|
|
You're in the
visual studio .net enterprise tools
group:EIF - The preffered event sink in a distributed environment
visual studio .net enterprise tools:
Hi,
I have a distributed application that spans over 2 computers. On a third computer there will be a management application that monitors the application. I would like to use EIF for some of the instrumentation issues, but I am not sure whats the best way to transfer the events to the management app. My first thought was to use WMI for this, since I already use this to read some of the performance counters, but I have read that WMI should only be used for infrequently events. So my question is: What is the preffered event sink when management application is located on another machine than the instrumented app? I also have another question is it possible to use request tracing over a message queue? Regards
I dont think there is one perferred way of doing it.
Depending on the number of events and the cost of raising each one, the event sink would vary from using Windows Tracing, Windows Event Log, or WMI. WMI is slow but you can get and aggregate the events on a remote computer (i..e the one with the management app on it). Windows Tracing is really fast, but you'd have to set up some system to scrape the log files onto the remote computer. If you're talking a low amount of events - I'd go WMI. Another possibilty is that you create a custom event sink that when raising any event directly pushes it across to your management app. You may want to consider having some events going immediately across to the management app and some in a delayed, scrape the log manner. To answer your other question. Its not really possible to use request tracing over a MSMQ. In order for it to work: - as you put the message onto the queue, you'd want to add in all the request tracing information extracted from the Thread.CallContext - as you read the message from the queue, you'd want to pull out all the request tracing information and put it back on the current thread of execution. However, not all the information is flowed around. As traces are nested (or stacked) inside each other, effectively only the information from the top of the stack is flowed around on the current thread of execution. This design decision was made to prevent the CallContext from growing and growing as the requests were nested inside each other. I believe that you could get it to work as long as there wasnt any nesting of request traces going on. I hope this helps. Mike -------------------- | | Hi, | | I have a distributed application that spans over 2 computers. | On a third computer there will be a management application that | monitors the application. I would like to use EIF for some of the | instrumentation issues, but I am not sure whats the best way to | transfer the events to the management app. My first thought was | to use WMI for this, since I already use this to read some of the | performance counters, but I have read that WMI should only be used | for infrequently events. | | So my question is: What is the preffered event sink when management | application is located on another machine than the instrumented app? | | I also have another question is it possible to use request tracing over | a message queue? | | | Regards | Alf | -- This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm
Wow, I had almost the exact same question and you've already answered it.
Thanks! However, I have a question on your answer: I don't know much about WMI. Searching for it on the net has overwhelmed me with information that isn't really relevant to simple app logging. I guess to get started I need to know two things: 1) Where does the logged information go and what application(s) can I use to get at (monitor) it? 2) How much do I need to deploy on the clients to use WMI? 3) Do WMI and EIF work on windows 98/ME/NT or do you have to have 2K+? Also, if you know a good site on WMI that is angled at developers doing logging rather than administers controling hardware, I'd be much obliged. [quoted text, click to view] "Mike Hayton [MS]" <mikehayt_@online.microsoft.com> wrote in message news:6KwgWLaIEHA.4060@cpmsftngxa06.phx.gbl... > I dont think there is one perferred way of doing it. > > Depending on the number of events and the cost of raising each one, the > event sink would vary from using Windows Tracing, Windows Event Log, or WMI. > WMI is slow but you can get and aggregate the events on a remote computer > (i..e the one with the management app on it). Windows Tracing is really > fast, but you'd have to set up some system to scrape the log files onto the > remote computer. > > If you're talking a low amount of events - I'd go WMI. > Another possibilty is that you create a custom event sink that when raising > any event directly pushes it across to your management app. > You may want to consider having some events going immediately across to the > management app and some in a delayed, scrape the log manner. > > To answer your other question. Its not really possible to use request > tracing over a MSMQ. > > In order for it to work: > - as you put the message onto the queue, you'd want to add in all the > request tracing information extracted from the Thread.CallContext > - as you read the message from the queue, you'd want to pull out all the > request tracing information and put it back on the current thread of > execution. > However, not all the information is flowed around. As traces are nested (or > stacked) inside each other, effectively only the information from the top > of the stack is flowed around on the current thread of execution. This > design decision was made to prevent the CallContext from growing and > growing as the requests were nested inside each other. I believe that you > could get it to work as long as there wasnt any nesting of request traces > going on. > > I hope this helps. > > Mike > > -------------------- > | > | Hi, > | > | I have a distributed application that spans over 2 computers. > | On a third computer there will be a management application that > | monitors the application. I would like to use EIF for some of the > | instrumentation issues, but I am not sure whats the best way to > | transfer the events to the management app. My first thought was > | to use WMI for this, since I already use this to read some of the > | performance counters, but I have read that WMI should only be used > | for infrequently events. > | > | So my question is: What is the preffered event sink when management > | application is located on another machine than the instrumented app? > | > | I also have another question is it possible to use request tracing over > | a message queue? > | > | > | Regards > | Alf > | > > -- > > This posting is provided "AS IS" with no warranties, and confers no rights. > Use of included script samples are subject to the terms specified at > http://www.microsoft.com/info/cpyright.htm >
inline below...
