Loader ETW Events

.NET Framework (current version)
 

These events collect information relating to loading and unloading application domains, assemblies, and modules.

All loader events are raised under the LoaderKeyword (0x8) keyword. The DCStart and the DCEnd events are raised under LoaderRundownKeyword (0x8) with StartRundown/EndRundown enabled. (For more information, see CLR ETW Keywords and Levels.)

Loader events are subdivided into the following:

The following table shows the keyword and level.

Keyword for raising the eventEventLevel
LoaderKeyword (0x8)AppDomainLoad_V1 and AppDomainUnLoad_V1Informational (4)
LoaderRundownKeyword (0x8) +

 StartRundownKeyword
AppDomainDCStart_V1Informational (4)
LoaderRundownKeyword (0x8) +

 EndRundownKeyword
AppDomainDCEnd_V1Informational (4)

The following table shows the event information.

EventEvent IDDescription
AppDomainLoad_V1 (logged for all application domains)156Raised whenever an application domain is created during the lifetime of a process.
AppDomainUnLoad_V1157Raised whenever an application domain is destroyed during the lifetime of a process.
AppDomainDCStart_V1157Enumerates the application domains during a start rundown.
AppDomainDCEnd_V1158Enumerates the application domains during an end rundown.

The following table shows the event data.

Field nameData typeDescription
AppDomainIDwin:UInt64The unique identifier for an application domain.
AppDomainFlagswin:UInt320x1: Default domain.

0x2: Executable.

0x4: Application domain, bit 28-31: Sharing policy of this domain.

0: A shared domain.
AppDomainNamewin:UnicodeStringFriendly application domain name. Might change during the lifetime of the process.
AppDomainIndexWin:UInt32The index of this application domain.
ClrInstanceIDwin:UInt16Unique ID for the instance of CLR or CoreCLR.

Back to top

The following table shows the keyword and level.

Keyword for raising the eventEventLevel
LoaderKeyword (0x8)AssemblyLoad and AssemblyUnloadInformational (4)
LoaderRundownKeyword (0x8) +

 StartRundownKeyword
AssemblyDCStartInformational (4)
LoaderRundownKeyword (0x8) +

 EndRundownKeyword
AssemblyDCEndInformational (4)

The following table shows the event information.

EventEvent IDDescription
AssemblyLoad_V1154Raised when an assembly is loaded.
AssemblyUnload_V1155Raised when an assembly is unloaded.
AssemblyDCStart_V1155Enumerates assemblies during a start rundown.
AssemblyDCEnd_V1156Enumerates assemblies during an end rundown.

The following table shows the event data.

Field nameData typeDescription
AssemblyIDwin:UInt64Unique ID for the assembly.
AppDomainIDwin:UInt64ID of the domain of this assembly.
BindingIDwin:UInt64ID that uniquely identifies the assembly binding.
AssemblyFlagswin:UInt320x1: Domain neutral assembly.

0x2: Dynamic assembly.

0x4: Assembly has a native image.

0x8: Collectible assembly.
AssemblyNamewin:UnicodeStringFully qualified assembly name.
ClrInstanceIDwin:UInt16Unique ID for the instance of CLR or CoreCLR.

Back to top

The following table shows the keyword and level.

Keyword for raising the eventEventLevel
LoaderKeyword (0x8)ModuleLoad_V2 and ModuleUnload_V2Informational (4)
LoaderRundownKeyword (0x8) +

 StartRundownKeyword
ModuleDCStart_V2Informational (4)
LoaderRundownKeyword (0x8) +

 EndRundownKeyword
ModuleDCEnd_V2Informational (4)

The following table shows the event information.

EventEvent IDDescription
ModuleLoad_V2152Raised when a module is loaded during the lifetime of a process.
ModuleUnload_V2153Raised when a module is unloaded during the lifetime of a process.
ModuleDCStart_V2153Enumerates modules during a start rundown.
ModuleDCEnd_V2154Enumerates modules during an end rundown.

The following table shows the event data.

Field nameData typeDescription
ModuleIDwin:UInt64Unique ID for the module.
AssemblyIDwin:UInt64ID of the assembly in which this module resides.
ModuleFlagswin:UInt320x1: Domain neutral module.

0x2: Module has a native image.

0x4: Dynamic module.

0x8: Manifest module.
Reserved1win:UInt32Reserved field.
ModuleILPathwin:UnicodeStringPath of the Microsoft intermediate language (MSIL) image for the module, or dynamic module name if it is a dynamic assembly (null-terminated).
ModuleNativePathwin:UnicodeStringPath of the module native image, if present (null-terminated).
ClrInstanceIDwin:UInt16Unique ID for the instance of CLR or CoreCLR.
ManagedPdbSignaturewin:GUIDGUID signature of the managed program database (PDB) that matches this module. (See Remarks.)
ManagedPdbAgewin:UInt32Age number written to the managed PDB that matches this module. (See Remarks.)
ManagedPdbBuildPathwin:UnicodeStringPath to the location where the managed PDB that matches this module was built. In some cases, this may just be a file name. (See Remarks.)
NativePdbSignaturewin:GUIDGUID signature of the Native Image Generator (NGen) PDB that matches this module, if applicable. (See Remarks.)
NativePdbAgewin:UInt32Age number written to the NGen PDB that matches this module, if applicable. (See Remarks.)
NativePdbBuildPathwin:UnicodeStringPath to the location where the NGen PDB that matches this module was built, if applicable. In some cases, this may just be a file name. (See Remarks.)

