How to add a ETW provider to an existing service fabric cluster using powershell?

Question

I have already created a service fabric cluster with azure diagnostics and it is functional currently with my services deployed into that cluster. I have an ETW EventSource in my service that I would like to start collecting events from because my service code already uses this event source to write my service related events. Since the cluster is already enabled for azure diagnostics and my services are already deployed into that cluster, I think it is a simple matter of updating the ETW provider with my event source in this service fabric cluster. Here is the exported template (only a partial is shown that is relevant for azure diagnostics):

{
"properties": {
    "publisher": "Microsoft.Azure.Diagnostics",
    "type": "IaaSDiagnostics",
    "typeHandlerVersion": "1.5",
    "autoUpgradeMinorVersion": true,
    "settings": {
        "WadCfg": {
            "DiagnosticMonitorConfiguration": {
                "overallQuotaInMB": "50000",
                "EtwProviders": {
                    "EtwEventSourceProviderConfiguration": [
                        {
                            "provider": "Microsoft-ServiceFabric-Actors",
                            "scheduledTransferKeywordFilter": "1",
                            "scheduledTransferPeriod": "PT5M",
                            "DefaultEvents": {
                                "eventDestination": "ServiceFabricReliableActorEventTable"
                            }
                        },
                        {
                            "provider": "Microsoft-ServiceFabric-Services",
                            "scheduledTransferPeriod": "PT5M",
                            "DefaultEvents": {
                                "eventDestination": "ServiceFabricReliableServiceEventTable"
                            }
                        },
                        {
                            "provider": "Bb.ServiceFabric.Infrastructure.Container",
                            "scheduledTransferPeriod": "PT1M",
                            "DefaultEvents": {
                                "eventDestination": "ServiceFabricReliableServiceEventTable"
                            }
                        }
                    ],
                    "EtwManifestProviderConfiguration": [
                        {
                            "provider": "cbd93bc2-71e5-4566-b3a7-595d8eeca6e8",
                            "scheduledTransferLogLevelFilter": "Information",
                            "scheduledTransferKeywordFilter": "4611686018427387904",
                            "scheduledTransferPeriod": "PT5M",
                            "DefaultEvents": {
                                "eventDestination": "ServiceFabricSystemEventTable"
                            }
                        }
                    ]
                }
            }
        },
        "StorageAccount": "sfdgsmsraghuplaygrou6827"
    }
},
"name": "VMDiagnosticsVmExt_vmNodeType0Name"
}

I would like to update following EtwProviders/EtwEventSourceProviderConfiguration to contain following section (as MyCompany.MyServices.MyStatelessService is the name of my service's EventSource):

{
"provider": "MyCompany.MyServices.MyStatelessService",
"scheduledTransferPeriod": "PT5M",
"DefaultEvents": {
    "eventDestination": "ServiceFabricReliableServiceEventTable"
}
}

Here are my questions:

Is this the correct way of inserting an ETW provider/EventSource (from my service) into an existing cluster (that is already enabled with azure diagnostics)?
Can I add this event source (as a ETW event source provider) using a powershell command(s)?
If so, what is the exact powershell command (using all the information from the above code fragment)?

Note: I am using .net framework 4.5.2.

Mikkel Mørk Hegnhøj Mikkel Mørk Hegnhøj · Accepted Answer · 2016-08-26T15:59:55

All seems good with the added configuration above. Just be aware that for ETWProviders the EventDestination cannot contain hyphens (-), yours don't so you are ok.

To update the Windows Azure Diagnostics (WAD) agent configuration, you can use either PowerShell or Cloud Explorer in Visual Studio.

For the former, simply update the ARM template and use the New-AzureRmResourceGroupDeployment cmdlet. See here for further information: https://azure.microsoft.com/en-us/documentation/articles/service-fabric-diagnostics-how-to-setup-wad/#update-diagnostics-to-collect-and-upload-logs-from-new-eventsource-channels

For using Cloud Explorer in Visual Studio. Browse to your Virtual Machine Scale Set (as this is the Azure resource that holds the WAD configuration). Right-click and choose Update Diagnostics. In the dialog shown, you have the option to upload a private and public configuration file. Simple take a .json document containing the {"WadCfg": {}} element, and upload that as a public configuration.

If you need to update the private configuration specifies the storage account name and AccessKey: { "storageAccountName": "", "storageAccountKey": "", "storageAccountEndPoint": "https://core.windows.net", }

Hope this helps. Mikkel

How to add a ETW provider to an existing service fabric cluster using powershell?

1 Answers