Runtime Information ETW Events
These ETW events log information about the runtime, including the SKU, version number, the manner in which the runtime was activated, the command-line parameters it was started with, the GUID (if applicable), and other relevant information. If multiple runtimes are executing within a process, the information provided by these events (the ClrInstanceID) helps disambiguate the runtimes.
The following table shows the two runtime information events. The events can be raised under any keyword or mask. (For more information, see CLR ETW Keywords and Levels.)
Event |
Event ID |
Provider |
Description |
|---|---|---|---|
RuntimeInformationEvent |
187 |
CLRRuntime |
Raised when a runtime is loaded. |
RuntimeInformationDCStart |
187 |
CLRRundown |
Enumerates the runtimes that are loaded. |
The following table shows event data.
Field name |
Data type |
Description |
|---|---|---|
ClrInstanceID |
win:UInt16 |
Unique ID for the instance of CLR or CoreCLR. |
Sku |
win:UInt16 |
1 – Desktop CLR. 2 – CoreCLR. |
BclVersion – Major Version |
win:UInt16 |
Major version of mscorlib.dll. |
BclVersion – Minor Version |
win:UInt16 |
Minor version number of mscorlib.dll. |
BclVersion – Build Number |
win:UInt16 |
Build number of mscorlib.dll. |
BclVersion – QFE |
win:UInt16 |
Hotfix version number of mscorlib.dll. |
VMVersion – Major Version |
win:UInt16 |
Version of clr.dll or coreclr.dll, depending on SKU. |
VMVersion – Minor Version |
win:UInt16 |
Minor version of clr.dll or coreclr.dll, depending on SKU. |
VMVersion – Build Number |
win:UInt16 |
Build number of clr.dll or coreclr.dll. |
VMVersion – QFE |
win:UInt16 |
Hotfix version number of clr.dll or coreclr.dll. |
StartupFlags |
win:UInt32 |
Startup flags defined in mscoree.h. |
StartupMode |
win:UInt8 |
0x01 - Managed executable. 0x02 - Hosted CLR. 0x04 - C++ managed interop. 0x08 - COM-activated. 0x10 - Other. |
CommandLine |
win:UnicodeString |
Non-null only if StartupMode=0x01. |
ComObjectGUID |
win:GUID |
Non-null only if StartupMode=0x08. |
RuntimeDLLPath |
win:UnicodeString |
Path to the CLR .dll file that was loaded into the process. |