spaghettidba/xesmarttarget

A configurable target for SQL Server Extended Events. Write to a table or perform custom actions with no effort.

XESmartTarget

XESmartTarget is the simplest way to write Extended Events data to a database table. But wait: there's more! XESmartTarget is the easiest way to process events without writing a single line of code!

XESmartTarget is a command line tool to help you working with SQL Server Extended Events. It offers the ability to perform custom actions in response to Events, in a way that is not possible by using the built-in targets.

While you are free to extend XESmartTarget with your own Response types, XESmartTarget does not require any coding. Instead, it can be configured with simple .json configuration files.

For instance, the following configuration file instructs XESmartTarget to connect to the server (local), hook to the Extended Events session test_session and forward all the events of type sql_batch_completed to a Response of type TableAppenderResponse, which will insert all events every 10 seconds into a table named test_session_data in the server (local), Database XESmartTargetTest, only the columns specified, only the rows with duration > 10000 microseconds.
It will also replay the sql_batch_completed events to the instance (local)\SQL2014 using the ReplayResponse Response type.

{
    "Target": {
        "ServerName": "(local)",
        "SessionName": "test_session",
        "Responses": [
            {
                //  JSON config files can contain comments
                "__type": "TableAppenderResponse",
                "ServerName": "(local)",
                "DatabaseName": "XESmartTargetTest",
                "TableName": "test_session_data",
                "AutoCreateTargetTable": true,
                "UploadIntervalSeconds": 10,
                "Events": [
                    "sql_batch_completed"
                ],
                "OutputColumns": [
                    "cpu_time", 
                    "duration", 
                    "physical_reads", 
                    "logical_reads", 
                    "writes", 
                    "row_count", 
                    "batch_text"
                ],
                "Filter": "duration > 10000"
            },
            {
                "__type": "ReplayResponse",
                "ServerName": "(local)\\SQL2014",
                "DatabaseName": "XESmartTargetTest",
                "Events": [
                    "sql_batch_completed"
                ],
                "StopOnError" : false
            }
        ]
    }
}

A complete description of all the setting you can control in the .JSON input file can be found in the Documentation.

Here is the output it produces:

And here is the output it produces in the database:

For the moment, the following Response types are available:

• CsvAppenderResponse
• EmailResponse
• ExecuteTSQLResponse
• ReplayResponse
• TableAppenderResponse

New Response types are in the works, such as GroupedTableAppenderResponse (groups data before writing to a table). Suggestions for new Response Types are more than welcome.

Check out the Documentation for more information.

XelToCsv

XESmartTarget also includes a command line tool to convert .XEL files to .CSV.

Usage is very simple. Here's an example:

XelToCsv.exe -s c:\temp\events.xel -d c:\temp\events.csv

It's a Library!

XESmartTarget is a .dll that you can use in your project. Not sure how to use it? No problem, look at Program.cs in the XESmartTarget project. It's super easy.

xesmarttarget's Issues

Allow loading configuration from URL

Aggregated column cannot have the same name as the underlying column in GroupedTableAppenderResponse

If I take the example from the documentation and name the aggregate and underlying column same name

"MIN(collection_time AS collection_time"

Full json

{
    "Target": {
        "ServerName": "MyServer",
        "SessionName": "loginaudit",
        "FailOnProcessingError": false,
        "Responses": [
            {
                "__type": "GroupedTableAppenderResponse",
                "ServerName": "MyServer",
                "DatabaseName": "xedemo",
                "TableName": "loginaudit",
                "AutoCreateTargetTable": true,
                "UploadIntervalSeconds": 10,
                "Events": [
                    "login"
                ],
                "OutputColumns": [
                    "database_name",
                    "MIN(collection_time) AS collection_time"
                ]
            }
        ]
    }
}

It will show an error

Error - XESmartTarget.Core.Responses.TableAppenderResponse : Error uploading to the target table
Error - XESmartTarget.Core.Responses.TableAppenderResponse : System.NullReferenceException: Object reference not set to an instance of an object.
at XESmartTarget.Core.Responses.GroupedTableAppenderResponse.Upload()
at XESmartTarget.Core.Responses.TableAppenderResponse.UploadTaskMain()

Might be worth mentioning that in the documentation. It took me a while to find the problem.

