Capturing Filtered Windows Events with Windows Azure Diagnostics

If you download the source code for my Hosted Web Core Worker Role, you’ll see a few lines of code which configure Windows Azure Diagnostics to capture Windows Events generated by Hosted Web Core:

var cfg = DiagnosticMonitor.GetDefaultInitialConfiguration();
// HWC uses the event log to indicate what's broken.
// This config setting is really handy when debugging bad config.
cfg.WindowsEventLog.DataSources.Add("Application!*[System[Provider[@Name='HostableWebCore']]]");
diagnosticMonitor = DiagnosticMonitor.Start("DiagnosticsConnectionString", cfg);

When you add a Windows Event log data source, you get to specify an XPath selection criterion for the events you want to log. The Windows Azure Diagnostics documentation gives a simple example and then links to Consuming Events for more details. In neither place could I find examples like what I wanted (listening to events from a particular provider).

I was able to figure out what to put in that string by creating a custom view in the Windows Event Viewer on my laptop and then switching to the XML view to see the XPath:

It wasn’t hard from there to derive the right syntax to pass to WindowsEventLog.DataSource.Add.