how do you distinguish ETW events from plugin events in Application Insights

Sniko Imper 1 Reputation point
2020-09-11T21:16:33.33+00:00

Just to be clear I am explaining the terminology first.
ETW stands for event tracing facility and is activated for IIS by these registry lines

MicrosoftAppInsights_ManagedHttpModulePath=C:\Program Files\WindowsPowerShell\Modules\Az.ApplicationMonitor\1.1.0\content\Runtime\Microsoft.ApplicationInsights.RedfieldIISModule.dll
MicrosoftAppInsights_ManagedHttpModuleType=Microsoft.ApplicationInsights.RedfieldIISModule.RedfieldIISModule

On the other hand, the Application Insights plugin is a native library (a profiler) written in C/C++ which is loaded by the .NET runtime on start and is responsible for instrumenting select methods in certain assemblies. In AI it is used to collect mostly SQL commands AFAIK.

QUESTION - How can I tell whether an event that is stored either locally on the windows box, or remotely on azure, originated from ETW or the plugin?
This question is deceptively simple, yet I have had too much difficulty arriving at an answer.
I've spent several days looking into it, opened support cases, emailed 3 MSFT engineers, still nothing.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,802 questions
Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,129 questions
{count} votes