Share via


CLR ETW Keywords and Levels

Event tracing for Windows (ETW) events can be filtered by category and level. Event keywords enable the filtering of events by category; they are used in combinations for the runtime and rundown providers. The event levels are identified by flags.

CLR ETW Keywords

The keywords are flags that can be combined to generate values. In practice, you use the hexadecimal values of the keywords instead of the keyword names when you call the command-line utilities.

The keywords are described in the following tables:

  • CLR ETW runtime keywords

  • CLR ETW rundown keywords

  • Keyword combinations for symbol resolution for the runtime provider

  • Keyword combinations for symbol resolution for the rundown provider

CLR ETW Runtime Keywords

The following table lists the CLR ETW runtime keywords, their values, and what they are used for.

Runtime keyword name

Value

Purpose

GCKeyword

0x00000001

Enables the collection of garbage collection events.

LoaderKeyword

0x00000008

Enables the collection of loader events.

JITKeyword

0x00000010

Enables the collection of just-in-time (JIT) events.

NGenKeyword

0x00000020

Enables the collection of events for native image methods (methods processed by the Native Image Generator, Ngen.exe); used with StartEnumerationKeyword and EndEnumerationKeyword.

StartEnumerationKeyword

0x00000040

Enables the enumeration of all the methods in the runtime; used in conjunction with NGenKeyword.

EndEnumerationKeyword

0x00000080

Enables the enumeration of all the methods destroyed in the runtime; used in conjunction with JITKeyword and NGenKeyword.

SecurityKeyword

0x00000400

Enables the collection of security events.

AppDomainResourceManagementKeyword

0x00000800

Enables the collection of resource monitoring events at an application domain level.

JITTracingKeyword

0x00001000

Enables the collection of JIT tracing events.

InteropKeyword

0x00002000

Enables the collection of interop events.

ContentionKeyword

0x00004000

Enables the collection of contention events.

ExceptionKeyword

0x00008000

Enables the collection of exception events.

ThreadingKeyword

0x00010000

Enables the collection of threadpool events.

StackKeyword

0x40000000

Enables the collection of CLR stack trace events.

Back to top

CLR ETW Rundown Keywords

The following table lists the CLR ETW rundown keywords, their values, and what they are used for.

Rundown keyword name

Value

Purpose

LoaderRundownKeyword

0x00000008

Enables the collection of loader events when used with StartRundownKeyword and EndRundownKeyword.

JitRundownKeyword

0x00000010

Enables the collection of method DCStart and DCEnd events for JIT-compiled methods when used with StartRundownKeyword and EndRundownKeyword.

NGenRundownKeyword

0x00000020

Enables the collection of method DCStart and DCEnd events for NGEN native image methods when used with StartRundownKeyword and EndRundownKeyword.

StartRundownKeyword

0x00000040

Enables the enumeration of system state during a start rundown.

EndRundownKeyword

0x00000100

Enables the enumeration of system state during an end rundown.

AppDomainResourceManagementRundownKeyword

0x00000800

Enables the collection of events for resource monitoring at an AppDomain level when used with StartRundownKeyword or EndRundownKeyword.

Back to top

Keyword Combinations for Symbol Resolution for the Runtime Provider

Keywords and flags

Application domain, assembly, module load/unload events

Method load/unload events (except dynamic events)

Dynamic method load/destroy events

LoaderKeyword

Load and unload events.

None.

None.

JITKeyword

(+ StartEnumerationKeyword does not add anything)

None.

Load events.

Load and unload events.

JITKeyword +

EndEnumerationKeyword

None.

Load and unload events.

Load and unload events.

NGenKeyword

None.

None.

Not applicable.

NGenKeyword +

StartEnumerationKeyword

None.

Load events.

Not applicable.

NGenKeyword +

EndEnumerationKeyword

None.

Unload events.

Not applicable.

Back to top

Keyword Combinations for Symbol Resolution for the Rundown Provider

Keywords and flags

Application domain, assembly, module DCStart/DCEnd events

Method DCStart/DCEnd events (including dynamic method events)

LoaderRundownKeyword +

StartRundownKeyword

DCStart events.

None.

LoaderRundownKeyword +

EndRundownKeyword

DCEnd events.

None.

JITKeyword +

StartRundownKeyword

None.

DCStart events.

JITKeyword +

EndRundownKeyword

None.

DCEnd events.

NGenKeyword +

StartRundownKeyword

None.

DCStart events.

NGenKeyword +

EndRundownKeyword

None.

DCEnd events.

Back to top

ETW Event Levels

ETW events can also be filtered by level. If the level is set at 0x5, events of all levels, including 0x5 and below (which are events that belong to categories enabled through keywords) are raised. If the level is set at 0x2, only events that belong to level 0x2 and below are raised.

The levels have the following meanings:

0x5 - Verbose

0x4 - Informational

0x3 - Warning

0x2 - Error

0x1 - Critical

0x0 - LogAlways

Back to top

See Also

Concepts

CLR ETW Providers

Other Resources

CLR ETW Events

ETW Events in the Common Language Runtime