RE: Simple question on ETW, or not?

Tech-Archive recommends: Fix windows errors by optimizing your registry

Thanks for replying so fast Yanno!

yup, that's right, the .etl emtpy seems empty, but why? The output I'm
getting from your IISLogReq.bat is this:

-------------------------------------------------------------------------------
IISLogReq.bat - Start/stop IIS 6 ETL trace for the following providers:

Provider Flags Level

-------------------------------------------------------------------------------
* "IIS: WWW Global" (Shutdown) 0x05
{D55D3BC9-CBA9-44DF-827E-132D3A4596C2} 0x000000fe 0x05
* "IIS: WWW Server" (IISAuthentication,
IISSecurity,
IISFilter,
IISStaticFile,
IISCGI,
IISCompression,
IISCache,
IISAll) 0x05
{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83} 0x000000fe 0x05
* "IIS: Active Server Pages (ASP)" 0x000000fe 0x05
{06B94D9A-B15E-456E-A4EF-37C984A2CB4B} 0x000000fe 0x05
* "ASP.NET Events" (Module,Page,AppServices) 0x05
{AFF081FE-0247-4275-9C4E-021F3DC1DA35} 0x000000fe 0x05
..
THE W3WP PROCESS NEEDS TO BE RUNNING BEFORE STARTING THE TRACE.
ASP/ASPX ALSO NEED TO INITIALIZED.
Step 1: Press a key to start the trace
Step 2: Reproduce the issue
Step 3: Press a key to stop and process the trace
..
-------------------------------------------------------------------------------
Press any key to continue . . .

C:\Documents and Settings\nreid.REELEEZEE\My
Documents\WMI\iis6tracing>logman start
IISLogReq -pf IISLogReq.prov -ets

Name: IISLogReq
Age Limit: 15
Buffer Size: 8
Buffers Written: 1
Events Lost: 0
Flush Timer: 0
Buffers Free: 2
Buffers Lost: 0
File Mode: Sequential
File Name: C:\Documents and Settings\nreid.REELEEZEE\My
Documents\WM
I\iis6tracing\IISLogReq.etl
Logger Id: 2
Logger Thread Id: 1224
Maximum Buffers: 26
Maximum File Size: 0
Minimum Buffers: 4
Number of buffers: 4
Real Time Buffers Lost: 0

Providers:
{AFF081FE-0247-4275-9C4E-021F3DC1DA35}

The command completed successfully.
-------------------------------------------------------------------------------
Trace should normally be started. Confirmation output should show all
providers
successfully notified. Now reproduce the issue.
Then come back to this window and press any key to stop and process the trace.
-------------------------------------------------------------------------------
Press any key to continue . . .





"yanno" wrote:

Hi Nick,

The error message is the kind of yu get when the ETW trace is actually
empty. To check your trace file contains data you should run tracerpt.exe
against it, it will turn it into a CSV file. There is you only get a row
which is the header it means no event was collected.

-yanno

"Nick" wrote:

Hi reader, if you're not familiar with WMI and ETW then pass this question
until there's some follow-up.


You're still here? Great!
I'm new to WMI and ETW but from reading I know it can help me to solve a
complex problem we have regarding differences between .Net FW1 and .Net FW2.
However after having tried for a couple of hours my patience is spent so I'm
resorting to this forum. I've spent a few hours reading up on the basics and
have yet to see my first ETW event logged. It can't be that difficult so
obviously I'm missing something, perhaps "up there"? For you to judge ;-)

Q: On my XP-Pro I want to achieve a unified log of a simple few ASP.Net 2.0
requests, including IIS 6.0, FW.2.0/ASP.Net 2.0, ADO.Net 2.0, and SQL Server
2005 events. (Our own code is NOT yet wmi aware.)

I've installed various stuff like the WMI tools, LogParser (use it all the
time for IIS logs), and the suggested ways of
https://blogs.gotdotnet.com/yanno/archive/2006/03/02/542485.aspx, and
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsql90/html/data_access_tracing.asp

All this has so far led to nothing, at least not "out-of-the-box", apart
from a crashing WMI Event Viewer or vague errors from
Tracerpt/DumpTraceReqs.js.

So who knows this stuff and can walk me through it? My first milestone would
be seeing just a single event in any readable form from any part of a local
Http session... I'm sure I could take it from there.

A: ... (please)



Thanks in advance, Nick

Reeleezee.com

.

Relevant Pages