Share via


Monitor System Activity Using Extended Events

This procedure illustrates how Extended Events can be used with Event Tracing for Windows (ETW) to monitor system activity. The procedure also shows how the CREATE EVENT SESSION, ALTER EVENT SESSION, and DROP EVENT SESSION statements are used.

Accomplishing these tasks involves using Query Editor in SQL Server Management Studio to carry out the following procedure. The procedure also requires using the command prompt to run ETW commands.

To monitor system activity using Extended Events

  1. In Query Editor, issue the following statements to create an event session and add two events. These events, checkpoint_begin and checkpoint_end, fire at the beginning and end of a database checkpoint.

    CREATE EVENT SESSION test0
    ON SERVER
    ADD EVENT sqlserver.checkpoint_begin,
    ADD EVENT sqlserver.checkpoint_end
    WITH (MAX_DISPATCH_LATENCY = 1 SECONDS)
    go
    
  2. Add the bucketing target with 32 buckets to count the number of checkpoints based on the database ID.

    ALTER EVENT SESSION test0
    ON SERVER
    ADD TARGET package0.histogram
    (
          SET slots = 32, filtering_event_name = 'sqlserver.checkpoint_end', source_type = 0, source = 'database_id'
    )
    go
    
  3. Issue the following statements to add the ETW target. This will enable you to see the begin and end events, which is used to determine how long the checkpoint takes.

    ALTER EVENT SESSION test0
    ON SERVER
    ADD TARGET package0.etw_classic_sync_target
    go
    
  4. Issue the following statements to start the session and begin event collection.

    ALTER EVENT SESSION test0
    ON SERVER
    STATE = start
    go
    
  5. Issue the following statements to cause three events to fire.

    USE tempdb
          checkpoint
    go
    USE master
          checkpoint
          checkpoint
    go
    
  6. Issue the following statements to view the event counts.

    SELECT CAST(xest.target_data AS xml) Bucketizer_Target_Data_in_XML
    FROM sys.dm_xe_session_targets xest
    JOIN sys.dm_xe_sessions xes ON xes.address = xest.event_session_address
    JOIN sys.server_event_sessions ses ON xes.name = ses.name
    WHERE xest.target_name = 'histogram' AND xes.name = 'test0'
    go
    
  7. At the command prompt, issue the following commands to view the ETW data.

    Note

    To get help for the tracerpt command, at the command prompt, enter tracerpt /?.

    logman query -ets --- List the ETW sessions. This is optional.
    logman update XE_DEFAULT_ETW_SESSION -fd -ets --- Flush the ETW log.
    tracerpt %temp%\xeetw.etl -o xeetw.txt --- Dump the events so they can be seen.
    
  8. Issue the following statements to stop the event session and remove it from the server.

    ALTER EVENT SESSION test0
    ON SERVER
    STATE = STOP
    go
     
    DROP EVENT SESSION test0
    ON SERVER
    go
    

See Also

Reference

CREATE EVENT SESSION (Transact-SQL)

ALTER EVENT SESSION (Transact-SQL)

DROP EVENT SESSION (Transact-SQL)

Extended Events Catalog Views (Transact-SQL)

Extended Events Dynamic Management Views

Concepts

SQL Server Extended Events Targets