{"id":777,"date":"2007-08-16T19:20:00","date_gmt":"2007-08-16T19:20:00","guid":{"rendered":"\/blogs\/bobb\/post\/Making-the-XEvent-ETW-target-run.aspx"},"modified":"2014-01-19T19:16:10","modified_gmt":"2014-01-20T03:16:10","slug":"making-the-xevent-etw-target-run","status":"publish","type":"post","link":"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/","title":{"rendered":"Making the XEvent ETW target run"},"content":{"rendered":"<p>\nWhen starting out with XEvent support, I thought it would be good to start with the ETW target, although you can capture and catagorize events in buckets with the async bucketizer target, and pair related events (like obtain lock\/release lock) with the pair matching target. Both&nbsp;VERY cool. But I just wanted a raw, vanilla trace, to start out. And I wrote <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/Aa964124.aspx\">a paper on ADO.NET and ETW<\/a> once. So easy one first, I thought&#8230;\n<\/p>\n<p>\nIt turns out that you need privileges to start an ETW session. The ETW session is started for you (rather than you using the logman utility and starting it yourself) when you issue an ALTER EVENT SESSION&#8230;STATE=START. But mine never started. It always produced:\n<\/p>\n<p>\nMsg 25602, Level 17, State 17, Line 1<br \/>\nThe target, &quot;CE79811F-1A80-40E1-8F5D-7445A3F375E7.package0.etw_classic_sync_target&quot;, encountered a configuration error during initialization.&nbsp; Object cannot be added to the event session.\n<\/p>\n<p>\nBTW, the guid before the name of the package is the package module id. You don&#39;t have to use it in CREATE EVENT SESSION&#8230;ADD TARGET&#8230;\n<\/p>\n<p>\nThe reason for this (for those of you that aren&#39;t reading <a href=\"http:\/\/social.msdn.microsoft.com\/forums\/en-US\/category\/sqlserver\/\">the Katmai forums<\/a>) is that the SQL Server service account is used to activate the ETW session. In order for this to work, the service account must be a member of the groups &quot;Performance Monitor Users&quot; and &quot;Performance Log Users&quot;. Mine wasn&#39;t a member of &quot;Performance Log Users&quot;. Make it a member of the group and this target &quot;works a treat&quot;, as my UK friends would say. I&#39;m tracing events to ETW as I write this. THANKS to Jerome Halmans for this information, its not yet in BOL that I could find.\n<\/p>\n<p>\nI&#39;ve always installed SQL Server (since 2005) by creating a simple account that&#39;s a member of only the USERS group in Windows machine\/domain. During install SQL Server gives this account all the privs (and only the privs) it needs. Mostly it does this by creating a group SQLServerMSSQLUser[machine][instance]. But it also makes the user you specify (I call it SQLService) members of groups (like &quot;Performance Monitor Users&quot;) when it requires group membership. It&#39;s a good idea to pick a service account this way for principal of least privilege, rather than running SQL Server as something else, like Admin or LocalSystem. See the <a href=\"http:\/\/download.microsoft.com\/download\/8\/5\/e\/85eea4fa-b3bb-4426-97d0-7f7151b2011c\/SQL2005SecBestPract.doc\">security best practices whitepaper<\/a> for details.\n<\/p>\n<p>\nIt&#39;s an interesting observation that not all the privs you need are tied to that single group, created at installation. That&#39;s (one of a few&nbsp;reasons) why its always best to use SQL Server Configuration Manager to change the service account rather than the &quot;Services&quot; control panel applet.\n<\/p>\n<p>\nI don&#39;t know if they&#39;re going to add &quot;Performance Log Users&quot; to the list of things that the installer does. If they don&#39;t add it automatically, don&#39;t forget to add it yourself for this feature (that is:&nbsp;ETW target in SQL Server XEvent). And don&#39;t forget to point the ETL file to a directory that the service account has permission to write to.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When starting out with XEvent support, I thought it would be good to start with the ETW target, although you can capture and catagorize events in buckets with the async bucketizer target, and pair related events (like obtain lock\/release lock) with the pair matching target. Both&nbsp;VERY cool. But I just wanted a raw, vanilla trace, [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,29],"tags":[],"class_list":["post-777","post","type-post","status-publish","format-standard","hentry","category-extended-events","category-sql-server-2008"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.9.