Failed to format ETW event property. Unexpected length of 0 for intype 300 and outtype 0

[lzur1]

To repro the issue you can tougle the Bluetooth on/off with the listen to bthport provider mentioned below.

iceAddress>233717558281702
[2022-11-25T03:09:40.000Z][LOGMONITOR] ERROR: Failed to format ETW event property. Unexpected length of 0 for intype 300 and outtype 0
[2022-11-25T03:09:40.000Z][LOGMONITOR] ERROR: Failed to query ETW event property length. Error: 15005l
[2022-11-25T03:09:40.000Z][LOGMONITOR] ERROR: Failed to format ETW event user data.
[2022-11-25T03:09:40.000Z][LOGMONITOR] ERROR: Failed to format ETW event property. Unexpected length of 0 for intype 300 and outtype 0

{
"LogConfig": {
"sources": [
{
"type": "ETW",
"eventFormatMultiLine": false,
"providers": [
{
"providerName": "BthPort",
"providerGuid": "A8DD90AF-85F0-40B1-B022-4F54961E8AE5",
"level": "Verbose"
}
]
}
]
}
}

[bobsira]

Hello @lzur1

I am unable to reproduce this on my host machine. When toggle Bluetooth I get the following logs:

<Source>EtwEvent</Source>
   <Time>2022-11-28T14:13:34.000Z</Time>
   <Provider idGuid="{A8DD90AF-85F0-40B1-B022-4F54961E8AE5}" />
   <DecodingSource>DecodingSourceTlg</DecodingSource>
   <Execution ProcessID="4" ThreadID="27172" />
   <Level>Verbose</Level>
   <Keyword>0x400000000000</Keyword>
   <EventData>
      <PartA_PrivTags>50333696</PartA_PrivTags>
      <DeviceExtensionSessionId>{75f5b29a-025d-0006-beb2-f5755d02d901}</DeviceExtensionSessionId>
   </EventData>
   <Source>EtwEvent</Source>
   <Time>2022-11-28T14:13:35.000Z</Time>
   <Provider idGuid="{A8DD90AF-85F0-40B1-B022-4F54961E8AE5}" />
   <DecodingSource>DecodingSourceTlg</DecodingSource>
   <Execution ProcessID="4" ThreadID="27172" />
   <Level>Verbose</Level>
   <Keyword>0x400000000000</Keyword>
   <EventData>
      <PartA_PrivTags>50333696</PartA_PrivTags>
      <DeviceExtensionSessionId>{75f5b29a-025d-0006-beb2-f5755d02d901}</DeviceExtensionSessionId>
   </EventData>
   <Source>EtwEvent</Source>
   <Time>2022-11-28T14:13:35.000Z</Time>
   <Provider idGuid="{A8DD90AF-85F0-40B1-B022-4F54961E8AE5}" />
   <DecodingSource>DecodingSourceTlg</DecodingSource>
   <Execution ProcessID="1188" ThreadID="2228" />
   <Level>Verbose</Level>
   <Keyword>0x400000000000</Keyword>
   <EventData>
      <PartA_PrivTags>33556480</PartA_PrivTags>
      <DeviceExtensionSessionId>{75f5b29a-025d-0006-beb2-f5755d02d901}</DeviceExtensionSessionId>
      <ScanType>0</ScanType>
      <ScanInteval>588</ScanInteval>
      <ScanWindow>60</ScanWindow>
   </EventData>
   <Source>EtwEvent</Source>
   <Time>2022-11-28T14:13:36.000Z</Time>
   <Provider idGuid="{A8DD90AF-85F0-40B1-B022-4F54961E8AE5}" />
   <DecodingSource>DecodingSourceTlg</DecodingSource>
   <Execution ProcessID="5640" ThreadID="5644" />
   <Level>Verbose</Level>
   <Keyword>0x400000000104</Keyword>
   <EventData>
      <PartA_PrivTags>50333696</PartA_PrivTags>
      <DeviceExtensionSessionId>{75f5b29a-025d-0006-beb2-f5755d02d901}</DeviceExtensionSessionId>
      <HciConnectionSessionId>{75f5b29a-025d-0006-a286-15765d02d901}</HciConnectionSessionId>
      <CxnActivityId>{00000000-0000-0000-0000-000000000000}</CxnActivityId>
      <WeInitiatedThisEvent>1</WeInitiatedThisEvent>
      <BTDeviceAddress>211748024193709</BTDeviceAddress>
   </EventData>

I am unable to reproduce this on a windowsservercore container. I can't get any logs though when I toggle Bluetooth from the container.

Are you getting this issue when running Log Monitor on the host or a container?

could you share with me a dump of system info please?

[lzur1]

You need to repro the issue on host, then the Bluetooth stack will trigger the event.
I attached the full error print and dump of the structure.
i believe the bad parding is for Bluetooth.BthPort.RadioDiagnosticTlv
bthport.csv
bthport_fail.txt

[bobsira]

Which version of the log monitor are you using?

[lzur1]

i rebased to latest last wed

[bobsira]

@lzur1 are you still keen on this issue? Could you confirm whether you are experiencing the problem in the latest release?

[bobsira]

Closing this for now! Reopen if it exists in the higher releases!