Enterprise Instrumentation

1
Enterprise Instrumentation

• Peter Himschoot
• MS Regional Director
• Info Support N.V.

2
Introduction

• Problem customer reports about a problem/bug in
  the production environment.
• Problem is reproducing the bug
• How do you go about solving this problem ?

3
Logging tracing

• Developers use
• Logging for exceptional circumstances
• For example the exception handling block
• Tracing
• But only in their development environment
• Why ? Because tracing is too slow

4
To put tracing in production

• Tracing needs to be
• Fast enough for production environment
• Easy to enable / disable per subsystem
• Reduce overhead even more
• Reliable persistent
• Easy to manage centrally for some cases
• For example using MOM
• Or using the event log
• Enterprise Instrumentation !

5
Enterprise Instrumentation

• Significantly improve enterprise customers
  ability to monitor and troubleshoot .NET
  applications
• Integrate and unify disparate tracing, eventing
  and logging technologies
• Integrate with existing management tools and
  products
• Key Scenarios
• Application Monitoring and Error Management
• Local Diagnostic Tracing
• Distributed Request Tracing

6
Simple Enterprise Instrumentation
7
Logical Architecture
Enterprise Instrumentation Configuration
.NET Application
Application Object
Application Object
Event Source
Event Source
Instrumentation API
Event Routing
Event Schema
WMI
EventTrace
EventLog
TraceLogs
EventLog
WMISubscribers
Trace Reader
8
Event schema
BaseEvent
CommonEvent
DiagnosticEvent
AdminEvent
AuditEvent
AuditMessageEvent
AdminMessageEvent
TraceEvent
ErrorEvent
AuditOperationEvent
AdminOperationEvent
TraceMessageEvent
ErrorMessageEvent
TraceDatabaseEvent
9
Event Sources events
10
Event Sink

• Event sinks are responsible for persisting the
  event source data
• To the event log
• To the event trace
• To WMI
• Whatever you may want
• Choice of event sink is determined by
• Type of event
• Frequency of event

11
Event Log

• Event Log is used for exceptional events
• Low frequency events such as
• Errors
• Warnings
• Audits
• Event log is not very fast
• Is known to everyone
• Is remotely accessible

12
Event Trace

• Newly added to windows 2000 and beyond
• For high frequency tracing
• Uses highly optimized code
• File is binary for efficiency
• Need special tool to read it
• File is stored locally
• Operations will need to copy it

13
WMI

• Slowest EventSink
• Use only for high-visibility events
• You can write code to act upon certain events
• User running out of disk space
• Too many requests per second
• Etc

14
Enabling/Disabling events

• You enable an event being persisted by
• Adding a filter
• Uses an EventCategory for filtering the event
• Uses an EventSink to actually log the event
• Bind filter to event source

15
Registering a new application

• First time a configuration file is generated
• Use InstallUtil for this
• Requires the intrumentation installer class

16
Filtering Event Sources
17
Coding for efficiency

• Enterprise Instrumentation allows you to check if
  tracing/logging will actually occur.
• Allows you to skip costly computations only used
  for tracing/logging

18
Coding for efficient tracing
19
Request Tracing

• Exposes the flow of the code
• Methods called during the request
• Flow from one machine to another
• Some restrictions
• Uses remoting infrastructure
• LogicalCallContext
• Only works for managed code

20
Little code involved
Define an EventSource for Request
Start Request
Call method(s)
Dispose Request
Use Try/Finally to ensure request is disposed !
21
Using EI for distributed apps
Application Server
Application Server
Distributed .NET Application
Event Source
Event Source
Event Source
Event Source
Event Routing
Event Routing
WMI
EventTrace
EventLog
WMI
EventTrace
EventLog
TraceLogs
EventLog
WMISubscribers
TraceLogs
EventLog
WMISubscribers
TraceReader
TraceReader
Management Server
Management Suite
Mgmt EventRepository
22
Distributed Request Tracing
Execution path for Login involves calls across 3
machines. Each method will log to a local
trace-log, which is aggregated and analyzed in
one place.
Computer1
App.Login()
Computer2
App.VerifyUser()
Computer3
App.AuditUser()
SQL
Events logged are aggregated and analyzed
23
Correlating events
24
Request Tracing
25
Configuration

• Configuration files determine
• The Event Sources
• The Event Sink
• The filterbindings between them
• You can change configuration using
• An xml editor
• Your own code
• You can change configurations path

26
Writing configuration code

• Dont trouble operations with XML configuration
  files
• E.g. Xml is case sensitive
• Write an application !
• Its easy !
• No typos to solve in the weekend

27
Configuration Object Model
EventSource
BoundFilters
Filter
ApplicationSettings
BoundEventCategories
EventCategory
BoundEventSinks
EventSink
28
Writing your own Configuration App
29
Some advanced features

• Custom Event Sinks
• Property Group Filters

30
Custom Event Sinks

• Derive from EventSink
• Implement constructor
• Implement Write
• Implement Dispose
• Implement IEventContainerSink
• Optional step, but better for performance
• Install assembly in GAC
• Declare sink in your configuration file

31
Property Group Filters

• Control which properties are set
• For example StackTrace is expensive
• Disabled by default for TraceEvents
• Enabled by default for ErrorEvents
• Turn on/off in configuration file

32
Custom Event Sinks Property Group Filters
33
Conclusion

• Tracing and logging are an important part of
  every application
• Tracing can be used even in production
• Request Tracing makes solving production problems
  easier
• Configuration allows you and operations to easily
  enable/disable tracing per subsystem

34
Resources
35
(No Transcript)