Loader ETW Events
These events collect information relating to loading and unloading application domains, assemblies, and modules.
All loader events are raised under the LoaderKeyword (0x8) keyword. The DCStart and the DCEnd events are raised under LoaderRundownKeyword (0x8) with StartRundown/EndRundown enabled. (For more information, see CLR ETW Keywords and Levels.)
Loader events are subdivided into the following:
Application Domain Events
CLR Loader Assembly Events
Module Events
CLR Domain Module Events
Application Domain Events
The following table shows the keyword and level.
Keyword for raising the event |
Event |
Level |
|---|---|---|
LoaderKeyword (0x8) |
AppDomainLoad_V1 and AppDomainUnLoad_V1 |
Informational (4) |
LoaderRundownKeyword (0x8) + StartRundownKeyword |
AppDomainDCStart_V1 |
Informational (4) |
LoaderRundownKeyword (0x8) + EndRundownKeyword |
AppDomainDCEnd_V1 |
Informational (4) |
The following table shows the event information.
Event |
Event ID |
Description |
|---|---|---|
AppDomainLoad_V1 (logged for all application domains) |
156 |
Raised whenever an application domain is created during the lifetime of a process. |
AppDomainUnLoad_V1 |
157 |
Raised whenever an application domain is destroyed during the lifetime of a process. |
AppDomainDCStart_V1 |
157 |
Enumerates the application domains during a start rundown. |
AppDomainDCEnd_V1 |
158 |
Enumerates the application domains during an end rundown. |
The following table shows the event data.
Field name |
Data type |
Description |
|---|---|---|
AppDomainID |
win:UInt64 |
The unique identifier for an application domain. |
AppDomainFlags |
win:UInt32 |
0x1: Default domain. 0x2: Executable. 0x4: Application domain, bit 28-31: Sharing policy of this domain. 0: A shared domain. |
AppDomainName |
win:UnicodeString |
Friendly application domain name. Might change during the lifetime of the process. |
AppDomainIndex |
Win:UInt32 |
The index of this application domain. |
ClrInstanceID |
win:UInt16 |
Unique ID for the instance of CLR or CoreCLR. |
Back to top
CLR Loader Assembly Events
The following table shows the keyword and level.
Keyword for raising the event |
Event |
Level |
|---|---|---|
LoaderKeyword (0x8) |
AssemblyLoad and AssemblyUnload |
Informational (4) |
LoaderRundownKeyword (0x8) + StartRundownKeyword |
AssemblyDCStart |
Informational (4) |
LoaderRundownKeyword (0x8) + EndRundownKeyword |
AssemblyDCEnd |
Informational (4) |
The following table shows the event information.
Event |
Event ID |
Description |
|---|---|---|
AssemblyLoad_V1 |
154 |
Raised when an assembly is loaded. |
AssemblyUnload_V1 |
155 |
Raised when an assembly is unloaded. |
AssemblyDCStart_V1 |
155 |
Enumerates assemblies during a start rundown. |
AssemblyDCEnd_V1 |
156 |
Enumerates assemblies during an end rundown. |
The following table shows the event data.
Field name |
Data type |
Description |
|---|---|---|
AssemblyID |
win:UInt64 |
Unique ID for the assembly. |
AppDomainID |
win:UInt64 |
ID of the domain of this assembly. |
BindingID |
win:UInt64 |
ID that uniquely identifies the assembly binding. |
AssemblyFlags |
win:UInt32 |
0x1: Domain neutral assembly. 0x2: Dynamic assembly. 0x4: Assembly has a native image. 0x8: Collectible assembly. |
AssemblyName |
win:UnicodeString |
Fully qualified assembly name. |
ClrInstanceID |
win:UInt16 |
Unique ID for the instance of CLR or CoreCLR. |
Back to top
Module Events
The following table shows the keyword and level.
Keyword for raising the event |
Event |
Level |
|---|---|---|
LoaderKeyword (0x8) |
ModuleLoad_V1 and ModuleUnload_V1 |
Informational (4) |
LoaderRundownKeyword (0x8) + StartRundownKeyword |
ModuleDCStart_V1 |
Informational (4) |
LoaderRundownKeyword (0x8) + EndRundownKeyword |
ModuleDCEnd_V1 |
Informational (4) |
The following table shows the event information.
Event |
Event ID |
Description |
|---|---|---|
ModuleLoad_V1 |
152 |
Raised when a module is loaded during the lifetime of a process. |
ModuleUnload_V1 |
153 |
Raised when a module is unloaded during the lifetime of a process. |
ModuleDCStart_V1 |
153 |
Enumerates modules during a start rundown. |
ModuleDCEnd_V1 |
154 |
Enumerates modules during an end rundown. |
The following table shows the event data.
Field name |
Data type |
Description |
|---|---|---|
ModuleID |
win:UInt64 |
Unique ID for the module. |
AssemblyID |
win:UInt64 |
ID of the assembly in which this module resides. |
ModuleFlags |
win:UInt32 |
0x1: Domain neutral module. 0x2: Module has a native image. 0x4: Dynamic module. 0x8: Manifest module. |
Reserved1 |
win:UInt32 |
Reserved field. |
ModuleILPath |
win:UnicodeString |
Path of the Microsoft intermediate language (MSIL) image for the module, or dynamic module name if it is a dynamic assembly (null-terminated). |
ModuleNativePath |
win:UnicodeString |
Path of the module native image, if present (null-terminated). |
ClrInstanceID |
win:UInt16 |
Unique ID for the instance of CLR or CoreCLR. |
Back to top
CLR Domain Module Events
The following table shows the keyword and level.
Keyword for raising the event |
Event |
Level |
|---|---|---|
LoaderKeyword (0x8) |
DomainModuleLoad_V1 |
Informational (4) |
LoaderRundownKeyword (0x8) + StartRundownKeyword |
DomainModuleDCStart_V1 |
Informational (4) |
LoaderRundownKeyword (0x8) + EndRundownKeyword |
DomainModuleDCEnd_V1 |
Informational (4) |
The following table shows the event information.
Event |
Event ID |
Description |
|---|---|---|
DomainModuleLoad_V1 |
151 |
Raised when a module is loaded for an application domain. |
DomainModuleDCStart_V1 |
151 |
Enumerates modules loaded for an application domain during a start rundown, and is logged for all application domains. |
DomainModuleDCEnd_V1 |
152 |
Enumerates modules loaded for an application domain during an end rundown, and is logged for all application domains. |
The following table shows the event data.
Field name |
Data type |
Description |
|---|---|---|
ModuleID |
win:UInt64 |
Identifies the assembly to which this module belongs. |
AssemblyID |
win:UInt64 |
ID of the assembly in which this module resides. |
AppDomainID |
win:UInt64 |
ID of the application domain in which this module is used. |
ModuleFlags |
win:UInt32 |
0x1: Domain neutral module. 0x2: Module has a native image. 0x4: Dynamic module. 0x8: Manifest module. |
Reserved1 |
win:UInt32 |
Reserved field. |
ModuleILPath |
win:UnicodeString |
Path of the MSIL image for the module, or dynamic module name if it is a dynamic assembly (null-terminated). |
ModuleNativePath |
win:UnicodeString |
Path of the module native image, if present (null-terminated). |
ClrInstanceID |
win:UInt16 |
Unique ID for the instance of CLR or CoreCLR. |
Back to top