The ASP.NET health monitoring enables you to add instrumentation to Web applications by using the so called Web Events. These Web events give us information about health status.
You can configure health monitoring by setting events and providers in the healthMonitoring section.
Naturally, ASP.NET provides us with a few out-of-the-box providers such as the EventLogWebEventProvider.
As many of you may have already noticed, when using the
EventLogWebEventProvider the events are added to the Application EventLog with the following source pattern:
ASP.NET "framework version"
If you are using ASP.NET 2.0, the source will look similar to "ASP.NET 2.0.50727.0 ".
You can imagine what happens when a server hosts several web applications ... you can't easily figure which application raised a web event because you can't apply a filter to do that. To figure it out, you must inspect the eventlog entry data.
What can you do to overlap this? Well you can create your own
EventLogWebEventProvider that allows you to specify which source to use.
Making such a provider is fairly simple but lead us to THE problem: which
eventId to use when creating the
What? Why is this a problem? are you saying.
Well, let's start all from the beginning ... you want to create your own provider so you can specify the
EventLog source but you certainly desire to keep the remaining settings unchanged so that monitoring applications that track the
EventLog entry for well known
eventIds are still working fine.
The problem is that Microsoft don't expose the algorithm used to created the
eventId from the
WebEvent data, and this way we can only guess which
eventId to use.
If you look at EventLogWebEventProvider.ProcessEvent method, you will find the following code:
int num = UnsafeNativeMethods.RaiseEventlogEvent((int) type,
(string) dataFields.ToArray(typeof(string)), dataFields.Count); <a href="%22%22%22%22http://11011.net/software/vspaste%22%22%22%22"></a>
This is your black box, no source or information is available.
To guess which
eventId is used for a specific Web Event, I created a small page that raises all known Web Events.
I found that even with all known Web Events configured to use
EventLogWebEventProvider almost half of them don't appear in
EventLog, but those that have an
EventLog entry made me speculate that
eventIds are sequential and follow the classes hierarchy. Here are the results:
Please note that I'm considering that no two different Web Events share the same
If you believe the assumptions made are correct, you can now start coding your provider.
Remember that you must create the
EventLog source before use it. You can do this by using the EventLog.CreateEventSource method.