ETW 意外跟踪事件 254?
ETW Unintended Trace Event 254?
我正在设置 WCF 服务,托管在 Windows 服务中,该服务使用 Windows 事件跟踪 (ETW) 进行日志记录。目前我只是专注于使用 ETW 设置一个虚拟 Windows 服务,我看到一些意外事件被记录下来。特别是,每当我启动或停止服务时,我都会看到操作码为 254 的事件,但没有消息。
我试着在网上四处寻找,但到目前为止我还没有找到任何关于这是什么的参考资料。
如果你想尝试一下,这里是服务代码:
Imports System.Threading
Public Class MyTestService
Private _cts As CancellationTokenSource
Private _workTask As Task = Nothing
Private Class WorkState
Public Property CancellationToken As CancellationToken
Public Sub New(ByVal cancelToken As CancellationToken)
Me.CancellationToken = cancelToken
End Sub
End Class
Protected Overrides Sub OnStart(ByVal args() As String)
' Add code here to start your service. This method should set things
' in motion so your service can do its work.
Debugger.Launch()
_cts = New CancellationTokenSource()
_workTask = Task.Factory.StartNew(AddressOf DoWork, New WorkState(_cts.Token), _cts.Token)
_workTask.ContinueWith(AddressOf OnWorkDone)
MyTestServiceEventSource.Log.OnServiceStarted()
End Sub
Private Sub OnWorkDone(parent As Task)
If Not IsNothing(parent.Exception) Then
MyTestServiceEventSource.Log.OnError(parent.Exception)
End If
End Sub
Private Sub DoWork(ByVal obj As Object)
Dim state = CType(obj, WorkState)
While Not state.CancellationToken.IsCancellationRequested
Threading.Thread.Sleep(5000)
MyTestServiceEventSource.Log.OnTick()
End While
End Sub
Protected Overrides Sub OnStop()
' Add code here to perform any tear-down necessary to stop your service.
Try
_cts.Cancel()
_workTask.Wait(1500)
Catch ex As Exception
MyTestServiceEventSource.Log.OnError(ex)
Finally
_cts = Nothing
_workTask = Nothing
End Try
MyTestServiceEventSource.Log.OnServiceStopped()
End Sub
End Class
这里是事件源class:
Imports System.Diagnostics.Tracing
Imports Newtonsoft
<EventSource(Name:="Company-MyTestService")>
Public Class MyTestServiceEventSource
Inherits EventSource
#Region "Singleton Pattern"
Private Shared _inst As New Lazy(Of MyTestServiceEventSource)(Function() New MyTestServiceEventSource())
Public Shared ReadOnly Property Log As MyTestServiceEventSource
Get
Return _inst.Value
End Get
End Property
Private Sub New()
MyBase.New()
End Sub
#End Region
Public Class EventIds
Public Const SERVICE_STARTED As Integer = 1
Public Const SERVICE_STOPPPED As Integer = 2
Public Const TICK_EVENT As Integer = 3
Public Const ERROR_EVENT As Integer = 4
End Class
<[Event](EventIds.SERVICE_STARTED, Opcode:=EventOpcode.Start, Message:="MyTestService Started", Level:=EventLevel.Informational)>
Public Sub OnServiceStarted()
If IsEnabled() Then
Me.WriteEvent(EventIds.SERVICE_STARTED)
End If
End Sub
<[Event](EventIds.TICK_EVENT, Message:="MyTestService Tick", Level:=EventLevel.Verbose)>
Public Sub OnTick()
If IsEnabled() Then
Me.WriteEvent(EventIds.TICK_EVENT)
End If
End Sub
<[Event](EventIds.ERROR_EVENT, Message:="{0}", Level:=EventLevel.Error)>
Public Sub OnError(ByVal errMsg As String, ByVal details As String)
If IsEnabled() Then
Me.WriteEvent(EventIds.ERROR_EVENT, errMsg, details)
End If
End Sub
<NonEvent>
Public Sub OnError(ByVal ex As Exception)
Try
Dim details = Json.JsonConvert.SerializeObject(ex)
OnError(ex.Message, details)
Catch ex2 As Exception
Debugger.Break()
End Try
End Sub
<[Event](EventIds.SERVICE_STOPPPED, Opcode:=EventOpcode.Stop, Message:="MyTestService Stopped", Level:=EventLevel.Informational)>
Public Sub OnServiceStopped()
If IsEnabled() Then
Me.WriteEvent(EventIds.SERVICE_STOPPPED)
End If
End Sub
End Class
所有 ETW 提供程序都必须有一个显示提供程序事件的清单。这是由 EventSource 通过您看到的 ManifestData
事件完成的。
Event MSec= "16059,4211" PID="3444" PName="foo" TID="1776" ActivityID="ffd679657c475d357c32b8dbe608b3ff" EventName="ManifestData" ProviderName="FooEventSource" ProviderGuid="GUID" ClassicProvider="False" ProcessorNumber="1" Opcode="254" >
我正在设置 WCF 服务,托管在 Windows 服务中,该服务使用 Windows 事件跟踪 (ETW) 进行日志记录。目前我只是专注于使用 ETW 设置一个虚拟 Windows 服务,我看到一些意外事件被记录下来。特别是,每当我启动或停止服务时,我都会看到操作码为 254 的事件,但没有消息。
我试着在网上四处寻找,但到目前为止我还没有找到任何关于这是什么的参考资料。
如果你想尝试一下,这里是服务代码:
Imports System.Threading
Public Class MyTestService
Private _cts As CancellationTokenSource
Private _workTask As Task = Nothing
Private Class WorkState
Public Property CancellationToken As CancellationToken
Public Sub New(ByVal cancelToken As CancellationToken)
Me.CancellationToken = cancelToken
End Sub
End Class
Protected Overrides Sub OnStart(ByVal args() As String)
' Add code here to start your service. This method should set things
' in motion so your service can do its work.
Debugger.Launch()
_cts = New CancellationTokenSource()
_workTask = Task.Factory.StartNew(AddressOf DoWork, New WorkState(_cts.Token), _cts.Token)
_workTask.ContinueWith(AddressOf OnWorkDone)
MyTestServiceEventSource.Log.OnServiceStarted()
End Sub
Private Sub OnWorkDone(parent As Task)
If Not IsNothing(parent.Exception) Then
MyTestServiceEventSource.Log.OnError(parent.Exception)
End If
End Sub
Private Sub DoWork(ByVal obj As Object)
Dim state = CType(obj, WorkState)
While Not state.CancellationToken.IsCancellationRequested
Threading.Thread.Sleep(5000)
MyTestServiceEventSource.Log.OnTick()
End While
End Sub
Protected Overrides Sub OnStop()
' Add code here to perform any tear-down necessary to stop your service.
Try
_cts.Cancel()
_workTask.Wait(1500)
Catch ex As Exception
MyTestServiceEventSource.Log.OnError(ex)
Finally
_cts = Nothing
_workTask = Nothing
End Try
MyTestServiceEventSource.Log.OnServiceStopped()
End Sub
End Class
这里是事件源class:
Imports System.Diagnostics.Tracing
Imports Newtonsoft
<EventSource(Name:="Company-MyTestService")>
Public Class MyTestServiceEventSource
Inherits EventSource
#Region "Singleton Pattern"
Private Shared _inst As New Lazy(Of MyTestServiceEventSource)(Function() New MyTestServiceEventSource())
Public Shared ReadOnly Property Log As MyTestServiceEventSource
Get
Return _inst.Value
End Get
End Property
Private Sub New()
MyBase.New()
End Sub
#End Region
Public Class EventIds
Public Const SERVICE_STARTED As Integer = 1
Public Const SERVICE_STOPPPED As Integer = 2
Public Const TICK_EVENT As Integer = 3
Public Const ERROR_EVENT As Integer = 4
End Class
<[Event](EventIds.SERVICE_STARTED, Opcode:=EventOpcode.Start, Message:="MyTestService Started", Level:=EventLevel.Informational)>
Public Sub OnServiceStarted()
If IsEnabled() Then
Me.WriteEvent(EventIds.SERVICE_STARTED)
End If
End Sub
<[Event](EventIds.TICK_EVENT, Message:="MyTestService Tick", Level:=EventLevel.Verbose)>
Public Sub OnTick()
If IsEnabled() Then
Me.WriteEvent(EventIds.TICK_EVENT)
End If
End Sub
<[Event](EventIds.ERROR_EVENT, Message:="{0}", Level:=EventLevel.Error)>
Public Sub OnError(ByVal errMsg As String, ByVal details As String)
If IsEnabled() Then
Me.WriteEvent(EventIds.ERROR_EVENT, errMsg, details)
End If
End Sub
<NonEvent>
Public Sub OnError(ByVal ex As Exception)
Try
Dim details = Json.JsonConvert.SerializeObject(ex)
OnError(ex.Message, details)
Catch ex2 As Exception
Debugger.Break()
End Try
End Sub
<[Event](EventIds.SERVICE_STOPPPED, Opcode:=EventOpcode.Stop, Message:="MyTestService Stopped", Level:=EventLevel.Informational)>
Public Sub OnServiceStopped()
If IsEnabled() Then
Me.WriteEvent(EventIds.SERVICE_STOPPPED)
End If
End Sub
End Class
所有 ETW 提供程序都必须有一个显示提供程序事件的清单。这是由 EventSource 通过您看到的 ManifestData
事件完成的。
Event MSec= "16059,4211" PID="3444" PName="foo" TID="1776" ActivityID="ffd679657c475d357c32b8dbe608b3ff" EventName="ManifestData" ProviderName="FooEventSource" ProviderGuid="GUID" ClassicProvider="False" ProcessorNumber="1" Opcode="254" >