ETW Logging From Service and Driver

A recent feature addition to my product at work is logging to a custom event log channel using ETW. I have used technology built on top of ETW before, such as WPP tracing, and while it is a bit cumbersome, the advantages are great, and once it’s set up, it’s not hard at all to use. I have also done classic Event Logging before.

With this recent feature work, I wanted to use the current technology, and I wanted to be able to log from my service and driver. I thought I had everything working. I created a manifest .xml file that defined my custom channels, and the events I wanted to log. I wrote some code to register/unregister with ETW, and to log various messages with their accompanying data.

But in my testing, I was able to log events from my service (running as system), but not from my driver. The calls to EtwRegister and EtwWrite looked like they were working perfectly. They returned a success code, but nothing every appeared in the log. The documentation says they will behave this way (returning success but not logging anything) if the event is not enabled.

I spend the next few hours trying to figure out why my events were not enabled. The logging level (Error, Warning, Information) was fine. The keywords were fine. The manifest file and the message resources it pointed to were okay. I even went so far as to write a notification callback so I could see what the system was enabling. It all looked fine.

I finally decided to try using a built-in channel instead of my own, and I selected the SYSTEM channel. Bam! Everything started working. Then I started to think that this might be a security issue. This was a bit counter-intuitive because the APIs weren’t failing. I would think that if you tried to write an event but didn’t have rights, you should get an access denied error, but apparently the system just happily eats your event and gives you a thumbs up.

The key turned out to be the isolation attribute on my custom channel. Setting the isolation=”system” attribute on the channel made everything start working.

I don’t understand why the logging worked from my service, but not from my driver, since both were running in the system context. But there it is. A very simple solution to a maddening problem (at least for a day).

2 thoughts on “ETW Logging From Service and Driver

  1. The infrastructure that underlies event logging has been completely revamped in Windows Vista. Information about each event conforms to an XML schema, and you can access the XML representing a given event. You can also construct XML-based queries against event logs. You do not have to know anything about XML to leverage the new features available. The Event Viewer allows you to access the functionality in an easy-to-use graphical format.

  2. @Bennett, you are absolutely right. This feature was my first experience with the newly revamped event tracing system, and it’s quite nice. Previously I had used WPP tracing (which now is built on top of the new Vista system), and “classic” event viewer logging. The new system is much more flexible, though a bit more complicated to get up and running.

    The other day I demo’ed this new feature for a customer and he congratulated us on using the “new event logging methods”. He was a bit surprised, which I guess just illustrates that there are a lot of people still using the older methods.

Leave a Reply to Bennett Conner Cancel reply

Your email address will not be published. Required fields are marked *

Complete the following to verify your humanity: * Time limit is exhausted. Please reload CAPTCHA.

This site uses Akismet to reduce spam. Learn how your comment data is processed.