I'm quite new to EIF so I'm hopefully just making a basic error of some
sort, but I've been testing EIF performance for the last day or so and I've
encountered a problem with Tracing output failing once the maxFileSize is
reached.

I've got the config set to sequential, which I believe should make the
tracelog file wrap over to a new file and archive the old one when the
current file is full. This isn't happening though until I reboot the
machine it's running on, at which point this roll-over happens perfectly a
new small file is created. Restarting the "Windows Trace Session Manager"
service didn't seem to have any effect, but then I'm not sure if it's
supposed to.
I've also tried disabling and re-enabling tracing in the config file while
it was in this 'stuck' state, but with no change.
Finally I tried increasing the maxFileSize while in this state, but the file
didn't then grow and the trace continued to be 'stuck'. On reboot, the file
wrapped over into a new file and when I started tracing again the file grew
until it reached the new maxFileSize and then the same happened again.

I've pasted the contents of my config file below. I've tried altering the
maxFileSize from 10 to 100, but the same behaviour is occurring now at
100Mb. I've set my 'Tracing App' config to log to both the Trace and Log
sinks and the EventLog keeps getting new events, but the tracelog file just
appears to stop receiving events when the maxFileSize is reached.

I'd really appreciate any suggestions on this issue,
thanks in advance,

Martin
-------- copy of my TraceSessions.config --------
<?xml version="1.0" encoding="utf-8" ?>
<configuration
xmlns="http://www.microsoft.com/schema/EnterpriseInstrumentation/v1/TraceSes
sions.xsd">
<defaultParameters minBuffers="4" maxFileSize="100" maxBuffers="25"
bufferSize="20" logFileMode="sequential" flushTimer="3" />
<sessionList>
<session name="TraceSession" enabled="true" fileName="C:\Program
Files\Microsoft Enterprise Instrumentation\Bin\Trace
Service\Logs\TraceLog.log" />
</sessionList>
</configuration>

--------------

Hi Martin,

Im sorry but the feature your thinking of doesnt work that way. EIF adds
very little over the basic Windows Event Tracing (WTE) functionality.
A whole bunch of points, and the a partial solution to what you want. :)

- The behaviour you're seeing is correct. With sequential trace logs, when
the file is full - further logging is discarded, with circular - the
logging wraps around so you get the most recent events in the log.

- When you stop and start a trace session, WTE clobbers any existing log
file and you'd lose the events. For that reason, we added into EIF in a
"move the log file is it exists" feature before starting a trace session.

- Stopping & starting the Windows Trace Session Manager (TSM) doesnt have
any effect on the running (aka enabled) trace sessions. Whats in the
TraceSessions.config (TS.config) is what is reflected in the running trace
sessions. Stopping the TSM, just means that any changes you make to the
TS.config wont be reflected in the trace sessions.

- If you edit the TS.config file and disable and enable the session, then
you'll observe that the existing log file is closed, moved and a new log
file is created. However events can be lost while the session is disabled.
A better solution is to change the logFileName of the session. Here WTE
will switch over to a new log file without loosing any events.

- Note that the TS.config file can be edited in notepad - or you can use
the config APIs (see the EIF samples) and write a script that edit it
automatically.

The partial solution to what you want is to write a script to update the
logFileName of the session. And then to schedule the script so it runs
automatically at set times. Of course you're not guaranteed that the log
file wont run out of space. I'd make the log file size pretty big and
probably cricular.

I know this isnt idea, but its probably the best that can be achieved with
v1 EIF.

