Edit

CLR ETW Keywords and Levels

  • Article

Event tracing for Windows (ETW) events can be filtered by category and level. Event CLR ETW Keywords enable the filtering of events by category; they are used in combinations for the runtime and rundown providers. The event levels are identified by flags.

CLR ETW Keywords

The keywords are flags that can be combined to generate values. In practice, you use the hexadecimal values of the keywords instead of the keyword names when you call the command-line utilities.

The keywords are described in the following tables:

CLR ETW Runtime Keywords

The following table lists the CLR ETW runtime keywords, their values, and what they are used for.

Runtime keyword name Value Purpose
GCKeyword 0x00000001 Enables the collection of garbage collection events.
LoaderKeyword 0x00000008 Enables the collection of loader events.
JITKeyword 0x00000010 Enables the collection of just-in-time (JIT) events.
NGenKeyword 0x00000020 Enables the collection of events for native image methods (methods processed by the Native Image Generator, Ngen.exe); used with StartEnumerationKeyword and EndEnumerationKeyword. This keyword has high overhead. It generates events for every method inside every loaded NGen module. Whenever possible, instead of using this keyword, we recommend that you use the program databases (PDBs) generated by profiling tools to retrieve information about methods from NGen modules. See also OverrideAndSuppressNGenEventsKeyword later in this table.
StartEnumerationKeyword 0x00000040 Enables the enumeration of all the methods in the runtime; used in conjunction with NGenKeyword.
EndEnumerationKeyword 0x00000080 Enables the enumeration of all the methods destroyed in the runtime; used in conjunction with JITKeyword and NGenKeyword.
SecurityKeyword 0x00000400 Enables the collection of security events.
AppDomainResourceManagementKeyword 0x00000800 Enables the collection of resource monitoring events at an application domain level.
JITTracingKeyword 0x00001000 Enables the collection of JIT tracing events.
InteropKeyword 0x00002000 Enables the collection of interop events.
ContentionKeyword 0x00004000 Enables the collection of contention events.
ExceptionKeyword 0x00008000 Enables the collection of exception events.
ThreadingKeyword 0x00010000 Enables the collection of thread pool events.
OverrideAndSuppressNGenEventsKeyword 0x00040000 (Available in the .NET Framework 4.5 and later.) Suppresses the high-overhead NGenKeyword keyword and prevents the generation of events for methods that are inside NGen modules. Starting with .NET Framework 4.5, profiling tools should use OverrideAndSuppressNGenEventsKeyword and NGenKeyword together to suppress the generation of events for methods in NGen modules. This enables the profiling tool to use the more efficient NGen PDBs to get information about methods in NGen modules. The CLR in the .NET Framework 4 and earlier versions does not support the creation of NGen PDBs. In these earlier versions, the CLR will not recognize OverrideAndSuppressNGenEventsKeyword and will process NGenKeyword to generate events for methods in NGen modules.
PerfTrackKeyWord 0x2000000 Enables the collection of the ModuleLoad and ModuleRange events.
StackKeyword 0x40000000 Enables the collection of CLR stack trace events.

CLR ETW Rundown Keywords

The following table lists the CLR ETW rundown keywords, their values, and what they are used for.

Rundown keyword name Value Purpose
LoaderRundownKeyword 0x00000008 Enables the collection of loader events when used with StartRundownKeyword and EndRundownKeyword.
JitRundownKeyword 0x00000010 Enables the collection of method DCStart and DCEnd events for JIT-compiled methods when used with StartRundownKeyword and EndRundownKeyword.
NGenRundownKeyword 0x00000020 Enables the collection of method DCStart and DCEnd events for NGen native image methods when used with StartRundownKeyword and EndRundownKeyword. This keyword has high overhead. It generates events for every method inside every loaded NGen module. Whenever possible, instead of using this keyword, we recommend that you use the program databases (PDBs) generated by profiling tools to retrieve information about methods from NGen modules. See also OverrideAndSuppressNGenEventsRundownKeyword later in this table.
StartRundownKeyword 0x00000040 Enables the enumeration of system state during a start rundown.
EndRundownKeyword 0x00000100 Enables the enumeration of system state during an end rundown.
AppDomainResourceManagementRundownKeyword 0x00000800 Enables the collection of events for resource monitoring at an AppDomain level when used with StartRundownKeyword or EndRundownKeyword.
ThreadingKeyword 0x00010000 Enables the collection of thread pool events.
OverrideAndSuppressNGenEventsRundownKeyword 0x00040000 (Available in the .NET Framework 4.5 and later.) Suppresses the high-overhead NGenRundownKeyword keyword and prevents the generation of events for methods that are inside NGen modules. Starting with .NET Framework 4.5, profiling tools should use OverrideAndSuppressNGenEventsRundownKeyword and NGenRundownKeyword together to suppress the generation of events for methods in NGen modules. This enables the profiling tool to use the more efficient NGen PDBs to get information about methods in NGen modules. The CLR in the .NET Framework 4 and earlier versions does not support the creation of NGen PDBs. In these earlier versions, the CLR will not recognize OverrideAndSuppressNGenEventsRundownKeyword and will process NGenRundownKeyword to generate events for methods in NGen modules.
PerfTrackKeyWord 0x2000000 Enables the collection of the ModuleDCStart, ModuleDCEnd, ModuleRangeDCStart, and ModuleRangeDCEnd events.

Keyword Combinations for Symbol Resolution for the Runtime Provider

Keywords and flags Application domain, assembly, module load/unload events Method load/unload events (except dynamic events) Dynamic method load/destroy events
LoaderKeyword Load and unload events. None. None.
JITKeyword

(+ StartEnumerationKeyword does not add anything)		 None. Load events. Load and unload events.
JITKeyword +

EndEnumerationKeyword		 None. Load and unload events. Load and unload events.
NGenKeyword None. None. Not applicable.
NGenKeyword +

StartEnumerationKeyword		 None. Load events. Not applicable.
NGenKeyword +

EndEnumerationKeyword		 None. Unload events. Not applicable.

Keyword Combinations for Symbol Resolution for the Rundown Provider

Keywords and flags Application domain, assembly, module DCStart/DCEnd events Method DCStart/DCEnd events (including dynamic method events)
LoaderRundownKeyword +

StartRundownKeyword		 DCStart events. None.
LoaderRundownKeyword +

EndRundownKeyword		 DCEnd events. None.
JITKeyword +

StartRundownKeyword		 None. DCStart events.
JITKeyword +

EndRundownKeyword		 None. DCEnd events.
NGenKeyword +

StartRundownKeyword		 None. DCStart events.
NGenKeyword +

EndRundownKeyword		 None. DCEnd events.

ETW Event Levels

ETW events can also be filtered by level. If the level is set at 0x5, events of all levels, including 0x5 and below (which are events that belong to categories enabled through keywords) are raised. If the level is set at 0x2, only events that belong to level 0x2 and below are raised.

The levels have the following meanings:

0x5 - Verbose

0x4 - Informational

0x3 - Warning

0x2 - Error

0x1 - Critical

0x0 - LogAlways

See also