Loader ETW Events

These events collect information relating to loading and unloading application domains, assemblies, and modules.

All loader events are raised under the LoaderKeyword (0x8) keyword. The DCStart and the DCEnd events are raised under LoaderRundownKeyword (0x8) with StartRundown/EndRundown enabled. (For more information, see CLR ETW Keywords and Levels.)

Loader events are subdivided into the following:

Application Domain Events

The following table shows the keyword and level.

Keyword for raising the event Event Level
LoaderKeyword (0x8) AppDomainLoad_V1 and AppDomainUnLoad_V1 Informational (4)
LoaderRundownKeyword (0x8) +

StartRundownKeyword
AppDomainDCStart_V1 Informational (4)
LoaderRundownKeyword (0x8) +

EndRundownKeyword
AppDomainDCEnd_V1 Informational (4)

The following table shows the event information.

Event Event ID Description
AppDomainLoad_V1 (logged for all application domains) 156 Raised whenever an application domain is created during the lifetime of a process.
AppDomainUnLoad_V1 157 Raised whenever an application domain is destroyed during the lifetime of a process.
AppDomainDCStart_V1 157 Enumerates the application domains during a start rundown.
AppDomainDCEnd_V1 158 Enumerates the application domains during an end rundown.

The following table shows the event data.

Field name Data type Description
AppDomainID win:UInt64 The unique identifier for an application domain.
AppDomainFlags win:UInt32 0x1: Default domain.

0x2: Executable.

0x4: Application domain, bit 28-31: Sharing policy of this domain.

0: A shared domain.
AppDomainName win:UnicodeString Friendly application domain name. Might change during the lifetime of the process.
AppDomainIndex Win:UInt32 The index of this application domain.
ClrInstanceID win:UInt16 Unique ID for the instance of CLR or CoreCLR.

Back to top

CLR Loader Assembly Events

The following table shows the keyword and level.

Keyword for raising the event Event Level
LoaderKeyword (0x8) AssemblyLoad and AssemblyUnload Informational (4)
LoaderRundownKeyword (0x8) +

StartRundownKeyword
AssemblyDCStart Informational (4)
LoaderRundownKeyword (0x8) +

EndRundownKeyword
AssemblyDCEnd Informational (4)

The following table shows the event information.

Event Event ID Description
AssemblyLoad_V1 154 Raised when an assembly is loaded.
AssemblyUnload_V1 155 Raised when an assembly is unloaded.
AssemblyDCStart_V1 155 Enumerates assemblies during a start rundown.
AssemblyDCEnd_V1 156 Enumerates assemblies during an end rundown.

The following table shows the event data.

Field name Data type Description
AssemblyID win:UInt64 Unique ID for the assembly.
AppDomainID win:UInt64 ID of the domain of this assembly.
BindingID win:UInt64 ID that uniquely identifies the assembly binding.
AssemblyFlags win:UInt32 0x1: Domain neutral assembly.

0x2: Dynamic assembly.

0x4: Assembly has a native image.

0x8: Collectible assembly.
AssemblyName win:UnicodeString Fully qualified assembly name.
ClrInstanceID win:UInt16 Unique ID for the instance of CLR or CoreCLR.

Back to top

Module Events

The following table shows the keyword and level.

Keyword for raising the event Event Level
LoaderKeyword (0x8) ModuleLoad_V2 and ModuleUnload_V2 Informational (4)
LoaderRundownKeyword (0x8) +

StartRundownKeyword
ModuleDCStart_V2 Informational (4)
LoaderRundownKeyword (0x8) +

EndRundownKeyword
ModuleDCEnd_V2 Informational (4)

The following table shows the event information.

Event Event ID Description
ModuleLoad_V2 152 Raised when a module is loaded during the lifetime of a process.
ModuleUnload_V2 153 Raised when a module is unloaded during the lifetime of a process.
ModuleDCStart_V2 153 Enumerates modules during a start rundown.
ModuleDCEnd_V2 154 Enumerates modules during an end rundown.

The following table shows the event data.

Field name Data type Description
ModuleID win:UInt64 Unique ID for the module.
AssemblyID win:UInt64 ID of the assembly in which this module resides.
ModuleFlags win:UInt32 0x1: Domain neutral module.

0x2: Module has a native image.

0x4: Dynamic module.

0x8: Manifest module.
Reserved1 win:UInt32 Reserved field.
ModuleILPath win:UnicodeString Path of the Microsoft intermediate language (MSIL) image for the module, or dynamic module name if it is a dynamic assembly (null-terminated).
ModuleNativePath win:UnicodeString Path of the module native image, if present (null-terminated).
ClrInstanceID win:UInt16 Unique ID for the instance of CLR or CoreCLR.
ManagedPdbSignature win:GUID GUID signature of the managed program database (PDB) that matches this module. (See Remarks.)
ManagedPdbAge win:UInt32 Age number written to the managed PDB that matches this module. (See Remarks.)
ManagedPdbBuildPath win:UnicodeString Path to the location where the managed PDB that matches this module was built. In some cases, this may just be a file name. (See Remarks.)
NativePdbSignature win:GUID GUID signature of the Native Image Generator (NGen) PDB that matches this module, if applicable. (See Remarks.)
NativePdbAge win:UInt32 Age number written to the NGen PDB that matches this module, if applicable. (See Remarks.)
NativePdbBuildPath win:UnicodeString Path to the location where the NGen PDB that matches this module was built, if applicable. In some cases, this may just be a file name. (See Remarks.)