Add Timeout to let XESmartTarget stop gracefully after it expires

nuget package

Hello! Would love a nuget package for XESmartTarget on nuget.org

merci 🍝

TableAppenderResponse does not work with synonyms

Running XESmartTarget Continuously for 24/7 Monitoring

Hi,

I am new to using XESmartTarget and have gone through its documentation. From my understanding, in order to use XESmartTarget effectively, I need to run the executable continuously. Is that correct? If so, is there a built-in way to run it as a service? What is the recommended approach to ensure it runs 24/7 for monitoring a production SQL Server instance?

In the demos I've seen, the XESmartTarget executable is run in a command line. However, I am concerned that if the RDP session gets disconnected or logged off by someone, the program will exit, causing the monitoring to stop. I need a solution that ensures XESmartTarget runs continuously without being interrupted.

Any suggestions or best practices for achieving this would be greatly appreciated. Thank you in advance!

Error on XESmartTarget ExecuteTSQLResponse

Hi Gianluca,
the error appear using XESmartTarget ExecuteTSQLResponse
Error SmartTarget.docx
I did the test to send records to the windows event log, and each time an event is triggered in the session they are multiplied in the windows event log, that is, if an event appears in the session it creates an event in the windows log, if a second event appears in the session 2 appear in the windows log, if a 3 event appears in the session in the windows log 3 appear, could you please review the reason for this error, if necessary I could pay you something for the help. thank you

New-DbaXESmartTableWriter not writing to table

I have been messing around with New-DbaXESmartTableWriter lately and noticed sometimes it works perfectly as expected and other times it will not write to the table at all. I have been trying different variations of the command I am running in powershell and have found the results to be very inconsistent of whether or not it will actually create/write to a table. Are there any troubleshooting steps I can take to see where the process is failing?

#Create session
Get-DbaXESessionTemplate | Out-GridView -PassThru | Import-DbaXESessionTemplate -SqlInstance myServer

#Start session
Start-DbaXESession -SqlInstance myServer -Session 'Failing Queries'

#Define table create
$response = New-DbaXESmartTableWriter -SqlInstance myServer -Database myDatabase -Table myTable -AutoCreateTargetTable

#Start Writing to table
Start-DbaXESmartTarget -SqlInstance myServer -Session 'Failing Queries' -Responder $response

Edit: When I run Get-DbaXESmartTarget I keep getting "WARNING: [09:04:38][Get-DbaXESmartTarget] Failure | Not enough memory resources are available to complete this operation". However, there is zero memory pressure that I am seeing.

Feature request - Add aggregate "LAST" to GroupedTableAppenderResponse

My use case is that I want to capture a change in plans on readable secondaries. Currently, Query Store doesn't work there (otherwise, I would use it).

I would use one of the several XE events to capture the actual query plan (for example query_plan_profile

and group the same plans by query_plan_hash_signed action.
Since I already detect differences in a plan via the query_plan_hash_signed, I don't need to compare the actual XML file (not even sure XML comparison is permitted) and just want to save its last value.

Can't get XESmartReplay to work

My assumption would be that if I run the following code:

$response = New-DbaXESmartReplay -SqlInstance sql2016 -Database planning
Start-DbaXESmartTarget -SqlInstance sql2017 -Session 'Profiler Standard' -Responder $response

And a create table is captured on sql2017, then that table should be created on sql2016 in the planning database. I went a step further and created a planning db on sql2017 and that still didn't work either.

I also tried to get more specific

Start-DbaXESmartTarget -SqlInstance sql2017 -Session 'Profiler Standard' -Responder $response -Database planning

btw, you can add -NotAsJob to the above commands to see what it's doing live instead of it shuffling it off as a powershell job. I'm curious as to what the output looks like, but I haven't gotten it to work yet.

Thanks,

Error: Object reference not set to an instance of an object.