Hope this helps

Mike


--------------------
| From: "Martin Crimes" <mcrimes@matra.co.uk>
| Subject: EIF - Trace stopping at maxFileSize
| Date: Thu, 11 Sep 2003 12:01:03 +0100
| Lines: 46
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
| Message-ID: <#CYpyPFeDHA.892@TK2MSFTNGP12.phx.gbl>
| Newsgroups: microsoft.public.vsnet.enterprise.tools
| NNTP-Posting-Host: uk-fw1.matra.co.uk 213.38.4.82
| Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
| Xref: cpmsftngxa06.phx.gbl microsoft.public.vsnet.enterprise.tools:1003
| X-Tomcat-NG: microsoft.public.vsnet.enterprise.tools
|
| I'm quite new to EIF so I'm hopefully just making a basic error of some
| sort, but I've been testing EIF performance for the last day or so and
I've
| encountered a problem with Tracing output failing once the maxFileSize is
| reached.
|
| I've got the config set to sequential, which I believe should make the
| tracelog file wrap over to a new file and archive the old one when the
| current file is full. This isn't happening though until I reboot the
| machine it's running on, at which point this roll-over happens perfectly a
| new small file is created. Restarting the "Windows Trace Session Manager"
| service didn't seem to have any effect, but then I'm not sure if it's
| supposed to.
| I've also tried disabling and re-enabling tracing in the config file while
| it was in this 'stuck' state, but with no change.
| Finally I tried increasing the maxFileSize while in this state, but the
file
| didn't then grow and the trace continued to be 'stuck'. On reboot, the
file
| wrapped over into a new file and when I started tracing again the file
grew
| until it reached the new maxFileSize and then the same happened again.
|
| I've pasted the contents of my config file below. I've tried altering the
| maxFileSize from 10 to 100, but the same behaviour is occurring now at
| 100Mb. I've set my 'Tracing App' config to log to both the Trace and Log
| sinks and the EventLog keeps getting new events, but the tracelog file
just
| appears to stop receiving events when the maxFileSize is reached.
|
| I'd really appreciate any suggestions on this issue,
| thanks in advance,
|
| Martin
| -------- copy of my TraceSessions.config --------
| <?xml version="1.0" encoding="utf-8" ?>
| <configuration
|
xmlns="http://www.microsoft.com/schema/EnterpriseInstrumentation/v1/TraceSes
| sions.xsd">
| <defaultParameters minBuffers="4" maxFileSize="100" maxBuffers="25"
| bufferSize="20" logFileMode="sequential" flushTimer="3" />
| <sessionList>
| <session name="TraceSession" enabled="true" fileName="C:\Program
| Files\Microsoft Enterprise Instrumentation\Bin\Trace
| Service\Logs\TraceLog.log" />
| </sessionList>
| </configuration>
|
| --------------
|
|
|

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Thanks for the correction Mike. I haven't found much info on the EIF
besides the help file in the EIF SDK and that doesn't really go into much
detail about the tracing options. I've searched the web and MSDN for info
on Windows Event Tracing, but am finding practically nothing besides the odd
mention of it being used by EIF.. Can you recommend any info sources on
this whch might explain how it works ?

Hopefully this is something which will be improved in a later version, so
far it's the only thing which has discouraged me from recommending EIF as an
internal instrumentation stategy here.

Cheers for the details about the tracing - really appreciate it,

Martin


[quoted text, click to view]

I generally perform a search on MSDN for TraceEvent() (which is the
underlying API for windows event tracing)

The main area is
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/bas
e/event_tracing.asp. which has a good description.

WTE has been around in Windows for ages (W2K) and its kernel level tracing
so its very performant. (Parts of the Windows OS are instrumented with it).
I have the feeling that hardly anyone was using it. The straight APIs is
pretty complicated. I think now that EIF has put an easy API on the top,
that it is getting used more.

