WCF tracing of ONLY failed requests?

I want to save trace information into .svclog files but only for failed requests. Is this possible? If so, how precisely?

I have a WCF service that's called hundreds of times per minute. On rare occasions clients will get an error 500 that occurs outside of the boundaries of my code running inside WCF (usually security issues). I'd like to know exactly why those errors are happening and what's causing them.

I would also really like to use the Trace Viewer tool to examine the .svclog files.

As far as I can tell, I have two options: 1) instrument FERB tracing by logging failed requests via system.webServer\tracing settings. Unfortunately, I really don't like the interface of the IE trace-viewer, nor do I get enough information from the trace-logs to figure out why an error outside of my code has occurred.

2) turn on the global tracing under system.diagnostics\trace section. This section produces great trace-logs with everything captured that I could ever want. However, I cannot find a way to only capture the information for failed requests. This section captures trace information for ALL requests. My trace logs quickly fill up!

My Errors 500 are intermittent and rare. Ultimately, I want to always have my .svclog tracing ON but only have it kick in when failed requests occur.

Please advice if this is possible?

Thank you!

Edit:

Graham, I've followed your advice and I'm not seeing the logs I expect. Here are relevant sections from the web.config:

<system.diagnostics>
    <trace>
        <listeners>
            <add type="Microsoft.WindowsAzure.Diagnostics.DiagnosticMonitorTraceListener, Microsoft.WindowsAzure.Diagnostics, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" name="AzureDiagnostics">
                <filter type="" />
            </add>
        </listeners>
    </trace>

    <sources>
        <source name="System.ServiceModel" switchValue="Error">
            <listeners>
                <add name="wcfTracing" 
                         type="System.Diagnostics.XmlWriterTraceListener" 
                         initializeData="Traces1.svclog"/>
                <add name="log4netTracing"
                         type="AzureWatch.Model.Service.Log4netTraceListener,AzureWatch.Model.Service"/>
            </listeners>
        </source>
        <source name="System.ServiceModel.MessageLogging" switchValue="Error">
            <listeners>
                <add name="wcfTracing"
                         type="System.Diagnostics.XmlWriterTraceListener"
                         initializeData="Traces2.svclog"/>
                <!--<add name="log4netTracing"
                         type="AzureWatch.Model.Service.Log4netTraceListener,AzureWatch.Model.Service"/>-->
            </listeners>
        </source>
    </sources>
    </system.diagnostics>

<!-- ... -->

        <diagnostics wmiProviderEnabled="true">

        <messageLogging 
            logEntireMessage="true" 
            logMalformedMessages="true" 
            logMessagesAtServiceLevel="true" 
            logMessagesAtTransportLevel="true"
            maxSizeOfMessageToLog="1000000"
            maxMessagesToLog="-1" />
    </diagnostics>

Here is the WCF's client error:

  <Exception>
    <Type>System.Net.Sockets.SocketException</Type>
    <Message>An existing connection was forcibly closed by the remote host</Message>
    <StackTrace>
      <Frame>at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)</Frame>
    </StackTrace>
  </Exception>

Unfortunately there is NOTHING that's logged by either of the trace-listeners. Failed Request log contains this:

-GENERAL_READ_ENTITY_END 
    BytesReceived 0 
    ErrorCode 2147943395 
    ErrorCode The I/O operation has been aborted because of either a thread exit or an application request. (0x800703e3) 
     Warning
-MODULE_SET_RESPONSE_ERROR_STATUS 
    ModuleName ManagedPipelineHandler 
    Notification 128 
    HttpStatus 400 
    HttpReason Bad Request 
    HttpSubStatus 0 
    ErrorCode 0 
    ConfigExceptionInfo  
    Notification EXECUTE_REQUEST_HANDLER 
    ErrorCode The operation completed successfully. (0x0) 
    0 msInformational

回答1:

I've tried putting in the following config for my WCF service, and hit the service with valid and invalid credentials. Only the requests with invalid credentials caused anything to appear in the service trace file. My service uses a custom UserNamePasswordValidator class, and this was present in the stack trace. The important parts are the switchValue="Error" and propagateActivity="false" in the <source> element. Not sure if this is exactly what you want, but it at least seems close...

<system.diagnostics>
  <sources>
    <source name="System.ServiceModel" switchValue="Error" 
            propagateActivity="false">
      <listeners>
        <add type="System.Diagnostics.DefaultTraceListener" name="Default">
          <filter type="" />
        </add>
        <add name="ServiceModelTraceListener">
          <filter type="" />
        </add>
      </listeners>
    </source>
  </sources>
  <sharedListeners>
    <add initializeData="C:\Path-to-log-file\Web_tracelog.svclog" 
         type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" 
         name="ServiceModelTraceListener" 
         traceOutputOptions="DateTime, Timestamp, Callstack">
      <filter type="" />
    </add>
  </sharedListeners>
  <trace autoflush="true" />
</system.diagnostics>

回答2:

Alternatively it's possible to specify EventTypeFilter as listener's filter

  <listeners>
    <add name="console" 
      type="System.Diagnostics.ConsoleTraceListener" >
      <filter type="System.Diagnostics.EventTypeFilter" 
        initializeData="Error" />
    </add>
  </listeners>