Latest Version

Config

{
    "Target": {
        "ServerName": "<SQLInstance>",
        "SessionName": "DDL Events in test_lk",
        "Responses": [
            {
                "__type": "TableAppenderResponse",
                "ServerName": "<SQLInstance>",
                "DatabaseName": "test_data_base",
                "TableName": "ddlAuditEvents",
                "AutoCreateTargetTable": true,
                "UploadIntervalSeconds": 10,
                "Events": [
                    "object_altered",
                    "object_created",
                    "object_deleted"
                ],
                "OutputColumns": [
                    "timestamp",
                    "username",
                    "object_name",
                    "name",
                    "ddl_phase"
                ]
            }
        ]
    }
}

Error:

Info - XESmartTarget.Core.Responses.TableAppenderResponse : Creating target table UK-SQL01.test_uk_octopus.ddlAuditEvent
s
Error - XESmartTarget.Core.Target : System.NullReferenceException: Object reference not set to an instance of an object.

   at XESmartTarget.Core.Utils.DataTableTSQLAdapter.GetCreateFromDataTableSQL() in C:\GitHub\XESmartTarget\XESmartTarget.Core\Utils\DataTableTSQLAdapter.cs:line 214
   at XESmartTarget.Core.Utils.DataTableTSQLAdapter.CreateFromDataTable() in C:\GitHub\XESmartTarget\XESmartTarget.Core\Utils\DataTableTSQLAdapter.cs:line 132
   at XESmartTarget.Core.Responses.TableAppenderResponse.CreateTargetTable(DataTable data) in C:\GitHub\XESmartTarget\XESmartTarget.Core\Responses\TableAppenderResponse.cs:line 220
   at XESmartTarget.Core.Responses.TableAppenderResponse.StartUploadTask() in C:\GitHub\XESmartTarget\XESmartTarget.Core\Responses\TableAppenderResponse.cs:line 145
   at XESmartTarget.Core.Responses.TableAppenderResponse.Enqueue(PublishedEvent evt) in C:\GitHub\XESmartTarget\XESmartTarget.Core\Responses\TableAppenderResponse.cs:line 133
   at XESmartTarget.Core.Target.Start() in C:\GitHub\XESmartTarget\XESmartTarget.Core\Target.cs:line 94

Table is not created.

Does it work with SSAS?

I have an Analysis Services session running in SQL 2019 and I can view the live data. When I attempt to run XESmartTarget with a TableAppenderResponse I get this error:

Error - XESmartTarget.Core.Target : System.InvalidOperationException: Unable to connect to the Extended Events session Cube_Actions on server FLJX1VMTBI03 ---> System.Data.SqlClient.SqlException: The Extended Events session named "Cube_Actions" could not be found. Make sure the session exists and is started.

Is XESmartTarget looking for the session on the database engine? Can I tell it to look in Analysis Services?

Add command line parameter to load a .sql file and create the session

Using an optional command line parameter, XESmartTarget should be able to create its own session.

Missing column in the TableAppenderResponse created table

I'm playing with XESmartTarget and found that it is not able to create the batch_text column. The following is my event session code.

