CLR ETW Keywords and Levels

Article
07/23/2022

Event tracing for Windows (ETW) events can be filtered by category and level. Event CLR ETW Keywords enable the filtering of events by category; they are used in combinations for the runtime and rundown providers. The event levels are identified by flags.

CLR ETW Keywords

The keywords are flags that can be combined to generate values. In practice, you use the hexadecimal values of the keywords instead of the keyword names when you call the command-line utilities.

The keywords are described in the following tables:

CLR ETW runtime keywords
CLR ETW rundown keywords
Keyword combinations for symbol resolution for the runtime provider
Keyword combinations for symbol resolution for the rundown provider

CLR ETW Runtime Keywords

The following table lists the CLR ETW runtime keywords, their values, and what they are used for.

Runtime keyword name	Value	Purpose
`GCKeyword`	0x00000001	Enables the collection of garbage collection events.
`LoaderKeyword`	0x00000008	Enables the collection of loader events.
`JITKeyword`	0x00000010	Enables the collection of just-in-time (JIT) events.
`NGenKeyword`	0x00000020	Enables the collection of events for native image methods (methods processed by the Native Image Generator, Ngen.exe); used with `StartEnumerationKeyword` and `EndEnumerationKeyword`. This keyword has high overhead. It generates events for every method inside every loaded NGen module. Whenever possible, instead of using this keyword, we recommend that you use the program databases (PDBs) generated by profiling tools to retrieve information about methods from NGen modules. See also `OverrideAndSuppressNGenEventsKeyword` later in this table.
`StartEnumerationKeyword`	0x00000040	Enables the enumeration of all the methods in the runtime; used in conjunction with `NGenKeyword`.
`EndEnumerationKeyword`	0x00000080	Enables the enumeration of all the methods destroyed in the runtime; used in conjunction with `JITKeyword` and `NGenKeyword`.
`SecurityKeyword`	0x00000400	Enables the collection of security events.
`AppDomainResourceManagementKeyword`	0x00000800	Enables the collection of resource monitoring events at an application domain level.
`JITTracingKeyword`	0x00001000	Enables the collection of JIT tracing events.
`InteropKeyword`	0x00002000	Enables the collection of interop events.
`ContentionKeyword`	0x00004000	Enables the collection of contention events.
`ExceptionKeyword`	0x00008000	Enables the collection of exception events.
`ThreadingKeyword`	0x00010000	Enables the collection of thread pool events.
`OverrideAndSuppressNGenEventsKeyword`	0x00040000	(Available in the .NET Framework 4.5 and later.) Suppresses the high-overhead `NGenKeyword` keyword and prevents the generation of events for methods that are inside NGen modules. Starting with .NET Framework 4.5, profiling tools should use `OverrideAndSuppressNGenEventsKeyword` and `NGenKeyword` together to suppress the generation of events for methods in NGen modules. This enables the profiling tool to use the more efficient NGen PDBs to get information about methods in NGen modules. The CLR in the .NET Framework 4 and earlier versions does not support the creation of NGen PDBs. In these earlier versions, the CLR will not recognize `OverrideAndSuppressNGenEventsKeyword` and will process `NGenKeyword` to generate events for methods in NGen modules.
`PerfTrackKeyWord`	0x2000000	Enables the collection of the `ModuleLoad` and `ModuleRange` events.
`StackKeyword`	0x40000000	Enables the collection of CLR stack trace events.

CLR ETW Rundown Keywords

The following table lists the CLR ETW rundown keywords, their values, and what they are used for.

