We're in the processes of ripping out most of our logging that is based on Log4Net and implementing ETW with EventSource.
The bit we're having difficulty getting our head round is how to route logging from shared components. For example with have a bunch of NT services (ServiceA, ServiceB etc) that that have a lot of common dependency's such as AssemblyA, AssemblyB etc.
Back in the old Log4Net days we'd pass a common ILogger around and route to a log file for each service via configuration. That way an error logged by AssemblyA running in ServiceB would be logged to ServiceB's log file.
With ETW as the target of events is controlled by the attribute on the logging class, the runtime aggregation is a lot harder.
We currently bouncing back and forth with each component logging to its own event source, aggregating the data after the fact, or implementing some DI trickery to route all the events from all the components to a single event source. While the former is easier for the developers/IT staff to diagnose a problem has it's happing, the latter seems to be easier after the fact.
Our biggest stumbling block seems to be when we look at an event source in Event Viewer for an error a component logged, we don't know the process name, only it's ID and it seems impossible to build custom views in event viewer based of process name?
Any advice on handling these types of systems?