Microsoft-Windows-DotNETRuntime

Event	Title	Channel	Sample	Rule
1	Count=.	ETW Trace	Y	N
1	Count=.	Operational	Y	N
2	Count=.	ETW Trace	Y	N
2	Count=.	Operational	Y	N
3	ClrInstanceID=.	ETW Trace	Y	N
3	NONE	Operational	Y	N
4	GenerationSize0=GenerationSize0.	ETW Trace	Y	N
4	GenerationSize0=.	Operational	Y	N
5	Address=	ETW Trace, Operational	N	N
6	Address=	ETW Trace, Operational	Y	N
7	ClrInstanceID=.	ETW Trace	Y	N
7	NONE	Operational	Y	N
8	ClrInstanceID=.	ETW Trace	Y	N
8	NONE	Operational	Y	N
9	Reason=.	ETW Trace	Y	N
9	Reason=.	Operational	Y	N
10	Amount=.	ETW Trace	Y	N
10	Amount=.	Operational	Y	N
11	ClrInstanceID=.	ETW Trace	N	N
11	NONE	Operational	N	N
12	NONE	Operational	N	N
13	Count=.	Operational	Y	N
14	ClrInstanceID=.	ETW Trace	Y	N
14	NONE	Operational	Y	N
15	Count=.	ETW Trace	Y	N
15	Count=.	Operational	Y	N
16	ClrInstanceID=Index.	Operational	Y	N
17	ClrInstanceID=Index.	Operational	Y	N
18	ClrInstanceID=Index.	Operational	Y	N
19	ClrInstanceID=Index.	ETW Trace	Y	N
19	ClrInstanceID=.	Operational	Y	N
20	High:ClrInstanceID=Address.	Operational	N	N
21	ClrInstanceID=Index.	Operational	Y	N
22	ClrInstanceID=Index.	Operational	Y	N
23	ClrInstanceID=Generation.	Operational	Y	N
25	HeapNum=.	Operational	N	N
26	HeapNum=.	Operational	N	N
27	HeapNum=.	Operational	N	N
28	HeapNum=.	Operational	N	N
29	TypeID=.	Operational	Y	N
30	HandleID=HandleID.	Operational	Y	N
31	HandleID=HandleID.	Operational	Y	N
32	Low:ClrInstanceID=Address.	Operational	N	N
33	HandleID=MethodIdentifier.	ETW Trace	Y	N
33	HandleID=.	Operational	Y	N
34	Method Load/UnLoad Info	ETW Trace	N	N
35	Reason=.	ETW Trace	Y	N
35	Reason=.	Operational	Y	N
36	ClrInstanceID=MethodIdentifier.	ETW Trace	Y	N
36	ClrInstanceID=.	Operational	Y	N
37	ClrInstanceID=MethodIdentifier.	ETW Trace	Y	N
37	ClrInstanceID=.	Operational	Y	N
38	ClrInstanceID=MethodIdentifier.	ETW Trace	Y	N
38	ClrInstanceID=.	Operational	Y	N
39	Method Load/UnLoad Verbose Info	ETW Trace	N	N
39	Event ID 39	Operational	N	N
40	WorkerThreadCount=MethodIdentifier.	ETW Trace	N	N
40	WorkerThreadCount=.	Operational	N	N
41	WorkerThreadCount=WorkerThreadCount.	Operational	N	N
42	WorkerThreadCount=WorkerThreadCount.	Operational	N	N
43	WorkerThreadCount=WorkerThreadCount.	Operational	N	N
44	IOThreadCount=IOThreadCount.	Operational	N	N
45	IOThreadCount=IOThreadCount.	Operational	N	N
46	IOThreadCount=IOThreadCount.	Operational	N	N
47	IOThreadCount=IOThreadCount.	Operational	N	N
48	ClrThreadID=ClrThreadID.	Operational	N	N
49	ClrThreadID=ClrThreadID.	Operational	N	N
50	WorkerThreadCount=ActiveWorkerThreadCount.	Operational	N	N
51	WorkerThreadCount=ActiveWorkerThreadCount.	Operational	N	N
52	WorkerThreadCount=ActiveWorkerThreadCount.	Operational	N	N
53	WorkerThreadCount=ActiveWorkerThreadCount.	Operational	N	N
54	Throughput=Throughput.	Operational	N	N
55	AverageThroughput=AverageThroughput.	Operational	N	N
56	Duration=Duration.	Operational	N	N
57	WorkerThreadCount=ActiveWorkerThreadCount.	Operational	Y	N
60	Count=.	Operational	N	N
61	WorkID=.	Operational	N	N
62	WorkID=.	Operational	N	N
63	WorkID=.	Operational	N	N
64	WorkID=.	Operational	N	N
65	WorkID=.	Operational	N	N
70	ID=.	Operational	Y	N
71	ID=.	Operational	Y	N
80	NONE	Operational	Y	N
81	NONE	Operational	N	N
82	ClrInstanceID=ClrInstanceID.	Operational	Y	N
83	AppDomainID=AppDomainID.	Operational	N	N
84	AppDomainID=AppDomainID.	Operational	N	N
85	ManagedThreadID=ManagedThreadID.	Operational	Y	N
86	ManagedThreadID=ManagedThreadID.	Operational	N	N
87	ManagedThreadID=ManagedThreadID.	Operational	N	N
88	ClrInstanceID=ClrInstanceID.	Operational	N	N
89	ClrInstanceID=ClrInstanceID.	Operational	N	N
91	ContentionFlags=ContentionFlags.	Operational	N	N
135	NONE	Operational	N	N
136	NONE	Operational	N	N
137	MethodID=MethodID.	Operational	N	N
138	MethodID=MethodID.	Operational	N	N
139	MethodID=MethodID.	Operational	N	N
140	MethodID=MethodID.	Operational	N	N
141	MethodID=MethodID.	Operational	N	N
142	MethodID=MethodID.	Operational	N	N
143	MethodID=MethodID.	Operational	Y	N
144	MethodID=MethodID.	Operational	N	N
145	MethodID=MethodID.	Operational	Y	N
149	ModuleID=ModuleID.	Operational	N	N
150	ModuleID=ModuleID.	Operational	N	N
151	ModuleID=ModuleID.	Operational	N	N
152	ModuleID=ModuleID.	Operational	Y	N
153	ModuleID=ModuleID.	Operational	N	N
154	AssemblyID=AssemblyID.	Operational	Y	N
155	AssemblyID=AssemblyID.	Operational	N	N
156	AppDomainID=AppDomainID.	Operational	N	N
157	AppDomainID=AppDomainID.	Operational	N	N
158	ClrInstanceID=ClrInstanceID;%ModuleID=ModuleID.	Operational	N	N
181	VerificationFlags=VerificationFlags.	Operational	N	N
182	VerificationFlags=VerificationFlags.	Operational	N	N
183	VerificationFlags=VerificationFlags.	Operational	N	N
184	VerificationFlags=VerificationFlags.	Operational	N	N
185	MethodBeingCompiledNamespace=MethodBeingCompiledNamespace.	Operational	Y	N
186	MethodBeingCompiledNamespace=MethodBeingCompiledNamespace.	Operational	Y	N
187	ClrInstanceID=ClrInstanceID.	Operational	N	N
188	MethodBeingCompiledNamespace=MethodBeingCompiledNamespace.	Operational	Y	N
189	MethodBeingCompiledNamespace=MethodBeingCompiledNamespace.	Operational	N	N
190	MethodID=MethodID.	Operational	N	N
200	BytesAllocated=BytesAllocated.	Operational	Y	N
201	BytesFreed=BytesFreed.	Operational	Y	N
202	HeapNum=.	Operational	Y	N
203	Heap=.	Operational	N	N
204	ClrInstanceID=ClrInstanceID.	Operational	Y	N
205	FinalYoungestDesired=FinalYoungestDesired.	Operational	Y	N
206	GCName=GCName;ClrInstanceID=ClrInstanceID.	Operational	N	N
240	DebugIPCEventStart	Operational	N	N
241	DebugIPCEventStop	Operational	N	N
242	DebugExceptionProcessingStart	Operational	N	N
243	DebugExceptionProcessingStop	Operational	N	N
250	EntryEIP=EntryEIP.	Operational	Y	N
251	NONE	Operational	Y	N
252	EntryEIP=EntryEIP.	Operational	Y	N
253	NONE	Operational	Y	N
254	EntryEIP=EntryEIP.	Operational	N	N
255	NONE	Operational	N	N
256	NONE	Operational	Y	N

Event ID 1: Count=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: Start
Source: Trace

Description

Count=Count; Depth=Depth; Reason=Reason; Type=Type; ClrInstanceID=ClrInstanceID; ClientSequenceNumber=ClientSequenceNumber

Message #

Count=%1;
Reason=%2

Fields #

Name	Description
`Count` UInt32
`Depth` UInt32
`Reason` UInt32
`Type` UInt32
`ClrInstanceID` UInt16
`ClientSequenceNumber` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 1,
    "version": 2,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14232,
      "thread_id": 13300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClientSequenceNumber": 0,
    "ClrInstanceID": 10,
    "Count": 5,
    "Depth": 2,
    "Reason": 1,
    "Type": 0
  },
  "message": "GarbageCollection"
}

Event ID 1: Count=.

Channel: Operational
Level: Informational
Task: GC
Opcode: Start

Message #

Count=%1;__Depth=%2;__Reason=%3;__Type=%4;__ClrInstanceID=%5;__ClientSequenceNumber=%6

Fields #

Name	Description
`Count`
`Depth`
`Reason`
`Type`
`ClrInstanceID`
`ClientSequenceNumber`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9848,
      "thread_id": 11732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.422Z",
    "version": 0
  },
  "event_data": {
    "ClientSequenceNumber": 0,
    "ClrInstanceID": 11,
    "Count": 14,
    "Depth": 2,
    "Reason": 1,
    "Type": 0
  },
  "message": ""
}

Event ID 2: Count=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: Stop
Source: Trace

Description

Count=Count; Depth=Depth; ClrInstanceID=ClrInstanceID

Message #

Count=%1;
Depth=%2

Fields #

Name	Description
`Count` UInt32
`Depth` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 2,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 1,
    "Depth": 2
  },
  "message": "GarbageCollection"
}

Event ID 2: Count=.

Channel: Operational
Level: Informational
Task: GC
Opcode: Stop

Message #

Count=%1;__Depth=%2;__ClrInstanceID=%3

Fields #

Name	Description
`Count`
`Depth`
`ClrInstanceID`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1552,
      "thread_id": 1680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.428Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 8,
    "Count": 3,
    "Depth": 2
  },
  "message": ""
}

Event ID 3: ClrInstanceID=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: RestartEEStop
Source: Trace

Description

ClrInstanceID=ClrInstanceID

Message #

NONE

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 3,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 132,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9
  },
  "message": "GarbageCollection"
}

Event ID 3: NONE

Channel: Operational
Level: Informational
Task: GC
Opcode: RestartEEStop

Message #

ClrInstanceID=%1

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1552,
      "thread_id": 1680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 132,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.428Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 8
  },
  "message": ""
}

Event ID 4: GenerationSize0=GenerationSize0.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: HeapStats
Source: Trace

Message #

GenerationSize0=%1;
TotalPromotedSize0=%2;
GenerationSize1=%3;
TotalPromotedSize1=%4;
GenerationSize2=%5;
TotalPromotedSize2=%6;
GenerationSize3=%7;
TotalPromotedSize3=%8;
FinalizationPromotedSize=%9;
FinalizationPromotedCount=%10;
PinnedObjectCount=%11;
SinkBlockCount=%12;
GCHandleCount=%13

Fields #

Name	Description
`GenerationSize0` UInt64
`TotalPromotedSize0` UInt64
`GenerationSize1` UInt64
`TotalPromotedSize1` UInt64
`GenerationSize2` UInt64
`TotalPromotedSize2` UInt64
`GenerationSize3` UInt64
`TotalPromotedSize3` UInt64
`FinalizationPromotedSize` UInt64
`FinalizationPromotedCount` UInt64
`PinnedObjectCount` UInt32
`SinkBlockCount` UInt32
`GCHandleCount` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 4,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 133,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "FinalizationPromotedCount": 1,
    "FinalizationPromotedSize": 32,
    "GCHandleCount": 52,
    "GenerationSize0": 24,
    "GenerationSize1": 67368,
    "GenerationSize2": 24,
    "GenerationSize3": 68648,
    "PinnedObjectCount": 7,
    "SinkBlockCount": 9,
    "TotalPromotedSize0": 44168,
    "TotalPromotedSize1": 0,
    "TotalPromotedSize2": 0,
    "TotalPromotedSize3": 68488
  },
  "message": "GarbageCollection"
}

Event ID 4: GenerationSize0=.