Remarks

  • The fields that have "Pdb" in their names can be used by profiling tools to locate PDBs that match the modules that were loaded during the profiling session. The values of these fields correspond to the data written into the IMAGE_DIRECTORY_ENTRY_DEBUG sections of the module normally used by debuggers to help locate PDBs that match the loaded modules.

  • The field names that begin with "ManagedPdb" refer to the managed PDB corresponding to the MSIL module that was generated by the managed compiler (such as the C# or Visual Basic compiler). This PDB uses the managed PDB format, and describes how elements from the original managed source code, such as files, line numbers, and symbol names, map to MSIL elements that are compiled into the MSIL module.

  • The field names that begin with "NativePdb" refer to the NGen PDB generated by calling NGEN createPDB. This PDB uses the native PDB format, and describes how elements from the original managed source code, such as files, line numbers, and symbol names, map to native elements that are compiled into the NGen module.

Back to top

CLR Domain Module Events

The following table shows the keyword and level.

Keyword for raising the event Event Level
LoaderKeyword (0x8) DomainModuleLoad_V1 Informational (4)
LoaderRundownKeyword (0x8) +

StartRundownKeyword
DomainModuleDCStart_V1 Informational (4)
LoaderRundownKeyword (0x8) +

EndRundownKeyword
DomainModuleDCEnd_V1 Informational (4)

The following table shows the event information.

Event Event ID Description
DomainModuleLoad_V1 151 Raised when a module is loaded for an application domain.
DomainModuleDCStart_V1 151 Enumerates modules loaded for an application domain during a start rundown, and is logged for all application domains.
DomainModuleDCEnd_V1 152 Enumerates modules loaded for an application domain during an end rundown, and is logged for all application domains.

The following table shows the event data.

Field name Data type Description
ModuleID win:UInt64 Identifies the assembly to which this module belongs.
AssemblyID win:UInt64 ID of the assembly in which this module resides.
AppDomainID win:UInt64 ID of the application domain in which this module is used.
ModuleFlags win:UInt32 0x1: Domain neutral module.

0x2: Module has a native image.

0x4: Dynamic module.

0x8: Manifest module.
Reserved1 win:UInt32 Reserved field.
ModuleILPath win:UnicodeString Path of the MSIL image for the module, or dynamic module name if it is a dynamic assembly (null-terminated).
ModuleNativePath win:UnicodeString Path of the module native image, if present (null-terminated).
ClrInstanceID win:UInt16 Unique ID for the instance of CLR or CoreCLR.

Back to top

Module Range Events

The following table shows the keyword and level.

Keyword for raising the event Event Level
PerfTrackKeyWord) ModuleRange Informational (4)
PerfTrackKeyWord ModuleRangeDCStart Informational (4)
PerfTrackKeyWord ModuleRangeDCEnd Informational (4)

The following table shows the event information.

Event Event ID Description
ModuleRange 158 This event is present if a loaded Native Image Generator (NGen) image has been optimized with IBC and contains information about the hot sections of the NGen image.
ModuleRangeDCStart 160 A ModuleRange event fired at the start of a rundown.
ModuleRangeDCEnd 161 A ModuleRange event fired at the end of a rundown.

The following table shows the event data.

Field name Data type Description
ClrInstanceID win:UInt16 Uniquely identifies a specific instance of the CLR in a process if multiple instances of the CLR are loaded.
ModuleID win:UInt64 Identifies the assembly to which this module belongs.
RangeBegin win:UInt32 The offset in the module that represents the start of the range for the specified range type.
RangeSize win:UInt32 The size of the specified range in bytes.
RangeType win:UInt32 A single value, 0x4, to represent Cold IBC ranges. This field can represent more values in the future.
RangeSize1 win:UInt32 0 indicates bad data.
RangeBegin2 win:UnicodeString

Remarks

If a loaded NGen image in a .NET Framework process has been optimized with IBC, the ModuleRange event that contains the hot ranges in the NGen image is logged along with its moduleID and ClrInstanceID. If the NGen image is not optimized with IBC, this event isn't logged. To determine the module name, this event must be collated with the module load ETW events.

The payload size for this event is variable; the Count field indicates the number of range offsets contained in the event. This event has to be collated with the Windows IStart event to determine the actual ranges. The Windows Image Load event is logged whenever an image is loaded, and contains the virtual address of the loaded image.

Module range events are fired under any ETW level greater than or equal to 4 and are classified as informational events.

See Also

CLR ETW Events