Incorrect data from the Microsoft-Windows-DotNETRuntime ETW provider
- Dominant language
- No language data
- Stars
- 4.8k
- Forks
- 6.1k
- Avg merge
- 19h 10m
- Merged PRs (30d)
- 268
Description
**Data sent by the Microsoft-Windows-DotNETRuntime ETW provider doesn't match event description from the [docs]( https://github.com/dotnet/docs/blob/e124c6d528a487a2332c81940ea8a9057f5fc88f/docs/framework/performance/loader-etw-events.md)**
We are trying to read events from the Microsoft-Windows-DotNETRuntime ETW provider via ETW sessions in the following way:
- open Event Trace session and set event writing to an etl file
- parse etl file with command `tracerpt "session.etl" -o "result.xml"`.
And we receive the following event:
```
152
2
4
10
33
0x20000008
0x7FF8337110000x1AA03BE0110C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dllC:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\568c843a2159d22391f14ec8680868a6\Microsoft.Management.Infrastructure.ni.dll37{ae53edfa-f525-412e-b901-1895653e435a}1Microsoft.Management.Infrastructure.pdb{568c843a-2159-d223-91f1-4ec8680868a6}1
Information
ModuleLoad
Loader
PerfTrack
Loader
ModuleID=0x7FF833711000;
AssemblyID=0x1AA03BE0;
ModuleFlags=DomainNeutral |Native |Manifest ;
ModuleILPath=0;
ModuleNativePath=C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll;
ClrInstanceID=C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\568c843a2159d22391f14ec8680868a6\Microsoft.Management.Infrastructure.ni.dll;
ManagedPdbSignature=37;
ManagedPdbAge={ae53edfa-f525-412e-b901-1895653e435a};
ManagedPdbBuildPath=1;
NativePdbSignature=Microsoft.Management.Infrastructure.pdb;
NativePdbAge={568c843a-2159-d223-91f1-4ec8680868a6};
NativePdbBuildPath=1
```
As you can see, fields have the wrong type, e.g., NativePdbAge and ManagedPdbAge have `win:GUID` type, but in the docs, it has `win:UInt32` type. Other fields have the wrong type too.
But we can read these events via Windows API with our library https://github.com/bi-zone/etw.
Properties from the same event, but parsed via [TdhFormatProperty function](https://docs.microsoft.com/en-us/windows/win32/api/tdh/nf-tdh-tdhformatproperty]):
```
{
"AssemblyID": "0x1AA03BE0",
"ClrInstanceID": "37",
"ManagedPdbAge": "1",
"ManagedPdbBuildPath": "Microsoft.Management.Infrastructure.pdb",
"ManagedPdbSignature": "{ae53edfa-f525-412e-b901-1895653e435a}",
"ModuleFlags": "DomainNeutral |Native |Manifest ",
"ModuleID": "0x7FF833711000",
"ModuleILPath": "C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Management.Infrastructure\\v4.0_1.0.0.0__31bf3856ad364e35\\Microsoft.Management.Infrastructure.dll",
"ModuleNativePath": "C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\568c843a2159d22391f14ec8680868a6\\Microsoft.Management.Infrastructure.ni.dll",
"NativePdbAge": "1",
"NativePdbBuildPath": "Microsoft.Management.Infrastructure.ni.pdb",
"NativePdbSignature": "{568c843a-2159-d223-91f1-4ec8680868a6}",
"Reserved1": "0"
}
```
And we see that all properties have the correct type.
**The question is**: why the windows utilities can't read events from the Microsoft-Windows-DotNETRuntime ETW provider in the right format? Whom should we believe? :)
BTW, It reproduces in different windows hosts: win10 1903, win10 1909, win10 1809.
I've attached the [etl file](https://drive.google.com/file/d/1wADvqf5TKNwBSMVXX5gdMeAE4NdLIRDo/view?usp=sharing) from which the example was parsed.
---
#### Document Details
⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*
* ID: 1c3f041e-a82c-8d7d-5303-59f69d78335a
* Version Independent ID: 72b94483-b88d-cd31-39c8-4bd6a4e92e9c
* Content: [Loader ETW Events](https://docs.microsoft.com/en-us/dotnet/framework/performance/loader-etw-events)
* Content Source: [docs/framework/performance/loader-etw-events.md](https://github.com/dotnet/docs/blob/master/docs/framework/performance/loader-etw-events.md)
* Product: **dotnet-framework**
* GitHub Login: @BillWagner
* Microsoft Alias: **wiwagn**
Contributor guide
Assessment
This issue has not been assessed yet.