CREATE EVENT SESSION test_session
ON SERVER
    ADD EVENT sqlserver.rpc_completed
    (ACTION (
         package0.collect_system_time,
         package0.event_sequence,
         sqlserver.client_app_name,
         sqlserver.client_connection_id,
         sqlserver.client_hostname,
         sqlserver.database_name,
         sqlserver.plan_handle,
         sqlserver.query_hash_signed,
         sqlserver.query_plan_hash_signed,
         sqlserver.request_id,
         sqlserver.server_principal_name,
         sqlserver.session_id,
         sqlserver.sql_text,
         sqlserver.transaction_id,
         sqlserver.transaction_sequence
     )
     WHERE (
         sqlserver.like_i_sql_unicode_string(statement, N'%%')
         OR sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'%%')
     )
    ),
    ADD EVENT sqlserver.sp_statement_completed
    (SET collect_object_name = (1)
     ACTION (
         package0.collect_system_time,
         package0.event_sequence,
         sqlserver.client_app_name,
         sqlserver.client_connection_id,
         sqlserver.client_hostname,
         sqlserver.database_name,
         sqlserver.plan_handle,
         sqlserver.query_hash_signed,
         sqlserver.query_plan_hash_signed,
         sqlserver.request_id,
         sqlserver.server_principal_name,
         sqlserver.session_id,
         sqlserver.sql_text,
         sqlserver.transaction_id,
         sqlserver.transaction_sequence
     )
     WHERE (
         sqlserver.like_i_sql_unicode_string(statement, N'%%')
         OR sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'%%')
     )
    ),
    ADD EVENT sqlserver.sql_batch_completed
    (SET collect_batch_text=(1)
	ACTION (
         package0.collect_system_time,
         package0.event_sequence,
         sqlserver.client_app_name,
         sqlserver.client_connection_id,
         sqlserver.client_hostname,
         sqlserver.database_name,
         sqlserver.plan_handle,
         sqlserver.query_hash_signed,
         sqlserver.query_plan_hash_signed,
         sqlserver.request_id,
         sqlserver.server_principal_name,
         sqlserver.session_id,
         sqlserver.sql_text,
         sqlserver.transaction_id,
         sqlserver.transaction_sequence
     )
     WHERE (
         sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'%%')
         OR sqlserver.like_i_sql_unicode_string(batch_text, N'%%')
     )
    ),
    ADD EVENT sqlserver.sql_statement_completed
    (ACTION (
         package0.collect_system_time,
         package0.event_sequence,
         sqlserver.client_app_name,
         sqlserver.client_connection_id,
         sqlserver.client_hostname,
         sqlserver.database_name,
         sqlserver.plan_handle,
         sqlserver.query_hash_signed,
         sqlserver.query_plan_hash_signed,
         sqlserver.request_id,
         sqlserver.server_principal_name,
         sqlserver.session_id,
         sqlserver.sql_text,
         sqlserver.transaction_id,
         sqlserver.transaction_sequence
     )
     WHERE (
         sqlserver.like_i_sql_unicode_string(statement, N'%%')
         OR sqlserver.like_i_sql_unicode_string(sqlserver.sql_text, N'%%')
     )
    )
    ADD TARGET package0.event_file
    (SET filename = N'f:\test\test_session.xel', max_file_size = (64), max_rollover_files = (10))
WITH (
    MAX_MEMORY = 4096KB,
    EVENT_RETENTION_MODE = ALLOW_SINGLE_EVENT_LOSS,
    MAX_DISPATCH_LATENCY = 30 SECONDS,
    MAX_EVENT_SIZE = 0KB,
    MEMORY_PARTITION_MODE = NONE,
    TRACK_CAUSALITY = ON,
    STARTUP_STATE = OFF
);
GO

This is my XESmartTarget config file.

{
    "Target": {
        "ServerName": ".",
        "SessionName": "test_session",
        "UserName": "",
        "Password": "",
        "FailOnProcessingError": false,
        "Responses": [
            {
                "__type": "TableAppenderResponse",
                "ServerName": "(local)",
                "DatabaseName": "pubs",
                "TableName": "test_session_data",
                "AutoCreateTargetTable": true,
                "UploadIntervalSeconds": 10,
                "UserName": "",
                "Password": "",
                "OutputColumns": [
                    "name",
                    "event_sequence",
                    "collect_system_time",
                    "duration",
                    "cpu_time",
                    "logical_reads",
                    "session_id",
                    "request_id",
                    "sql_text",
                    "batch_text",
                    "statement",
                    "transaction_id",
                    "transaction_sequence",
                    "plan_handle",
                    "query_hash_signed",
                    "query_plan_hash_signed",
                    "object_name",
                    "database_name",
                    "client_app_name",
                    "client_hostname",
                    "server_principal_name",
                    "client_connection_id"
                ]
            }
        ]
    }
}

As you can see, I have batch_text column listed under OutputColumns. I also confirmed that the SSMS live data can show the batch_text column, which is from the sql_batch_completed event.

