Event Collection Service
You can use the monitoring features in AppFabric to collect instrumentation events and store them into a monitoring database. To assist in this process, AppFabric provides a Windows service called the Event Collection service. The Event Collection service takes events from an Event Tracing for Windows (ETW) session and writes them to a monitoring database. Emitting and collecting data can be expensive, but enhancements made in the .NET Framework 4 to use ETW use fewer resources than alternatives such as System.Diagnostics.
An instance of the Event Collection service runs on every computer that hosts the WF and WCF services you want to monitor. Multiple event collector instances can run on a single server. AppFabric limits the number of simultaneous event collector instances to 10.
Features and Capabilities
The Event Collection service consumes WCF analytic tracing events and WF tracking events emitted by an EtwTrackingParticipant to an ETW session. For more information, see EtwTrackingParticipant Class (https://go.microsoft.com/fwlink/?LinkId=168423).
Core Functionality
The following features are central to Event Collection service functionality:
Subscribe to events from multiple WCF and WF applications.
Route events from an application to a specific monitoring database.
Support multiple monitoring databases and route events for different providers to different monitoring databases.
Security and Privacy
The Event Collection service builds on existing Windows, IIS, and WF and WCF security in the following ways:
Users can isolate events by using multiple ETW sessions and multiple monitoring database connections.
Object-based security (ACLs) is used to secure configuration and to control reading and writing to ETW sessions.
Role-based security (see SQL Server Security) controls reading and writing to the monitoring database.