Semantic Logging using ETW with Custom Keywords not logging

Question

I am trying to use .Net 4.5, Semantic Logging (SLAB) EventSource, to create events with custom keywords. I would like to use Out-of-Process, and use the keywords to steer events to logfiles or SQL. I have used EventSourceAnalyzer against this class in a separate test, and no exceptions.

I can "steer" the events to different sinks by using different "EventLevel", but I would prefer to route with custom keywords.

Here is the class --

 public class XYZWebLog : EventSource
{
    public class Keywords
    {
        public const EventKeywords Login = (EventKeywords)2;
        public const EventKeywords Billing = (EventKeywords)4;
    }

    [Event(1, Level = EventLevel.Informational, Keywords = Keywords.Login)]
    public void SuccessfulLogin(string loginId) { WriteEvent(1, loginId); }
    [Event(2, Level = EventLevel.Informational, Keywords = Keywords.Login)]
    public void UnSuccessfulLogin(string loginId){ WriteEvent(2, loginId); }

    [Event(3, Level = EventLevel.Informational, Keywords = Keywords.Login)]
    public void Logout(string loginId) { WriteEvent(3, loginId); }

    [Event(4, Level = EventLevel.Informational, Keywords = Keywords.Billing)]
    public void BillAudit(string UserId, string Action, string VisitId, string BillingID, string Details) { WriteEvent(4, UserId, Action, VisitId, BillingID, Details); }

    private static XYZWebLog _log = new XYZWebLog();
    private XYZWebLog() {}
    public static XYZWebLog Log { get { return _log; } }
}

And then here is the config for the SemanticLogging-svc.exe :

 <!-- Sinks reference definitons used by this host to listen ETW events -->

<flatFileSink name="svcRuntime" fileName="Billing.log" >
  <sources>


    <eventSource name="XYZWebLog" level="Informational" matchAnyKeyword="4" />
  </sources>

  <eventTextFormatter header="----------"/>
</flatFileSink>

<flatFileSink name="loginLogs" fileName="Login-Logout.log" >
  <sources>
    <eventSource name="XYZWebLog" level="Informational" matchAnyKeyword="2" />
  </sources>
  <eventTextFormatter header="++++++++++"/>
</flatFileSink>

If I remove the "matchAnyKeyword", and set up the levels correctly, I can make the events go into different files -- I have tried "2" and "0x002", and other things around defining the custom event that I can think of. I have searched online and studied what documentation I could find.

Answer 1

I don't know much about SLAB. But I was able to use your sample and generate ETW events based on Keywords.

Here is the code.

namespace ConsoleApplication2
{
    class Program
    {
        static void Main(string[] args)
        {
            for (int i = 0; i < 10; i++)
            {
                XYZWebLog.Log.SuccessfulLogin("naveen");
                XYZWebLog.Log.BillAudit("naveen", "bought", "123", "123", "details");

            }
        }
    }

    public class XYZWebLog : EventSource
    {
        public class Keywords
        {
            public const EventKeywords Login = (EventKeywords)2;
            public const EventKeywords Billing = (EventKeywords)4;
        }

        [Event(1, Level = EventLevel.Informational, Keywords = Keywords.Login)]
        public void SuccessfulLogin(string loginId) { WriteEvent(1, loginId); }
        [Event(2, Level = EventLevel.Informational, Keywords = Keywords.Login)]
        public void UnSuccessfulLogin(string loginId) { WriteEvent(2, loginId); }

        [Event(3, Level = EventLevel.Informational, Keywords = Keywords.Login)]
        public void Logout(string loginId) { WriteEvent(3, loginId); }
![enter image description here][1]
        [Event(4, Level = EventLevel.Informational, Keywords = Keywords.Billing)]
        public void BillAudit(string UserId, string Action, string VisitId, string BillingID, string Details)
        {
            WriteEvent(4, UserId, Action, VisitId, BillingID, Details);
        }
        private static XYZWebLog _log = new XYZWebLog();
        private XYZWebLog() { }
        public static XYZWebLog Log { get { return _log; } }
    }
}

My tool of choice to viewing and controlling ETW events is Perfview

I was able to generate events based on the keyword using PerfView.

If you notice in the Additional Providers field I have used the keyword *XYZWebLog:4 which means I want to filter only Billing events.

And based on this setting, only these events are generated.

And I changed the setting to *XYZWebLog:2 and here is my output