-------------------- | | Wow, I had almost the exact same question and you've already answered it. | Thanks! However, I have a question on your answer: | | I don't know much about WMI. Searching for it on the net has overwhelmed me | with information that isn't really relevant to simple app logging. I guess | to get started I need to know two things: I totally agree about the overload in info - I know a bit about WMI but wouldnt say Im an expert. | | 1) Where does the logged information go and what application(s) can I use to | get at (monitor) it? In some regards the information goes nowhere until some one/thing registers a query (like a SQL statement) of the events wanted. Then the events are routed to the query. There's large commerical apps that can take data through WMI - Microsoft Operations Manager (MOM) is one that can be used to monitor many computers and get events from WMI. On the smaller side - there's the EventViewer & "CIM Studio" that comes with the WMI SDK (downloadable from MSDN). I'd also have a look for .NET samples of WMI.NET (the main class to do a search for is the ManagementEventWatcher). I wrote a simple EventWatcher that I'll attach (might need a bit of tinkering to get it to work). You can even write script that can get data via WMI. | | 2) How much do I need to deploy on the clients to use WMI? From memory, I think WMI is already installed on XP and you have to install it on Win2K machines (http://msdn.microsoft.com/library/default.asp?url=/downloads/list/wmi.asp) | | 3) Do WMI and EIF work on windows 98/ME/NT or do you have to have 2K+? W2K or greater. I've answered the other thread with this question. | | Also, if you know a good site on WMI that is angled at developers doing | logging rather than administers controling hardware, I'd be much obliged. I'd have a look at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/htm l/cpconmanagingapplicationsusingwmi.asp This is describing the classes that EIF's WmiSink is built on top of. | | [quoted text, click to view] | "Mike Hayton [MS]" <mikehayt_@online.microsoft.com> wrote in message | > I dont think there is one perferred way of doing it.| news:6KwgWLaIEHA.4060@cpmsftngxa06.phx.gbl... | > | > Depending on the number of events and the cost of raising each one, the | > event sink would vary from using Windows Tracing, Windows Event Log, or | WMI. | > WMI is slow but you can get and aggregate the events on a remote computer | > (i..e the one with the management app on it). Windows Tracing is really | > fast, but you'd have to set up some system to scrape the log files onto | the | > remote computer. | > | > If you're talking a low amount of events - I'd go WMI. | > Another possibilty is that you create a custom event sink that when | raising | > any event directly pushes it across to your management app. | > You may want to consider having some events going immediately across to | the | > management app and some in a delayed, scrape the log manner. | > | > To answer your other question. Its not really possible to use request | > tracing over a MSMQ. | > | > In order for it to work: | > - as you put the message onto the queue, you'd want to add in all the | > request tracing information extracted from the Thread.CallContext | > - as you read the message from the queue, you'd want to pull out all the | > request tracing information and put it back on the current thread of | > execution. | > However, not all the information is flowed around. As traces are nested | (or | > stacked) inside each other, effectively only the information from the top | > of the stack is flowed around on the current thread of execution. This | > design decision was made to prevent the CallContext from growing and | > growing as the requests were nested inside each other. I believe that you | > could get it to work as long as there wasnt any nesting of request traces | > going on. | > | > I hope this helps. | > | > Mike | > | > -------------------- | > | | > | Hi, | > | | > | I have a distributed application that spans over 2 computers. | > | On a third computer there will be a management application that | > | monitors the application. I would like to use EIF for some of the | > | instrumentation issues, but I am not sure whats the best way to | > | transfer the events to the management app. My first thought was | > | to use WMI for this, since I already use this to read some of the | > | performance counters, but I have read that WMI should only be used | > | for infrequently events. | > | | > | So my question is: What is the preffered event sink when management | > | application is located on another machine than the instrumented app? | > | | > | I also have another question is it possible to use request tracing over | > | a message queue? | > | | > | | > | Regards | > | Alf | > | | > | > -- | > | > This posting is provided "AS IS" with no warranties, and confers no | rights. | > Use of included script samples are subject to the terms specified at | > http://www.microsoft.com/info/cpyright.htm | > | | | -- This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at
Hi