Hope this helps

Mike




--------------------

| Hi Martin,
|
| Im sorry but the feature your thinking of doesnt work that way. EIF adds
| very little over the basic Windows Event Tracing (WTE) functionality.
| A whole bunch of points, and the a partial solution to what you want. :)
|
| - The behaviour you're seeing is correct. With sequential trace logs,
when
| the file is full - further logging is discarded, with circular - the
| logging wraps around so you get the most recent events in the log.
|
| - When you stop and start a trace session, WTE clobbers any existing log
| file and you'd lose the events. For that reason, we added into EIF in a
| "move the log file is it exists" feature before starting a trace session.
|
| - Stopping & starting the Windows Trace Session Manager (TSM) doesnt have
| any effect on the running (aka enabled) trace sessions. Whats in the
| TraceSessions.config (TS.config) is what is reflected in the running
trace
| sessions. Stopping the TSM, just means that any changes you make to the
| TS.config wont be reflected in the trace sessions.
|
| - If you edit the TS.config file and disable and enable the session, then
| you'll observe that the existing log file is closed, moved and a new log
| file is created. However events can be lost while the session is
disabled.
| A better solution is to change the logFileName of the session. Here WTE
| will switch over to a new log file without loosing any events.
|
| - Note that the TS.config file can be edited in notepad - or you can use
| the config APIs (see the EIF samples) and write a script that edit it
| automatically.
|
| The partial solution to what you want is to write a script to update the
| logFileName of the session. And then to schedule the script so it runs
| automatically at set times. Of course you're not guaranteed that the log
| file wont run out of space. I'd make the log file size pretty big and
| probably cricular.
|
| I know this isnt idea, but its probably the best that can be achieved
with
| v1 EIF.
|
| Hope this helps
|
| Mike
|
|
| --------------------
| | From: "Martin Crimes" <mcrimes@matra.co.uk>
| | Subject: EIF - Trace stopping at maxFileSize
| | Date: Thu, 11 Sep 2003 12:01:03 +0100
| | Lines: 46
| | X-Priority: 3
| | X-MSMail-Priority: Normal
| | X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
| | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
| | Message-ID: <#CYpyPFeDHA.892@TK2MSFTNGP12.phx.gbl>
| | Newsgroups: microsoft.public.vsnet.enterprise.tools
| | NNTP-Posting-Host: uk-fw1.matra.co.uk 213.38.4.82
| | Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
| | Xref: cpmsftngxa06.phx.gbl microsoft.public.vsnet.enterprise.tools:1003
| | X-Tomcat-NG: microsoft.public.vsnet.enterprise.tools
| |
| | I'm quite new to EIF so I'm hopefully just making a basic error of some
| | sort, but I've been testing EIF performance for the last day or so and
| I've
| | encountered a problem with Tracing output failing once the maxFileSize
is
| | reached.
| |
| | I've got the config set to sequential, which I believe should make the
| | tracelog file wrap over to a new file and archive the old one when the
| | current file is full. This isn't happening though until I reboot the
| | machine it's running on, at which point this roll-over happens
perfectly a
| | new small file is created. Restarting the "Windows Trace Session
Manager"
| | service didn't seem to have any effect, but then I'm not sure if it's
| | supposed to.
| | I've also tried disabling and re-enabling tracing in the config file
while
| | it was in this 'stuck' state, but with no change.
| | Finally I tried increasing the maxFileSize while in this state, but the
| file
| | didn't then grow and the trace continued to be 'stuck'. On reboot, the
| file
| | wrapped over into a new file and when I started tracing again the file
| grew
| | until it reached the new maxFileSize and then the same happened again.
| |
| | I've pasted the contents of my config file below. I've tried altering
the
| | maxFileSize from 10 to 100, but the same behaviour is occurring now at
| | 100Mb. I've set my 'Tracing App' config to log to both the Trace and
Log
| | sinks and the EventLog keeps getting new events, but the tracelog file
| just
| | appears to stop receiving events when the maxFileSize is reached.
| |
| | I'd really appreciate any suggestions on this issue,
| | thanks in advance,
| |
| | Martin
| | -------- copy of my TraceSessions.config --------
| | <?xml version="1.0" encoding="utf-8" ?>
| | <configuration
| |
|
xmlns="http://www.microsoft.com/schema/EnterpriseInstrumentation/v1/TraceSes
| | sions.xsd">
| | <defaultParameters minBuffers="4" maxFileSize="100" maxBuffers="25"
| | bufferSize="20" logFileMode="sequential" flushTimer="3" />
| | <sessionList>
| | <session name="TraceSession" enabled="true" fileName="C:\Program
| | Files\Microsoft Enterprise Instrumentation\Bin\Trace
| | Service\Logs\TraceLog.log" />
| | </sessionList>
| | </configuration>
| |
| | --------------
| |
| |
| |
|
| --
|
| This posting is provided "AS IS" with no warranties, and confers no
rights.
| Use of included script samples are subject to the terms specified at
| http://www.microsoft.com/info/cpyright.htm
|
|

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm