Skip to content

Conversation

@cgillum
Copy link
Member

@cgillum cgillum commented Sep 17, 2025

Problem Description

During an incident investigation, we saw the following error message logged by the ETW provider:

Event 300 was called with 2 argument(s), but it is defined with 4 parameter(s).

Impact

This error does not cause any exceptions. It just produces a logging error and prevents us from seeing any AcquiredAppLock events in App Service telemetry. The log should still get captured correctly in Application Insights, however, since that does not depend on the ETW provider.

Root Cause and Fix

Looking at the code, the problem seemed to be that we were passing a 2 to WriteEventCore when we needed to be passing a 4. Rather than fixing this directly, I decided we should just not use WriteEventCore (which is unsafe) and instead just use WriteEvent, which is safer and more consistent with our other logs.

As an aside WriteEventCore is useful as a performance optimization. However, this particular log event is written infrequently and therefore doesn't really benefit from a slightly more optimal code path.

@cgillum cgillum merged commit d561432 into main Sep 22, 2025
5 checks passed
@cgillum cgillum deleted the cgillum/fix-etw-trace branch September 22, 2025 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants