Heap Trace Provider
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 32 | HeapCreate | ETW Trace | N | N |
| 33 | HeapAlloc | ETW Trace | N | N |
| 34 | HeapRealloc | ETW Trace | N | N |
| 35 | Heap_TypeGroup1 | ETW Trace | N | N |
| 36 | HeapFree | ETW Trace | N | N |
| 37 | HeapExpand | ETW Trace | N | N |
| 38 | HeapSnapShot | ETW Trace | N | N |
| 42 | HeapContract | ETW Trace | N | N |
| 43 | Heap_TypeGroup1 | ETW Trace | N | N |
| 44 | Heap_TypeGroup1 | ETW Trace | N | N |
| 45 | Heap_TypeGroup1 | ETW Trace | N | N |
| 46 | Heap_TypeGroup1 | ETW Trace | N | N |
| 47 | Heap_SubsegmentGroup | ETW Trace | N | N |
| 48 | Heap_SubsegmentGroup | ETW Trace | N | N |
| 49 | Heap_SubsegmentGroup | ETW Trace | N | N |
| 50 | Heap_SubsegmentGroup | ETW Trace | N | N |
| 51 | HeapCommitDecommit | ETW Trace | N | N |
| 52 | HeapCommitDecommit | ETW Trace | N | N |
| 53 | HeapSubsegmentInitialize | ETW Trace | N | N |
| 54 | HeapAffinityManagerEnable | ETW Trace | N | N |
| 55 | HeapAffinitySlotAssigned | ETW Trace | N | N |
| 56 | HeapSubSegmentActivated | ETW Trace | N | N |
| 57 | HeapAffinitySlotChanged | ETW Trace | N | N |
| 58 | HeapSubsegmentReuseThresholdActivated | ETW Trace | N | N |
Event ID 32: HeapCreate
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
HeapFlags mof:UInt32 | |
ReservedSpace mof:Object | |
CommittedSpace mof:Object | |
AllocatedSpace mof:Object |
Event ID 33: HeapAlloc
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
AllocSize mof:Object | |
AllocAddress mof:UInt32 | |
SourceId mof:UInt32 |
Event ID 34: HeapRealloc
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
NewAllocAddress mof:UInt32 | |
OldAllocAddress mof:UInt32 | |
NewAllocSize mof:Object | |
OldAllocSize mof:Object | |
SourceId mof:UInt32 |
Event ID 36: HeapFree
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
FreeAddress mof:UInt32 | |
SourceId mof:UInt32 |
Event ID 37: HeapExpand
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
CommittedSize mof:Object | |
CommitAddress mof:UInt32 | |
FreeSpace mof:Object | |
CommittedSpace mof:Object | |
ReservedSpace mof:Object | |
NoOfUCRs mof:UInt32 | |
AllocatedSpace mof:Object |
Event ID 38: HeapSnapShot
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
FreeSpace mof:Object | |
CommittedSpace mof:Object | |
ReservedSpace mof:Object | |
HeapFlags mof:UInt32 | |
ProcessId mof:UInt32 | |
LargeUCRSpace mof:Object | |
FreeListLength mof:UInt32 | |
UCRLength mof:UInt32 | |
AllocatedSpace mof:Object |
Event ID 42: HeapContract
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
DeCommittedSize mof:Object | |
DeCommitAddress mof:UInt32 | |
FreeSpace mof:Object | |
CommittedSpace mof:Object | |
ReservedSpace mof:Object | |
NoOfUCRs mof:UInt32 | |
AllocatedSpace mof:Object |
Event ID 47: Heap_SubsegmentGroup
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
SubSegment mof:UInt32 | |
SubSegmentSize mof:Object | |
BlockSize mof:Object |
Event ID 48: Heap_SubsegmentGroup
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
SubSegment mof:UInt32 | |
SubSegmentSize mof:Object | |
BlockSize mof:Object |
Event ID 49: Heap_SubsegmentGroup
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
SubSegment mof:UInt32 | |
SubSegmentSize mof:Object | |
BlockSize mof:Object |
Event ID 50: Heap_SubsegmentGroup
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
SubSegment mof:UInt32 | |
SubSegmentSize mof:Object | |
BlockSize mof:Object |
Event ID 51: HeapCommitDecommit
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
Block mof:UInt32 | |
Size mof:Object | |
Caller mof:UInt32 |
Event ID 52: HeapCommitDecommit
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
Block mof:UInt32 | |
Size mof:Object | |
Caller mof:UInt32 |
Event ID 53: HeapSubsegmentInitialize
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
SubSegment mof:UInt32 | |
BlockSize mof:Object | |
BlockCount mof:Object | |
AffinityIndex mof:UInt32 |
Event ID 54: HeapAffinityManagerEnable
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
BucketIndex mof:UInt32 |
Event ID 56: HeapSubSegmentActivated
#Fields #
| Name | Description |
|---|---|
HeapHandle mof:UInt32 | |
SubSegment mof:UInt32 |
Provenance
ETW provider GUID {222962AB-6180-4B88-A825-346B75F2A24A}
- WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26
Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.
- WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02
MOF class: HeapTraceProvider
- Win11-26200.6584, schema read from the WMI MOF class, captured 2026-06-02
MOF class: HeapTraceProvider