I am working on a project that requires tracing in it and
some of the values in the events contain long strings. I
am wondering if there is a upper limit on how long a
string can be inside the events when they are written out
to the log files. My events show up in the log files
great as long as I keep my string lengths to minimal.

Does any one have insight on this.

Thank you this information was valuable. I can now raise the events with longer values by increasing the buffer size
The strange thing about this is that the eventsource was not throwing any errors while trying to write the events out
It just would not raise them

Thanks agai

----- Jyothi Srinivasan [MS] wrote: ----


Hi

This limit is different for different Event Sinks. For EIF, Event Source
name can be upto 128 chars and Description can go upto 512 chars

For Windows Event Log, event payload greater than 32766 chars will be
truncated, If EnterpriseInstrumentation.config is configured in the
following way, then Exception can be seen when event representation exceeds
the limit

<instrumentedApp name="MyApp" mode="debug" /><eventSources><eventSource name="Application" type="softwareElement"
internalExceptionHandler="throw" description="Application level event
source." /></eventSources

For Windows Event Tracing, the limit is set by bufferSize parameter (in
Kb). The error here would be like:

Unable to write the event to the Windows Event Trace. After retrying the
TraceEvent() API {0} times, an error code of {1} and message "{2}" was
still returned. The most likely cause for this error is that the serialized
event is larger than the trace session's BufferSize. Try increasing the
BufferSize for this trace session ({3}). Note that changing the BufferSize
requires the restarting of the session
There is an upper limit on the event of 32 * 1024L - 80L bytes

I am not sure for WMI.


Hope this helps

Regards
Jyoth

|
| I am working on a project that requires tracing in it and
| some of the values in the events contain long strings. I
| am wondering if there is a upper limit on how long a
| string can be inside the events when they are written out
| to the log files. My events show up in the log files
| great as long as I keep my string lengths to minimal
|
| Does any one have insight on this
|
|
|


This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Hi,

This limit is different for different Event Sinks. For EIF, Event Source
name can be upto 128 chars and Description can go upto 512 chars.

For Windows Event Log, event payload greater than 32766 chars will be
truncated, If EnterpriseInstrumentation.config is configured in the
following way, then Exception can be seen when event representation exceeds
the limit.

<instrumentedApp name="MyApp" mode="debug" />
<eventSources>
<eventSource name="Application" type="softwareElement"
internalExceptionHandler="throw" description="Application level event
source." />
</eventSources>

For Windows Event Tracing, the limit is set by bufferSize parameter (in
Kb). The error here would be like:

Unable to write the event to the Windows Event Trace. After retrying the
TraceEvent() API {0} times, an error code of {1} and message "{2}" was
still returned. The most likely cause for this error is that the serialized
event is larger than the trace session's BufferSize. Try increasing the
BufferSize for this trace session ({3}). Note that changing the BufferSize
requires the restarting of the session.
There is an upper limit on the event of 32 * 1024L - 80L bytes;

I am not sure for WMI.


Hope this helps,

Regards,
Jyothi

|
| I am working on a project that requires tracing in it and
| some of the values in the events contain long strings. I
| am wondering if there is a upper limit on how long a
| string can be inside the events when they are written out
| to the log files. My events show up in the log files
| great as long as I keep my string lengths to minimal.
|
| Does any one have insight on this.
|
|
|


This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Jyothi,

Thanks for your response but I am still having problems with it. I have increased the maxBuffers and bufferSize as seen here

<defaultParameters minBuffers="4" maxFileSize="100" maxBuffers="400000" bufferSize="395000" logFileMode="circular" flushTimer="3" /><sessionList><session name="ClientSession" enabled="true" fileName="C:\temp\ClientTraceLog.log" /></sessionList>

but I can still only have a string in that is no longer then 14674 char. Am I setting the buffers incorrectly or do they need to be larger yet.

The reader returns the class name as "Read past end of Buffer".

