This project is read-only.

"configure ETW to save the trace messages to a .etl file"

Topics: General, Using
Nov 20, 2014 at 3:02 PM
Hello Community,

I am reading this article:

And it makes mention of the following statement:
"As an alternative to the Out-of-Process Host application included with the block, you could configure ETW to save the trace messages to a .etl file and use another tool to read this log file."

I've been searching online on how to quickly create an .etl file with ETW, but it is coming up short. Would someone be able to point me in the right direction to do this? That is, I do not want to configure a sink, I just want to write directly to an .ETL file.

Thank you,
Nov 20, 2014 at 6:17 PM
Here's a great tutorial for creating (and reading) an etl file from EventSource: Instrumenting Your Application to Measure its Performance Part 3 An introduction to EventSource, Logman, and PerfView.

Assuming you have the EventSource created:
    [EventSource(Guid = "b9651a6b-e34d-4585-97d2-b9a05935cb33", Name="Entlib-Dev-MyEventSource")]
    public class MyEventSource : EventSource
        public static readonly MyEventSource Log = new MyEventSource();

        private MyEventSource() { }

        [Event(1, Level = EventLevel.Informational, Keywords = System.Diagnostics.Tracing.EventKeywords.None)]
        public void PackageDelivered(string message)
            this.WriteEvent(1, message);

the steps are:
  • Create a data collector using LogMan (note use of the GUID from EventSource declaration):
C:\Logs>LOGMAN create trace MyEventSource -o C:\logs\myeventsource.etl -p "{b9651a6b-e34d-4585-97d2-b9a05935cb33}" -f bincirc -max 1000
  • Start the data collector:
C:\Logs>logman start myeventsource
  • Run the application
  • Stop the collector:
C:\Logs>logman stop myeventsource
Now you should see an etl file (e.g. myeventsource_000001.etl) which can be opened using a tool such as PerfView.

Randy Levy
Enterprise Library support engineer
Support How-to
Marked as answer by MichaelDBang on 11/20/2014 at 10:19 AM
Nov 20, 2014 at 6:22 PM
Yeah, that's what I ended up doing. I was hoping there would be something a little more straight-forward that didn't involve an external application altogether. ;P
Nov 20, 2014 at 6:34 PM
Edited Nov 20, 2014 at 6:36 PM
There is also a GUI which you can use to manage:

From Computer Managment (compmgmt.msc) navigate to System Tools->Performance->Data Collector Sets. Under User Defined you will see the data collector defined with the logman create trace command. From there you can stop, start delete.

And I agree, the ETW stuff is still a bit arcane.

Randy Levy
Enterprise Library support engineer
Support How-to
Nov 20, 2014 at 6:39 PM
Correct, I saw that, too. :) It just seems like I should be able to easily define a .etl sink location and be done with it, much like how a FlatFileSink and/or RollingFileSink work. Instead, I have to use an external application. In this case I am writing a unit test to test functionality that occurs when a EventSource writes an entry that exceeds the max size, so I need an easy way to automate that. Unit Tests aren't supposed to use or be dependent on external resources like this. I realize this isn't EntLib's domain, but still. :)
Nov 20, 2014 at 6:42 PM