This documentation is archived and is not being maintained.

EventProviderTraceListener Class

A listener for System.Diagnostics.TraceSource that writes events to the ETW subsytem.

Namespace:  System.Diagnostics.Eventing
Assembly:  System.Core (in System.Core.dll)

[HostProtectionAttribute(SecurityAction.LinkDemand, MayLeakOnAbort = true)]
public class EventProviderTraceListener : TraceListener


The HostProtectionAttribute attribute applied to this type or member has the following Resources property value: MayLeakOnAbort. The HostProtectionAttribute does not affect desktop applications (which are typically started by double-clicking an icon, typing a command, or entering a URL in a browser). For more information, see the HostProtectionAttribute class or SQL Server Programming and Host Protection Attributes.

All event data (trace or debug) from the source event is written to the ETW subsystem as a string. The data elements are delimited using a comma. To specify a different delimiter, use the Delimiter property.

Adding the listener to System.Diagnostics.TraceSource registers the provider with the ETW subsystem. You must create an ETW trace session using the Logman.exe executable program (or something similar) to write the events to a log file.

You do not need a manifest to consume events from the listener because the event data is a single string.

When you call the System.Diagnostics.TraceSource methods to write events, you pass a TraceEventType enumeration value. The enumeration contains both level and keyword values. When you enable a trace listener provider from an ETW session, the level value that you specify can be the value associated with one of the following TraceEventType enumeration values:

  • Critical (value is 1)

  • Error (value is 2)

  • Information (value is 8)

  • Verbose (value is 16)

  • Warning (value is 4)

The keyword value that you specify for the session can be the value associated with one of the following TraceEventType enumeration values:

  • Resume (value is 2,048)

  • Start (value is 256)

  • Stop (value is 512)

  • Suspend (value is 1,024)

  • Transfer (value is 4,096)

        private static Guid providerId = new Guid("{B3F0C8FC-E8A8-4868-8901-1465E8A2F41B}");

            EventProviderTraceListener listener = new EventProviderTraceListener(providerId.ToString(), "Test Listener", "::");

            // You should use the All default level and control the level using the
            // ETW session; otherwise, you may not log all the events requested by the
            // session.
            TraceSource source = new TraceSource("MyProvider", SourceLevels.All);


            source.TraceData(TraceEventType.Warning | TraceEventType.Start, 2, new object[] { "abc", "def", true, 123 });

            source.TraceEvent(TraceEventType.Warning, 12, "Provider guid: {0}", new object[] { providerId });

            source.TraceInformation("string {0}, bool {1}, int {2}, ushort {3}", new object[] { "abc", false, 123, (UInt32)5 });


Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.

Windows 7, Windows Vista, Windows Server 2008 R2, Windows Server 2008

The .NET Framework and .NET Compact Framework do not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.

.NET Framework

Supported in: 3.5