CLR ETW Keywords and Levels

CLR ETW Keywords and Levels

.NET Framework (current version)
 

Event tracing for Windows (ETW) events can be filtered by category and level. Event CLR ETW Keywords enable the filtering of events by category; they are used in combinations for the runtime and rundown providers. The event levels are identified by flags.

The keywords are flags that can be combined to generate values. In practice, you use the hexadecimal values of the keywords instead of the keyword names when you call the command-line utilities.

The keywords are described in the following tables:

The following table lists the CLR ETW runtime keywords, their values, and what they are used for.

Runtime keyword name

Value

Purpose

GCKeyword

0x00000001

Enables the collection of garbage collection events.

LoaderKeyword

0x00000008

Enables the collection of loader events.

JITKeyword

0x00000010

Enables the collection of just-in-time (JIT) events.

NGenKeyword

0x00000020

Enables the collection of events for native image methods (methods processed by the Native Image Generator, Ngen.exe); used with StartEnumerationKeyword and EndEnumerationKeyword. This keyword has high overhead. It generates events for every method inside every loaded NGen module. Whenever possible, instead of using this keyword, we recommend that you use the program databases (PDBs) generated by profiling tools to retrieve information about methods from NGen modules. See also OverrideAndSuppressNGenEventsKeyword later in this table.

StartEnumerationKeyword

0x00000040

Enables the enumeration of all the methods in the runtime; used in conjunction with NGenKeyword.

EndEnumerationKeyword

0x00000080

Enables the enumeration of all the methods destroyed in the runtime; used in conjunction with JITKeyword and NGenKeyword.

SecurityKeyword

0x00000400

Enables the collection of security events.

AppDomainResourceManagementKeyword

0x00000800

Enables the collection of resource monitoring events at an application domain level.

JITTracingKeyword

0x00001000

Enables the collection of JIT tracing events.

InteropKeyword

0x00002000

Enables the collection of interop events.

ContentionKeyword

0x00004000

Enables the collection of contention events.

ExceptionKeyword

0x00008000

Enables the collection of exception events.

ThreadingKeyword

0x00010000

Enables the collection of thread pool events.

OverrideAndSuppressNGenEventsKeyword

0x00040000

(Available in the .NET Framework 4.5 and later.) Suppresses the high-overhead NGenKeyword keyword and prevents the generation of events for methods that are inside NGen modules. Starting with the .NET Framework 4.5, profiling tools should use OverrideAndSuppressNGenEventsKeyword and NGenKeyword together to suppress the generation of events for methods in NGen modules. This enables the profiling tool to use the more efficient NGen PDBs to get information about methods in NGen modules. The CLR in the .NET Framework 4 and earlier versions does not support the creation of NGen PDBs. In these earlier versions, the CLR will not recognize OverrideAndSuppressNGenEventsKeyword and will process NGenKeyword to generate events for methods in NGen modules.

PerfTrackKeyWord

0x2000000

Enables the collection of the ModuleLoad and ModuleRange events.

StackKeyword

0x40000000

Enables the collection of CLR stack trace events.

Back to top

The following table lists the CLR ETW rundown keywords, their values, and what they are used for.

Rundown keyword name

Value

Purpose

LoaderRundownKeyword

0x00000008

Enables the collection of loader events when used with StartRundownKeyword and EndRundownKeyword.

JitRundownKeyword

0x00000010

Enables the collection of method DCStart and DCEnd events for JIT-compiled methods when used with StartRundownKeyword and EndRundownKeyword.

NGenRundownKeyword

0x00000020

Enables the collection of method DCStart and DCEnd events for NGen native image methods when used with StartRundownKeyword and EndRundownKeyword. This keyword has high overhead. It generates events for every method inside every loaded NGen module. Whenever possible, instead of using this keyword, we recommend that you use the program databases (PDBs) generated by profiling tools to retrieve information about methods from NGen modules. See also OverrideAndSuppressNGenEventsRundownKeyword later in this table.

StartRundownKeyword

0x00000040

Enables the enumeration of system state during a start rundown.

EndRundownKeyword

0x00000100

Enables the enumeration of system state during an end rundown.

AppDomainResourceManagementRundownKeyword

0x00000800

Enables the collection of events for resource monitoring at an AppDomain level when used with StartRundownKeyword or EndRundownKeyword.

ThreadingKeyword

0x00010000

Enables the collection of thread pool events.

OverrideAndSuppressNGenEventsRundownKeyword

0x00040000

(Available in the .NET Framework 4.5 and later.) Suppresses the high-overhead NGenRundownKeyword keyword and prevents the generation of events for methods that are inside NGen modules. Starting with the .NET Framework 4.5, profiling tools should use OverrideAndSuppressNGenEventsRundownKeyword and NGenRundownKeyword together to suppress the generation of events for methods in NGen modules. This enables the profiling tool to use the more efficient NGen PDBs to get information about methods in NGen modules. The CLR in the .NET Framework 4 and earlier versions does not support the creation of NGen PDBs. In these earlier versions, the CLR will not recognize OverrideAndSuppressNGenEventsRundownKeyword and will process NGenRundownKeyword to generate events for methods in NGen modules.

PerfTrackKeyWord

0x2000000

Enables the collection of the ModuleDCStart, ModuleDCEnd, ModuleRangeDCStart, and ModuleRangeDCEnd events.

Back to top

Keywords and flags

Application domain, assembly, module load/unload events

Method load/unload events (except dynamic events)

Dynamic method load/destroy events

LoaderKeyword

Load and unload events.

None.

None.

JITKeyword 

(+ StartEnumerationKeyword does not add anything)

None.

Load events.

Load and unload events.

JITKeyword +

EndEnumerationKeyword

None.

Load and unload events.

Load and unload events.

NGenKeyword

None.

None.

Not applicable.

NGenKeyword +

StartEnumerationKeyword

None.

Load events.

Not applicable.

NGenKeyword +

EndEnumerationKeyword

None.

Unload events.

Not applicable.

Back to top

Keywords and flags

Application domain, assembly, module DCStart/DCEnd events

Method DCStart/DCEnd events (including dynamic method events)

LoaderRundownKeyword +

StartRundownKeyword

DCStart events.

None.

LoaderRundownKeyword +

EndRundownKeyword

DCEnd events.

None.

JITKeyword +

StartRundownKeyword 

None.

DCStart events.

JITKeyword +

EndRundownKeyword

None.

DCEnd events.

NGenKeyword +

StartRundownKeyword

None.

DCStart events.

NGenKeyword +

EndRundownKeyword

None.

DCEnd events.

Back to top

ETW events can also be filtered by level. If the level is set at 0x5, events of all levels, including 0x5 and below (which are events that belong to categories enabled through keywords) are raised. If the level is set at 0x2, only events that belong to level 0x2 and below are raised.

The levels have the following meanings:

0x5 - Verbose

0x4 - Informational

0x3 - Warning

0x2 - Error

0x1 - Critical

0x0 - LogAlways

Show:
© 2016 Microsoft