Rundown keyword name	Value	Purpose
`LoaderRundownKeyword`	0x00000008	Enables the collection of loader events when used with `StartRundownKeyword` and `EndRundownKeyword`.
`JitRundownKeyword`	0x00000010	Enables the collection of method `DCStart` and `DCEnd` events for JIT-compiled methods when used with `StartRundownKeyword` and `EndRundownKeyword`.
`NGenRundownKeyword`	0x00000020	Enables the collection of method `DCStart` and `DCEnd` events for NGen native image methods when used with `StartRundownKeyword` and `EndRundownKeyword`. This keyword has high overhead. It generates events for every method inside every loaded NGen module. Whenever possible, instead of using this keyword, we recommend that you use the program databases (PDBs) generated by profiling tools to retrieve information about methods from NGen modules. See also `OverrideAndSuppressNGenEventsRundownKeyword` later in this table.
`StartRundownKeyword`	0x00000040	Enables the enumeration of system state during a start rundown.
`EndRundownKeyword`	0x00000100	Enables the enumeration of system state during an end rundown.
`AppDomainResourceManagementRundownKeyword`	0x00000800	Enables the collection of events for resource monitoring at an AppDomain level when used with `StartRundownKeyword` or `EndRundownKeyword`.
`ThreadingKeyword`	0x00010000	Enables the collection of thread pool events.
`OverrideAndSuppressNGenEventsRundownKeyword`	0x00040000	(Available in the .NET Framework 4.5 and later.) Suppresses the high-overhead `NGenRundownKeyword` keyword and prevents the generation of events for methods that are inside NGen modules. Starting with .NET Framework 4.5, profiling tools should use `OverrideAndSuppressNGenEventsRundownKeyword` and `NGenRundownKeyword` together to suppress the generation of events for methods in NGen modules. This enables the profiling tool to use the more efficient NGen PDBs to get information about methods in NGen modules. The CLR in the .NET Framework 4 and earlier versions does not support the creation of NGen PDBs. In these earlier versions, the CLR will not recognize `OverrideAndSuppressNGenEventsRundownKeyword` and will process `NGenRundownKeyword` to generate events for methods in NGen modules.
`PerfTrackKeyWord`	0x2000000	Enables the collection of the `ModuleDCStart`, `ModuleDCEnd`, `ModuleRangeDCStart`, and `ModuleRangeDCEnd` events.

Keyword Combinations for Symbol Resolution for the Runtime Provider

Keywords and flags	Application domain, assembly, module load/unload events	Method load/unload events (except dynamic events)	Dynamic method load/destroy events
`LoaderKeyword`	Load and unload events.	None.	None.
`JITKeyword` (+ `StartEnumerationKeyword` does not add anything)	None.	Load events.	Load and unload events.
`JITKeyword` + `EndEnumerationKeyword`	None.	Load and unload events.	Load and unload events.
`NGenKeyword`	None.	None.	Not applicable.
`NGenKeyword` + `StartEnumerationKeyword`	None.	Load events.	Not applicable.
`NGenKeyword` + `EndEnumerationKeyword`	None.	Unload events.	Not applicable.

Keyword Combinations for Symbol Resolution for the Rundown Provider

Keywords and flags	Application domain, assembly, module DCStart/DCEnd events	Method DCStart/DCEnd events (including dynamic method events)
`LoaderRundownKeyword` + `StartRundownKeyword`	`DCStart` events.	None.
`LoaderRundownKeyword` + `EndRundownKeyword`	`DCEnd` events.	None.
`JITKeyword` + `StartRundownKeyword`	None.	`DCStart` events.
`JITKeyword` + `EndRundownKeyword`	None.	`DCEnd` events.
`NGenKeyword` + `StartRundownKeyword`	None.	`DCStart` events.
`NGenKeyword` + `EndRundownKeyword`	None.	`DCEnd` events.

ETW Event Levels

ETW events can also be filtered by level. If the level is set at 0x5, events of all levels, including 0x5 and below (which are events that belong to categories enabled through keywords) are raised. If the level is set at 0x2, only events that belong to level 0x2 and below are raised.

The levels have the following meanings:

0x5 - Verbose

0x4 - Informational

0x3 - Warning

0x2 - Error

0x1 - Critical

0x0 - LogAlways

Share via