Channel: Operational
Level: Informational
Task: GC
Opcode: HeapStats

Message #

GenerationSize0=%1;__TotalPromotedSize0=%2;__GenerationSize1=%3;__TotalPromotedSize1=%4;__GenerationSize2=%5;__TotalPromotedSize2=%6;__GenerationSize3=%7;__TotalPromotedSize3=%8;__FinalizationPromotedSize=%9;__FinalizationPromotedCount=%10;__PinnedObjectCount=%11;__SinkBlockCount=%12;__GCHandleCount=%13;__ClrInstanceID=%14

Fields #

Name	Description
`GenerationSize0`
`TotalPromotedSize0`
`GenerationSize1`
`TotalPromotedSize1`
`GenerationSize2`
`TotalPromotedSize2`
`GenerationSize3`
`TotalPromotedSize3`
`FinalizationPromotedSize`
`FinalizationPromotedCount`
`PinnedObjectCount`
`SinkBlockCount`
`GCHandleCount`
`ClrInstanceID`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1552,
      "thread_id": 1680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 133,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.428Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 8,
    "FinalizationPromotedCount": 0,
    "FinalizationPromotedSize": 0,
    "GCHandleCount": 30,
    "GenerationSize0": 12,
    "GenerationSize1": 12,
    "GenerationSize2": 58664,
    "GenerationSize3": 17992,
    "PinnedObjectCount": 5,
    "SinkBlockCount": 3,
    "TotalPromotedSize0": 0,
    "TotalPromotedSize1": 0,
    "TotalPromotedSize2": 20356,
    "TotalPromotedSize3": 17928
  },
  "message": ""
}

Event ID 5: Address=

Channel: ETW Trace, Operational
Task: GC
Opcode: CreateSegment
Source: Trace

Description

Address=Address; Size=Size; Type=Type; ClrInstanceID=ClrInstanceID

Message #

Address=%1;
Size=%2;
Type=%3

Fields #

Name	Description
`Address` UInt64
`Size` UInt64
`Type` UInt32
`ClrInstanceID` UInt16

Event ID 6: Address=

Channel: ETW Trace, Operational
Level: 4
Task: GC
Opcode: FreeSegment

Fields #

Name	Description
`Address`
`ClrInstanceID`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 6,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 13192,
      "thread_id": 1568
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 135,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.432Z",
    "version": 0
  },
  "event_data": {
    "Address": 2619187597312,
    "ClrInstanceID": 11
  },
  "message": ""
}

Event ID 7: ClrInstanceID=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: RestartEEStart
Source: Trace

Description

ClrInstanceID=ClrInstanceID

Message #

NONE

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 7,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 136,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9
  },
  "message": "GarbageCollection"
}

Event ID 7: NONE

Channel: Operational
Level: Informational
Task: GC
Opcode: RestartEEStart

Message #

ClrInstanceID=%1

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1552,
      "thread_id": 1680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 136,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.428Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 8
  },
  "message": ""
}

Event ID 8: ClrInstanceID=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: SuspendEEStop
Source: Trace

Description

ClrInstanceID=ClrInstanceID

Message #

NONE

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 8,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 137,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14232,
      "thread_id": 13300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 10
  },
  "message": "GarbageCollection"
}

Event ID 8: NONE

Channel: Operational
Level: Informational
Task: GC
Opcode: SuspendEEStop

Message #

ClrInstanceID=%1

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9848,
      "thread_id": 11732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 137,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.422Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11
  },
  "message": ""
}

Event ID 9: Reason=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: SuspendEEStart
Source: Trace

Description

Reason=Reason; Count=Count; ClrInstanceID=ClrInstanceID

Message #

Reason=%1

Fields #

Name	Description
`Reason` UInt32
`Count` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 9,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 10,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14232,
      "thread_id": 13300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 10,
    "Count": 4,
    "Reason": 1
  },
  "message": "GarbageCollection"
}

Event ID 9: Reason=.

Channel: Operational
Level: Informational
Task: GC
Opcode: SuspendEEStart

Message #

Reason=%1;__Count=%2;__ClrInstanceID=%3

Fields #

Name	Description
`Reason`
`Count`
`ClrInstanceID`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 9,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9848,
      "thread_id": 11732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 10,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.422Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "Count": 13,
    "Reason": 1
  },
  "message": ""
}

Event ID 10: Amount=.

Channel: ETW Trace
Level: Verbose
Task: GC
Opcode: AllocationTick
Source: Trace

Description

Amount=AllocationAmount; Kind=AllocationKind; ClrInstanceID=ClrInstanceID;Amount64=AllocationAmount64; TypeID=TypeID; TypeName=TypeName; HeapIndex=HeapIndex; Address=Address

Message #

Amount=%1;
Kind=%2

Fields #

Name	Description
`AllocationAmount` UInt32
`AllocationKind` UInt32
`ClrInstanceID` UInt16
`AllocationAmount64` UInt64
`TypeID` Pointer
`TypeName` UnicodeString
`HeapIndex` UInt32
`Address` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}",
    "event_source_name": "",
    "event_id": 10,
    "version": 3,
    "level": 5,
    "task": 1,
    "opcode": 11,
    "keywords": "0x0000000000000001",
    "time_created": "2026-08-01T07:19:07.192144+00:00",
    "event_record_id": 211,
    "correlation": {
      "ActivityID": "{8fbbb2c3-2150-0001-be66-bf8f5021dd01}"
    },
    "execution": {
      "process_id": 9688,
      "thread_id": 4168
    },
    "channel": "ETW Trace",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AllocationAmount": 103384,
    "AllocationKind": 0,
    "ClrInstanceID": 9,
    "AllocationAmount64": 103384,
    "TypeID": "0x7ffb7b8907a0",
    "TypeName": "System.String",
    "HeapIndex": 0,
    "Address": "0x1a25001ce10"
  },
  "message": ""
}

Event ID 10: Amount=.

Channel: Operational
Level: 4
Task: GC
Opcode: AllocationTick

Fields #

Name	Description
`AllocationAmount`
`AllocationKind`
`ClrInstanceID`
`AllocationAmount64`
`TypeID`
`TypeName`
`HeapIndex`
`Address`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 10,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 11,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.944Z",
    "version": 0
  },
  "event_data": {
    "Address": "0x20D00BF3068",
    "AllocationAmount": 107584,
    "AllocationAmount64": 107584,
    "AllocationKind": 0,
    "ClrInstanceID": 11,
    "HeapIndex": 0,
    "TypeID": "0x7FFE9E8E3300",
    "TypeName": "System.Int32[]"
  },
  "message": ""
}

Event ID 11: ClrInstanceID=.

Channel: ETW Trace
Task: GC
Opcode: CreateConcurrentThread
Source: Trace

Description

ClrInstanceID=ClrInstanceID

Message #

NONE

Fields #

Name	Description
`ClrInstanceID` UInt16

Event ID 11: NONE

Channel: Operational
Task: GC
Opcode: CreateConcurrentThread

Event ID 12: NONE

Channel: Operational
Task: GC
Opcode: TerminateConcurrentThread

Description

ClrInstanceID=ClrInstanceID

Fields #

Name	Description
`ClrInstanceID` UInt16

Event ID 13: Count=.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: FinalizersStop

Description

Count=Count; ClrInstanceID=ClrInstanceID

Message #

Count=%1

Fields #

Name	Description
`Count` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 13,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 15,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.463+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 15288
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 1
  },
  "message": "GarbageCollection"
}

Event ID 14: ClrInstanceID=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: FinalizersStart
Source: Trace

Description

ClrInstanceID=ClrInstanceID

Message #

NONE

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 14,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 19,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.463+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 15288
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9
  },
  "message": "GarbageCollection"
}

Event ID 14: NONE

Channel: Operational
Level: Informational
Task: GC
Opcode: FinalizersStart

Message #

ClrInstanceID=%1

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 14,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4152,
      "thread_id": 5080
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 19,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.433Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 7
  },
  "message": ""
}

Event ID 15: Count=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: Type
Opcode: BulkType
Source: Trace

Description

Count=Count; ClrInstanceID=ClrInstanceID

Message #

Count=%1;
ClrInstanceID=%2

Fields #

Name	Description
`Count` mof:UInt32
`ClrInstanceID` UInt16
`Values` Int8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 21,
    "opcode": 10,
    "keywords": "0x0000000000080000",
    "time_created": "2026-06-02T05:22:23.458+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 31,
    "Values": "789D0CE3F97F000000100AE3F97F00005B0100020000000012530079007300740065006D002E00560065007200730069006F006E0000000000000028280CE3F97F000000100AE3F97F0000BF0400020000000012530079007300740065006D002E0043006F006C006C0065006300740069006F006E0073002E00470065006E0065007200690063002E00440069006300740069006F006E00610072007900600032005B00530079007300740065006D002E0053007400720069006E0067002C00530079007300740065006D002E0041007000700043006F006E0074006500780074002B00530077006900740063006800560061006C0075006500530074006100740065005D00000002000000685A0CE3F97F0000382B0CE3F97F0000685A0CE3F97F000000100AE3F97F000073000002000000000E530079007300740065006D002E0053007400720069006E006700000000000000382B0CE3F97F000000100AE3F97F0000BF0A00020000000008530077006900740063006800560061006C00750065005300740061007400650000000000000068B50CE3F97F000000100AE3F97F0000880000020000000012530079007300740065006D002E005F005F00460069006C007400650072007300000000000000801514E3F97F000000100AE3F97F0000D20000020000000012530079007300740065006D002E00440042004E0075006C006C00000000000000A83314E3F97F000000100AE3F97F00001C0100020000000012530079007300740065006D002E004F007000650072006100740069006E006700530079007300740065006D00000000000000E01114E3F97F000000100AE3F97F0000EB0000020000000011530079007300740065006D002E00470075006900640000000000000038770CE3F97F000000100AE3F97F00002C0100020000000012530079007300740065006D002E00520075006E00740069006D006500540079007000650000000000000088E914E3F97F000000100AE3F97F0000F80A0002000000001241006300740069007600610074006F00720043006100630068006500000000000000985F0CE3F97F000000100AE3F97F00003E0100020000000012530079007300740065006D002E00530068006100720065006400530074006100740069006300730000000000000020B60CE3F97F000000100AE3F97F0000000600020100000012530079007300740065006D002E005200650066006C0065006300740069006F006E002E004D0065006D00620065007200460069006C00740065007200000000000000B0B60CE3F97F000000100AE3F97F00000A0600020000000012530079007300740065006D002E005200650066006C0065006300740069006F006E002E004D0069007300730069006E006700000000000000C2330AE3F97F000000100AE3F97F000000000002080000001D530079007300740065006D002E0054007900700065005B005D00000001000000A8700CE3F97F0000A8700CE3F97F000000100AE3F97F0000480100020000000012530079007300740065006D002E005400790070006500000000000000D8BF0CE3F97F000000100AE3F97F0000D40000020000000012530079007300740065006D002E00440065006600610075006C007400420069006E00640065007200000000000000E22F0AE3F97F000000100AE3F97F000000000002080000001D530079007300740065006D002E0043006800610072005B005D00000001000000E0680CE3F97F0000E0680CE3F97F000000100AE3F97F0000B60000020000000003530079007300740065006D002E004300680061007200000000000000C85014E3F97F000000100AE3F97F0000070300020000000012530079007300740065006D002E00530065006300750072006900740079002E005000650072006D0069007300730069006F006E0073002E00530065006300750072006900740079005000650072006D0069007300730069006F006E00000000000000683C14E3F97F000000100AE3F97F0000E10100020000000012530079007300740065006D002E00530065006300750072006900740079002E005000650072006D0069007300730069006F006E0054006F006B0065006E00000000000000803D14E3F97F000000100AE3F97F0000E20100020000000012530079007300740065006D002E00530065006300750072006900740079002E005000650072006D0069007300730069006F006E0054006F006B0065006E0046006100630074006F0072007900000000000000183D14E3F97F000000100AE3F97F00007E0300020000000012530079007300740065006D002E00530065006300750072006900740079002E005500740069006C002E0054006F006B0065006E0042006100730065006400530065007400000000000000389E0CE3F97F000000100AE3F97F0000A30300020000000012530079007300740065006D002E0047006C006F00620061006C0069007A006100740069006F006E002E00430061006C0065006E006400610072004400610074006100000000000000C09B0CE3F97F000000100AE3F97F0000A90300020000000012530079007300740065006D002E0047006C006F00620061006C0069007A006100740069006F006E002E00430075006C00740075007200650049006E0066006F00000000000000209D0CE3F97F000000100AE3F97F0000DC0300020000000012530079007300740065006D002E0047006C006F00620061006C0069007A006100740069006F006E002E00430075006C0074007500720065004400610074006100000000000000409F0CE3F97F000000100A...[truncated]"
  },
  "message": "Type"
}

Event ID 15: Count=.

