Using EventProviderTraceListener

In .Net framework 3.5, there is a new trace listener, EventProviderTraceListener, which you can use to do ETW tracing. There are good introduction and some intimidating tips. It took me a while to figure out that, to do a simple ETW trace, you can just configure it like a normal trace listener by having an app config file like:



<trace autoflush=”true” indentsize=”4″>


<add name=”myListener” type=”System.Diagnostics.Eventing.EventProviderTraceListener, System.Core, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089″ initializeData=”{BF8671E1-2B70-41f3-AE0C-993C6A7D6763}” />

<remove name=”Default” />





I put the event provider ID as initializeData and it seems to work. With that config file, you can simply use Trace.WriteLine(“my message”).

To start a trace session, do:

logman start mysession -p {BF8671E1-2B70-41f3-AE0C-993C6A7D6763} -o mytest.etl -ets

After you are done with tracing, you can stop by

logman stop mysession -ets

Then you can use tracerpt to dump the log to readable format.

tracerpt mytest.etl

ETW tracing is very customizable, but for doing simple tracing for debugging, it seems logging a message is enough. One advantage of using ETW tracing is performance. I did some simple measurement with a loop like:

            Stopwatch timePerParse = Stopwatch.StartNew();
for (int i = 0; i < 50000; ++i)
Trace.WriteLine(“this is using Trace”);

The result is like (on a 2.4 GHz machine):

Default trace listener with DBGView.exe






Note: EventProviderTraceListener currently is only supported on Vista.

Keywords: ETW tracing EventProviderTraceListener System.Diagnostics.Eventing.EventProviderTraceListener logman.exe tracerpt.exe