Thanks

----- Jyothi Srinivasan [MS] wrote: -----


Hi,

This limit is different for different Event Sinks. For EIF, Event Source
name can be upto 128 chars and Description can go upto 512 chars.

For Windows Event Log, event payload greater than 32766 chars will be
truncated, If EnterpriseInstrumentation.config is configured in the
following way, then Exception can be seen when event representation exceeds
the limit.

<instrumentedApp name="MyApp" mode="debug" /><eventSources><eventSource name="Application" type="softwareElement"
internalExceptionHandler="throw" description="Application level event
source." /></eventSources>

For Windows Event Tracing, the limit is set by bufferSize parameter (in
Kb). The error here would be like:

Unable to write the event to the Windows Event Trace. After retrying the
TraceEvent() API {0} times, an error code of {1} and message "{2}" was
still returned. The most likely cause for this error is that the serialized
event is larger than the trace session's BufferSize. Try increasing the
BufferSize for this trace session ({3}). Note that changing the BufferSize
requires the restarting of the session.
There is an upper limit on the event of 32 * 1024L - 80L bytes;

I am not sure for WMI.


Hope this helps,

Regards,
Jyothi

|
| I am working on a project that requires tracing in it and
| some of the values in the events contain long strings. I
| am wondering if there is a upper limit on how long a
| string can be inside the events when they are written out
| to the log files. My events show up in the log files
| great as long as I keep my string lengths to minimal.
|
| Does any one have insight on this.
|
|
|


This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Hi,

I am not sure if these large values are good. Also when any change is made
in these settings you will need to re-start the session for the new
settings to take effect.

You could try with smaller values and try. These would also largely depend
on the memory size and configuration.

Another thing to try would be to set the debug mode "on" in the config file
which would help in knowing the issue or source of error.

The following link on tracing may be of help.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/bas
e/about_event_tracing.asp


Regards,
Jyothi

|
| Jyothi,

Thanks for your response but I am still having problems with it. I have
increased the maxBuffers and bufferSize as seen here

<defaultParameters minBuffers="4" maxFileSize="100" maxBuffers="400000"
bufferSize="395000" logFileMode="circular" flushTimer="3"
/><sessionList><session name="ClientSession" enabled="true"
fileName="C:\temp\ClientTraceLog.log" /></sessionList>

but I can still only have a string in that is no longer then 14674 char.
Am I setting the buffers incorrectly or do they need to be larger yet.

The reader returns the class name as "Read past end of Buffer".

Thanks

----- Jyothi Srinivasan [MS] wrote: -----


Hi,

This limit is different for different Event Sinks. For EIF, Event
Source
name can be upto 128 chars and Description can go upto 512 chars.

For Windows Event Log, event payload greater than 32766 chars will be
truncated, If EnterpriseInstrumentation.config is configured in the
following way, then Exception can be seen when event representation
exceeds
the limit.

<instrumentedApp name="MyApp" mode="debug"
/><eventSources><eventSource name="Application" type="softwareElement"
internalExceptionHandler="throw" description="Application level event
source." /></eventSources>

For Windows Event Tracing, the limit is set by bufferSize parameter
(in
Kb). The error here would be like:

Unable to write the event to the Windows Event Trace. After retrying
the
TraceEvent() API {0} times, an error code of {1} and message "{2}" was
still returned. The most likely cause for this error is that the
serialized
event is larger than the trace session's BufferSize. Try increasing
the
BufferSize for this trace session ({3}). Note that changing the
BufferSize
requires the restarting of the session.
There is an upper limit on the event of 32 * 1024L - 80L bytes;

I am not sure for WMI.


Hope this helps,

Regards,
Jyothi

|
| I am working on a project that requires tracing in it and
| some of the values in the events contain long strings. I
| am wondering if there is a upper limit on how long a
| string can be inside the events when they are written out
| to the log files. My events show up in the log files
| great as long as I keep my string lengths to minimal.
|
| Does any one have insight on this.
|
|
|


This posting is provided "AS IS" with no warranties, and confers no
rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


|


This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm