Runtime: Port System.Diagnostics.Eventing.Reader to .NET Core

[theimowski]

As already commented, I'd like to query nested event logs from Applications and Services, like Microsoft-Windows-PowerShell/Operational:

In full .NET framework one would do this using System.Diagnostics.Eventing namespace

There's also a separate project in PowerShell, which ports most of the functionality to .NET Core, but it's missing i.a. System.Diagnostics.Eventing.EventLogWatcher

From what I understand, in order to query those nested event logs running NETCOREAPP on Windows, System.Diagnostics.Eventing would need to be ported to NETSTANDARD - am I right?

Related issues:
https://github.com/dotnet/corefx/pull/24344
https://github.com/dotnet/corefx/issues/24852

[danmosemsft]

@thesourcerer

[vancem]

We actually have a first cut port of this code to .NET Core (it only took 2 hours to do), @thesourcerer is trying it out. We have to figure out various details where exactly to put it and how to test it. If you are interested in helping please let us know (Mostly it is about writing tests and validating it works for your scenarios)

[vancem]

While did a quick port of the EventLog reader, which @thesourcerer is trying out, please notice above that seems to be a more complete port that powershell has done. https://github.com/PowerShell/PowerShell/tree/master/src/Microsoft.PowerShell.CoreCLR.Eventing.

Thus we may wish to use that (and add the EventLogWatcher as requested). Mostly the value over and above the Powershell version is simply packaging it up into an 'offical' COREFX nuget package (and adding testing).

[theimowski]

I am happy to help with testing the implementation - please let me know as soon as you have the code in public.

That's right - the PowerShell team does even release a NuGet package on PS feed, but it seems it's a meta package not targeting NETSTANDARD

Here's the PR that adds the project to PowerShell, and here a PR to add PS tests for that module.

[theimowski]

FWIW I started work on adding EventLogWatcher in a fork of PowerShell repo - I'm now able to cross-compile those sources into my project and use EventLogWatcher

[vancem]

@brianrob @valenis FYI.

[vancem]

Just FYI, I have created a CoreFX project called System.Diagnostics.Eventing for this and have mostly created the CorefX build files needed for it. It does not quite build yet, but it is close.

The plan is that I will create a PR for this when I get it building. I then need the community to add some testing for it (and we will review that we like all the decisions I made about exactly how the DLL works.

[vancem]

I have created pull request dotnet/corefx#31545 that adds the reader logic to the System.Diagnostics.EventLog.dll which is ultimately part of the Microsoft.Windows.Compatability package.

If you do

git checkout -b vancem-System.Diagnostic.EventLog.Reader master
git pull https://github.com/vancem/corefx.git System.Diagnostic.EventLog.Reader

You can pull down the change yourself and help add tests to the EventLogReaderTests.cs file

[vancem]

Addressed by dotnet/corefx#33662

[theimowski]

Thanks a lot for this!