Repository navigation
PowerShell ETW logging on windows needs to use a unique provider id and register the manifest. #4939
Description
Currently, PowerShell uses the same ETW provider GUID as PowerShell on Windows. This presents a few, subtle problems:
1: PowerShell 6 events cannot be easily distinguished from PowerShell/Windows.
2: PowerShell 6 is relying on a valid ETW manifest being registered to ensure events can be decoded. This assumption breaks on down-level systems that do not contain PowerShell/Windows 5.X and also ties PowerShell 6 to PowerShell/Windows events.
The solution is as follows:
1: Snapshot the PowerShell/Windows ETW manifest and update the provider GUID and Provider Name.
The Event viewer location should be moved outside the Microsoft/Windows event tree since PowerShell 6 does not ship inbox.
2: Provide a script or MSI action to register the PowerShell 6 manifest either at install time or as a post install, user step to address xcopy deploy use cases.
3: Document the updated Provider GUID, name, and any registration steps (if appropriate)consumers.
Activity
lzybkr commentedon Sep 28, 2017
It might be worth moving to EventSource instead of using ETW directly - this would be useful on Linux/Mac.
anmenaga commentedon Sep 28, 2017
What is the plan for several different PS versions installed side-by-side?
SteveL-MSFT commentedon Sep 28, 2017
I think side-by-side PSCore should be fine in the same log as long as it can be filtered. PSCore and Windows PowerShell should be completely separate
iSazonov commentedon Sep 29, 2017
EventSource Proposal
RichardSiddaway commentedon Sep 29, 2017
Would it be possible to set up a PowerShell v6 source for each version so that side by side of multiple v6 versions could be differentiated
SteveL-MSFT commentedon Sep 29, 2017
I believe the current thinking is to have PSCore6.x all in the same log, but should be easy to filter for a particular version.
iSazonov commentedon Sep 29, 2017
RichardSiddaway As Steve Lee (@SteveL-MSFT) said we can use a field to filter. The field can be PSVersion or GitCommitId.
mirichmo commentedon Oct 10, 2017
For reference: #1189. I looked into it a while ago and noted additional actions that must take place for PowerShell Core to support it.
Redirect ETW logging to Syslog on Linux (#5144)
daxian-dbw commentedon Nov 9, 2017
Dan Travison (@dantraMSFT) #5360 has been merged. Do you want to leave this issue open to track the manifest file clean up work?
dantraMSFT commentedon Nov 9, 2017
No, I'll close it and create a separate issue. I don't know when we'll do the manifest cleanup since it depends on removing full CLRcode that references it.
#5394
dantraMSFT commentedon Nov 9, 2017
Actually, this needs to remain open until the PowerShell.Core.Instrumentation nuget package is published.
Redirect ETW logging to Syslog on Linux (PowerShell#5144)