Channel: Operational
Level: Informational
Task: Type
Opcode: BulkType

Message #

Count=%1;__ClrInstanceID=%2

Fields #

Name	Description
`Count`
`ClrInstanceID`
`Values`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 15,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4860,
      "thread_id": 7456
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 10,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.424Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 7,
    "Count": 31,
    "Values": "C8498E9EFE7F00000010899EFE7F00005B0100020000000012530079007300740065006D002E00560065007200730069006F006E0000000000000010C48F9EFE7F00000010899EFE7F00001200000200000000124D006900630072006F0073006F00660074002E00570069006E00330032002E00520065006700690073007400720079004B0065007900000000000000A249899EFE7F00000010899EFE7F000000000002080000001D530079007300740065006D002E0053007400720069006E0067005B005D00000001000000A0078E9EFE7F0000A0078E9EFE7F00000010899EFE7F000073000002000000000E530079007300740065006D002E0053007400720069006E006700000000000000509C8D9EFE7F00000010899EFE7F0000BF0400020000000012530079007300740065006D002E0043006F006C006C0065006300740069006F006E0073002E00470065006E0065007200690063002E00440069006300740069006F006E00610072007900600032005B00530079007300740065006D002E0053007400720069006E0067002C00530079007300740065006D002E0041007000700043006F006E0074006500780074002B00530077006900740063006800560061006C0075006500530074006100740065005D00000002000000A0078E9EFE7F0000609F8D9EFE7F0000609F8D9EFE7F00000010899EFE7F0000BF0A00020000000008530077006900740063006800560061006C00750065005300740061007400650000000000000050D18F9EFE7F00000010899EFE7F0000760000020000000012530079007300740065006D002E00430075006C0074007500720065004100770061007200650043006F006D0070006100720065007200000000000000984B8D9EFE7F00000010899EFE7F0000780000020000000012530079007300740065006D002E004F007200640069006E0061006C0043006F006D0070006100720065007200000000000000BA4D899EFE7F00000010899EFE7F000000000002080000001D530079007300740065006D002E0049006E007400330032005B005D0000000100000068338E9EFE7F000068338E9EFE7F00000010899EFE7F0000FB0000020000000008530079007300740065006D002E0049006E00740033003200000000000000A0DC8D9EFE7F00000010899EFE7F00007D0000020000000011530079007300740065006D002E004400610074006500540069006D00650000000000000060C48D9EFE7F00000010899EFE7F0000880000020000000012530079007300740065006D002E005F005F00460069006C007400650072007300000000000000F0228C9EFE7F00000010899EFE7F00009C0000020000000012530079007300740065006D002E0041007000700044006F006D00610069006E00500061007500730065004D0061006E0061006700650072000000000000006A49899EFE7F00000010899EFE7F000000000002080000001D530079007300740065006D002E0043006800610072005B005D0000000100000010168E9EFE7F000010168E9EFE7F00000010899EFE7F0000B60000020000000003530079007300740065006D002E00430068006100720000000000000018B38D9EFE7F00000010899EFE7F00001C0100020000000012530079007300740065006D002E004F007000650072006100740069006E006700530079007300740065006D00000000000000D8D78D9EFE7F00000010899EFE7F0000EB0000020000000011530079007300740065006D002E00470075006900640000000000000058248E9EFE7F00000010899EFE7F00002C0100020000000012530079007300740065006D002E00520075006E00740069006D006500540079007000650000000000000090C78F9EFE7F00000010899EFE7F0000F80A0002000000001241006300740069007600610074006F00720043006100630068006500000000000000C80C8E9EFE7F00000010899EFE7F00003E0100020000000012530079007300740065006D002E00530068006100720065006400530074006100740069006300730000000000000018C58D9EFE7F00000010899EFE7F0000000600020100000012530079007300740065006D002E005200650066006C0065006300740069006F006E002E004D0065006D00620065007200460069006C00740065007200000000000000A8C58D9EFE7F00000010899EFE7F00000A0600020000000012530079007300740065006D002E005200650066006C0065006300740069006F006E002E004D0069007300730069006E0067000000000000001A4D899EFE7F00000010899EFE7F000000000002080000001D530079007300740065006D002E0054007900700065005B005D00000001000000C81D8E9EFE7F0000C81D8E9EFE7F00000010899EFE7F0000480100020000000012530079007300740065006D002E00540079007000650000000000000018BF8D9EFE7F00000010899EFE7F0000D40000020000000012530079007300740065006D002E00440065006600610075006C007400420069006E0064006500720000000000000008458F9EFE7F00000010899EFE7F0000070300020000000012530079007300740065006D002E00530065006300750072006900740079002E005000650072006D0069007300730069006F006E0073002E00530065006300750072006900740079005000650072006D0069007300730069006F006E00000000000000B8C08F9EFE7F00000010899EFE7F0000E10100020000000012530079007300740065006D002E00530065006300750072006900740079002E005000650072006D0069007300730069006F006E0054006F006B0065006E00000000000000D0C18F9EFE7F00000010899EFE7F0000E20100020000000012530079007300740065006D002E00530065006300750072006900740079002E005000650072006D0069007300730069006F006E0054006F006B0065006E0046006100630074006F007200790000000000000068C18F9EFE7F00000010899EFE7F00007E0300020000000012530079007300740065006D002E00530065006300750072006900740079002E005500740069006C002E0054006F006B0065006E004200610073006500640053006500740000000000000070768D9EFE7F00000010899EFE7F0000BF0400020000000012530079007300740065006D002E0043006F006C006C0065006300740069006F006E0073002E00470065006E0065007200690063002E00440069006300740069006F006E00610072007900600032005B00530079007300740065006D002E0053007400720069006E0067002C00530079007300740065006D002E004F0062006A006500630074005D00000002000000A0078E9EFE7F0000B00B8E9EFE7F0000B00B8E9EFE7F00000010899EFE7F00003D000002000000001C530079007300740065006D002E004F0062006A00650063007400000000000000"
  },
  "message": ""
}

Event ID 16: ClrInstanceID=Index.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCBulkRootEdge

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Index` UInt32
`Count` UInt32
`ClrInstanceID` UInt16
`Values` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 20,
    "keywords": "0x0000000000100000",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 116,
    "Index": 0,
    "Values": "10F20000B40100000000000000908985DEF97F00000000000000000000000000000058B475DEF97F000030F20000B4010000000000000058B475DEF97F000010F20000B4010000000000000058B475DEF97F00000000000000000000000000000058B475DEF97F0000B0E20000B40100000000000000185985DEF97F00000000000000000000000000000068D4B0C2F97F0000B0E20000B4010000000000000068D4B0C2F97F0000909C0010B401000000040000005036B0C2F97F0000909C0010B401000000040000005036B0C2F97F000038AE0000B401000000000000009837B0C2F97F00000000000000000000000000000018AE61C4F97F000018580000B4010000000000000018AE61C4F97F00000000000000000000000000000018AE61C4F97F000000430000B40100000000000000F8780AE3F97F0000C0580000B40100000000000000F8780AE3F97F0000904D0000B40100000000000000F8780AE3F97F000000000000000000000000000000F8780AE3F97F000000430000B40100000000000000B0BC27E3F97F0000F0570000B40100000000000000B0BC27E3F97F0000F8460000B40100000000000000B0BC27E3F97F0000C0580000B40100000000000000B0BC27E3F97F0000C0580000B4010000000000000098BC27E3F97F0000F8460000B4010000000000000098BC27E3F97F000000430000B4010000000000000098BC27E3F97F0000F0570000B4010000000000000098BC27E3F97F00000000000000000000000000000098BC27E3F97F00000000000000000000000000000098BC27E3F97F0000F0570000B401000000000000000000000000000000000000000000000000000000000000000000000000F8460000B401000000000000000000000000000000D8570000B40100000000000000000000000000000000430000B40100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018580000B401000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F0140100B4010000000000000068E626E3F97F0000F0140100B40100000000000000202227E3F97F000000000000000000000000000000202227E3F97F0000909C0010B401000000040000006073AFC2F97F000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070750000B40100000000000000004729E3F97F000090030100B40100000000000000B8850AE3F97F000070750000B40100000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F0000D0030100B40100000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000B8850AE3F97F000000000000000000000000000000F0C528E3F97F000090030100B40100000000000000584C29E3F97F000018760000B40100000000000000584C29E3F97F0000E8FF0000B40100000004000000584C29E3F97F0000C8790000B40100000000000000584C29E3F97F000000000000000000000000000000584C29E3F97F000070750000B40100000000000000584C29E3F97F000000000000000000000000000000584C29E3F97F000058000100B4010000000000000000023BE3F97F000020970000B4010000000000000000023BE3F97F00000000000000000000000000000000023BE3F97F000070750000B4010000000000000000023BE3F97F000050B10000B401000001000000000000000000000000D8A70000B40100000202000000C0117F76B401000040A10000B40100000202000000C8117F76B401000040940000B40100000202000000D0117F76B4010000903F0000B40100000202000000F0117F76B4010000E8FF0000B4010000020000000050137F76B4010000D0030100B4010000020000000060137F76B401000098A10000B4010000020000000068137F76B4010000D8570000B4010000020000000070137F76B4010000104C0000B4010000020000000080137F76B4010000984A0000B4010000020000000088137F76B4010000B8490000B4010000020000000090137F76B401000010480000B4010000020000000098137F76B4010000F8460000B40100000200000000A0137F76B4010000B8200000B40100000200000000A8137F76B401000040140000B40100000200000000B0137F76B401000068130000B40100000200000000B8137F76B4010000C8120000B40100000200000000C0137F76B401000028120000B40100000200000000C8137F76B401000088110000B40100000200000000D0137F76B4010000E8100000B4010000020000...[truncated]"
  },
  "message": "GarbageCollection"
}

Event ID 17: ClrInstanceID=Index.

Channel: Operational
Level: Informational
Task: GC
Opcode: GCBulkRootConditionalWeakTableElementEdge

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Index` UInt32
`Count` UInt32
`ClrInstanceID` UInt16
`Values` UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 17,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3820,
      "thread_id": 2688
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 21,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.432Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "Count": 5,
    "Index": 0,
    "Values": "C0DA008087010000401A068087010000D81D0AF487010000A0D6008087010000B819068087010000E01D0AF48701000080D60080870100003019068087010000E81D0AF4870100005064038087010000C065038087010000F01D0AF4870100004076028087010000108D028087010000F81D0AF487010000"
  },
  "message": ""
}

Event ID 18: ClrInstanceID=Index.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCBulkNode

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Index` UInt32
`Count` UInt32
`ClrInstanceID` UInt16
`Values` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 18,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 22,
    "keywords": "0x0000000000100000",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 608,
    "Index": 0,
    "Values": "48100000B4010000A000000000000000185C0CE3F97F00000000000000000000E8100000B4010000A000000000000000B05C0CE3F97F0000000000000000000088110000B4010000A000000000000000285D0CE3F97F0000000000000000000028120000B4010000A000000000000000A05D0CE3F97F00000000000000000000C8120000B4010000A000000000000000185E0CE3F97F0000000000000000000068130000B4010000A000000000000000185E0CE3F97F0000000000000000000008140000B40100001800000000000000805E0CE3F97F0000000000000000000020140000B40100001A00000000000000685A0CE3F97F0000000000000000000040140000B40100003000000000000000985F0CE3F97F0000000000000000000070140000B40100007000000000000000685A0CE3F97F00000000000000000000E0140000B40100009A00000000000000685A0CE3F97F0000000000000000000080150000B4010000D80000000000000008600CE3F97F0000030000000000000058160000B40100002200000000000000685A0CE3F97F0000000000000000000080160000B40100005A00000000000000685A0CE3F97F00000000000000000000E0160000B4010000800000000000000000670CE3F97F00000100000000000000F0170000B40100002800000000000000685A0CE3F97F0000000000000000000038180000B40100003600000000000000685A0CE3F97F0000000000000000000070180000B4010000A8000000000000001A300AE3F97F00000300000000000000D0190000B40100002800000000000000685A0CE3F97F00000000000000000000F8190000B40100001C00000000000000685A0CE3F97F00000000000000000000181A0000B40100003200000000000000685A0CE3F97F00000000000000000000501A0000B40100003800000000000000685A0CE3F97F00000000000000000000881A0000B40100003A00000000000000685A0CE3F97F00000000000000000000C81A0000B40100002E00000000000000685A0CE3F97F00000000000000000000F81A0000B40100002800000000000000685A0CE3F97F00000000000000000000201B0000B40100002A00000000000000685A0CE3F97F00000000000000000000501B0000B40100003200000000000000685A0CE3F97F00000000000000000000881B0000B40100004600000000000000685A0CE3F97F00000000000000000000D01B0000B40100004600000000000000685A0CE3F97F00000000000000000000181C0000B40100004C00000000000000685A0CE3F97F00000000000000000000681C0000B40100004000000000000000685A0CE3F97F00000000000000000000A81C0000B40100003E00000000000000685A0CE3F97F00000000000000000000E81C0000B40100003800000000000000685A0CE3F97F00000000000000000000201D0000B40100003800000000000000685A0CE3F97F00000000000000000000581D0000B40100002A00000000000000685A0CE3F97F00000000000000000000881D0000B40100003600000000000000685A0CE3F97F00000000000000000000C01D0000B40100004400000000000000685A0CE3F97F00000000000000000000081E0000B40100003000000000000000685A0CE3F97F00000000000000000000381E0000B40100002400000000000000685A0CE3F97F00000000000000000000A01F0000B40100005A00000000000000685A0CE3F97F0000000000000000000000200000B40100005200000000000000685A0CE3F97F0000000000000000000058200000B40100005E00000000000000685A0CE3F97F00000000000000000000B8200000B40100004000000000000000586C0CE3F97F0000000000000000000078220000B40100001E00000000000000685A0CE3F97F00000000000000000000A0230000B40100001C00000000000000685A0CE3F97F00000000000000000000C0230000B40100001C00000000000000685A0CE3F97F00000000000000000000E0230000B40100001C00000000000000685A0CE3F97F0000000000000000000000240000B40100001C00000000000000685A0CE3F97F0000000000000000000020240000B40100006600000000000000685A0CE3F97F0000000000000000000088240000B40100001E00000000000000685A0CE3F97F00000000000000000000A8240000B40100003E00000000000000685A0CE3F97F00000000000000000000E8240000B40100001E00000000000000685A0CE3F97F0000000000000000000008250000B40100003C00000000000000685A0CE3F97F0000000000000000000048250000B40100001C00000000000000685A0CE3F97F0000000000000000000068250000B40100001C00000000000000685A0CE3F97F0000000000000000000088250000B40100001C00000000000000685A0CE3F97F00000000000000000000A8250000B40100001C00000000000000685A0CE3F97F00000000000000000000C8250000B40100001C00000000000000685A0CE3F97F00000000000000000000E8250000B40100001C00000000000000685A0CE3F97F0000000000000000000008260000B40100001C00000000000000685A0CE3F97F0000000000000000000028260000B40100001C00000000000000685A0CE3F97F0000000000000000000048260000B40100001C00000000000000685A0CE3F97F0000000000000000000068260000B40100001C00000000000000685A0CE3F97F0000000000000000000088260000B40100001C00000000000000685A0CE3F97F00000000000000000000...[truncated]"
  },
  "message": "GarbageCollection"
}

Event ID 19: ClrInstanceID=Index.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCBulkEdge
Source: Trace

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Index` UInt32
`Count` UInt32
`ClrInstanceID` UInt16
`Values` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 19,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 23,
    "keywords": "0x0000000000100000",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 1751,
    "Index": 0,
    "Values": "E0160000B401000000000000E8940000B40100000000000028950000B40100000000000070180000B40100000000000070140000B401000000000000E0140000B40100000000000038180000B40100000000000020140000B40100000000000020140000B40100000000000020140000B40100000000000020140000B40100000000000020240000B40100000000000020240000B40100000000000020140000B40100000000000088240000B401000000000000A8240000B401000000000000A8240000B401000000000000A8240000B401000000000000E8240000B40100000000000008250000B40100000000000008250000B401000000000000E8240000B40100000000000048250000B40100000000000068250000B401000000000000A82C0000B401000000000000102D0000B401000000000000E0230000B40100000000000088260000B401000000000000A8260000B401000000000000C8260000B401000000000000F8260000B40100000000000028270000B40100000000000048270000B40100000000000068270000B40100000000000088270000B401000000000000A8270000B401000000000000A8270000B401000000000000302D0000B401000000000000E0230000B40100000000000088260000B40100000000000088260000B401000000000000F8270000B40100000000000018280000B401000000000000502D0000B401000000000000702D0000B401000000000000A82D0000B401000000000000C82D0000B401000000000000E82D0000B40100000000000020140000B40100000000000020140000B40100000000000010290000B40100000000000038290000B40100000000000058290000B40100000000000078290000B40100000000000098290000B40100000000000020140000B401000000000000B8290000B40100000000000000240000B401000000000000C0230000B40100000000000088250000B401000000000000A8250000B401000000000000C8250000B401000000000000E8250000B40100000000000008260000B40100000000000028260000B40100000000000048260000B40100000000000068260000B40100000000000038280000B40100000000000068280000B40100000000000090280000B401000000000000C0280000B401000000000000E8280000B40100000000000038280000B40100000000000080360000B401000000000000002F0000B40100000000000020370000B40100000000000068370000B40100000000000048370000B40100000000000010300000B40100000000000088370000B401000000000000A8370000B401000000000000C8370000B401000000000000E8370000B40100000000000038380000B40100000000000088380000B401000000000000D8380000B40100000000000058390000B401000000000000D8380000B40100000000000058390000B401000000000000D8380000B401000000000000402F0000B401000000000000702F0000B401000000000000A02F0000B401000000000000E02F0000B401000000000000B82E0000B401000000000000E02E0000B401000000000000E02E0000B40100000000000038300000B40100000000000060300000B40100000000000088300000B401000000000000B0300000B401000000000000E0300000B40100000000000010310000B40100000000000038310000B40100000000000068310000B40100000000000088310000B401000000000000A8310000B401000000000000C8310000B401000000000000E8310000B40100000000000008320000B40100000000000028320000B40100000000000048320000B40100000000000068320000B40100000000000088320000B401000000000000A8320000B401000000000000C8320000B401000000000000E8320000B40100000000000008330000B40100000000000028330000B40100000000000050330000B40100000000000080330000B401000000000000A8330000B401000000000000D0330000B401000000000000F0330000B40100000000000018340000B40100000000000040340000B40100000000000068340000B40100000000000098340000B401000000000000C0340000B401000000000000F0340000B40100000000000020140000B40100000000000020350000B40100000000000040350000B40100000000000060350000B40100000000000080350000B401000000000000D0330000B401000000000000A0350000B401000000000000C0350000B401000000000000E0350000B40100000000000000360000B40100000000000020360000B40100000000000040360000B40100000000000060360000B40100000000000020140000B401000000000000083D0000B401000000000000083D0000B401000000000000083D0000B401000000000000483C0000B401000000000000C0460000B40100000000000070400000B40100000000000058460000B40100000000000048440000B401000000000000103C0000B40100000000000018410000B401000000000000903F0000B401000000000000483C0000B401000000000000903F0000B40100000000000038420000B401000000000000D0410000B401000000000000A8400000B40100000000000020420000B401000000000000483C0000B401000000000000B83C0000B40100000000000048430000B401000000000000E0430000B401000000000000483C0000B40100000000000000430000B40100000000000028460000B401000000000000903F0000B401000000000000F0450000B40100000000000090460000B4010000...[truncated]"
  },
  "message": "GarbageCollection"
}

Event ID 19: ClrInstanceID=.

Channel: Operational
Level: Informational
Task: GC
Opcode: GCBulkEdge

Message #

ClrInstanceID=%1;__Index=%2;__Count=%3

Fields #

Name	Description
`Index`
`Count`
`ClrInstanceID`
`Values`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 19,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1552,
      "thread_id": 1680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 23,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.427Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 8,
    "Count": 756,
    "Index": 0,
    "Values": "2C132102000000004C482102000000006C48210200000000A0142102000000007C22210200000000F414210200000000A8152102000000007014210200000000641B210200000000C01B210200000000082221020000000050222102000000009C20210200000000EC20210200000000081D210200000000481D210200000000641D210200000000801D2102000000009C1D210200000000B81D210200000000D41D210200000000F01D2102000000000C1E210200000000281E210200000000441E210200000000481D210200000000641D210200000000801D2102000000009C1D210200000000B81D210200000000D41D210200000000F01D2102000000000C1E210200000000281E210200000000441E210200000000781B2102000000003422210200000000D022210200000000CC25210200000000EC25210200000000AC252102000000000040210200000000342321020000000030B22102000000005C232102000000007C2321020000000068252102000000002812210200000000D022210200000000D022210200000000D02221020000000030402102000000007C402102000000007C4021020000000090402102000000001445210200000000B447210200000000284621020000000044462102000000000C47210200000000B046210200000000C046210200000000A046210200000000A046210200000000EC46210200000000FC46210200000000A046210200000000A046210200000000F4472102000000009C44210200000000B44721020000000038482102000000008C482102000000004C482102000000006C48210200000000F848210200000000F86121020000000064632102000000002C632102000000005C7A2102000000000864210200000000D063210200000000A4772102000000007C64210200000000D06321020000000098642102000000007C7C21020000000010B121020000000028B12102000000007064210200000000281221020000000070AA21020000000064632102000000008C6421020000000010B3210200000000B4C8210200000000C06921020000000028122102000000002812210200000000281221020000000028122102000000002812210200000000281221020000000028122102000000006C652102000000006C652102000000002812210200000000C865210200000000DC65210200000000DC65210200000000DC65210200000000106621020000000024662102000000002466210200000000106621020000000054662102000000004C65210200000000F46A210200000000286B2102000000005C6521020000000004672102000000001467210200000000286721020000000048672102000000006867210200000000786721020000000088672102000000009867210200000000AC67210200000000AC67210200000000386B2102000000005C6521020000000004672102000000000467210200000000F0672102000000000468210200000000486B210200000000586B210200000000746B210200000000846B210200000000946B21020000000028122102000000002812210200000000A468210200000000BC68210200000000D068210200000000E468210200000000F86821020000000028122102000000000C692102000000006466210200000000746621020000000084662102000000009466210200000000A466210200000000B466210200000000C466210200000000D466210200000000E466210200000000F4662102000000001868210200000000386821020000000050682102000000007068210200000000886821020000000018682102000000002071210200000000FC6B210200000000747121020000000098712102000000008871210200000000CC6C210200000000A871210200000000B871210200000000C871210200000000D8712102000000000072210200000000287221020000000050722102000000009072210200000000507221020000000090722102000000005072210200000000306C210200000000546C210200000000786C210200000000AC6C210200000000E86C210200000000006D210200000000006D210200000000146D210200000000306D2102000000004C6D210200000000686D210200000000886D210200000000A86D210200000000C46D210200000000E46D210200000000F86D2102000000000C6E210200000000206E210200000000346E210200000000486E2102000000005C6E210200000000706E210200000000846E210200000000986E210200000000AC6E210200000000C06E210200000000D46E210200000000E86E210200000000FC6E210200000000186F210200000000386F210200000000506F210200000000686F2102000000007C6F210200000000946F210200000000AC6F210200000000C86F210200000000E86F210200000000047021020000000024702102000000002812210200000000447021020000000058702102000000006C702102000000008070210200000000686F2102000000009470210200000000A870210200000000BC70210200000000D070210200000000E470210200000000F8702102000000000C712102000000002812210200000000E47321020000000018752102000000006075210200000000B475210200000000CC752102000000007064210200000000A87521020000000018752102000000003075210200000000607521020000000048752102000000009C73210200000000E4732102000000003C782102000000005878210200000000A076210200000000387A210200000000207A210200000000A4772102000000006C762102000000003C77210200000000507A210200000000447A210200000000A477210200000000087721020000000058782102000000008C79210200000000D4792102000000008C79210200000000A479210200000000D479210200000000BC79210200000000907A210200000000EC63210200000000D0AA21020000000094AA210200000000D0AA210200000000ACB1210200000000C4B1210200000000C4AA21020000000020AB21020000000094AA210200000000DCB0210200000000E8B021020000000084AB21020000000028A3210200000000ACAB21020000000028A321020000000068AB21020000000048AB210200000000BCAB21020000000048AC210200000000FC46210200000000D046210200000000ACAB210200000000281221020000000070AA210200000000F46221020000000064B12102000000008CCC21020000000010B32102000000002812210200000000281221020000000010B32102000000002812210200000000C069210200000000281221020000000098C9210200000000E4C8210200000000E4B421020000000078B521020000000094B421020000000000DE21020000000004D2210200000000B4DD2102000000000CB621020000000018B5210200000000F8C921020000000078C9210200000000ACB52102000000008CC921020000000078C92102000000008CBB2102000000008CBB2102000000008CBB210200000000C8BC21020000000008C7210200000000B0C2210200000000E8C2210200000000F8C32102000000004CC12102000000004CC121020000000068C121020000000068C121020000000084C121020000000084C1210200000000A0C1210200000000A0C1210200000000BCC1210200000000BCC1210200000000D8C1210200000000D8C1210200000000F4C1210200000000F4C121020000000010C221020000000010C22102000000002CC22102000000002CC221020000000048C221020000000048C221020000000064C221020000000064C22102000000002CC52102000000002CD3210200000000D4D121020000000078C52102000000002CBB2102000000007CD5210200000000A8C8210200000000B4C821020000000010B32102000000002812210200000000C069210200000000281221020000000018C921020000000098C8210200000000A8C721020000000078C9210200000000A8C721020000000000DE21020000000004D2210200000000B4DD2102000000000CB621020000000078C92102000000000CB221020000000048B2210200000000342321020000000080F421020000000030B221020000000018D221020000000048D2210200000000F8D12102000000003CD221020000000070D221020000000010D321020000000068D3210200000000BCD221020000000070D2210200000000BCD2210200000000B8D321020000000078D32102000000002CD3210200000000A4D321020000000070D221020000000064BB210200000000981C210200000000A0D2210200000000CCD321020000000010D4210200000000981C2102000000002CD321020000000078D321020000000070D2210200000000A0D22102000000002CD321020000000078D321020000000070D22102000000007CD521020000000048DF21020000000078DF210200000000A8DF210200000000E8DF2102000000000CE021020000000044E021020000000078E0210200000000C8E021020000000078DF21020000000000E1210200000000A8DF21020000000038E121020000000048DF21020000000070E1210200000000E8DF210200000000A8E12102000000000CE0210200000000E0E121020000000044E021020000000018E221020000000078E02102000000001840210200000000DCE021020000000014E12102000000004CE121020000000084E1210200000000BCE1210200000000F4E12102000000002CE2210200000000A0E02102000000002812210200000000FCB221020000000034B321020000000048B321020000000054B32102000000008CBB2102000000007849210200000000ACCD21020000000050252102000000001046210200000000601C2102000000007C1C210200000000981C210200000000B41C210200000000D01C210200000000EC1C21020000000014C5210200000000381221020000000098BB210200000000B8BB210200000000D8BB210200000000F8BB21020000000004BC21020000000010BC21020000000044B42102000000000CB621020000000074B421020000000050B4210200000000141D210200000000C4AA210200000000C07A2102000000006C7B210200000000287C2102000000007C7C21020000000020712102000000002073210200000000F46421020000000020732102000000006C77210200000000D07621020000000008B4210200000000C069210200000000B473210200000000A869210200000000346921020000000044462102000000009848210200000000144821020000000020482102000000009C44210200000000601E2102000000008C1F2102000000004C492102000000006440210200000000EC61210200000000F84821020000000080C2210200000000F8BB2102000000008446210200000000D04621020000000028BE21020000000028122102000000003423210200000000C412210200000000DC122102000000004414210200000000E415210200000000001621020000000010162102000000002C1621020000000058162102000000007816210200000000A016210200000000DC16210200000000181721020000000058172102000000008C17210200000000B017210200000000E41721020000000010182102000000003C182102000000005C182102000000008418210200000000B018210200000000E8182102000000000C192102000000003C19210200000000541A210200000000A41A210200000000EC1A210200000000F01B2102000000000C1C210200000000281C210200000000441C210200000000601C2102000000007C1C210200000000981C210200000000B41C210200000000D01C210200000000EC1C210200000000481D210200000000641D210200000000801D2102000000009C1D210200000000B81D210200000000D41D210200000000F01D2102000000000C1E210200000000281E210200000000441E210200000000D8242102000000001C2521020000000014452102000000008445210200000000984521020000000054462102000000006C46210200000000A0462102000000004C472102000000005C472102000000007447210200000000944721020000000038642102000000005464210200000000BC64210200000000D8642102000000003C652102000000004C652102000000005C652102000000006C65210200000000C865210200000000DC652102000000001066210200000000246621020000000054662102000000006466210200000000746621020000000084662102000000009466210200000000A466210200000000B466210200000000C466210200000000D466210200000000E466210200000000F46621020000000004672102000000001467210200000000286721020000000048672102000000006867210200000000786721020000000088672102000000009867210200000000AC67210200000000F067210200000000046821020000000018682102000000003868210200000000506821020000000070682102000000008868210200000000A468210200000000BC68210200000000D068210200000000E468210200000000F8682102000000000C692102000000003469210200000000FC6B210200000000306C210200000000546C210200000000786C210200000000AC6C210200000000CC6C210200000000E86C210200000000006D210200000000146D210200000000306D2102000000004C6D210200000000686D210200000000886D210200000000A86D210200000000C46D210200000000E46D210200000000F86D2102000000000C6E210200000000206E210200000000346E210200000000486E2102000000005C6E210200000000706E210200000000846E210200000000986E210200000000AC6E210200000000C06E210200000000D46E210200000000E86E210200000000FC6E210200000000186F210200000000386F210200000000506F210200000000686F2102000000007C6F210200000000946F210200000000AC6F210200000000C86F210200000000E86F21020000000004702102000000002470210200000000447021020000000058702102000000006C7021020000000080702102000000009470210200000000A870210200000000BC70210200000000D070210200000000E470210200000000F8702102000000000C71210200000000D072210200000000EC722102000000007875210200000000C07A210200000000DC7A210200000000B87B210200000000507D210200000000A07D21020000000070A321020000000090A32102000000004CA421020000000068A421020000000020A621020000000038A621020000000058A6210200000000B0A821020000000008BA21020000000048BB21020000000064BB21020000000038BC210200000000F4BE210200000000F8C02102000000004CC121020000000068C121020000000084C1210200000000A0C1210200000000BCC1210200000000D8C1210200000000F4C121020000000010C22102000000002CC221020000000048C221020000000064C2210200000000A4C3210200000000C0C3210200000000DCC321020000000004C42102000000001CC62102000000009CC621020000000070D2210200000000A0D221020000000070D921020000000030DA21020000000048DA21020000000064DA21020000000080DA210200000000BCDA21020000000048DF21020000000078DF210200000000A8DF210200000000E8DF2102000000000CE021020000000044E021020000000078E021020000000050E2210200000000B4F4210200000000401B210200000000401B210200000000401B210200000000081D210200000000981B2102000000003422210200000000981B210200000000401B21020000000064DD210200000000401B2102000000002063210200000000AC23210200000000D8232102000000000C242102000000004C24210200000000942421020000000080252102000000007862210200000000F4622102000000002C63210200000000B463210200000000D063210200000000EC6321020000000070642102000000004C7B2102000000000CB221020000000048B221020000000090B3210200000000ACB32102000000000CB82102000000002CBB21020000000080BB21020000000004BC2102000000001CBC210200000000A8BC210200000000C8BC21020000000088C0210200000000F8C321020000000054D9210200000000D8DA210200000000B0DB210200000000D4DB210200000000D0DC210200000000E4DC2102000000002CDD210200000000"
  },
  "message": ""
}

Event ID 20: High:ClrInstanceID=Address.

Channel: Operational
Task: GC
Opcode: GCSampledObjectAllocation

Message #

High:ClrInstanceID=%1;
Address=%2;
TypeID=%3;
ObjectCountForTypeSample=%4;
TotalSizeForTypeSample=%5

Fields #

Name	Description
`Address` Pointer
`TypeID` Pointer
`ObjectCountForTypeSample` UInt32
`TotalSizeForTypeSample` UInt64
`ClrInstanceID` UInt16

Event ID 21: ClrInstanceID=Index.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCBulkSurvivingObjectRanges

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Index` UInt32
`Count` UInt32
`ClrInstanceID` UInt16
`Values` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 21,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 25,
    "keywords": "0x0000000000400000",
    "time_created": "2026-06-02T05:22:23.457+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 5,
    "Index": 0,
    "Values": "38100010B4010000F02700000000000048380010B40100001804000000000000803C0010B4010000F81F000000000000985C0010B4010000D83F000000000000909C0010B4010000987F000000000000"
  },
  "message": "GarbageCollection"
}

Event ID 22: ClrInstanceID=Index.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCBulkMovedObjectRanges

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Index` UInt32
`Count` UInt32
`ClrInstanceID` UInt16
`Values` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 22,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 26,
    "keywords": "0x0000000000400000",
    "time_created": "2026-06-02T05:22:23.457+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14508,
      "thread_id": 4072
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 457,
    "Index": 0,
    "Values": "4810559ED50100003010559ED5010000C0030000000000000814559ED50100000814559ED501000038000000000000004014559ED50100004014559ED50100002003000000000000F017559ED50100006017559ED501000028000000000000003818559ED50100008817559ED5010000E000000000000000D019559ED50100008018559ED50100009004000000000000A01F559ED5010000281D559ED501000058010000000000007822559ED5010000801E559ED50100002000000000000000A023559ED5010000A01E559ED50100008816000000000000E83A559ED50100004035559ED50100002800000000000000B83B559ED50100006835559ED5010000C003000000000000903F559ED50100004039559ED5010000A8010000000000005841559ED5010000E83A559ED50100001800000000000000D041559ED5010000003B559ED501000080000000000000000043559ED5010000803B559ED50100008001000000000000D044559ED5010000003D559ED5010000C000000000000000B045559ED5010000D83D559ED501000028020000000000001048559ED50100000040559ED50100005001000000000000B849559ED50100005041559ED5010000C001000000000000104C559ED50100002843559ED5010000D800000000000000904D559ED50100000044559ED50100000002000000000000B84F559ED50100000046559ED501000038000000000000006050559ED50100003846559ED5010000A0060000000000001857559ED5010000F04C559ED50100009000000000000000D857559ED5010000804D559ED50100007802000000000000D05A559ED5010000F84F559ED50100006000000000000000085C559ED50100005850559ED5010000B001000000000000E85F559ED50100002052559ED501000038000000000000002862559ED50100005852559ED50100008800000000000000D863559ED5010000E052559ED5010000B80A0000000000001070559ED5010000B05D559ED50100001002000000000000B072559ED5010000C05F559ED501000088000000000000006073559ED50100004860559ED50100005000000000000000E874559ED50100009860559ED50100008800000000000000B875559ED50100002061559ED5010000F003000000000000C879559ED50100002865559ED50100003001000000000000A07B559ED50100005866559ED50100009800000000000000507D559ED5010000F066559ED50100003800000000000000B88C559ED50100002867559ED50100003001000000000000408F559ED50100005868559ED501000068000000000000008891559ED5010000C068559ED5010000F803000000000000B095559ED5010000D06C559ED501000038000000000000002096559ED5010000086D559ED501000038000000000000007896559ED5010000406D559ED50100001009000000000000A09F559ED50100006876559ED5010000A80200000000000090A2559ED50100001079559ED5010000A80400000000000050A7559ED5010000D07D559ED5010000700700000000000050B0559ED50100005885559ED5010000E00000000000000050B1559ED50100003886559ED50100003802000000000000B0B3559ED50100007088559ED5010000380300000000000018B8559ED5010000C08B559ED5010000B003000000000000F0C5559ED5010000708F559ED5010000700000000000000080C6559ED5010000F88F559ED5010000800000000000000028C7559ED50100007890559ED5010000800000000000000000C8559ED5010000F890559ED5010000580300000000000080CB559ED50100006894559ED5010000A00000000000000048CC559ED50100000895559ED5010000580000000000000048CD559ED50100006095559ED5010000D80200000000000048D0559ED50100005098559ED5010000500000000000000038D1559ED5010000A098559ED5010000A80000000000000070D5559ED50100004899559ED5010000380000000000000028E2559ED50100008099559ED5010000200000000000000090E2559ED5010000A099559ED5010000100600000000000000E9559ED5010000C89F559ED5010000480000000000000008EA559ED501000010A0559ED5010000480000000000000000EC559ED501000058A0559ED5010000D005000000000000F0F1559ED501000040A6559ED50100002000000000000000D0F4559ED501000060A6559ED50100003800000000000000E8FF559ED501000098A6559ED5010000C810000000000000C810569ED501000078B7559ED501000038000000000000006813569ED5010000B0B7559ED5010000F800000000000000A014569ED5010000A8B8559ED50100005000000000000000501A569ED5010000F8B8559ED50100002800000000000000A81B569ED501000020B9559ED50100000801000000000000E81F569ED501000028BA559ED501000050050000000000005825569ED501000090BF559ED501000050000000000000001826569ED5010000E0BF559ED501000090020000000000001829569ED501000070C2559ED5010000C002000000000000282C569ED501000048C5559ED50100008801000000000000502E569ED5010000D0C6559ED50100009000000000000000802F569ED501000060C7559ED50100001001000000000000E830569ED501000070C8559ED501000030000000000000007031569ED5010000A0C8559ED501000058010000000000006837569ED501000010CA559ED501000070000000000000007040569ED501000080CA559ED50100003800000000000000C040569ED5010000...[truncated]"
  },
  "message": "GarbageCollection"
}

Event ID 23: ClrInstanceID=Generation.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCGenerationRange

Message #

ClrInstanceID=%1;
Generation=%2;
RangeStart=%3;
RangeUsedLength=%4;
RangeReservedLength=%5

Fields #

Name	Description
`Generation` UInt8
`RangeStart` Pointer
`RangeUsedLength` UInt64
`RangeReservedLength` UInt64
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 23,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 27,
    "keywords": "0x0000000000400000",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14232,
      "thread_id": 13300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 10,
    "Generation": 3,
    "RangeReservedLength": 134213632,
    "RangeStart": "0x20C77AB1000",
    "RangeUsedLength": 1421496
  },
  "message": "GarbageCollection"
}

Event ID 25: HeapNum=.

