CLR ETW Keywords and Levels
Event tracing for Windows (ETW) events can be filtered by category and level. Event keywords enable the filtering of events by category; they are used in combinations for the runtime and rundown providers. The event levels are identified by flags.
CLR ETW Keywords
The keywords are flags that can be combined to generate values. In practice, you use the hexadecimal values of the keywords instead of the keyword names when you call the command-line utilities.
The keywords are described in the following tables:
CLR ETW runtime keywords
CLR ETW rundown keywords
Keyword combinations for symbol resolution for the runtime provider
Keyword combinations for symbol resolution for the rundown provider
CLR ETW Runtime Keywords
The following table lists the CLR ETW runtime keywords, their values, and what they are used for.
Runtime keyword name |
Value |
Purpose |
|---|---|---|
GCKeyword |
0x00000001 |
Enables the collection of garbage collection events. |
LoaderKeyword |
0x00000008 |
Enables the collection of loader events. |
JITKeyword |
0x00000010 |
Enables the collection of just-in-time (JIT) events. |
NGenKeyword |
0x00000020 |
Enables the collection of events for native image methods (methods processed by the Native Image Generator, Ngen.exe); used with StartEnumerationKeyword and EndEnumerationKeyword. |
StartEnumerationKeyword |
0x00000040 |
Enables the enumeration of all the methods in the runtime; used in conjunction with NGenKeyword. |
EndEnumerationKeyword |
0x00000080 |
Enables the enumeration of all the methods destroyed in the runtime; used in conjunction with JITKeyword and NGenKeyword. |
SecurityKeyword |
0x00000400 |
Enables the collection of security events. |
AppDomainResourceManagementKeyword |
0x00000800 |
Enables the collection of resource monitoring events at an application domain level. |
JITTracingKeyword |
0x00001000 |
Enables the collection of JIT tracing events. |
InteropKeyword |
0x00002000 |
Enables the collection of interop events. |
ContentionKeyword |
0x00004000 |
Enables the collection of contention events. |
ExceptionKeyword |
0x00008000 |
Enables the collection of exception events. |
ThreadingKeyword |
0x00010000 |
Enables the collection of threadpool events. |
StackKeyword |
0x40000000 |
Enables the collection of CLR stack trace events. |
Back to top
CLR ETW Rundown Keywords
The following table lists the CLR ETW rundown keywords, their values, and what they are used for.
Rundown keyword name |
Value |
Purpose |
|---|---|---|
LoaderRundownKeyword |
0x00000008 |
Enables the collection of loader events when used with StartRundownKeyword and EndRundownKeyword. |
JitRundownKeyword |
0x00000010 |
Enables the collection of method DCStart and DCEnd events for JIT-compiled methods when used with StartRundownKeyword and EndRundownKeyword. |
NGenRundownKeyword |
0x00000020 |
Enables the collection of method DCStart and DCEnd events for NGEN native image methods when used with StartRundownKeyword and EndRundownKeyword. |
StartRundownKeyword |
0x00000040 |
Enables the enumeration of system state during a start rundown. |
EndRundownKeyword |
0x00000100 |
Enables the enumeration of system state during an end rundown. |
AppDomainResourceManagementRundownKeyword |
0x00000800 |
Enables the collection of events for resource monitoring at an AppDomain level when used with StartRundownKeyword or EndRundownKeyword. |
Back to top
Keyword Combinations for Symbol Resolution for the Runtime Provider
Keywords and flags |
Application domain, assembly, module load/unload events |
Method load/unload events (except dynamic events) |
Dynamic method load/destroy events |
|---|---|---|---|
LoaderKeyword |
Load and unload events. |
None. |
None. |
JITKeyword (+ StartEnumerationKeyword does not add anything) |
None. |
Load events. |
Load and unload events. |
JITKeyword + EndEnumerationKeyword |
None. |
Load and unload events. |
Load and unload events. |
NGenKeyword |
None. |
None. |
Not applicable. |
NGenKeyword + StartEnumerationKeyword |
None. |
Load events. |
Not applicable. |
NGenKeyword + EndEnumerationKeyword |
None. |
Unload events. |
Not applicable. |
Back to top
Keyword Combinations for Symbol Resolution for the Rundown Provider
Keywords and flags |
Application domain, assembly, module DCStart/DCEnd events |
Method DCStart/DCEnd events (including dynamic method events) |
|---|---|---|
LoaderRundownKeyword + StartRundownKeyword |
DCStart events. |
None. |
LoaderRundownKeyword + EndRundownKeyword |
DCEnd events. |
None. |
JITKeyword + StartRundownKeyword |
None. |
DCStart events. |
JITKeyword + EndRundownKeyword |
None. |
DCEnd events. |
NGenKeyword + StartRundownKeyword |
None. |
DCStart events. |
NGenKeyword + EndRundownKeyword |
None. |
DCEnd events. |
Back to top
ETW Event Levels
ETW events can also be filtered by level. If the level is set at 0x5, events of all levels, including 0x5 and below (which are events that belong to categories enabled through keywords) are raised. If the level is set at 0x2, only events that belong to level 0x2 and below are raised.
The levels have the following meanings:
0x5 - Verbose
0x4 - Informational
0x3 - Warning
0x2 - Error
0x1 - Critical
0x0 - LogAlways
Back to top