Click here to Skip to main content
12,447,625 members (61,035 online)
Click here to Skip to main content
Add your own
alternative version

Stats

10.2K views
4 bookmarked
Posted

ASP.NET - Health Monitoring and EventLogWebEventProvider - Part 1

, 14 Apr 2010 CPOL
Rate this:
Please Sign up or sign in to vote.
The ASP.NET health monitoring enables you to add instrumentation to Web applications by using the so called Web Events. These Web events give us information about health status.

The ASP.NET health monitoring enables you to add instrumentation to Web applications by using the so called Web Events. These Web events give us information about health status.

You can configure health monitoring by setting events and providers in the healthMonitoring section.

Naturally, ASP.NET provides us with a few out-of-the-box providers such as the EventLogWebEventProvider.

As many of you may have already noticed, when using the EventLogWebEventProvider the events are added to the Application EventLog with the following source pattern:

ASP.NET "framework version"

If you are using ASP.NET 2.0, the source will look similar to "ASP.NET 2.0.50727.0 ".

You can imagine what happens when a server hosts several web applications ... you can't easily figure which application raised a web event because you can't apply a filter to do that. To figure it out, you must inspect the eventlog entry data.

What can you do to overlap this? Well you can create your own EventLogWebEventProvider that allows you to specify which source to use.

Making such a provider is fairly simple but lead us to THE problem: which eventId to use when creating the EventLog entry?

What? Why is this a problem? are you saying.

Well, let's start all from the beginning ... you want to create your own provider so you can specify the EventLog source but you certainly desire to keep the remaining settings unchanged so that monitoring applications that track the EventLog entry for well known eventIds are still working fine.

The problem is that Microsoft don't expose the algorithm used to created the eventId from the WebEvent data, and this way we can only guess which eventId to use.

If you look at EventLogWebEventProvider.ProcessEvent method, you will find the following code:

int num = UnsafeNativeMethods.RaiseEventlogEvent((int) type, 
(string[]) dataFields.ToArray(typeof(string)), dataFields.Count); <a href="%22%22%22%22http://11011.net/software/vspaste%22%22%22%22"></a>

This is your black box, no source or information is available.

To guess which eventId is used for a specific Web Event, I created a small page that raises all known Web Events.

I found that even with all known Web Events configured to use EventLogWebEventProvider almost half of them don't appear in EventLog, but those that have an EventLog entry made me speculate that eventIds are sequential and follow the classes hierarchy. Here are the results:

Web Event EventLog entry eventId Speculated eventId range
WebBaseEvent - 1303
WebManagementEvent - 1304
WebApplicationLifetimeEvent 1305 1305
WebRequestEvent 1306 1306
WebHeartbeatEvent 1307 1307
WebBaseErrorEvent - 1308
WebRequestErrorEvent 1309 1309
WebErrorEvent 1310 1310
WebAuditEvent - 1311
WebSuccessAuditEvent 1312 1312
WebAuthenticationSuccessAuditEvent - 1313
WebFailureAuditEvent 1314 1314
WebAuthenticationFailureAuditEvent - 1315
WebViewStateFailureAuditEvent 1316 1316

Please note that I'm considering that no two different Web Events share the same eventId.

If you believe the assumptions made are correct, you can now start coding your provider.

Remember that you must create the EventLog source before use it. You can do this by using the EventLog.CreateEventSource method.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Nuno M. F. Gomes
Architect everis
Portugal Portugal
Over 13 years of experience in the Software Development working mainly in the banking and insurance industry.

Over 3 year of experience as Operations Team Leader focused on Infrastructure Management and Software Configuration Management.

I've been honored with the Microsoft Most Valuable Professional (MVP) Award for three consecutive years, 2010, 2011 and 2012, in recognition to exceptional technical contributions and leadership.

Current / Recent Technical Projects
- Dominican Republic Instance management, including 2nd line System management, capacity management, SW monitoring and deploy management
- Colombian SECOPII Instance management, including 2nd line System management, capacity management, SW monitoring and deploy management
- Vortal Main Instance management, including 2nd line System management, capacity management, SW monitoring and deploy management
- Vortal Development ecosystem management, including Server management, , capacity management, SW monitoring and deploy management

Areas of Specialization:
- Operations Management - ISO 20000 & ISO 27001 driven
- Team Management and Coaching
- Technology Leadership, Solutions/Architecture
- Product life cycle management, Continuous Integration
- Technological background in Microsoft frameworks and tools.

You may also be interested in...

Comments and Discussions

 
Generalsample code Pin
Donsw23-Oct-10 16:24
memberDonsw23-Oct-10 16:24 
GeneralMy vote of 2 Pin
Donsw23-Oct-10 16:24
memberDonsw23-Oct-10 16:24 
you relly need sample code

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.160811.3 | Last Updated 14 Apr 2010
Article Copyright 2010 by Nuno M. F. Gomes
Everything else Copyright © CodeProject, 1999-2016
Layout: fixed | fluid