I tried using the code Mike attached in his last post but I always seems to get an error saying Error Starting Watcher : 'Not supported' eventwatcher = new ManagementEventWatcher("\\\\.\\root\\EnterpriseInstrumentation" , "select * from BaseEvent"); eventwatcher.EventArrived += new EventArrivedEventHandler(this.HandleEvent); eventwatcher.Start(); // This is where I get an Mangement Exception saying 'Not supported' This is also the error I get when I try to add a wmi event consumer to the SimpleInstrumentation sample so I guess there is something wrong with my WMI installation. I have tried deleting the Repository and regsrv all dll's in windows\system32\wbem folder. Any suggestions? Alf On Sat, 24 Apr 2004 15:42:13 GMT, Mike Hayton [MS] [quoted text, click to view] <mikehayt_@online.microsoft.com> wrote: > inline below... > > > -------------------- > | > | Wow, I had almost the exact same question and you've already answered > it. > | Thanks! However, I have a question on your answer: > | > | I don't know much about WMI. Searching for it on the net has > overwhelmed > me > | with information that isn't really relevant to simple app logging. I > guess > | to get started I need to know two things: > > I totally agree about the overload in info - I know a bit about WMI but > wouldnt say Im an expert. > > > | > | 1) Where does the logged information go and what application(s) can I > use > to > | get at (monitor) it? > > In some regards the information goes nowhere until some one/thing > registers > a query (like a SQL statement) of the events wanted. Then the events are > routed to the query. > > There's large commerical apps that can take data through WMI - Microsoft > Operations Manager (MOM) is one that can be used to monitor many > computers > and get events from WMI. On the smaller side - there's the EventViewer & > "CIM Studio" that comes with the WMI SDK (downloadable from MSDN). I'd > also > have a look for .NET samples of WMI.NET (the main class to do a search > for > is the ManagementEventWatcher). I wrote a simple EventWatcher that I'll > attach (might need a bit of tinkering to get it to work). You can even > write script that can get data via WMI. > > | > | 2) How much do I need to deploy on the clients to use WMI? > From memory, I think WMI is already installed on XP and you have to > install > it on Win2K machines > (http://msdn.microsoft.com/library/default.asp?url=/downloads/list/wmi.asp) > > | > | 3) Do WMI and EIF work on windows 98/ME/NT or do you have to have 2K+? > > W2K or greater. I've answered the other thread with this question. > > | > | Also, if you know a good site on WMI that is angled at developers doing > | logging rather than administers controling hardware, I'd be much > obliged. > > I'd have a look at > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/htm > l/cpconmanagingapplicationsusingwmi.asp > This is describing the classes that EIF's WmiSink is built on top of. > > | > | > | "Mike Hayton [MS]" <mikehayt_@online.microsoft.com> wrote in message > | news:6KwgWLaIEHA.4060@cpmsftngxa06.phx.gbl... > | > I dont think there is one perferred way of doing it. > | > > | > Depending on the number of events and the cost of raising each one, > the > | > event sink would vary from using Windows Tracing, Windows Event Log, > or > | WMI. > | > WMI is slow but you can get and aggregate the events on a remote > computer > | > (i..e the one with the management app on it). Windows Tracing is > really > | > fast, but you'd have to set up some system to scrape the log files > onto > | the > | > remote computer. > | > > | > If you're talking a low amount of events - I'd go WMI. > | > Another possibilty is that you create a custom event sink that when > | raising > | > any event directly pushes it across to your management app. > | > You may want to consider having some events going immediately across > to > | the > | > management app and some in a delayed, scrape the log manner. > | > > | > To answer your other question. Its not really possible to use request > | > tracing over a MSMQ. > | > > | > In order for it to work: > | > - as you put the message onto the queue, you'd want to add in all the > | > request tracing information extracted from the Thread.CallContext > | > - as you read the message from the queue, you'd want to pull out all > the > | > request tracing information and put it back on the current thread of > | > execution. > | > However, not all the information is flowed around. As traces are > nested > | (or > | > stacked) inside each other, effectively only the information from the > top > | > of the stack is flowed around on the current thread of execution. > This > | > design decision was made to prevent the CallContext from growing and > | > growing as the requests were nested inside each other. I believe > that > you > | > could get it to work as long as there wasnt any nesting of request > traces > | > going on. > | > > | > I hope this helps. > | > > | > Mike > | > > | > -------------------- > | > | > | > | Hi, > | > | > | > | I have a distributed application that spans over 2 computers. > | > | On a third computer there will be a management application that > | > | monitors the application. I would like to use EIF for some of the > | > | instrumentation issues, but I am not sure whats the best way to > | > | transfer the events to the management app. My first thought was > | > | to use WMI for this, since I already use this to read some of the > | > | performance counters, but I have read that WMI should only be used > | > | for infrequently events. > | > | > | > | So my question is: What is the preffered event sink when management > | > | application is located on another machine than the instrumented > app? > | > | > | > | I also have another question is it possible to use request tracing > over > | > | a message queue? > | > | > | > | > | > | Regards > | > | Alf > | > | > | > > | > -- > | > > | > This posting is provided "AS IS" with no warranties, and confers no > | rights. > | > Use of included script samples are subject to the terms specified at > | > http://www.microsoft.com/info/cpyright.htm > | > > | > | > | > --
Don't see what you're looking for? Try a search.
|
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
| home · blog · groups | Questions? Comments? Contact the dn |