Sergey # Blog

Few thoughts about the current.

Tx... Network!

Recently we have released the new library from Tx (LINQ to Logs and Traces) family that targets the networking - Tx.Network. That is the place we are going to publish all parsers/readers/listeners for networking protocols and packet captures files.

In the initial release we have included readers of pcap and pcapng formats, which are very popular among network engineers. Many popular tools like Wireshark uses PcapNG as a default format for storing of packet captures.

See how that easy to query those:

1
PcapNg.ReadForward(@"c:\git\tx\traces\snmp.pcapng").Take(5)

If you are interested - read that documentation how you could use Tx.Network library for reading network captures of UDP or SNMP datagrams.

Welcome to Binary-in-ETW!

One of the most questionable features of ETW, an excellent tracing mechanism, is mixing of serialization with channel itself. This is why we built Binary-in-ETW library that has been released as part of Tx (LINQ to Logs and Traces). Now you can use JSON or Bond’s Compact Binary serializations methods or any another ones that could serialize to byte array like Avro, ProtoBuf, BJSON, etc.

Diagnostic of ApplicationInsights SDK

This blog post was written by Anastasia Baranchenkova.

Currently, Application Insights SDK is in public beta stage, so you cannot expect it to be absolutely stable. Application Insights uses ETW to log its own verbose traces. If you lost any hope to understand why you do not see anything in the portal you may want to get that traces. Often Application Insights developement team would want to take a look at its internal traces in order to diagnose the specific behavior.

LINQ to Application Insights Traces

Application Insights has 7 days retention policy. You can run quite complicated queries using Metric and Search explorers but if you need to analyze historical data you need to use Continuous Export feature. You can read more about setting up Continuous Exports here.

Now what data is stored in Azure Blob Storage you can would want to query it. Tx (LINQ to Logs and Traces) library allows you to run Language Integrated Query (LINQ) directly on raw event sources: ad-hoc query on past history in trace and log files and standing queries on real-time feeds, such as Event Tracing for Windows (ETW) sessions. In the LINQPad experience of Tx is as if all the events were in a database, except, no database is involved - the query happens directly on raw logs/traces. And now Tx supports Application Insights data format.