceEvent/)

    My understanding is that there is no official support by MS to read ETW events by code. There are some libraries provided under perfview but no offical support.


    I have already posted to SO. But ETW is not widely used and know there fore not much help.


    Best Regards,

    • Edited by mehmetim Wednesday, November 28, 2018 6:34 AM
    Wednesday, November 28, 2018 6:32 AM