Azure/diagnostics-eventflow

EventSourceInput captures System.Runtime logs as well (NET 7)

Tridy opened this issue ยท 12 comments

Tridy commented

Here is the eventFlowConfig.json config that I have:

{
  "inputs": [
    {
      "type": "EventSource",
      "sources": [
        {
          "providerName": "MySuperDuperEventSource",
          "level": "Informational"
        }
      ]
    }
  ],

  "outputs": [
    {
      "type": "StdOutput"
    }
  ],
  "schemaVersion": "2016-08-11"
}

when I run the application, besides my MySuperDuperEventSource logs, I also get a bunch of System.Runtime logs, like this:

...
[2] {"Timestamp":"2023-10-13T07:46:36.7033948+00:00","ProviderName":"System.Runtime","Level":0,"Keywords":0,"Payload":{"EventId":-1,"EventName":"EventCounters","Name":"working-set","DisplayName":"Working Set","Mean":43.782144,"StandardDeviation":0.0,"Count":1,"Min":43.782144,"Max":43.782144,"IntervalSec":1.0039572,"Series":"Interval=1000","CounterType":"Mean","Metadata":"","DisplayUnits":"MB"}}
[2] {"Timestamp":"2023-10-13T07:46:36.703516+00:00","ProviderName":"System.Runtime","Level":0,"Keywords":0,"Payload":{"EventId":-1,"EventName":"EventCounters","Name":"gc-heap-size","DisplayName":"GC Heap Size","Mean":4.15472,"StandardDeviation":0.0,"Count":1,"Min":4.15472,"Max":4.15472,"IntervalSec":1.0039572,"Series":"Interval=1000","CounterType":"Mean","Metadata":"","DisplayUnits":"MB"}}
...

It seems to be specific to StdOutput that has it (that I have seen so far), when I add other outputs like ApplicationInsights, for instance, these System.Runtime events do not get logged.

Is there a way of fixing that?

Tridy commented

I think that I get the same problem with the test CapturesEventCountersFromEventSource

test/Microsoft.Diagnostics.EventFlow.Inputs.Tests/EventSourceInputTests.cs

when with the assert:

Assert.Equal("testCounter", data.Payload["Name"]);

I have the one from the System.Runtime instead :

Name Value Type
data.Payload["Name"] "cpu-usage" object {string}

Thanks for the report @Tridy I will take a look

Tridy commented

This happens when I upgrade Microsoft.Diagnostics.EventFlow.Inputs.Tests to NET7
and running CapturesEventCountersFromEventSource which will fail the mentioned assertion.

the updated to NET7 Microsoft.Diagnostics.EventFlow.Inputs.Tests..csproj:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFrameworks>net7.0</TargetFrameworks>
    <DebugType>portable</DebugType>
    <AssemblyName>Microsoft.Diagnostics.EventFlow.Inputs.Tests</AssemblyName>
    <PublicSign Condition=" '$(OS)' != 'Windows_NT' ">true</PublicSign>
    <GenerateRuntimeConfigurationFiles>true</GenerateRuntimeConfigurationFiles>
    <NoWarn>$(NoWarn);NU1603</NoWarn>
    <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
    <GenerateBindingRedirectsOutputType>true</GenerateBindingRedirectsOutputType>
  </PropertyGroup>
  <ItemGroup>
    <ProjectReference Include="..\TestHelpers\TestHelpers.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Core\Microsoft.Diagnostics.EventFlow.Core.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.EtwUtilities\Microsoft.Diagnostics.EventFlow.EtwUtilities.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.EventSource\Microsoft.Diagnostics.EventFlow.Inputs.EventSource.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.Trace\Microsoft.Diagnostics.EventFlow.Inputs.Trace.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.Serilog\Microsoft.Diagnostics.EventFlow.Inputs.Serilog.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.MicrosoftLogging\Microsoft.Diagnostics.EventFlow.Inputs.MicrosoftLogging.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.ApplicationInsights\Microsoft.Diagnostics.EventFlow.Inputs.ApplicationInsights.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.Etw\Microsoft.Diagnostics.EventFlow.Inputs.Etw.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.Log4net\Microsoft.Diagnostics.EventFlow.Inputs.Log4net.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.NLog\Microsoft.Diagnostics.EventFlow.Inputs.NLog.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.DiagnosticSource\Microsoft.Diagnostics.EventFlow.Inputs.DiagnosticSource.csproj" />
    <ProjectReference Include="..\..\src\Microsoft.Diagnostics.EventFlow.Inputs.ActivitySource\Microsoft.Diagnostics.EventFlow.Inputs.ActivitySource.csproj" />
  </ItemGroup>
  <ItemGroup Condition=" '$(TargetFramework)' == 'net471' ">
    <Reference Include="System" />
    <Reference Include="Microsoft.CSharp" />
  </ItemGroup>
  <ItemGroup>
    <PackageReference Include="Microsoft.ApplicationInsights" Version="2.21.0" />
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.7.2" />
    <PackageReference Include="Moq" Version="4.20.69" />
    <PackageReference Include="xunit" Version="2.5.2" />
    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.3">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="3.1.5" />
    <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="7.0.0" />
    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
  </ItemGroup>
  <ItemGroup>
    <Service Include="{82a7f48d-3b50-4b1e-b82e-3ada8210c358}" />
  </ItemGroup>
</Project>