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Making the XEvent ETW target run - Bob Beauchemin<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Making the XEvent ETW target run - Bob Beauchemin\" \/>\n<meta property=\"og:description\" content=\"When starting out with XEvent support, I thought it would be good to start with the ETW target, although you can capture and catagorize events in buckets with the async bucketizer target, and pair related events (like obtain lock\/release lock) with the pair matching target. Both&nbsp;VERY cool. But I just wanted a raw, vanilla trace, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/\" \/>\n<meta property=\"og:site_name\" content=\"Bob Beauchemin\" \/>\n<meta property=\"article:published_time\" content=\"2007-08-16T19:20:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-01-20T03:16:10+00:00\" \/>\n<meta name=\"author\" content=\"Bob Beauchemin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Bob Beauchemin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/\",\"url\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/\",\"name\":\"Making the XEvent ETW target run - Bob Beauchemin\",\"isPartOf\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/#website\"},\"datePublished\":\"2007-08-16T19:20:00+00:00\",\"dateModified\":\"2014-01-20T03:16:10+00:00\",\"author\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/#\/schema\/person\/62bfa986c5b5d28fcffd8b4fc409c73e\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Extended Events\",\"item\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/category\/extended-events\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Making the XEvent ETW target run\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/#website\",\"url\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/\",\"name\":\"Bob Beauchemin\",\"description\":\"SQL Server Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/#\/schema\/person\/62bfa986c5b5d28fcffd8b4fc409c73e\",\"name\":\"Bob Beauchemin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6f80e6cc667410857fa6a21931dc528b8092f4d112bf7a8ff7c267674d44ee37?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6f80e6cc667410857fa6a21931dc528b8092f4d112bf7a8ff7c267674d44ee37?s=96&d=mm&r=g\",\"caption\":\"Bob Beauchemin\"},\"sameAs\":[\"http:\/www.sqlskills.com\/blogs\/bobb\/\"],\"url\":\"https:\/\/www.sqlskills.com\/blogs\/bobb\/author\/bobb\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Making the XEvent ETW target run - Bob Beauchemin","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/","og_locale":"en_US","og_type":"article","og_title":"Making the XEvent ETW target run - Bob Beauchemin","og_description":"When starting out with XEvent support, I thought it would be good to start with the ETW target, although you can capture and catagorize events in buckets with the async bucketizer target, and pair related events (like obtain lock\/release lock) with the pair matching target. Both&nbsp;VERY cool. But I just wanted a raw, vanilla trace, [&hellip;]","og_url":"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/","og_site_name":"Bob Beauchemin","article_published_time":"2007-08-16T19:20:00+00:00","article_modified_time":"2014-01-20T03:16:10+00:00","author":"Bob Beauchemin","twitter_misc":{"Written by":"Bob Beauchemin","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/","url":"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/","name":"Making the XEvent ETW target run - Bob Beauchemin","isPartOf":{"@id":"https:\/\/www.sqlskills.com\/blogs\/bobb\/#website"},"datePublished":"2007-08-16T19:20:00+00:00","dateModified":"2014-01-20T03:16:10+00:00","author":{"@id":"https:\/\/www.sqlskills.com\/blogs\/bobb\/#\/schema\/person\/62bfa986c5b5d28fcffd8b4fc409c73e"},"breadcrumb":{"@id":"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.sqlskills.com\/blogs\/bobb\/making-the-xevent-etw-target-run\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.sqlskills.com\/blogs\/bobb\/"},{"@type":"ListItem","position":2,"name":"Extended Events","item":"https:\/\/www.sqlskills.com\/blogs\/bobb\/category\/extended-events\/"},{"@type":"ListItem","position":3,"name":"Making the XEvent ETW target run"}]},{"@type":"WebSite","@id":"https:\/\/www.sqlskills.com\/blogs\/bobb\/#website","url":"https:\/\/www.sqlskills.com\/blogs\/bobb\/","name":"Bob Beauchemin","description":"SQL Server Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.sqlskills.com\/blogs\/bobb\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.sqlskills.com\/blogs\/bobb\/#\/schema\/person\/62bfa986c5b5d28fcffd8b4fc409c73e","name":"Bob Beauchemin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.sqlskills.com\/blogs\/bobb\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6f80e6cc667410857fa6a21931dc528b8092f4d112bf7a8ff7c267674d44ee37?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6f80e6cc667410857fa6a21931dc528b8092f4d112bf7a8ff7c267674d44ee37?s=96&d=mm&r=g","caption":"Bob Beauchemin"},"sameAs":["http:\/www.sqlskills.com\/blogs\/bobb\/"],"url":"https:\/\/www.sqlskills.com\/blogs\/bobb\/author\/bobb\/"}]}},"_links":{"self":[{"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/posts\/777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/comments?post=777"}],"version-history":[{"count":0,"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/posts\/777\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/media?parent=777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/categories?post=777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/bobb\/wp-json\/wp\/v2\/tags?post=777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}