Edit

Event Logging in WCF

  • Article

Windows Communication Foundation (WCF) traces internal events in the Windows event log.

Viewing Event Logs

Event logging is enabled automatically by default, and there is no mechanism to disable it. Events logged by WCF can be viewed using the Event Viewer. To launch this tool, click Start, click Control Panel, double-click Administrative Tools, and then double-click Event Viewer.

Application Event Log

The Application Event Log contains most of the events generated by WCF. Most of the entries indicate that a particular feature failed to start up for an application. Examples include:

  • Message Logging/tracing: WCF writes an event to the event log when trace and message logging fails. However, not every trace failure triggers an event. To prevent the event log from being completely filled with traces failures, WCF implements a 10 minute blackout period for such an event. This means that if WCF writes a trace failure to the event log, it will not do so again for at least 10 minutes.

  • Shared Listener: The WCF TCP Port Sharing Service logs an event when it fails to start.

  • CardSpace: Logs events when the service fails to start.

  • Critical and error events, such as startup failures or crashes

  • Message logging turned on: Logs events when message logging is turned on. This is to notify the administrator that sensitive, application-specific information may be logged in message headers and bodies.

  • An event is logged when the enableLoggingKnownPII attribute in the machineSettings element of the machine.config file is set. This attribute specifies if any application running on the machine is permitted to log known personally identifiable information (PII).

  • If the logKnownPii attribute in either the app.config or web.config file is set to true for a specific application to turn on PII logging, but the enableLoggingKnownPII attribute in the machineSettings element of the machine.config file is set to false, an event is logged. In addition, if both logKnownPii and enableLoggingKnownPII are set to true, and event is logged. For more information on these configuration settings, see the Security section of the Configuring Message Logging topic.

Security Event Log

The Security Event Log contains security audit events that are logged by WCF.

System Event Log

WCF does not log anything in the System Event Log.

Event Log Entries

The source of an event is the name of the assembly that generates the log entry.

The type of an event log entry is used to indicate the severity of an event. Each event must be of a single type, which the application indicates when it reports the event. The Event Viewer uses this type to determine which icon to display in the list view of the log. For the different event type of an event log entry, see EventLogEntryType.

When you click "more information" when viewing an event in the Event Viewer, the Event Viewer may send information across the Internet. For more information, see the Event Viewer help.

See also