So @Tridy sorry for late follow-up. I have this PR in the works #426 which enables running all tests on .NET 7.

We'll see what automated run discovers, but so far running on my machine, I do not see any issues with unexpected event counters from System.Runtime... ๐Ÿค”

Yeah, the automated run also passed without finding any issues. Would it be possible for you to share a whole program that exhibits the problem? TIA!

Tridy commented

Thanks for the feedback!

Sure, here is a sample application that reproduces my problem:
https://github.com/Tridy/EventFlowDemo.git

here is the console log from a run of this application:
https://pastebin.com/eS7fPe2K

Just an idea, could compiling that with .NET 8 create this problem (but it runs in .NET 7)?

0>------- Started building project: MyConsole
0>Microsoft.NET.RuntimeIdentifierInference.targets(311,5): Message NETSDK1057 : You are using a preview version of .NET. See: https://aka.ms/dotnet-support-policy
C:\Program Files\dotnet\dotnet.exe exec "C:\Program Files\dotnet\sdk\8.0.100-rc.2.23502.2\Roslyn\bincore\csc.dll" [TRUNCATED]
MyConsole -> E:\WS\EventFlowDemo\src\MyConsole\bin\Debug\net7.0\MyConsole.dll
0>------- Finished building project: MyConsole. Succeeded: True. Errors: 0. Warnings: 0
Build completed in 00:00:02.316

Thanks for quick reply, appreciate it! Will try to check later today, incl. running on a machine that has .NET 8 RC. It is certainly possible that the behavior has changed between 7 and 8.

I can reproduce on my machine that has 8.0 rc2

I am not quite sure if this is related to .NET 8 honestly... I looked at the DLLs loaded by the sample you shared and they all seem from the .NET 7 family... asking for help some EventSource experts here at MS...

OK so it looks like this is caused by this known issue: dotnet/runtime#31927 Which is "clearly a bug", but also has been there for such a long time that there are serious backward compatibility concerns with fixing it.

I hope that the facility that EventFlow has for ignoring EventSources is sufficient for you. For example, the following configuration seems to make your example work as intended:

{
  "inputs": [
    {
      "type": "EventSource",
      "sources": [
        {
          "providerName": "MySuperDuperEventSource",
          "level": "Informational"
        },
        {
          "disabledProviderNamePrefix": "System.Runtime"
        }
      ]
    }
  ],

  "outputs": [
    {
      "type": "StdOutput"
    }
  ],
  "schemaVersion": "2016-08-11"
}

If this is not enough/too coarse-grained, let me know please what would you like to be able to do instead.

This will do it for now.
I will track the dotnet runtime issue you linked to see if it is fixed in the future.
Thanks for the help!

What should we do with this issue then?

Thanks for letting me know @Tridy. We can treat this issue as "external" and close it for now.