What can i use e13c0d23-ccbc-4e12-931b-d9cc2eee27e4 for? RRS feed

  • Question

  • Deal CLR Experts,


    while e13c0d23-ccbc-4e12-931b-d9cc2eee27e4 is a fairly selective search term I does not deliver any hints how i can extract any trace information from the .NET Common Language Runtime.


    Well it looks like there is some kind of ETW Event Provider whith this GUID arround but I have no clue what kind of information i could extract there.


    What i have tryed so far is


    Z:\>logman query providers

    Provider                                 GUID
    HTTP Service Trace                       {dd5ef90a-6398-47a4-ad34-4dcecdef795f}
    WSAT Trace Provider                      {7f3fe630-462b-47c5-ab07-67ca84934abd}
    ASP.NET Events                           {AFF081FE-0247-4275-9C4E-021F3DC1DA35}
    Windows Kernel Trace                     {9e814aad-3204-11d2-9a82-006008a86939}
    Processor Trace Information              {08213901-B301-4a4c-B1DD-177238110F9F}
    ACPI Driver Trace Provider               {dab01d4d-2d48-477d-b1c3-daad0ce6f06b}
    .NET Common Language Runtime             {e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}


    Z:\>logman create trace dot_net_trace -p {e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}
    The command completed successfully.

    Z:\>logman start dot_net_trace
    The command completed successfully.

    Z:\>logman query dot_net_trace

    Name:         dot_net_trace
    Type:         Trace
    Status:       Running
    Start:        <Manual>
    Stop:         <Manual>
    File:         C:\PerfLogs\dot_net_trace_000001.etl
    Run As:       <Default>

    Logger name:  dot_net_trace
    Buffer Size:  128


    The command completed successfully.

    Z:\>logman stop dot_net_trace
    The command completed successfully.


    but all i get is a header of the Logfile







    Thursday, March 6, 2008 7:21 PM


All replies

  • Could you please clarify what exactly you mean by "a header of the Logfile"? How exactly you write the trace log?
    Monday, March 10, 2008 7:07 AM
  • Hi,


    you are right, i forgot to describe the last step i performed calling


    tracerpt dot_net_trace_000001.etl


    that produces a cvs file containing a header as well as summary.txt file, both containing no real content.







    Tuesday, March 11, 2008 9:57 AM
  • Based on my research, after you start the log provider, an empty log will be written. After that, you can write logs to this ETW log in your code. You can use the EventProviderTraceListener Class provided in the .net 3.5.

    Recommended reading
    ETW Tracing: How and Why? for more details.
    Wednesday, March 12, 2008 3:53 AM
  • Hello Feng,


    that does not sound reasonable to me for two reasons:

    - In the EventProviderTraceListener samples they always hand over a different GUID and give the Provider a name. It looks to me like one is always creating a new Provider. Makes sense that my application has its own provider with its own  EventTraces. Its not the CLS emitting the EventTraces but my application. Still using .NET 3.0 I played arround with the ETWEventlListerner provided with the WCF TechnologySamples. One creates a custom provider there as well.

    - The '.NET Common Language Provider' was there in .NET 2.0 already. Would not make sense if its only purpose was to serve as sink for EventTraces that applications emit.


    So either there is a way of making the CLR itself emit EventTraces or the '.NET Common Language Provider' is some dummy without real purpose.









    Wednesday, March 12, 2008 7:24 PM
  • Once again hello Feng,


    digging deeper I found a File called CLR.MOF right under C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727 it strengthens my thesis that there are EventTrace subclasses containing information about garbage collection and thread states. This answers at least the 'what kind of information does this event provider deliver' part of my initial question in a nice formal, language neutral way. Nice.

    This MOF file seems to be installed on my computer, I verified that with wbemtest.exe. So i do have classes...but where are the instances?





    Wednesday, March 12, 2008 8:20 PM
  • After further study on this, I found:

    First, you can write to this log after you started it in your application:
    Code Snippet

    EventProviderTraceListener listener = new EventProviderTraceListener("e13c0d23-ccbc-4e12-931b-d9cc2eee27e4",


    And other applications like some profilers can also write to it: VSPerfCmd is an example, note the EVENTSSurpriseption part.

    Thursday, March 13, 2008 9:56 AM
  • Things are about to get hotter...


    when i try


    Code Snippet

    C:\Program Files\Microsoft Visual Studio 8\Team Tools\Performance Tools>VSPerfCmd -events:on,e13c0d23-ccbc-4e12-931b-d9cc2eee27e4,0x7fffffff
    Microsoft (R) VSPerf Command Version 8.0.50727 x86
    Copyright (C) Microsoft Corp. All rights reserved.

    Error VSP1306 : Profile Monitor does not appear to be running.




    good so go to VS, start a Profiler session, start again


    Code Snippet

    C:\Program Files\Microsoft Visual Studio 8\Team Tools\Performance Tools>VSPerfCmd -events:on,e13c0d23-ccbc-4e12-931b-d9cc2eee27e4,0x7fffffff
    Microsoft (R) VSPerf Command Version 8.0.50727 x86
    Copyright (C) Microsoft Corp. All rights reserved.

    Warning VSP2349 : The .NET Runtime Event Provider requires setting COMPLUS_ETWEnabled=1 in your process' environment.  Please be certain to
    set this variable before invoking your target process.



    setting COMPLUS_ETWEnabled=1 as Environment Variable with


    Code Snippet

    set COMPLUS_ETWEnabled=1



    did not change the situation and there is not a single hit for COMPLUS_ETWEnabled=1 or VSP2349 on live.com , So hot track but dead end road?

    Thursday, March 13, 2008 11:00 AM
  • The general steps to collect ETW tracing information from the CLR are:

    1. set complus_etwenabled=1 in the command window
    2. Start the ETW session the way you have started
    3. Run your .NET scenario you wish to profile (say hw.exe - which has to be a managed app or atleast hosts the .NET runtime). Pass 0xFF as flags and 0x5 as level
    4. Stop the ETW session the way you stopped
    4. Convert the .etl file to .csv using tracerpt
    5. View your csv file for events.

    The CLR.mof file has all the .NET Runtime ETW events listed in it.
    • Proposed as answer by Sanket Patel Thursday, April 16, 2009 3:31 PM
    Saturday, September 20, 2008 12:10 AM