I have a custom ETW provider that I use to trace into log files along with selected IIS traces. When I perform the following query using COM interop via a vbs script, it works perfectly:
SELECT Timestamp, TO_STRING(Timestamp, 'HH:mm:ss.llnn') AS TimestampStr, ProcessID, ThreadID, ProviderGUID, EventNumber, EventType, EventTypeName, ContextId, AppPoolId, RequestURL, RequestVerb, HttpStatus, BytesSent, BytesReceived, TraceType, ClientRequestId, ServerRequestId, ServerAddress, UserContext, ServerOperation, ServerOperationData, ClientOperation, AuthType, AuthUserName
FROM 'C:\MyCasLog.etl'
WHERE ProviderGUID='{67c6e8e5-b62b-4f47-a04d-ecb487d00046}' OR
(ProviderGUID='{3a2a4e84-4c21-4981-ae10-3fda0d9b0f83}' AND (EventName='IISGeneral' AND (EventTypeName='GENERAL_REQUEST_START' OR EventTypeName='GENERAL_REQUEST_END')) OR (EventName='IISAuthentication' AND EventTypeName='AUTH_SUCCEEDED'))
ORDER BY TimestampStr, EventType, TraceType
Run the exact same query inside C# and it fails to pick up the events from my custom provider. However if I change the first line of the WHERE clause to refer to the provider name instead:
WHERE ProviderDescription='Microsoft Exchange Server 2007 Client Access Performance' OR
It works perfectly. This is a complete mystery to me.