ASP.NET - Health Monitoring and EventLogWebEventProvider - Part 1

The ASP.NET health monitoring enables you to add instrumentation to Web applications by using the so called Web Events. These Web events give us information about health status.

You can configure health monitoring by setting events and providers in the healthMonitoring section.

Naturally, ASP.NET provides us with a few out-of-the-box providers such as the EventLogWebEventProvider.

As many of you may have already noticed, when using the EventLogWebEventProvider the events are added to the Application EventLog with the following source pattern:

ASP.NET "framework version"

If you are using ASP.NET 2.0, the source will look similar to "ASP.NET 2.0.50727.0 ".

You can imagine what happens when a server hosts several web applications ... you can't easily figure which application raised a web event because you can't apply a filter to do that. To figure it out, you must inspect the eventlog entry data.

What can you do to overlap this? Well you can create your own EventLogWebEventProvider that allows you to specify which source to use.

Making such a provider is fairly simple but lead us to THE problem: which eventId to use when creating the EventLog entry?

What? Why is this a problem? are you saying.

Well, let's start all from the beginning ... you want to create your own provider so you can specify the EventLog source but you certainly desire to keep the remaining settings unchanged so that monitoring applications that track the EventLog entry for well known eventIds are still working fine.

The problem is that Microsoft don't expose the algorithm used to created the eventId from the WebEvent data, and this way we can only guess which eventId to use.

If you look at EventLogWebEventProvider.ProcessEvent method, you will find the following code:

int num = UnsafeNativeMethods.RaiseEventlogEvent((int) type, 
(string[]) dataFields.ToArray(typeof(string)), dataFields.Count); <a href="%22%22%22%22http://11011.net/software/vspaste%22%22%22%22"></a>

This is your black box, no source or information is available.

To guess which eventId is used for a specific Web Event, I created a small page that raises all known Web Events.

I found that even with all known Web Events configured to use EventLogWebEventProvider almost half of them don't appear in EventLog, but those that have an EventLog entry made me speculate that eventIds are sequential and follow the classes hierarchy. Here are the results:

Please note that I'm considering that no two different Web Events share the same eventId.

If you believe the assumptions made are correct, you can now start coding your provider.

Remember that you must create the EventLog source before use it. You can do this by using the EventLog.CreateEventSource method.