XML Logging in the .NET Framework

This was originally going to be some guideline instructions for a CodePlex project, Essential.Diagnostics that I work on, but it ended up being more an opinion piece so I thought it would fit better on a blog.

There are several trace listeners (loggers) in the .NET Framework that can produce XML output. Outputting to XML results in more complex (verbose) files than, say, a simple text file output, but usually has the benefit of being better processed by tools, correlated across tiers, etc.

There are three main XML listeners, plus one extension in Essential.Diagnostics:

• XmlWriterTraceListener
• RollingXmlTraceListener (in Essential.Diagnostics)
• EventSchemaTraceListener (in System.Core)
• EventProviderTraceListener (in System.Core)

Examples of how to configure and use each one (used to produce the output below) is provided in the Essential.Diagnostics project.

Windows 8 Developer Preview Safe Mode

In Windows 8 the ‘Safe Mode’ option is not available on the boot with F8 screen, prompting several guides on creating an additional boot entry using BCDEDIT and chaning the properties via the Windows GUI — not much use if your machine has already run into trouble.

Shift+F8 is the secret key that gets the old boot options menu, with ‘Safe Mode’, but you need to hold it down during POST and keep holding it down until the “Advanced Boot Option” screen appears, otherwise you can’t time it right (unlike F8, or F10 below, which you just hit at the beginning of the boot).

Also the Edit Boot Options menu, available via boot with F10, is still available, and that allows low level control of all the boot options.

I couldn’t track down a current reference for the options, but did find one for Windows XP / Server 2003, most of which still appear relevant: http://support.microsoft.com/kb/833721

To get the same as ‘Safe Mode with Networking’:

1. Press F10 while booting
2. You should get a text screen titled “Edit Boot Options”, with a section ”Edit Windows Boot options for: Windows Developer Preview”
3. There should be an input area that already has “/NOEXECUTE=OPTIN” (in my case it also had “/HYPERVISORLAUNCHTYPE=AUTO”, which I think is because I am running Hyper-V)
4. Add “/SAFEBOOT:NETWORK” (Note: “/NOGUIBOOT” doesn’t seem to work — it still shows the loading screen, so options like “/SOS” didn’t work)
5. Hit ENTER to boot

Safe Mode is important for an early Developer Preview like this as drivers issues are much more likely (I ran into problems trying to add the NVIDIA drivers for my Alienware M14x and had to boot into safe mode to uninstall them).

Comparison of logging frameworks

I added a comparison of the major logging/tracing frameworks for .NET to the CodePlex site for Essential.Diagnostics, to demonstrate how System.Diagnostics stacks up against log4net, NLog and the Enterprise Library.

I also added a performance comparison (the source code is in the CodePlex project if you want to verify the results).

Look at the results for yourself, but I think System.Diagnostics does okay — and the extensions in Essential.Diagnostics (plus others such as Ukadc.Diagnostics and UdpPocketTrace) fill out the gaps compared to log4net and NLog. Similarly on the performance side, all have very little overhead (NLog is a winner on overhead, but does relatively worse on actually writing the messages to a log file).

What about the Enterprise Library Logging Application Block? Well, I just don’t think it does well compared to the others. Sure it was a lot better than .NET 1.0 System.Diagnostics, but a lot of that was added in .NET 2.0 System.Diagnostics (such as multiple sources). In some cases it is worse than what is currently available in the standard framework — e.g. no delayed formatting. This shows up in the performance figures which indicate several magnitudes greater overhead than any of the other frameworks!

I’m obviously biased, but I really think that the best solution is to stick with the standard, out-of-the-box, System.Diagnostics, extended where necessary to fill any gaps (Essential.Diagnostics, etc, for additional listeners, filters & formatting).

P.S. Also check out my guidance on Logging Levels.

SharePoint 2010 logging levels

According to MSDN “in Microsoft SharePoint Foundation 2010 the preferred method of writing to the Trace Logs is to use the SPDiagnosticsServiceBase class” (http://msdn.microsoft.com/en-us/library/ff512746.aspx).

MSDN also provides some guidance on the trace and event log severity levels to use (http://msdn.microsoft.com/en-us/library/ff604025.aspx), however the WriteEvent() and WriteTrace() methods use slightly different enums; the diagnostics logging configuration in Central Administration is slightly different again, and then you have a third set of values accessed by the PowerShell command Get-SPLogEvent.

The table below shows the mapping of levels from these different sources.

Despite the complicated mapping, in general I think things go in the right direction with events writing to the event log and trace log at the same time, and having a high trace level. The distinction between event logging and trace information is also good, with independently set thresholds.

EventSeverity	EventLogEntryType	TraceSeverity	ULSTraceLevel	ULSLogFileProcessor .TraceLevel
None = 0		None = 0	0 (None)	Unassigned = 0
ErrorServiceUnavailable = 10	Error		1	Critical = 1 (or ErrorCritical)
ErrorSecurityBreach = 20
ErrorCritical = 30
Error = 40
				Exception = 4
				Assert = 6
Warning = 50	Warning		8	Warning = 8
FailureAudit = 60
		Unexpected = 10	Unexpected = 10	Unexpected = 10
		Monitorable = 15	Monitorable = 15	Monitorable = 15
SuccessAudit = 70	Information		18	Information = 18
Information = 80
Success = 90
Verbose = 100
		High = 20	High = 20	High = 20
		Medium = 50	Medium = 50	Medium = 50
		Verbose = 100	Verbose = 100	Verbose = 100
		VerboseEx = 200	VerboseEx = 200	VerboseEx = 200

[Rant] Why are IM/presence networks still fragmented?

Email (well, the majority of it anyway) is one nice standardised SMTP network — any mail server can send to any address, finding each other by the domain. To some degree client protocols are also standardised (IMAP or POP), and although there are exceptions (e.g. Exchange protocol) the servers and clients still generally support the standard protocols as well.

Instant messaging, presence, and related networks are, however, still fragmented.

SharePoint 2010 design considerations

SharePoint 2010 introduces the ribbon bar as a central place for all the editing controls, that in earlier versions could be scattered across the page.

When designing custom master pages for SP 2010 you may want to visually integrate the ribbon bar into the design, as is done in the out-of-the box v4.master (wiki & workspaces) and nightandday.master (publishing portal) pages.

To do this, I have documented the size of the different elements, so they can be included in the design.

Essential.Diagnostics library added to CodePlex

Essential.Diagnostics is a library of additional trace listeners and other bits for the .NET Framework System.Diagnostics trace logging.

It doesn’t change the way you write log statements (you still use TraceSource), but fits into the built-in extension points to add functionality (mostly additional trace listeners and filters).

From the project description:

“Essential.Diagnostics contains additional trace listeners, filters and utility classes for the .NET Framework System.Diagnostics trace logging. Included are colored console (that allows custom formats), SQL database (including a tool to create tables) and in-memory trace listeners, simple property and expression filters, activity and logical operation scopes, and configuration file monitoring.”

The intention is to round-out System.Diagnostics with additional capabilities so that it can be compared to alternative 3rd party logging systems (NLog, log4net, Common.Logging, and even Enterprise Library).

Note that the library is intentionally much lighter than Enterprise Library; rather than an overhaul of the logging mechanism itself the library is mainly meant to provide additional trace listeners.

I put the source code up a few days ago, but only recently finished the packaging scripts for the downloads.

With the recent release of NuPack NuGet, I have also spent an additional bit of time and set it up as a NuGet package.