Remarks

  • The fields that have "Pdb" in their names can be used by profiling tools to locate PDBs that match the modules that were loaded during the profiling session. The values of these fields correspond to the data written into the IMAGE_DIRECTORY_ENTRY_DEBUG sections of the module normally used by debuggers to help locate PDBs that match the loaded modules.

  • The field names that begin with "ManagedPdb" refer to the managed PDB corresponding to the MSIL module that was generated by the managed compiler (such as the C# or Visual Basic compiler). This PDB uses the managed PDB format, and describes how elements from the original managed source code, such as files, line numbers, and symbol names, map to MSIL elements that are compiled into the MSIL module.

  • The field names that begin with "NativePdb" refer to the NGen PDB generated by calling NGEN createPDB. This PDB uses the native PDB format, and describes how elements from the original managed source code, such as files, line numbers, and symbol names, map to native elements that are compiled into the NGen module.

Back to top

The following table shows the keyword and level.

Keyword for raising the eventEventLevel
LoaderKeyword (0x8)DomainModuleLoad_V1Informational (4)
LoaderRundownKeyword (0x8) +

 StartRundownKeyword
DomainModuleDCStart_V1Informational (4)
LoaderRundownKeyword (0x8) +

 EndRundownKeyword
DomainModuleDCEnd_V1Informational (4)

The following table shows the event information.

EventEvent IDDescription
DomainModuleLoad_V1151Raised when a module is loaded for an application domain.
DomainModuleDCStart_V1151Enumerates modules loaded for an application domain during a start rundown, and is logged for all application domains.
DomainModuleDCEnd_V1152Enumerates modules loaded for an application domain during an end rundown, and is logged for all application domains.

The following table shows the event data.

Field nameData typeDescription
ModuleIDwin:UInt64Identifies the assembly to which this module belongs.
AssemblyIDwin:UInt64ID of the assembly in which this module resides.
AppDomainIDwin:UInt64ID of the application domain in which this module is used.
ModuleFlagswin:UInt320x1: Domain neutral module.

0x2: Module has a native image.

0x4: Dynamic module.

0x8: Manifest module.
Reserved1win:UInt32Reserved field.
ModuleILPathwin:UnicodeStringPath of the MSIL image for the module, or dynamic module name if it is a dynamic assembly (null-terminated).
ModuleNativePathwin:UnicodeStringPath of the module native image, if present (null-terminated).
ClrInstanceIDwin:UInt16Unique ID for the instance of CLR or CoreCLR.

Back to top

The following table shows the keyword and level.

Keyword for raising the eventEventLevel
PerfTrackKeyWord)ModuleRangeInformational (4)
PerfTrackKeyWordModuleRangeDCStartInformational (4)
PerfTrackKeyWordModuleRangeDCEndInformational (4)

The following table shows the event information.

EventEvent IDDescription
ModuleRange158This event is present if a loaded Native Image Generator (NGen) image has been optimized with IBC and contains information about the hot sections of the NGen image.
ModuleRangeDCStart160A ModuleRange event fired at the start of a rundown.
ModuleRangeDCEnd161A ModuleRange event fired at the end of a rundown.

The following table shows the event data.

Field nameData typeDescription
ClrInstanceIDwin:UInt16Uniquely identifies a specific instance of the CLR in a process if multiple instances of the CLR are loaded.
ModuleIDwin:UInt64Identifies the assembly to which this module belongs.
RangeBeginwin:UInt32The offset in the module that represents the start of the range for the specified range type.
RangeSizewin:UInt32The size of the specified range in bytes.
RangeTypewin:UInt32A single value, 0x4, to represent Cold IBC ranges. This field can represent more values in the future.
RangeSize1win:UInt320 indicates bad data.
RangeBegin2win:UnicodeString

Remarks

If a loaded NGen image in a .NET Framework process has been optimized with IBC, the ModuleRange event that contains the hot ranges in the NGen image is logged along with its moduleID and ClrInstanceID. If the NGen image is not optimized with IBC, this event isn't logged. To determine the module name, this event must be collated with the module load ETW events.

The payload size for this event is variable; the Count field indicates the number of range offsets contained in the event. This event has to be collated with the Windows IStart event to determine the actual ranges. The Windows Image Load event is logged whenever an image is loaded, and contains the virtual address of the loaded image.

Module range events are fired under any ETW level greater than or equal to 4 and are classified as informational events.

CLR ETW Events

Show: