What are the advantages of using ETW EventSources versus regular EventLog API?

Question

We are currently investigating replacing the logging on our system. In many places we are already using the regular EventLog API which auto creates the Event Source if one doesn't exists.

I'd like to know how much benefit there is to converting our code over to using EventSources proper instead of just using the regular EventLog API (which is very easy to use). Is this worth doing?

We want to achieve both logging (where we want to know about single success/error/info/warn status events) and also tracing.

score 3 · Accepted Answer · answered Sep 20 '13 at 20:06

3

Eventlog is internally ETW starting with Vista (just for information).

For tracing the Eventlog is not helpful. You would float the eventlog with too many entries. With Eventsource the data are not send until you listen to them (xperf, WPR, PerfView) so this doesn't impact performance.

And if you still need Eventlog entries you can also use EventSource to write to the Eventlog.

Microsoft released a NuGet Package of Microsoft EventSource Library a few weeks ago.

Microsoft explained here how to use it:

Announcing the EventSource NuGet Package – Write to the Windows Event Log

When using Eventsource you have the huge benefit of also adding Kernel providers with xperf/WPR like CPU or DISK and you can see how your application impacts the system.

answered Sep 20 '13 at 20:06

magicandre1981

27,895
5
86
127

FYI, the Nuget EventSource library is for .NET 4.0, EventSource is already built into .net 4.5 and later.. – Erik Funkenbusch Sep 22 '13 at 18:58
and what's the problem? With this nuGet package you can code for both, not only for 4.5. – magicandre1981 Sep 23 '13 at 04:02
The problem is that your answer makes it seem like you have to use the nuget package to use EventSource. You only use the nuget package with .net 4.0, not 4.5 because it's built in – Erik Funkenbusch Sep 23 '13 at 05:58
Ok, should I be using the Semantic Logging Application Block (SLAB) which uses ETW or plain ETW provided in .NET4.5 by default? – jaffa Sep 23 '13 at 11:47
use the NuGet version. This version will be update regularly and also supports Eventlog support. – magicandre1981 Sep 24 '13 at 03:48

What are the advantages of using ETW EventSources versus regular EventLog API?

1 Answers1