Channel: Operational
Task: GC
Opcode: MarkStackRoots

Description

HeapNum=HeapNum; ClrInstanceID=ClrInstanceID

Message #

HeapNum=%1;
ClrInstanceID=%2

Fields #

Name	Description
`HeapNum` UInt32
`ClrInstanceID` UInt16

Event ID 26: HeapNum=.

Channel: Operational
Task: GC
Opcode: MarkFinalizeQueueRoots

Description

HeapNum=HeapNum; ClrInstanceID=ClrInstanceID

Message #

HeapNum=%1;
ClrInstanceID=%2

Fields #

Name	Description
`HeapNum` UInt32
`ClrInstanceID` UInt16

Event ID 27: HeapNum=.

Channel: Operational
Task: GC
Opcode: MarkHandles

Description

HeapNum=HeapNum; ClrInstanceID=ClrInstanceID

Message #

HeapNum=%1;
ClrInstanceID=%2

Fields #

Name	Description
`HeapNum` UInt32
`ClrInstanceID` UInt16

Event ID 28: HeapNum=.

Channel: Operational
Task: GC
Opcode: MarkCards

Description

HeapNum=HeapNum; ClrInstanceID=ClrInstanceID

Message #

HeapNum=%1;
ClrInstanceID=%2

Fields #

Name	Description
`HeapNum` UInt32
`ClrInstanceID` UInt16

Event ID 29: TypeID=.

Channel: Operational
Also via: realtime ETW trace
Level: Verbose
Task: GC
Opcode: FinalizeObject

Description

TypeID=TypeID; ObjectID=ObjectID; ClrInstanceID=ClrInstanceID

Message #

TypeID=%1;
ObjectID=%2;
ClrInstanceID=%3

Fields #

Name	Description
`TypeID` Pointer
`ObjectID` Pointer
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 29,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 32,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.463+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 15288
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "ObjectID": "0x1B40000B150",
    "TypeID": "0x7FF9E3143430"
  },
  "message": "GarbageCollection"
}

Event ID 30: HandleID=HandleID.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: SetGCHandle

Message #

HandleID=%1;
ObjectID=%2;
Kind=%3;
Generation=%4;
AppDomainID=%5;
ClrInstanceID=%6

Fields #

Name	Description
`HandleID` Pointer
`ObjectID` Pointer
`Kind` UInt32
`Generation` UInt32
`AppDomainID` UInt64
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 30,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 33,
    "keywords": "0x0000000000000002",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 16352,
      "thread_id": 20944
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainID": 1985424221824,
    "ClrInstanceID": 9,
    "Generation": 0,
    "HandleID": "0x1CE44EC4440",
    "Kind": 0,
    "ObjectID": "0x0"
  },
  "message": "GarbageCollection"
}

Event ID 31: HandleID=HandleID.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: DestoryGCHandle

Message #

HandleID=%1;
ClrInstanceID=%2

Fields #

Name	Description
`HandleID` Pointer
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 31,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 34,
    "keywords": "0x0000000000000002",
    "time_created": "2026-06-02T05:22:23.461+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 16352,
      "thread_id": 20944
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "HandleID": "0x1CE44EC4448"
  },
  "message": "GarbageCollection"
}

Event ID 32: Low:ClrInstanceID=Address.

Channel: Operational
Task: GC
Opcode: GCSampledObjectAllocation

Message #

Low:ClrInstanceID=%1;
Address=%2;
TypeID=%3;
ObjectCountForTypeSample=%4;
TotalSizeForTypeSample=%5

Fields #

Name	Description
`Address` Pointer
`TypeID` Pointer
`ObjectCountForTypeSample` UInt32
`TotalSizeForTypeSample` UInt64
`ClrInstanceID` UInt16

Event ID 33: HandleID=MethodIdentifier.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Verbose
Task: GC
Opcode: PinObjectAtGCTime
Source: Trace

Message #

HandleID=%1;
ObjectID=%2;
ObjectSize=%3;
TypeName=%4;
;
ClrInstanceID=%5

Fields #

Name	Description
`HandleID` Pointer
`ObjectID` Pointer
`ObjectSize` UInt64
`TypeName` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 33,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 36,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17236,
      "thread_id": 11988
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 7,
    "HandleID": "0x162A9D417C0",
    "ObjectID": "0x162B9EF0AF0",
    "ObjectSize": 4120,
    "TypeName": "System.Object[]"
  },
  "message": "GarbageCollection"
}

Event ID 33: HandleID=.

Channel: Operational
Level: Verbose
Task: GC
Opcode: PinObjectAtGCTime

Message #

HandleID=%1;__ObjectID=%2;__ObjectSize=%3;__TypeName=%4;__;__ClrInstanceID=%5

Fields #

Name	Description
`HandleID`
`ObjectID`
`ObjectSize`
`TypeName`
`ClrInstanceID`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 33,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9848,
      "thread_id": 11732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 36,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.422Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "HandleID": "0x21D1AFE1600",
    "ObjectID": "0x21D1D1DF050",
    "ObjectSize": 56,
    "TypeName": "_s__RTTIBaseClassDescriptor"
  },
  "message": ""
}

Event ID 34: Method Load/UnLoad Info

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`MethodIdentifier` mof:UInt64
`ModuleID` mof:UInt64
`MethodStartAddress` mof:UInt64
`MethodSize` mof:UInt32
`MethodToken` mof:UInt32
`MethodFlags` mof:UInt32

Event ID 35: Reason=.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: Triggered
Source: Trace

Description

Reason=Reason

Message #

Reason=%1

Fields #

Name	Description
`Reason` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 35,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 35,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14232,
      "thread_id": 13300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 10,
    "Reason": 1
  },
  "message": "GarbageCollection"
}

Event ID 35: Reason=.

Channel: Operational
Level: Informational
Task: GC
Opcode: Triggered

Message #

Reason=%1

Fields #

Name	Description
`Reason`
`ClrInstanceID`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 35,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9848,
      "thread_id": 11732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 35,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.422Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "Reason": 1
  },
  "message": ""
}

Event ID 36: ClrInstanceID=MethodIdentifier.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCBulkRootCCW
Source: Trace

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Count` UInt32
`ClrInstanceID` UInt16
`Values` Int8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 36,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 38,
    "keywords": "0x0000000000100000",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 4,
    "Values": "E0197F76B401000068790000B401000070D313E3F97F000098FE8A76B4010000010000000000000001000000E8197F76B401000000430000B401000000AA6AC4F97F000018FF8A76B4010000020000000000000001000000F0197F76B401000010440000B4010000A0010DE3F97F000098FF8A76B4010000010000000000000001000000F8197F76B401000080150000B401000008600CE3F97F000018008A76B4010000030000000000000001000000"
  },
  "message": "GarbageCollection"
}

Event ID 36: ClrInstanceID=.

Channel: Operational
Level: Informational
Task: GC
Opcode: GCBulkRootCCW

Message #

ClrInstanceID=%1;__Index=%2;__Count=%3

Fields #

Name	Description
`Count`
`ClrInstanceID`
`Values`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 36,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3820,
      "thread_id": 2688
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 38,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.430Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "Count": 2,
    "Values": "E8190AF487010000103B00808701000008068C78FE7F000018FF15F487010000000000000000000000000000F8190AF4870100002815008087010000380D8E9EFE7F0000180015F487010000010000000000000001000000"
  },
  "message": ""
}

Event ID 37: ClrInstanceID=MethodIdentifier.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCBulkRCW
Source: Trace

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Count` UInt32
`ClrInstanceID` UInt16
`Values` Int8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 37,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 39,
    "keywords": "0x0000000000100000",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "Count": 1,
    "Values": "48790000B401000088D514E3F97F0000E01F1C76B401000058E1E5F9F97F00000100000000000000"
  },
  "message": "GarbageCollection"
}

Event ID 37: ClrInstanceID=.

Channel: Operational
Level: Informational
Task: GC
Opcode: GCBulkRCW

Message #

ClrInstanceID=%1;__Index=%2;__Count=%3

Fields #

Name	Description
`Count`
`ClrInstanceID`
`Values`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 37,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7312,
      "thread_id": 1804
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 39,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.436Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "Count": 1,
    "Values": "F047AC37DC010000D0B48F9EFE7F0000A0E3E24FDC010000E0C9C5B1FE7F00000100000000000000"
  },
  "message": ""
}

Event ID 38: ClrInstanceID=MethodIdentifier.

Channel: ETW Trace
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GCBulkRootStaticVar
Source: Trace

Message #

ClrInstanceID=%1;
Index=%2;
Count=%3

Fields #

Name	Description
`Count` UInt32
`AppDomainID` UInt64
`ClrInstanceID` UInt16
`Values` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 38,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 40,
    "keywords": "0x0000000000100000",
    "time_created": "2026-06-02T05:22:23.462+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainID": 1874586659216,
    "ClrInstanceID": 9,
    "Count": 127,
    "Values": "48100010B4010000A8BB0000B4010000789D0CE3F97F0000000000005400680072006500610064004500720072006F0072004D006F00640065004D0069006E004F007300560065007200730069006F006E00000098100010B401000028620000B401000028280CE3F97F00000000000073005F007300770069007400630068004D00610070000000A0100010B4010000C8640000B4010000685A0CE3F97F0000000000005300770069007400630068004E006F004100730079006E006300430075007200720065006E007400430075006C0074007500720065000000A8100010B401000048650000B4010000685A0CE3F97F00000000000053007700690074006300680045006E0066006F007200630065004A006100700061006E006500730065004500720061005900650061007200520061006E006700650073000000B0100010B4010000D8650000B4010000685A0CE3F97F00000000000053007700690074006300680046006F0072006D00610074004A006100700061006E006500730065004600690072007300740059006500610072004100730041004E0075006D006200650072000000B8100010B401000070660000B4010000685A0CE3F97F00000000000053007700690074006300680045006E0066006F007200630065004C00650067006100630079004A006100700061006E006500730065004400610074006500500061007200730069006E0067000000C0100010B401000008670000B4010000685A0CE3F97F0000000000005300770069007400630068005400680072006F00770045007800630065007000740069006F006E004900660044006900730070006F00730065006400430061006E00630065006C006C006100740069006F006E0054006F006B0065006E0053006F0075007200630065000000C8100010B4010000B0670000B4010000685A0CE3F97F000000000000530077006900740063006800500072006500730065007200760065004500760065006E0074004C006900730074006E00650072004F0062006A006500630074004900640065006E0074006900740079000000D0100010B401000060680000B4010000685A0CE3F97F0000000000005300770069007400630068005500730065004C00650067006100630079005000610074006800480061006E0064006C0069006E0067000000D8100010B4010000C8680000B4010000685A0CE3F97F00000000000053007700690074006300680042006C006F0063006B004C006F006E006700500061007400680073000000E0100010B401000020690000B4010000685A0CE3F97F00000000000053007700690074006300680044006F004E006F00740041006400640072004F00660043007300700050006100720065006E007400570069006E0064006F007700480061006E0064006C0065000000E8100010B4010000C8690000B4010000685A0CE3F97F0000000000005300770069007400630068005300650074004100630074006F007200410073005200650066006500720065006E00630065005700680065006E0043006F007000790069006E00670043006C00610069006D0073004900640065006E0074006900740079000000F0100010B4010000886A0000B4010000685A0CE3F97F000000000000530077006900740063006800490067006E006F007200650050006F0072007400610062006C006500500044004200730049006E0053007400610063006B005400720061006300650073000000F8100010B4010000186B0000B4010000685A0CE3F97F0000000000005300770069007400630068005500730065004E00650077004D006100780041007200720061007900530069007A006500000000110010B4010000A06B0000B4010000685A0CE3F97F00000000000053007700690074006300680055007300650043006F006E00630075007200720065006E00740046006F0072006D0061007400740065007200540079007000650043006100630068006500000008110010B4010000406C0000B4010000685A0CE3F97F0000000000005300770069007400630068005500730065004C006500670061006300790045007800650063007500740069006F006E0043006F006E0074006500780074004200650068006100760069006F007200550070006F006E0055006E0064006F004600610069006C00750072006500000010110010B4010000F06C0000B4010000685A0CE3F97F000000000000530077006900740063006800430072007900700074006F006700720061007000680079005500730065004C006500670061006300790046006900700073005400680072006F007700000018110010B4010000786D0000B4010000685A0CE3F97F00000000000053007700690074006300680044006F004E006F0074004D00610072007300680061006C004F0075007400420079007200650066005300610066006500410072007200610079004F006E0049006E0076006F006B006500000020110010B4010000286E0000B4010000685A0CE3F97F0000000000005300770069007400630068005500730065004E006500740043006F0072006500540069006D0065007200000028110010B401000020140000B4010000685A0CE3F97F00000000000045006D00700074007900000088110010B4010000083D0000B401000068B50CE3F97F00000000000049006E007300740061006E0063006500000060120010B401000030440000B4010000801514E3F97F000000000000560061006C00750065000000D0120010B401000078960000B4010000A83314E3F97F0000000000006D005F006F0073000000E0120010...[truncated]"
  },
  "message": "GarbageCollection"
}

Event ID 38: ClrInstanceID=.

