TdhGetEventInformation returns 1168 for manifest based events

[ovidiubuligan]

Hello , I am no expert in ETW but I know I have an event stream that has some custom properties and I want to use this tool to print them out to STDOUT.

I running the code from master to debug the issue and am getting the 1168 error while querying for information via TdhGetEventInformation

The configuration file is verry simple :

{
  "LogConfig": {
    "sources": [
      {
        "type": "ETW",
        "providers": [
          {
            "ProviderGuid": "AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAA",
            "level": "Error"
          }
        ]
      }
    ]
  }
}

Do I need to do something extra for manifest based/ extra properties event ?

[bobsira]

@ovidiubuligan Your manifest looks correct. It seems like you do not have a valid provider. "AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAA" value for providerGuid seems to be invalid hence causing the 1168 error code.

[bobsira]

Context, this is failing because of the logic to validate the GUID in the code: https://github.com/microsoft/windows-container-tools/blob/main/LogMonitor/src/LogMonitor/Parser/LoggerSettings.h#:~:text=%7D%3B-,inline,%7D,-enum%20class%20LogSourceType

The GUID should have the following requirements:

1. Total length of GUID string 36
2. It should be separated into 5 parts by dash (-) delimiter
3. Each of the five parts should be of the following length: 8 - 4 - 4 - 4 - 12

Hence the following does not give out the 1168 error code "ProviderGuid": "AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA"

Unless there are any more concerns, we can close out this. cc: @iankingori @RebeccaMbulaMs

[huxia]

I'm hitting the same issue, and I'm pretty sure my guid & config file is correct.
Same applies to the origin post from @ovidiubuligan, it indicates that the code already runs into TdhGetEventInformation. per doc https://docs.microsoft.com/en-us/windows/win32/api/tdh/nf-tdh-tdhgeteventinformation and
https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes--1000-1299-
, 1168 means ERROR_NOT_FOUND | The schema for the event was not found..

Also, our app's ETW can be captured by logman.

I'm also new to ETW, so will be super appreciate if some one can help on how to resolve this issue.

BTW: our etw is generated by this c# logger

    [EventSource(Name = "EtwLogger", Guid = "{9C8CCDAB-A025-499C-A9C8-F21E3968E094}")]
    public sealed class EventSourceLogEngine : BaseEventSourceLogEngine
    {
        /// <summary>
        /// Initializes a new instance of the <see cref="EventSourceLogEngine"/> class.
        /// </summary>
        /// <param name="traceGroup">An optional trace group to use for all logs generated from this instance.</param>
        public EventSourceLogEngine(string traceGroup)
            : base(traceGroup)
        {
        }

        [Event((int)EventLevel.Verbose, Version = 1, Level = EventLevel.Verbose)]
        private void LogVerbose(string LogTag, string TraceGroup, string Message, string Method, string File, int Line)
        {
        }

        [Event((int)EventLevel.Informational, Version = 1, Level = EventLevel.Informational)]
        private void LogInfo(string LogTag, string TraceGroup, string Message, string Method, string File, int Line)
        {
        }

        [Event((int)EventLevel.Warning, Version = 1, Level = EventLevel.Warning)]
        private void LogWarn(string LogTag, string TraceGroup, string Message, string Method, string File, int Line)
        {
        }

        [Event((int)EventLevel.Error, Version = 1, Level = EventLevel.Error)]
        private void LogError(string LogTag, string TraceGroup, string Message, string Method, string File, int Line)
        {
        }

        [Event((int)EventLevel.Critical, Version = 1, Level = EventLevel.Critical)]
        private void LogCritical(string LogTag, string TraceGroup, string Message, string Method, string File, int Line)
        {
        }
    }

[bobsira]

@huxia thanks for reaching out.

Could you confirm to me the Windows Edition, Version and OS build you are using while experiencing this.

[bobsira]

@huxia Also I want to repro this. Could you share

(i) The Event Manifest XML file you used to author ETW event
(ii) The tool you are using to consume the ETW events
(ii) any steps I might need to use to repro this on my end.

Thanks.

[mjrousos]

This comes up when the events are not from an ETW provider directly but from a .NET EventSource. I'm not an expert on EventSource, but my understanding is that it's a cross-platform tracing technology that, on Windows, can be subscribed to from ETW.

I expect the failure here is because of the subtle difference between EventSource and ETW. Still, other ETW listeners can receive EventSource events (PerfView and LogMan both do). It would be very useful if LogMonitor could forward EventSource events to the console as they're becoming more common for tracing in .NET apps.

Some details on how ETW and EventSources relate: dotnet/docs#4954

[profnandaa]

Thanks for the tip @mjrousos! We'll follow up on this.

[bobsira]

Update on this thread, we have spent some efforts in mapping out the work that would go into implenting this in Log Monitor . We are also keen to know the work around that you've had with this issue @huxia and @ovidiubuligan.

What tools have you been using at the moment to overcome this issue?