15

Why should I use Event Tracing for Windows (ETW) over the standard .NET EventLog class, and vice versa? Does knowing that we'll be using quite a few performance counters impact the decision?

What I know so far:

  1. ETW should perform much better.
  2. ETW is much more work to integrate with (e.g. .NET Event Tracing for Windows)
  3. By selecting one of the standard channels in ETW (e.g. Application, System), the same information is available in the event log.
Community
  • 1
  • 1
Kaleb Pederson
  • 45,767
  • 19
  • 102
  • 147

2 Answers2

15

ETW has many advantages.

First, in .NET 4.5, it will be far simpler to use. The EventSource class in 4.5 dramatically simplifies creating events from within your code.

However, even without this, ETW has some huge advantages, though it does typically work differently, and, as such, serve a different purpose than EventLog.

EventLog is really designed for logging. ETW, on the other hand, allows you to trace your application's progress in the context of the system as a whole. When you start collecting ETW events, you collect them on a system basis, which lets you not only trace your application, but see what's happening in relation to the system as it's running. By using a tool like PerfView, you can see how specific portions of your application operate while simultaneously seeing what's happening with the framework and Windows as a whole.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Reed Copsey
  • 554,122
  • 78
  • 1,158
  • 1,373
4

This MSDN article does a good job describing the benefits of ETW.

While the EventSource provides a great idiomatic way for .NET developers to author ETW events, it doesn’t come with any of the familiar destinations for logging (rolling file, database, etc.). ETW uses its own destinations such as .etl files, and uses different tools for parsing and analyzing log data.

The new Semantic Logging Application Block makes it easier to incorporate the EventSource functionality and to manage the logging behavior of your system. It makes it possible to inherit most of the structure from the ETW pipeline, including event metadata and payload, to write log messages to multiple destinations, such as databases, rolling files or Windows Azure table storage, and to control what your system logs by setting filters and logging verbosity.

Grigori Melnik
  • 4,067
  • 2
  • 34
  • 40