Arithmetic operation resulted in an overflow using eventRegister.exe

Question

I'm trying to compile a simple project with ETW logs. Have added EventSource as NuGet reference. When I had Event attributes like this

[Event(1, Message = "Something happend in base at begin: {0}")]

It wasn't working, but at least it was successfully compiling. Then I changed the attribute and it became like this

[Event(2, Level = EventLevel.Error, Message = "Base stp {0}", Keywords = EventKeywords.All)]

And I started to get

Unexpected error: Arithmetic operation resulted in an overflow.

1. Is there a way to fix it and don't change the structure of my classes?
2. Is there a way to debug or at least somehow investigate errors from eventRegister.exe?

My command line is:

Documents\Visual Studio 2015\Projects\Console1\packages\Microsoft.Diagnostics.Tracing.EventRegister.1.1.28\build\eventRegister.exe" -DumpRegDlls @"Documents\Visual Studio 2015\Projects\Console1\Common\bin\Debug\Common.eventRegister.rsp" "Documents\Visual Studio 2015\Projects\Console1\Common\bin\Debug\Common.dll"

Code of the test example could be found here.

Answer 1

In this case, the issue is the use of "Keywords = EventKeywords.All" in the event definition. EventKeywords.All is not intended for use in events. It means "all 64 keywords", which is actually illegal since the top bits are reserved. The EventKeywords.All value is defined for convenience when setting up event listeners or when checking for event masks, but shouldn't be used when defining events. In this case, EventRegister wasn't expecting events to use that for the Keywords value so it was hitting an exception. (This would have had problems at runtime as well since EventSource would have complained about the use of reserved keywords.)

Are you making use of the manifest that EventRegister creates? The EventRegister tool reflects over your assembly and generates a manifest file for each class in your assembly that inherits from EventSource. If you aren't using the manifest it generates, you don't need to run it. There are several things that can confuse the EventRegister tool and cause it to fail.

If you aren't using the manifest, you can disable EventRegister in your .csproj file, or you can have your project depend on "EventSource Redistributable" instead of "EventSource", which will give you access to the EventSource DLL without adding EventRegister to the build process.

Note also that EventSource is built-in to .NET 4.5 and later -- you only need the NuGet if you need to run your project on an older .NET runtime. The built-in version performs MUCH faster as well (since it doesn't need to JIT as much -- all of the built-in runtime DLLs get JIT'ed during install).

One final note is that the .NET 4.6 and the NuGet 1.1.24 and later versions of EventSource have a "manifest-free" option that eliminates the manifest entirely. They also have an eventSource.Write method that allows you to write events directly without having to keep track of event IDs. So instead of:

[EventSource]
class MyEventSource : EventSource
{
    [Event(...)]
    public void MyEvent(...)
    {
        WriteEvent(...);
    }
}

es = new MyEventSource();
es.MyEvent(23, "Hello");

You can just do this:

es = new EventSource("MyEventSourceName");
es.Write("MyEvent", new {
    Number = 23,
    Name = "Hello"
});