When I run XESmartTarget, it created a table like this:

USE [pubs]
GO

/****** Object:  Table [dbo].[test_session_data]    Script Date: 7/19/2023 3:49:53 AM ******/
SET ANSI_NULLS ON
GO

SET QUOTED_IDENTIFIER ON
GO

CREATE TABLE [dbo].[test_session_data](
	[name] [nvarchar](max) NULL,
	[duration] [bigint] NULL,
	[cpu_time] [decimal](20, 0) NULL,
	[logical_reads] [decimal](20, 0) NULL,
	[statement] [nvarchar](max) NULL,
	[transaction_sequence] [decimal](20, 0) NULL,
	[transaction_id] [bigint] NULL,
	[sql_text] [nvarchar](max) NULL,
	[session_id] [int] NULL,
	[server_principal_name] [nvarchar](max) NULL,
	[request_id] [bigint] NULL,
	[query_plan_hash_signed] [bigint] NULL,
	[query_hash_signed] [bigint] NULL,
	[plan_handle] [varbinary](max) NULL,
	[database_name] [nvarchar](max) NULL,
	[client_hostname] [nvarchar](max) NULL,
	[client_connection_id] [uniqueidentifier] NULL,
	[client_app_name] [nvarchar](max) NULL,
	[event_sequence] [decimal](20, 0) NULL,
	[collect_system_time] [datetimeoffset](7) NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
GO

Why there is no batch_text column in the table? Thanks.

Setup: QMonitor Agent is copied to a separate folder

The service should point to it

XESmartTarget.Core.Utils.XELFileCSVAdapter does not export all events

XESmartTarget library is missing to export seemingly random number of events.

The issue was initially discovered by incorrect / missing End of Line in the exported CSV. All the exported CSVs have had size around 25 MB, which makes me think there might be some internal size limitation.

Details were reported here:
dataplat/dbatools#8726

Allow having multiple targets in the same config but still support old style config

Column 'X' does not belong to underlying table 'events'

I have a peculiar problem. I'm tracking an event and collecting the sql_text global field/action.
But when the event has column is_system = true then sql_text is not collected at all (the schema shape has changed)

Service Broker activation is considered a system process even though it's arguably a user process.

I propose that the XESmartTarget return a NULL when the column is not found instead of the error. The SSMS XE viewer acts the same.

I've also tried to split the collection into two responses - one where is_system = 'False' collects the sql_text and the other one which doesn't. My filter snippet looks like this:

"Filter": "query_hash_signed <> 0 OR is_system = 'True'"

Then I've got an error:

Error - XESmartTarget.Core.Target : servername
Error - XESmartTarget.Core.Target : Cannot find column [is_system].
Error - XESmartTarget.Core.Target : at System.Data.NameNode.Bind(DataTable table, List1 list) at System.Data.BinaryNode.Bind(DataTable table, List1 list)
at System.Data.DataExpression.Bind(DataTable table)
at System.Data.DataView.set_RowFilter(String value)
at XESmartTarget.Core.Utils.XEventDataTableAdapter.ReadEvent(PublishedEvent evt) in C:\github\XESmartTarget\XESmartTarget.Core\Utils\XEventDataTableAdapter.cs:line 242
at XESmartTarget.Core.Responses.TableAppenderResponse.Enqueue(PublishedEvent evt) in C:\github\XESmartTarget\XESmartTarget.Core\Responses\TableAppenderResponse.cs:line 130
at XESmartTarget.Core.Target.TargetWorker.Process() in C:\github\XESmartTarget\XESmartTarget.Core\Target.cs:line 158

This is weird because the column is definitely there.
The column is recognized when I set up a different XE with a different JSON.

Create target for grouping data before writing to a database table

Add a mechanism to reconnect the session when error/disconnection is found

Reconnect XESmartTarget to the session when the server is disconnected / unavailable.
Control the behavior with a parameter in the configuration file. Keep current behavior (quit with error) as default.

ConfigWizard: does not display service user name in the servers page

Should be updated if changed in the services tab

GroupedTableAppenderResponse Error with strings that contain special characters.

When using the GroupedTableAppenderResponse with a column that contains ' characaters causes the grouping to fail. Repro below.

Issue seems to be related to the content in the "message" column, the GroupedTableAppenderResponse works fine when that column is removed from the list.

