XEvent Timestamp is a large integer value not the expected datatime value

The timestamp column for XEvent is stored internally as an offset from the start of the trace.   The XEvent header contains the starting, UTC time and each event stores the offset in ticks from the value stored in the header.

On a system where the time is adjusted, for example daylight savings time falls backward, the offset stored in the individual trace record can become a negative value.

There is a bug in the common, XEvent reader code that impacts the TSQL reader as well as the client reader (SSMS, XEvent Linq reader, …).   Instead of reading the value as a signed value the value is read as unsigned.   This causes the unsigned value to look like 0xFFFFFFFFFFFF####.   The signed value should be –#### but it is incorrectly treated as a unsigned.   This large of an offset is illegal and causes the reader to return an error.

When using the TSQL reader function (sys.fn_xe_file_target_read) an incorrect value returned from the reader for timestamp is output as the calculated, tick offset value (%I64u) instead of the datetime value.

A correct event looks like:

…. timestamp="2015-04-11T11:19:24.265Z">                               

Incorrect event might look like: 

…. timestamp="18446744070113720036">

Attempting to open the file in SSMS (management Studio) results in the following error.

Bob Dorr - Principal SQL Server Escalation Engineer

Comments

• Anonymous
  May 28, 2017
  Hello, I am getting this same window when I am trying to read "ALWAYSON HEALTH EVENTS" from dashboard. And I could not able to see any events. But some times when I PAUSE and RESUME "AUTO REFRESH" on dash board then I get the same window but can see some events .I could not able to paste the screen I captured. What is your suggestion on this window to not get again in future.Thank you in advance
• Anonymous
  November 30, 2018
  What is the fix here?