Share via

Create Multiple Event Collection Services

  • Article

The Event Collection service uses event collectors to obtain event information and write it to the monitoring store. You can configure multiple event collection services for your application monitored by Windows Server AppFabric. Here are the following steps to configure a new Event Collection service.

  1. Add a new collector section in the root Web.config file.

    <collectors>
   <collector name="" session="0">
      <settings retryCount="5" eventBufferSize="10000" retryWait="00:00:15" samplingInterval="00:00:05" aggregationEnabled="true"/>
   </collector>
</collectors>

    Each configuration attribute has value range limits. These limits are specified in the [System Drive]:\Windows\System32\inetsrv\config\schema\ApplicationServer_schema.xml file.

    Note

    Scope is optional. If a scope is not specified the Event Collection service searches the entire IIS hierarchy.

    The session attribute in the configuration maps to well known GUIDs that identify the ETW Session that the Event Collection service will use.

    # Unique Session ID

    0

    {4F880754-D52D-4e29-AB99-A3FAB65F4EE}

    1

    {E75EC25E-CCE3-4d07-9753-B43D0A308B22}

    2

    {B00F53ED-863D-40b1-BB0B-A9D6AFA2D393}

    3

    {0BFCAF6D-3385-4270-9D4B-14F745BC0CEC}

    4

    {27DE143C-8B3C-472c-A170-AD1468B146DA}

    5

    {69931CA9-1C22-47ac-9716-1F3F7CEAE14B}

    6

    {0F2BA7E6-B1B1-4d05-AC82-10D2E9C529FF}

    7

    {92B0ED6B-4101-4710-8898-9258B0228AB9}

    8

    {AE836A61-E1B2-4702-AAC4-1D2575B14547}

    9

    {B03E9A94-38B8-4396-8375-ADD2DDD4A9A2}

  2. When you start the new instance the collector name should be passed to the Event Collection service instance through the –name parameter on the command line. The value should match the name attribute of the desired collector configuration specified in the root Web.config file.

  3. The identity of the Event Collection service instance is a member of the AS_Administrators group.

  4. Ensure that the identity of the application pool of the monitored application has Write permissions to the ETW session. This can be verified by opening the Windows performance monitor tool and checking the security settings for the ETW session started by the Event Collection service. The ACLs can be modified programmatically by using the EventAccessControl Win32 API (https://go.microsoft.com/fwlink/?LinkId=179742).

Here is an example script that creates a new Event Collection service instance.

@echo off

set NAME=MySecondEventCollectorInstance
set BINPATH=C:\Windows\System32\AppFabric\EventCollectorService.exe
set ARGS=
set DISPLAYNAME="Event Collector Instance 2"
set DESCRIPTION="An instance of Event Collection Service which is not default"
set SC_EXE=sc.exe

%SC_EXE% create %NAME% binpath= ""%BINPATH%" %ARGS% -name %NAME%" error= normal obj= LocalSystem start= auto type= share DisplayName= %DISPLAYNAME%
%SC_EXE% description %SCOPENAME% %DESCRIPTION%