Enterprise Instrumentation Framework

[John Lee]

Hi, All,

I have an issue really need help on, Thanks in advance!!!

OS: windows xp
..NET framework v1.1
Enterprise Instrumentation Framework installed

I did the following customization in the event schema project:

Modified the CommonEvent class:

1. added property String ContextKey
2. added property MyExtraInfo ExtraInfo

The MyExtraInfo class:

using System;
using System.Collections.Specialized;
using System.Runtime.Serialization ;
using Microsoft.EnterpriseInstrumentation.Schema;

[Serializable]
[InstrumentationType]
public class MyExtraInfo : ISerializable
{
private NameValueCollection data;
public CLCExtraInfo()
{
data = new NameValueCollection();
}
public CLCExtraInfo(SerializationInfo info,StreamingContext context)
{
data = new NameValueCollection();
System.Runtime.Serialization.SerializationInfoEnum erator enumerator
= info.GetEnumerator();
while (enumerator.MoveNext())
{
data.Add(enumerator.Current.Name,
enumerator.Current.Value.ToString());
}
}
public void Add(string keyName, string keyValue)
{
data.Add(keyName, keyValue);
}
void ISerializable.GetObjectData(SerializationInfo info,
StreamingContext context)
{
if (data.Count == 0) return;
foreach (string key in data.AllKeys)
{
info.AddValue(key, data[key]);
}
}
}

When I raise event with ContextKey and ExtraInfo (added bunch of name-value
pairs) set, from the eventlog, I see the ContextKey has been serialized
correctly
but the ExtraInfo which is a type I defined, serialized as

MyExtraInfo ExtraInfo = {}

which means nothing insidem, Could anyone point out what could be the
problem?

Thanks very much!

John

[Jeffrey Tan[MSFT]]

Hi John,

I think you should debug into your application to find if GetObjectData was
called.
For more information about how to do runtime serialization in .Net, Jeffrey
Richter's article is a good resource:
http://msdn.microsoft.com/msdnmag/issues/02/04/net/
http://msdn.microsoft.com/msdnmag/issues/02/07/net/
http://msdn.microsoft.com/msdnmag/issues/02/09/net/

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[John Lee]

Hi, Jeffrey,

Thanks for your response. I did a test with MyExtraInfo class it the
GetObjectData did get called and it works fine in a test project.
Then I put a EventLog.Write() inside the GetObjectData for the CommonEvent
class that I added a property ExtraInfo as MyExtraInfo, there is no event
log entry was written so could you please tell me what serialize formatter
or method the LogSink use to serialize event schema class to windows Event
Log?

Could we have the source code for LogSink, WMISink and TraceSink as we do
for the Event Schema? then I can figure it out how the event schema gets
serialized.

Thanks again!

John

""Jeffrey Tan[MSFT]"" <v-*****@online.microsoft.com> wrote in message
news:jH**************@cpmsftngxa07.phx.gbl...

Hi John,

I think you should debug into your application to find if GetObjectData was called.
For more information about how to do runtime serialization in .Net, Jeffrey Richter's article is a good resource:
http://msdn.microsoft.com/msdnmag/issues/02/04/net/
http://msdn.microsoft.com/msdnmag/issues/02/07/net/
http://msdn.microsoft.com/msdnmag/issues/02/09/net/

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi John,

Based on my understanding, you have explicitly serialized the MyExtraInfo
class instance, it works fine, but if you tried to serialize CommonEvent
class object which expose MyExtraInfo as a property, the MyExtraInfo field
is not serialized.
I think you should implement ISerializable interface for CommonEvent class,
and in ISerializable.GetObjectData method, add MyExtraInfo field into the
SerializationInfo parameter, then the .Net Framework will invoke your
MyExtraInfo's serialization operation.
In your MyExtraInfo class's implementation, it is strange that 2 overloaded
constructor's name is not MyExtraInfo, but CLCExtraInfo?
Also, what does your MyExtraInfo.Add's usage?

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[John Lee]

Hi, Jeffrey,

Thanks for your information. But I think that might not the issue, because I
tested with the following scenerio:

I created another class TestClass marked as [Serializable] that contains a
public property as type MyExtraInfo, and I use Soap|binary formatter to
serialize the TestClass and the MyExtraInfo's GetObjectData did get called
and it works as I expected.

If a class use any type that implement ISerializable would need to implement
ISerializable then that would be a nightmare!

I guess by some reason, the EIF did not use Binaryformatter or SoapFormatter
to serialize the CommonEvent class - Could you please help us to get the
source code of the logsink to figure out why the customized serialization
method is not called.

Thanks very much!

John

""Jeffrey Tan[MSFT]"" <v-*****@online.microsoft.com> wrote in message
news:3r*************@cpmsftngxa07.phx.gbl...

Hi John,

Based on my understanding, you have explicitly serialized the MyExtraInfo
class instance, it works fine, but if you tried to serialize CommonEvent
class object which expose MyExtraInfo as a property, the MyExtraInfo field
is not serialized.
I think you should implement ISerializable interface for CommonEvent class, and in ISerializable.GetObjectData method, add MyExtraInfo field into the
SerializationInfo parameter, then the .Net Framework will invoke your
MyExtraInfo's serialization operation.
In your MyExtraInfo class's implementation, it is strange that 2 overloaded constructor's name is not MyExtraInfo, but CLCExtraInfo?
Also, what does your MyExtraInfo.Add's usage?

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi John,

In Jeffrey Richter's article part 3, he teaches us how to serialize a class
which did not implement Serialization:
http://msdn.microsoft.com/msdnmag/issues/02/09/net/
Acutally, he uses ISerializationSurrogate to help serialize the class. For
private field, use Reflection to refer to them.

For source code, if the downloaded EIF install file did not contain souce
code, it means that there is no public source code for it.

Thanks for your understanding.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi John,

I will help you to find if there is any public source code of EIF.
I will reply you ASAP.
Thanks for your understanding,

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

[Jeffrey Tan[MSFT]]

Hi John,

Sorry for letting you wait for so long time.
I have confirmed that there is no public source code for EIF. For your
problem, does my workaround make sence?
If it still did not resolve your problem, please feel free to tell me.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.