Event Session

CREATE EVENT SESSION FailedLogins
ON SERVER
    ADD EVENT sqlserver.error_reported
    (ACTION
     (
         sqlserver.client_app_name,
         sqlserver.client_hostname,
         sqlserver.database_name,
         sqlserver.nt_username
     )
     WHERE severity = 14
           AND error_number = 18456
           AND state > 1
    );
GO

ALTER EVENT SESSION FailedLogins ON SERVER STATE = START;
GO

XESmartTarget config JSON

{
    "Target": {
        "ServerName": "<ServerName>",
        "SessionName": "FailedLogins",
        "Responses": [
            {
                "__type": "TableAppenderResponse",
                "ServerName": "<ServerName>",
                "DatabaseName": "XeAnalysis",
                "TableName": "FailedLoginData",
                "AutoCreateTargetTable": true,
                "UploadIntervalSeconds": 10,
                "Events": [
                    "error_reported"
                ],
                "OutputColumns": [
                    "client_hostname",
                    "client_app_name",
                    "database_name",
                    "category",
                    "error_number",
                    "nt_username",
                    "message"
                ]
            },
            {
                "__type": "GroupedTableAppenderResponse",
                "ServerName": "<ServerName>",
                "DatabaseName": "XeAnalysis",
                "TableName": "GroupedFailedLoginData",
                "AutoCreateTargetTable": true,
                "UploadIntervalSeconds": 10,
                "Events": [
                    "error_reported"
                ],
                "OutputColumns": [
                    "client_hostname",
                    "client_app_name",
                    "database_name",
                    "category",
                    "error_number",
                    "nt_username",
                    "message",
                    "MIN(collection_time) AS firstseen",
                    "MAX(collection_time) AS lastseen",
                    "COUNT(collection_time) AS EventCount"
                ]
            }
        ]
    }
}

Example of data row is attached

Results.txt

Error output is attached

CommandOutput.txt

Add collection time bucket to GroupedTableAppenderResponse

I'd like to trend aggregated data for insights over time.

Example:

XE definition

create event session wait_info on server
add event sqlos.wait_info
(
    where opcode = 'end'
)

json config (simplified)

{
    "Target": {
        "ServerName": "server",
        "SessionName": "wait_info ",
        "FailOnProcessingError": false,
        "Responses": [
            {
                "__type": "GroupedTableAppenderResponse",
                "ServerName": "localhost",
                "DatabaseName": "XeSmartTarget",
                "TableName": "WaitInfoHistogram",
                "AutoCreateTargetTable": true,
                "UploadIntervalSeconds": 10,
                "Events": [
                    "wait_info"
                ],
                "OutputColumns": [
                    "database_id",
                    "MAX(collection_time) AS max_collection_time", 
                    "SUM(duration) AS sum_duration_ms"
                ]
            }
        ]
    }
}

Current

It will group by database_id sum duration of waits. For each collection it will then merge with what's in the table so I get total waits per DB since the collection started (similar to how SQL Server tracks wait stats since last restart)

Ideal

Introduce a date bucket syntax for the collection_time column
For example:

• DATE_BUCKET syntax from SQL Server 2022
• bin() from Kusto
• C# equivalent (first search result - https://stackoverflow.com/a/8856405/4609186)

So instead of collection_time , I'd have something like bin(collection_time, 5m) and have the aggregates in 5-minute intervals.

Error during start: Could not load file or assembly 'Microsoft.SqlServer.XEvent.Linq.dll' or one of its dependencies.

Please help how to fix this error:
MSSQL 2019, Win server 2016 or 2019

D:\XEVENTS>sp_trace.bat

D:\XEVENTS>"C:\Program Files\XESmartTarget\xesmarttarget.exe" --File d:\xevents\sp_trace.json --GlobalVariables ServerName=sqlnonerp4
XESmartTarget 1.5.1
Copyright c 2018 spaghettidba - spaghettidba

Info - XESmartTarget.Program : Reading configuration from 'd:\xevents\sp_trace.json'
Info - XESmartTarget.Core.Responses.TableAppenderResponse : Initializing Response of Type 'XESmartTarget.Core.Responses.TableAppenderResponse'
Info - XESmartTarget.Program : Starting Target
Error - XESmartTarget.Core.Target : System.AggregateException: One or more errors occurred. ---> System.IO.FileNotFoundException: 
Could not load file or assembly 
'Microsoft.SqlServer.XEvent.Linq.dll' or one of its dependencies. 
The specified module could not be found.
   at XESmartTarget.Core.Target.TargetWorker.Process()
   at System.Threading.Tasks.Task.Execute()
   --- End of inner exception stack trace ---
   at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
   at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
   at XESmartTarget.Core.Target.Start() in C:\github\XESmartTarget\XESmartTarget.Core\Target.cs:line 64
---> (Inner Exception #0) System.IO.FileNotFoundException: Could not load file or assembly 'Microsoft.SqlServer.XEvent.Linq.dll' or one of its dependencies. 
The specified module could not be found.
File name: 'Microsoft.SqlServer.XEvent.Linq.dll'
   at XESmartTarget.Core.Target.TargetWorker.Process()
   at System.Threading.Tasks.Task.Execute()

