Viewing/Collecting Service Fabric ETW Events OnPrem

Question

We are trying to view Service ETW Events in an OnPrem cluster. The long term plan will be to install an ElasticSearch cluster to send the events to. I don't have time to build that out this week, instead I need to understand why my App is blowing up.

We have installed Microsoft Message Analyzer on one of the node servers and I can connect with a live session to view the Cluster ETW Events Service Fabric System Provider.

I would like to be able to view the Application ETW Events. I've followed the instructions in the article here:

https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-diagnostic-collect-logs-without-an-agent

This article seems to focus on 3 files, eventFlowConfig.json, Program.cs and ServiceEventSource.cs.

EventFlowConfig.Json has:

    "inputs": [
    {
      "type": "EventSource",
      "sources": [
        { "providerName": "Microsoft-ServiceFabric-Services" },
        { "providerName": "Microsoft-ServiceFabric-Actors" },
        { "providerName": "TMHP-CacheApp-CacheAPI"  }
      ]
    }
  ],
  "filters": [
    {
      "type": "drop",
      "include": "Level == Verbose"
    }
   ],
   "outputs": [
    {
      "type": "StdOutput"
    }

In program.cs I have:

  using (var diagnosticsPipeline = ServiceFabricDiagnosticPipelineFactory.CreatePipeline("CacheApp-CacheAPI-DiagnosticsPipeline"))
                {

                    ServiceRuntime.RegisterServiceAsync("EndpointType",
                    context => new Endpoint(context)).GetAwaiter().GetResult();

                    ServiceEventSource.Current.ServiceTypeRegistered(Process.GetCurrentProcess().Id, typeof(Endpoint).Name);
                    // Prevents this host process from terminating so services keeps running. 
                    Thread.Sleep(Timeout.Infinite);
                }

ServiceEventSource.cs has:

 [EventSource(Name = "TMHP-CacheApp-CacheAPI")]

I package and deploy fine, but using MSMA I don't know how to attach to the Application Provider? I think I would be adding a "Custom Provider" but it asks for a GUID. Is there someway to find this Guid? I'm assuming I want to add the customer provider for my specific ServiceFabric Application of type:

"TMHP-CacheApp-CacheAPI"

Thanks in advance, Greg

Answer 1

I'd recommend that you use PerFView instead, Vance has an article on how to view EventSource based events in PerfView https://blogs.msdn.microsoft.com/vancem/2012/07/09/introduction-tutorial-logging-etw-events-in-c-system-diagnostics-tracing-eventsource/ The '*' in front of the EventSource name is important.

Here's some instructions for how to view actor events, your custom EventSource should be the same pattern.

The Actor and ReliableServices are EventSource based so to view them in PerfView you have to follow the instructions on Vance’s blog. Don't forget the '*'!!!

1. Start PerfView with a command line like this: perfview /onlyproviders=*Microsoft-ServiceFabric-Actors
2. You can collect using Collect | Collect | Start Collection. Make sure that the Advanced Options | Additional Providers field contains =*Microsoft-ServiceFabric-Actors
3. When you finish collecting they are viewable under Events