Channel: Operational
Level: Informational
Task: GC
Opcode: GCBulkRootStaticVar

Message #

ClrInstanceID=%1;__Index=%2;__Count=%3

Fields #

Name	Description
`Count`
`AppDomainID`
`ClrInstanceID`
`Values`

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 38,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1552,
      "thread_id": 1680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 40,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:51.427Z",
    "version": 0
  },
  "event_data": {
    "AppDomainID": 23221144,
    "ClrInstanceID": 8,
    "Count": 72,
    "Values": "2810210300000000184021020000000070D2687300000000000000005400680072006500610064004500720072006F0072004D006F00640065004D0069006E004F007300560065007200730069006F006E0000003010210300000000DCE0210200000000149B69730000000000000000430075007200720065006E00740055007300650072000000341021030000000014E1210200000000149B697300000000000000004C006F00630061006C004D0061006300680069006E006500000038102103000000004CE1210200000000149B6973000000000000000043006C006100730073006500730052006F006F00740000003C1021030000000084E1210200000000149B697300000000000000005500730065007200730000004010210300000000BCE1210200000000149B6973000000000000000050006500720066006F0072006D0061006E0063006500440061007400610000004410210300000000F4E1210200000000149B69730000000000000000430075007200720065006E00740043006F006E00660069006700000048102103000000002CE2210200000000149B69730000000000000000440079006E00440061007400610000004C10210300000000A0E0210200000000B6616173000000000000000068006B00650079004E0061006D0065007300000098102103000000002812210200000000DCAB6873000000000000000045006D0070007400790000009C10210300000000FCB22102000000007430697300000000000000005F0069006E00760061007200690061006E007400430075006C0074007500720065000000A01021030000000034B32102000000007430697300000000000000005F0069006E00760061007200690061006E007400430075006C007400750072006500490067006E006F007200650043006100730065000000A41021030000000048B3210200000000E4A2697300000000000000005F006F007200640069006E0061006C000000A81021030000000054B3210200000000E4A2697300000000000000005F006F007200640069006E0061006C00490067006E006F007200650043006100730065000000C8102103000000008CBB210200000000E8796873000000000000000049006E007300740061006E00630065000000D8102103000000007849210200000000A4356273000000000000000069006E007300740061006E00630065000000F010210300000000ACCD210200000000066561730000000000000000630061007400650067006F007200790046006F0072004C006100740069006E00310000006C1121030000000050252102000000001094687300000000000000006D005F006F007300000074112103000000001046210200000000D0826873000000000000000045006D0070007400790000009011210300000000601C21020000000024BC68730000000000000000560061006C00750065005400790070006500000094112103000000007C1C21020000000024BC6873000000000000000045006E0075006D00540079007000650000009811210300000000981C21020000000024BC687300000000000000004F0062006A00650063007400540079007000650000009C11210300000000B41C21020000000024BC6873000000000000000053007400720069006E00670054007900700065000000A011210300000000D01C21020000000024BC68730000000000000000440065006C006500670061007400650054007900700065000000A811210300000000EC1C21020000000024BC6873000000000000000073005F00740079007000650064005200650066000000AC1121030000000014C5210200000000A0E56873000000000000000073005F0041006300740069007600610074006F007200430061006300680065000000B8112103000000003812210200000000C4AE687300000000000000005F0073006800610072006500640053007400610074006900630073000000DC1121030000000098BB2102000000004C7A68730000000000000000460069006C007400650072004100740074007200690062007500740065000000E011210300000000B8BB2102000000004C7A68730000000000000000460069006C007400650072004E0061006D0065000000E411210300000000D8BB2102000000004C7A68730000000000000000460069006C007400650072004E0061006D006500490067006E006F007200650043006100730065000000E811210300000000F8BB2102000000009C7A687300000000000000004D0069007300730069006E0067000000EC1121030000000004BC21020000000032636173000000000000000045006D00700074007900540079007000650073000000F01121030000000010BC210200000000287B68730000000000000000640065006600610075006C007400420069006E006400650072000000441321030000000044B42102000000004033697300000000000000004100730073006500720074005000650072006D0069007300730069006F006E00000048132103000000000CB6210200000000D098697300000000000000004100730073006500720074005000650072006D0069007300730069006F006E0054006F006B0065006E000000541321030000000074B42102000000006C996973000000000000000073005F0074006800650054006F006B0065006E0046006100630074006F007200790000005C1321030000000050B421020000000030996973000000000000000073005F0074006F006B0065006E0053006500740000001815210300000000141D21020000000032636173000000000000000073005F00720075006E00740069006D006500450076006900640065006E00630065005400790070006500730000006C15210300000000C4AA21020000000060B969730000000000000000440065006600610075006C00740000007415210300000000C07A21020000000024BC687300000000000000005F006D0069006E005200650073006F007500720063006500530065007400000078152103000000006C7B210200000000DCAB6873000000000000000052006500730052006500610064006500720054007900700065004E0061006D00650000007C15210300000000287C210200000000DCAB6873000000000000000052006500730053006500740054007900700065004E0061006D006500000080152103000000007C7C210200000000DCAB687300000000000000004D00730063006F0072006C00690062004E0061006D0065000000881521030000000020712102000000001CD36873000000000000000049006E00760061007200690061006E00740000008C15210300000000207321020000000084D16873000000000000000073005F007500730065007200440065006600610075006C007400430075006C00740075007200650000009015210300000000F46421020000000084D16873000000000000000073005F0049006E00760061007200690061006E007400430075006C00740075007200650049006E0066006F0000009415210300000000207321020000000084D16873000000000000000073005F007500730065007200440065006600610075006C00740055004900430075006C0074007500720065000000A4152103000000006C77210200000000A89D6873000000000000000073005F004C00630069006400430061006300680065006400430075006C00740075007200650073000000A815210300000000D076210200000000A89D6873000000000000000073005F004E0061006D006500430061006300680065006400430075006C00740075007200650073000000B01621030000000008B4210200000000B0E86873000000000000000073005F0049006E00760061007200690061006E0074000000CC16210300000000C0692102000000003CD26873000000000000000073005F0049006E00760061007200690061006E0074000000D416210300000000B473210200000000B0D36873000000000000000073005F00630061006300680065006400430075006C00740075007200650073000000D816210300000000A86921020000000070D26873000000000000000073005F00770069006E003700560065007200730069006F006E000000DC162103000000003469210200000000DCAB6873000000000000000073005F0052006500670069006F006E004B00650079000000481721030000000044462102000000004CBE6973000000000000000073005F006100630074006900760069007400790054007200610063006B006500720049006E007300740061006E006300650000004C1721030000000098482102000000009E63617300000000000000006E006900620062006C006500620069007400730000005C17210300000000144821020000000028AE6873000000000000000073005F004500760065006E00740053006F00750072006300650043007200650061007400650064004C006F0063006B000000641721030000000020482102000000003CF06873000000000000000073005F004500760065006E00740053006F007500720063006500730000006C172103000000009C442102000000004488687300000000000000004C006F00670000009417210300000000601E2102000000009E63617300000000000000007000720069006D00650073000000A4172103000000008C1F21020000000028AE687300000000000000006C006F0063006B004F0062006A000000DC172103000000004C49210200000000248B6873000000000000000073005F00640075006D006D007900440065006600610075006C00740045004300000004182103000000006440210200000000881F6473000000000000000077006F0072006B005100750065007500650000000818210300000000EC61210200000000F0206473000000000000000061006C006C0054006800720065006100640051007500650075006500730000000C18210300000000F848210200000000942F697300000000000000006300630062000000D41821030000000080C221020000000024A76973000000000000000073005F007000630061000000DC18210300000000F8BB2102000000009C7A68730000000000000000560061006C00750065000000982021030000000084462102000000008CCE6873000000000000000073005F00640065006600610075006C007400550074006600380045006E0063006F00640069006E0067004E006F0042006F006D000000AC20210300000000D0462102000000007CCF68730000000000000000750074006600380045006E0063006F00640069006E0067000000E02221030000000028BE210200000000B8F26873000000000000000053006F0072007400420079004D00650074006100640061007400610054006F006B0065006E00000088452103000000002063210200000000380AAF7200000000000000006C006F0061006400650072000000F03E21030000000064DD21020000000028AE6873000000000000000073005F0049006E007400650072006E0061006C00530079006E0063004F0062006A006500630074000000"
  },
  "message": ""
}

Event ID 39: Method Load/UnLoad Verbose Info

Channel: ETW Trace
Task: GC
Opcode: GCDynamicEvent
Source: Trace

Fields #

Name	Description
`Name` UnicodeString
`DataSize` UInt32
`Data` Binary
`ClrInstanceID` UInt16

Event ID 39

Channel: Operational
Task: GC
Opcode: GCDynamicEvent

Event ID 40: WorkerThreadCount=MethodIdentifier.

Channel: ETW Trace
Task: WorkerThreadCreationV2
Opcode: Start
Source: Trace

Message #

WorkerThreadCount=%1;
RetiredWorkerThreads=%2

Fields #

Name	Description
`WorkerThreadCount` UInt32
`RetiredWorkerThreads` UInt32

Event ID 40: WorkerThreadCount=.

Channel: Operational
Task: WorkerThreadCreationV2
Opcode: Start

Fields #

Name	Description
`WorkerThreadCount`
`RetiredWorkerThreads`

Event ID 41: WorkerThreadCount=WorkerThreadCount.

Channel: Operational
Task: WorkerThreadCreationV2
Opcode: Stop

Message #

WorkerThreadCount=%1;
RetiredWorkerThreads=%2

Fields #

Name	Description
`WorkerThreadCount` UInt32
`RetiredWorkerThreads` UInt32

Event ID 42: WorkerThreadCount=WorkerThreadCount.

Channel: Operational
Task: WorkerThreadRetirementV2
Opcode: Start

Message #

WorkerThreadCount=%1;
RetiredWorkerThreads=%2

Fields #

Name	Description
`WorkerThreadCount` UInt32
`RetiredWorkerThreads` UInt32

Event ID 43: WorkerThreadCount=WorkerThreadCount.

Channel: Operational
Task: WorkerThreadRetirementV2
Opcode: Stop

Message #

WorkerThreadCount=%1;
RetiredWorkerThreads=%2

Fields #

Name	Description
`WorkerThreadCount` UInt32
`RetiredWorkerThreads` UInt32

Event ID 44: IOThreadCount=IOThreadCount.

Channel: Operational
Task: IOThreadCreation
Opcode: Start

Message #

IOThreadCount=%1;
RetiredIOThreads=%2

Fields #

Name	Description
`IOThreadCount` UInt32
`RetiredIOThreads` UInt32
`ClrInstanceID` UInt16

Event ID 45: IOThreadCount=IOThreadCount.

Channel: Operational
Task: IOThreadCreation
Opcode: Stop

Message #

IOThreadCount=%1;
RetiredIOThreads=%2

Fields #

Name	Description
`IOThreadCount` UInt32
`RetiredIOThreads` UInt32
`ClrInstanceID` UInt16

Event ID 46: IOThreadCount=IOThreadCount.

