BizTalk ETW tracing and LogParser

 

On a recent project we’ve implemented ETW tracing following the best practices and it indeed gave a great feeling of being able to enable tracing whenever we needed to. My colleague Tomasso Groenendijk implemented an ESB Itinerary Service for ETW tracing and we used the Cat controller to create log files and perform analysis, i didn’t knew about a great tool (or how to use it) called LogParser which basically is the missing puzzle piece (thanks to my other colleague Glenn Fecunda).

LogParser is a great tool which is superfast at analyzing large amounts of data by building up some sort of internal database. It allows you to query the data, in a SQL like syntax.

Below is a small example, which shows a simple query, however, once you see how fast it is on large amounts of data, it sure is a tool worth looking at. The most practical use if when you have a log for which there are special providers (EventLog, IIS etc), but still, with the ‘general’ providers TEXTLINE you can get the idea of how it works, and from there, it’s easy to write some .cpp to create your own provider Knipogende emoticon.

TESTCODE

TraceManager.CustomComponent.TraceDetails("test, " + DateTime.Now.ToString(), null);

EventTrace (started a trace with the Cat Controller)

[0]2CB4.1710::04/29/2013-13:49:08.524 [Event]:INFO: This is warm-up event written into ETW trace log - please ignore

[0]3590.2874::04/29/2013-13:49:56.360 [Event]:INFO: This is warm-up event written into ETW trace log - please ignore

[0]364C.2604::04/29/2013-13:49:59.418 [Event]:INFO: This is warm-up event written into ETW trace log - please ignore

[0]3788.254C::04/29/2013-13:50:32.604 [Event]:INFO: This is warm-up event written into ETW trace log - please ignore

[0]1624.1DD4::04/29/2013-13:50:34.982 [Event]:INFO: This is warm-up event written into ETW trace log - please ignore

[0]1B28.2700::04/29/2013-13:50:40.279 [Event]:INFO: This is warm-up event written into ETW trace log - please ignore

[0]0454.1260::04/29/2013-13:50:43.305 [Event]:INFO: This is warm-up event written into ETW trace log - please ignore

[0]3360.0FD8::04/29/2013-13:53:07.038 [Event]:test, 29-4-2013 13:53:07

[0]3360.0FD8::04/29/2013-13:53:07.462 [Event]:test, 29-4-2013 13:53:07

[0]3360.0FD8::04/29/2013-13:53:16.939 [Event]:test, 29-4-2013 13:53:16

[0]3360.0FD8::04/29/2013-13:53:20.961 [Event]:test, 29-4-2013 13:53:20

[0]3360.0FD8::04/29/2013-13:53:21.201 [Event]:test, 29-4-2013 13:53:21

[0]3360.0FD8::04/29/2013-13:53:21.384 [Event]:test, 29-4-2013 13:53:21

[0]3360.0FD8::04/29/2013-13:53:21.889 [Event]:test, 29-4-2013 13:53:21

[0]3360.0FD8::04/29/2013-13:53:22.075 [Event]:test, 29-4-2013 13:53:22

[0]3360.0FD8::04/29/2013-13:53:22.235 [Event]:test, 29-4-2013 13:53:22

[0]3360.0FD8::04/29/2013-13:53:22.418 [Event]:test, 29-4-2013 13:53:22

[0]3360.0FD8::04/29/2013-13:53:22.584 [Event]:test, 29-4-2013 13:53:22

[0]3360.0FD8::04/29/2013-13:53:22.731 [Event]:test, 29-4-2013 13:53:22

Select using LogParser (-i:TEXTLINE…no other provider available)

LogParser "SELECT * FROM BizTalkTrace.txt WHERE Text LIKE '%22.731%'" -i:TEXTLINE

LogFilename   Index Text

20    [0]3360.0FD8::04/29/2013-13:53:22.731 [Event]:test, 29-4-2013 13:53:22

Exclude the INFO lines

LogParser "SELECT * FROM BizTalkTrace.txt WHERE TEXT NOT LIKE '%[Event]:INFO%'" -i:TEXTLINE

 

 

So, go on and develop your own providers….and keep me in the loop once they are done Knipogende emoticon.

 

Regards,

 

Sander

Comments

Post a Comment

Popular posts from this blog

Azure implementation guidelines

In My post ‘ Service Bus Management ’ I pointed out a way of implementing a DTAP strategy for managing the Service Bus environment. There’s now a great post available from Microsoft which goes into more detail about other aspects of managing the Azure subscriptions and other artefacts which is quite useful when setting up your Azure environments. Follow this link to the ‘Azure Implementation Guidelines’ HTH, Sander
Read more

Focus and innovation - recap of the last 2 years

It's been a long time since my last post. Hereby a partial explanation for that, with the note that this blog will remain active for the purpose of being a resource for historical references. My IT career started with programming, and adventures within holland, as well as overseas. When I realised programming is something you can specify, I figured that providing added value is crucial for a long term career and decided to focus on process centric roles. I started with webservice integration and eventually from that to process integration using BizTalk. The great feeling when discussing high level processes and implementing solutions within days, even highly scalable and interfacing with LOB systems is great. After several years of implementing solutions like these, I started questioning if all of this work was justified by the business case, if the solution was actually contributing, if the choices had been valid. In other words, I needed to understand the choices made. When...
Read more

BizTalk Pub/sub vs Topics based routing–discussion

My colleagues and I had a brief discussion about the subject ‘Topics’ and what it brings… Do you all agree/disagree with the following statement: topic-based pub-sub messaging doesn’t really exist in BizTalk “In my opinion; I disagree, as BizTalk offers the following 'out-of-the-box' • Message Routing (f.e build in context properties like message type, trading partner, operation etc) • Content Routing (f.e. promoted properties, message inspection in orchestrations/pipelines icw orchestration logic)” My colleague Rene Brauwers Here my 2 cents…. I agree that it exists...however the current offerings in BizTalk are tightly coupled, making the usage far from perfect. When doing content based routing on custom fields (promoted properties), you will be making the solution message-coupled; Your custom message property schema is deployed, and the message filter on these fields have a direct relationship with this property schema. Making any change to this schema will g...
Read more