Viewing EIF Trace Service Logs

I've talked here before about problems I've had with EIF, the Microsoft Enterprise Instrumentation Framework. At the time, I thought that the bug I was seeing manifested itself as “I'm unable to open a remote logfile written by the EIF trace service.” Well, recently I had a chance to come back to this problem at my client, and after close to a week working on the problem, I finally found out that it has nothing to do with the remoteness of the files at all. Instead, it seems that because Windows 2003 and Windows XP use a different format to write the file, what's written on one system cannot be read on another. Since our webfarm runs 2003, and our desktops run XP, we were hitting the bug.

The real bummer is that there doesn't seem to be a way around this that doesn't involve rewriting the EIF trace service. It's really a problem with the fact that (according to Maros) the EIF trace service uses the Win32 OpenTrace/ProcessTrace APIs, and these are implemented differently on the two systems. D'oh!

The sort of good news is that other sinks still work fine. So you can write events to the Windows Event Log or to WMI right out of the box no problem...just not to the high-speed trace service that they provide. And they don't give you the source to the service, either, so I can't even fix the problem myself. Sigh.