Uninstall event source (ETW) without manifest file?

Question

What is the best way to uninstall / delete previously installed event sources without using manifest?

For example. If I have something like:


    [EventSource(Name = "Corporation-Module-X")]
    public sealed class XEventSource : EventSource
    {
        //...
    }

For installing event source I am using wevtutil {im | install-manifest}

For uninstall is easy if I have the manifest. But could I uninstall event source without having manifest file?

I will try to clarify how I am using event sources and why I would like to remove it.

After installing event source using wevtutil, event source is visible as event trace provider. So I can create new Data Collector Set in Performance Monitor where I am adding my event source (together with some performance counters). It looks like this:

What could happen is that event source get renamed or deleted. E.g. after rename and install using wevtutil.


    [EventSource(Name = "Corporation-Module-Y")]
    public sealed class XEventSource : EventSource
    {
        //...
    }

Old one is still there in event trace providers:

What I would like is to query all installed event providers that start with Corporation* and to delete them before installing new one.

Thanks!

I've voted now to close the question as "too broad" because I still have no idea if the dumped manifest works and how else we could help you. — magicandre1981, Apr 05 '19 at 13:35
I am marking your post as the answer since there is not better. It could probably work... — Zeljko, Apr 05 '19 at 13:43

magicandre1981 · Accepted Answer · 2019-04-05T13:44:42.690

2

There is no need to uninstall anything, because a manifest is not registered if you EventSource. The manifest is sent the ManifestData Event

to the listener tool (Perfview, Windows Performance Toolkit) so that they can interpret the recorded data.

When you registered the provider, you can dump the manifest and use again wevtutil to remove it.

edited Apr 05 '19 at 13:44

answered Mar 20 '19 at 15:54

magicandre1981

27,895
5
86
127

I will update my question. Just to clarify why I would like to remove that event source. – Zeljko Mar 21 '19 at 09:58
[perfview allows you to dump the manifest of installed providers](https://stackoverflow.com/a/39092214/1466046) and now use the manifest for what ever you want – magicandre1981 Mar 21 '19 at 16:48

Uninstall event source (ETW) without manifest file?

1 Answers1