XelToCsv won't launch 1.4.9

Revision: I used gacutil /i and pushed both versions into the GAC. I had to pull down 1.9.71.2 from Nuget - at least I think I had to pull it down - didn't see that rev DLL in the download. It worked after that. I copied the XelToCsv EXE out of the folder and also had to push NLog into the GAC for it to work outside the install folder. Not sure if any of this is unexpected. Great tools - will put them to good use.

In 1.4.9, the XelToCsv doesn't run:
C:\Program Files\XESmartTarget>XelToCsv.exe

Unhandled Exception: System.IO.FileLoadException: Could not load file or assembly 'CommandLine, Version=1.9.71.2, Culture=neutral, PublicKeyToken=de6f01bd326f8c32' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)
at XelToCsv.Program.Main(String[] args)

XESmartTarget is using version 2.8.0 of the CommandLine package. I think it is causing GAC issues with the mismatch??

The "Events" list is case-sensitive, where insensitive would be preferred

GelfTcpResponse not inserting "short_message" or "message" (as seen from Graylog GELF receiver machine)

Hi,

I'm puzzled that sending to the Gelf appender doesn't seem to produce the required short_message or message fields, at least with the latest build (1.4.7). "host", "version" and "timestamp" are passed, though (a tcpdump trace on the receiver/graylog-GELF listener is shown)

Is this a known issue? From

XESmartTarget/XESmartTarget.Core/Responses/GelfTcpResponse.cs

Line 97 in c698355

// populate short_message column

it seems "impossible" an empty "short_message" ?

Regards,

--

root@stg-iljapp-0005:~# tcpdump -i ens192 -s 16384 -A   ip and dst port 12207

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens192, link-type EN10MB (Ethernet), capture size 16384 bytes
20:15:05.906205 IP 192.168.203.12.12812 > stg-iljapp-0005.12207: Flags [S], seq 2364957333, win 64240, options [mss 1380,nop,wscale 8,nop,nop,sackOK], length 0
[email protected].....
.r.2./[email protected]........
20:15:05.936176 IP 192.168.203.12.12812 > stg-iljapp-0005.12207: Flags [.], ack 1509824531, win 1024, length 0
E..([email protected])....
.r.2./...b.Y...P.............
20:15:05.936258 IP 192.168.203.12.12812 > stg-iljapp-0005.12207: Flags [F.], seq 519, ack 1, win 1024, length 0
E..([email protected]'....
.r.2./...d.Y...P.............
20:15:05.936728 IP 192.168.203.12.12812 > stg-iljapp-0005.12207: Flags [P.], seq 0:519, ack 1, win 1024, length 519
E../[email protected]!....
.r.2./...b.Y...P...N...{"collection_time":"2022-06-30T20:15:02.9460546","name":"rpc_completed","cpu_time":172000,"duration":164066,"physical_reads":0,"logical_reads":76055,"writes":4,"result":"OK","row_count":2,"connection_reset_option":"None","object_name":"svp_siv_peticiones_mod_pro","statement":"exec [dbo].[svp_siv_peticiones_mod_pro] ","data_stream":"","output_parameters":"","client_hostname":"VMCOMPILANET","database_name":"iTareas","session_id":51,"transaction_id":0,"host":"PCALVARO","version":"1.1","timestamp":1656612902.9460545}.
20:15:05.961409 IP 192.168.203.12.12812 > stg-iljapp-0005.12207: Flags [.], ack 2, win 1024, length 0
E..([email protected]$....
.r.2./...d.Y...P.............

Setup: upgrade should delete all local config files

Local files should be deleted or logging.conf should be in a separate folder