I'm currently working on a (C++) application that is trying to feed on system wide events through Windows` event log.
I am using the EvtSubscribe API which is described very nicely by MSDN.
Everything works fine and I successfully receive notifications for any event that occurs.
What bothers me is that I stumbled upon a web reference that describes an event type I never saw beforehand: 'Activity Tracing'.
All the other (Critical, Error, Information, etc.) event types are acquired using the EvtRender API and EvtSystemLevel/EvtSystemKeywords getters.
Google searches were full of false positives, since the keywords 'Activity' and 'Tracing' are reused for multiple applications and infrastructures.
My best lead came from a reference we found, written by a user of a different event logging collection framework:
Microsoft use it to troubleshoot aplications.
Negotiation/SCT exchange. This can happen at the transport later (through binary data exchange) or message layer (through SOAP message exchanges). Message encryption/decryption, with signature verification and authentication. Traces appear in the ambient activity, typically "Process Action."
Authorization and verification. This can happen locally or when communicating between endpoints.
Using Tracing to Troubleshoot Your Application http://msdn.microsoft.com/en-us/library/aa738639.aspx
Activity Tracing in Message Security http://msdn.microsoft.com/en-us/library/aa738609.aspx
When I tried to examine these links I saw that this tracing mechanism allows troubleshooting of WCF applications.
But, since I'm no expert of WCF to say the least, I don't want to spend days on setting up a .NET environment and brute forcing sample WCF applications to enables this feature and trigger such event logs.
Could anyone recommend a quick way of generating such an Event Log?