ETW not logging events to channel (event log)

Question

I´m working on a project testing ETW tracing with manifest-based events. What I´m struggling to understand is why I can´t see any events in my log file.

Here is the manifest:

<?xml version="1.0" encoding="UTF-16"?>
<instrumentationManifest xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="http://schemas.microsoft.com/win/2004/08/events/trace">
    <instrumentation>
        <events>
            <provider name="WELTest-Provider" guid="{AAC04D94-4865-4C1A-9812-E2009390AAAB}" symbol="PROVIDER_GUID" resourceFileName="C:\Users\Robert\Documents\Visual Studio 2015\Projects\WELTest\x64\Debug\WELTest.exe" messageFileName="C:\Users\Robert\Documents\Visual Studio 2015\Projects\WELTest\x64\Debug\WELTest.exe">
                <events>
                    <event symbol="Event1" value="1" version="1" channel="WELTest-Provider/Admin" level="win:Informational" task="Task1" message="$(string.WELTest-Provider.event.1.message)">
                    </event>
                </events>
                <tasks>
                    <task name="Task1" symbol="TASK_1" value="1" eventGUID="{7724744E-1BD0-45FB-8FB7-7A7176917C05}" message="$(string.WELTest-Provider.task.TASK_1.message)">
                    </task>
                </tasks>
                <channels>
                    <channel name="WELTest-Provider/Admin" chid="WELTest-Provider/Admin" symbol="WELTest_Provider_Admin" type="Admin" enabled="true" message="$(string.WELTest-Provider.channel.WELTest_Provider_Admin.message)">
                    </channel>
                </channels>
            </provider>
        </events>
    </instrumentation>
    <localization>
        <resources culture="en-US">
            <stringTable>
                .....
            </stringTable>
        </resources>
    </localization>
</instrumentationManifest>

Here is the code generated from the manifest with the message compiler (MC.EXE) using the parameter -um.

#include "stdafx.h"

#include <windows.h>
#include <stdio.h>
#include <evntprov.h>

#include "WELTestManifest.h"


int main()
{
    ULONG ulRet = EventRegisterWELTest_Provider();
    if( ulRet != ERROR_SUCCESS )
    {
        printf( "EventRegisterWELTest_Provider returned with errror: %lu", ulRet );
        return 1;
    }

    ulRet= EventWriteEvent1();
    if( ulRet != ERROR_SUCCESS )
    {
        printf( "EventWriteEvent1 returned with errror: %lu", ulRet );
        return 1;
    }

    EventUnregisterWELTest_Provider();


    return 0;
}

Then i register my provider with:

wevtutil im WELTestManifest.man

There is no warnings or errors when I run this command. I run the program above a couple of times and it does not report any errors, everything seems to work.

I then investigate Event Viewer to see if any event have been written to the event log and there is no event there.

• Have I missed a setting or parameter?

• What is needed to write to an event log (file) using ETW?

Answer 1

I found out the solution, you right-click the event log and select "Enable logging"