dotnet / dotnet/docs

Incorrect data from the Microsoft-Windows-DotNETRuntime ETW provider

Open
#22,155 2 comments 3 reactions 0 assignees View on GitHub
dotnet-framework/svc
Dominant language
No language data
Stars
4.8k
Forks
6.1k
Avg merge
19h 10m
Merged PRs (30d)
268

Description

**Data sent by the Microsoft-Windows-DotNETRuntime ETW provider doesn't match event description from the [docs]( https://github.com/dotnet/docs/blob/e124c6d528a487a2332c81940ea8a9057f5fc88f/docs/framework/performance/loader-etw-events.md)**

We are trying to read events from the Microsoft-Windows-DotNETRuntime ETW provider via ETW sessions in the following way:
- open Event Trace session and set event writing to an etl file
- parse etl file with command `tracerpt "session.etl" -o "result.xml"`.

And we receive the following event:

```



152
2
4
10
33
0x20000008







0x7FF8337110000x1AA03BE0110C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dllC:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\568c843a2159d22391f14ec8680868a6\Microsoft.Management.Infrastructure.ni.dll37{ae53edfa-f525-412e-b901-1895653e435a}1Microsoft.Management.Infrastructure.pdb{568c843a-2159-d223-91f1-4ec8680868a6}1


Information
ModuleLoad

Loader
PerfTrack

Loader
ModuleID=0x7FF833711000;
AssemblyID=0x1AA03BE0;
ModuleFlags=DomainNeutral |Native |Manifest ;
ModuleILPath=0;
ModuleNativePath=C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll;
ClrInstanceID=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\568c843a2159d22391f14ec8680868a6\Microsoft.Management.Infrastructure.ni.dll;
ManagedPdbSignature=37;
ManagedPdbAge={ae53edfa-f525-412e-b901-1895653e435a};
ManagedPdbBuildPath=1;
NativePdbSignature=Microsoft.Management.Infrastructure.pdb;
NativePdbAge={568c843a-2159-d223-91f1-4ec8680868a6};
NativePdbBuildPath=1

```

As you can see, fields have the wrong type, e.g., NativePdbAge and ManagedPdbAge have `win:GUID` type, but in the docs, it has `win:UInt32` type. Other fields have the wrong type too.

But we can read these events via Windows API with our library https://github.com/bi-zone/etw.
Properties from the same event, but parsed via [TdhFormatProperty function](https://docs.microsoft.com/en-us/windows/win32/api/tdh/nf-tdh-tdhformatproperty]):

```
{
"AssemblyID": "0x1AA03BE0",
"ClrInstanceID": "37",
"ManagedPdbAge": "1",
"ManagedPdbBuildPath": "Microsoft.Management.Infrastructure.pdb",
"ManagedPdbSignature": "{ae53edfa-f525-412e-b901-1895653e435a}",
"ModuleFlags": "DomainNeutral |Native |Manifest ",
"ModuleID": "0x7FF833711000",
"ModuleILPath": "C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Management.Infrastructure\\v4.0_1.0.0.0__31bf3856ad364e35\\Microsoft.Management.Infrastructure.dll",
"ModuleNativePath": "C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\568c843a2159d22391f14ec8680868a6\\Microsoft.Management.Infrastructure.ni.dll",
"NativePdbAge": "1",
"NativePdbBuildPath": "Microsoft.Management.Infrastructure.ni.pdb",
"NativePdbSignature": "{568c843a-2159-d223-91f1-4ec8680868a6}",
"Reserved1": "0"
}
```
And we see that all properties have the correct type.

**The question is**: why the windows utilities can't read events from the Microsoft-Windows-DotNETRuntime ETW provider in the right format? Whom should we believe? :)
BTW, It reproduces in different windows hosts: win10 1903, win10 1909, win10 1809.

I've attached the [etl file](https://drive.google.com/file/d/1wADvqf5TKNwBSMVXX5gdMeAE4NdLIRDo/view?usp=sharing) from which the example was parsed.

---
#### Document Details

⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*

* ID: 1c3f041e-a82c-8d7d-5303-59f69d78335a
* Version Independent ID: 72b94483-b88d-cd31-39c8-4bd6a4e92e9c
* Content: [Loader ETW Events](https://docs.microsoft.com/en-us/dotnet/framework/performance/loader-etw-events)
* Content Source: [docs/framework/performance/loader-etw-events.md](https://github.com/dotnet/docs/blob/master/docs/framework/performance/loader-etw-events.md)
* Product: **dotnet-framework**
* GitHub Login: @BillWagner
* Microsoft Alias: **wiwagn**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.