[release/7.0] Managed EventSources do not show up by default in EventPipe sessions (#75248)

[davmason]

Backport of #75248 to release/7.0

Customer Impact

This is customer reported and requires deep understanding to diagnose and understand the 'fix'.

Currently if you specify Keywords==0 on an EventPipe session, you will get no events from managed EventSources by default. This is due to the fact that managed EventSources use bits 44-47 of the keywords field to keep track of which session the event belongs to. An event from a managed EventSource will have keywords 0xF00000000000 by default, even if no keywords are set on the event.

The expected behavior is that if you have a session with no keywords specified you will see any events with no keywords specified.

Testing

Manual verification of dotnet-trace and Microsoft.Diagnostics.NETCore.Client will receive keywords as expected

Risk

We are changing the default behavior of what events are emitted, but we are changing it to match the documentation so it should be a positive change. We have had multiple people run in to this issue and not be able to figure it out on their own.

[hoyosjs]

Do we have any ES in the runtime that have no keywords and that would suddenly get noisy for customers and changes the perf of the scenarios they already measure? I see a lot of them in dotnet.dll, libs like Microsoft.AspNetCore.DeveloperCertificates.XPlat, Microsoft.AspNet.Hosting, kestrel, System.Net.Sockets, ArrayPool... In general this feels like a better approach for how to handle this (unless someone tries to reason about the source of an event with this).

[carlossanlop]

@davmason can you please send the email to Tactics requesting approval, and add the label servicing-consider?

[jeffschwMSFT]

approved. please take a look at the failing ci. we will take for consideration in 7.0.x

[davmason]

Do we have any ES in the runtime that have no keywords and that would suddenly get noisy for customers and changes the perf of the scenarios they already measure? I see a lot of them in dotnet.dll, libs like Microsoft.AspNetCore.DeveloperCertificates.XPlat, Microsoft.AspNet.Hosting, kestrel, System.Net.Sockets, ArrayPool... In general this feels like a better approach for how to handle this (unless someone tries to reason about the source of an event with this).

I don't think there are any super chatty providers with no keywords, usually if they are super chatty we put them behind keywords. This change makes the behavior match other collection mechanisms, so it shouldn't surprise anyone

[davmason]

For transparency, I just pushed new changes to check for events with all the keyword bits set. This reverts it to the original change I had made in 8.0, I thought I could simplify it but EventSource will send a message with all the keywords set when it runs in to an internal error.

[carlossanlop]

Approved by Tactics.
Signed off by area owners.
No OOB package authoring changes needed.
CI is green.
Ready to merge.