Channel: Operational
Task: IOThreadRetirement
Opcode: Start

Message #

IOThreadCount=%1;
RetiredIOThreads=%2

Fields #

Name	Description
`IOThreadCount` UInt32
`RetiredIOThreads` UInt32
`ClrInstanceID` UInt16

Event ID 47: IOThreadCount=IOThreadCount.

Channel: Operational
Task: IOThreadRetirement
Opcode: Stop

Message #

IOThreadCount=%1;
RetiredIOThreads=%2

Fields #

Name	Description
`IOThreadCount` UInt32
`RetiredIOThreads` UInt32
`ClrInstanceID` UInt16

Event ID 48: ClrThreadID=ClrThreadID.

Channel: Operational
Task: ThreadpoolSuspensionV2
Opcode: Start

Message #

ClrThreadID=%1;
CPUUtilization=%2

Fields #

Name	Description
`ClrThreadID` UInt32
`CpuUtilization` UInt32

Event ID 49: ClrThreadID=ClrThreadID.

Channel: Operational
Task: ThreadpoolSuspensionV2
Opcode: Stop

Message #

ClrThreadID=%1;
CPUUtilization=%2

Fields #

Name	Description
`ClrThreadID` UInt32
`CpuUtilization` UInt32

Event ID 50: WorkerThreadCount=ActiveWorkerThreadCount.

Channel: Operational
Task: ThreadPoolWorkerThread
Opcode: Start

Message #

WorkerThreadCount=%1;
RetiredWorkerThreadCount=%2;
ClrInstanceID=%3

Fields #

Name	Description
`ActiveWorkerThreadCount` UInt32
`RetiredWorkerThreadCount` UInt32
`ClrInstanceID` UInt16

Event ID 51: WorkerThreadCount=ActiveWorkerThreadCount.

Channel: Operational
Task: ThreadPoolWorkerThread
Opcode: Stop

Message #

WorkerThreadCount=%1;
RetiredWorkerThreadCount=%2;
ClrInstanceID=%3

Fields #

Name	Description
`ActiveWorkerThreadCount` UInt32
`RetiredWorkerThreadCount` UInt32
`ClrInstanceID` UInt16

Event ID 52: WorkerThreadCount=ActiveWorkerThreadCount.

Channel: Operational
Task: ThreadPoolWorkerThreadRetirement
Opcode: Start

Message #

WorkerThreadCount=%1;
RetiredWorkerThreadCount=%2;
ClrInstanceID=%3

Fields #

Name	Description
`ActiveWorkerThreadCount` UInt32
`RetiredWorkerThreadCount` UInt32
`ClrInstanceID` UInt16

Event ID 53: WorkerThreadCount=ActiveWorkerThreadCount.

Channel: Operational
Task: ThreadPoolWorkerThreadRetirement
Opcode: Stop

Message #

WorkerThreadCount=%1;
RetiredWorkerThreadCount=%2;
ClrInstanceID=%3

Fields #

Name	Description
`ActiveWorkerThreadCount` UInt32
`RetiredWorkerThreadCount` UInt32
`ClrInstanceID` UInt16

Event ID 54: Throughput=Throughput.

Channel: Operational
Task: ThreadPoolWorkerThreadAdjustment
Opcode: Sample

Message #

Throughput=%1;
ClrInstanceID=%2

Fields #

Name	Description
`Throughput` Double
`ClrInstanceID` UInt16

Event ID 55: AverageThroughput=AverageThroughput.

Channel: Operational
Task: ThreadPoolWorkerThreadAdjustment
Opcode: Adjustment

Message #

AverageThroughput=%1;
NewWorkerThreadCount=%2;
Reason=%3;
ClrInstanceID=%4

Fields #

Name	Description
`AverageThroughput` Double
`NewWorkerThreadCount` UInt32
`Reason` UInt32
`ClrInstanceID` UInt16

Event ID 56: Duration=Duration.

Channel: Operational
Task: ThreadPoolWorkerThreadAdjustment
Opcode: Stats

Message #

Duration=%1;
Throughput=%2;
ThreadWave=%3;
ThroughputWave=%4;
ThroughputErrorEstimate=%5;
AverageThroughputErrorEstimate=%6;
ThroughputRatio=%7;
Confidence=%8;
NewControlSetting=%9;
NewThreadWaveMagnitude=%10;
ClrInstanceID=%11

Fields #

Name	Description
`Duration` Double
`Throughput` Double
`ThreadWave` Double
`ThroughputWave` Double
`ThroughputErrorEstimate` Double
`AverageThroughputErrorEstimate` Double
`ThroughputRatio` Double
`Confidence` Double
`NewControlSetting` Double
`NewThreadWaveMagnitude` UInt16
`ClrInstanceID` UInt16

Event ID 57: WorkerThreadCount=ActiveWorkerThreadCount.

Channel: Operational
Level: Informational
Task: ThreadPoolWorkerThread
Opcode: Wait

Message #

WorkerThreadCount=%1;
RetiredWorkerThreadCount=%2;
ClrInstanceID=%3

Fields #

Name	Description
`ActiveWorkerThreadCount` UInt32
`RetiredWorkerThreadCount` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 57,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 6444
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 90,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:57.648Z",
    "version": 0
  },
  "event_data": {
    "ActiveWorkerThreadCount": 10,
    "ClrInstanceID": 11,
    "RetiredWorkerThreadCount": 0
  },
  "message": ""
}

Event ID 60: Count=.

Channel: Operational
Task: ThreadPoolWorkingThreadCount
Opcode: Start

Description

Count=Count; ClrInstanceID=ClrInstanceID

Message #

Count=%1;
ClrInstanceID=%2

Fields #

Name	Description
`Count` UInt32
`ClrInstanceID` UInt16

Event ID 61: WorkID=.

Channel: Operational
Task: ThreadPool
Opcode: Enqueue

Description

WorkID=WorkID; ClrInstanceID=ClrInstanceID

Message #

WorkID=%1;
ClrInstanceID=%2

Fields #

Name	Description
`WorkID` Pointer
`ClrInstanceID` UInt16

Event ID 62: WorkID=.

Channel: Operational
Task: ThreadPool
Opcode: Dequeue

Description

WorkID=WorkID; ClrInstanceID=ClrInstanceID

Message #

WorkID=%1;
ClrInstanceID=%2

Fields #

Name	Description
`WorkID` Pointer
`ClrInstanceID` UInt16

Event ID 63: WorkID=.

Channel: Operational
Task: ThreadPool
Opcode: IOEnqueue

Description

WorkID=NativeOverlapped; MultiDequeues=ClrInstanceID ClrInstanceID=MultiDequeues

Message #

WorkID=%1;
MultiDequeues=%4
ClrInstanceID=%3

Fields #

Name	Description
`NativeOverlapped` Pointer
`Overlapped` Pointer
`MultiDequeues` Boolean
`ClrInstanceID` UInt16

Event ID 64: WorkID=.

Channel: Operational
Task: ThreadPool
Opcode: IODequeue

Description

WorkID=NativeOverlapped; ClrInstanceID=ClrInstanceID

Message #

WorkID=%1;
ClrInstanceID=%3

Fields #

Name	Description
`NativeOverlapped` Pointer
`Overlapped` Pointer
`ClrInstanceID` UInt16

Event ID 65: WorkID=.

Channel: Operational
Task: ThreadPool
Opcode: IOPack

Description

WorkID=NativeOverlapped; ClrInstanceID=ClrInstanceID

Message #

WorkID=%1;
ClrInstanceID=%3

Fields #

Name	Description
`NativeOverlapped` Pointer
`Overlapped` Pointer
`ClrInstanceID` UInt16

Event ID 70: ID=.

Channel: Operational
Level: Informational
Task: Thread
Opcode: Creating

Description

ID=ID; ClrInstanceID=%s

Message #

ID=%1;
ClrInstanceID=%s

Fields #

Name	Description
`ID` Pointer
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 70,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 11,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.961Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "ID": "0x20D7F0096B0"
  },
  "message": ""
}

Event ID 71: ID=.

Channel: Operational
Level: Informational
Task: Thread
Opcode: Running

Description

ID=ID; ClrInstanceID=%s

Message #

ID=%1;
ClrInstanceID=%s

Fields #

Name	Description
`ID` Pointer
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 71,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 8552
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.962Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "ID": "0x20D7F0096B0"
  },
  "message": ""
}

Event ID 80: NONE

Channel: Operational
Level: Error
Task: Exception
Opcode: Start

Description

ExceptionType=ExceptionType; ExceptionMessage=ExceptionMessage; ExceptionEIP=ExceptionEIP; ExceptionHRESULT=ExceptionHRESULT; ExceptionFlags=ExceptionFlags; ClrInstanceID=ClrInstanceID

Fields #

Name	Description
`ExceptionType` UnicodeString
`ExceptionMessage` UnicodeString
`ExceptionEIP` Pointer
`ExceptionHRESULT` UInt32
`ExceptionFlags` UInt16
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 80,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.959Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "ExceptionEIP": "0x7FFE77FE1BA8",
    "ExceptionFlags": 16,
    "ExceptionHRESULT": 2148734209,
    "ExceptionMessage": "A command that prompts the user failed because the host program or the command type does not support user interaction. Try a host program that supports user interaction, such as the Windows PowerShell Console or Windows PowerShell ISE, and remove prompt-related commands from command types that do not support user interaction, such as Windows PowerShell workflows.",
    "ExceptionType": "System.Management.Automation.Host.HostException"
  },
  "message": ""
}

Event ID 81: NONE

Channel: Operational
Task: Contention
Opcode: Start

Description

ContentionFlags=ContentionFlags; ClrInstanceID=ClrInstanceID

Fields #

Name	Description
`ContentionFlags` UInt8
`ClrInstanceID` UInt16

Event ID 82: ClrInstanceID=ClrInstanceID.

Channel: Operational
Also via: realtime ETW trace
Task: ClrStack
Opcode: Walk

Message #

ClrInstanceID=%1;
Reserved1=%2;
Reserved2=%3;
FrameCount=%4;
Stack=%5

Fields #

Name	Description
`ClrInstanceID` UInt16
`Reserved1` UInt8
`Reserved2` UInt8
`FrameCount` UInt32
`Stack` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 82,
    "version": 0,
    "level": 0,
    "task": 11,
    "opcode": 82,
    "keywords": "0x0000000040000000",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14232,
      "thread_id": 13300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 10,
    "FrameCount": 19,
    "Reserved1": 0,
    "Reserved2": 0,
    "Stack": "0x7FF9E7FB0F20"
  },
  "message": "CLRStack"
}

Event ID 83: AppDomainID=AppDomainID.

Channel: Operational
Task: AppDomainResourceManagement
Opcode: MemAllocated

Message #

AppDomainID=%1;
Allocated=%2;
ClrInstanceID=%3

Fields #

Name	Description
`AppDomainID` UInt64
`Allocated` UInt64
`ClrInstanceID` UInt16

Event ID 84: AppDomainID=AppDomainID.

Channel: Operational
Task: AppDomainResourceManagement
Opcode: MemSurvived

Message #

AppDomainID=%1;
Survived=%2;
ProcessSurvived=%3;
ClrInstanceID=%4

Fields #

Name	Description
`AppDomainID` UInt64
`Survived` UInt64
`ProcessSurvived` UInt64
`ClrInstanceID` UInt16

Event ID 85: ManagedThreadID=ManagedThreadID.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: AppDomainResourceManagement
Opcode: ThreadCreated

Message #

ManagedThreadID=%1;
AppDomainID=%2;
Flags=%3;
ManagedThreadIndex=%4;
OSThreadID=%5;
ClrInstanceID=%6

Fields #

Name	Description
`ManagedThreadID` UInt64
`AppDomainID` UInt64
`Flags` UInt32
`ManagedThreadIndex` UInt32
`OSThreadID` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 85,
    "version": 0,
    "level": 4,
    "task": 14,
    "opcode": 50,
    "keywords": "0x0000000000010800",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 16352,
      "thread_id": 20944
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainID": 1985424221824,
    "ClrInstanceID": 9,
    "Flags": 0,
    "ManagedThreadID": 1985849307744,
    "ManagedThreadIndex": 7,
    "OSThreadID": 20944
  },
  "message": "AppDomainResourceManagement"
}

Event ID 86: ManagedThreadID=ManagedThreadID.

Channel: Operational
Task: AppDomainResourceManagement
Opcode: ThreadTerminated

Message #

ManagedThreadID=%1;
AppDomainID=%2;
ClrInstanceID=%3

Fields #

Name	Description
`ManagedThreadID` UInt64
`AppDomainID` UInt64
`ClrInstanceID` UInt16

Event ID 87: ManagedThreadID=ManagedThreadID.

Channel: Operational
Task: AppDomainResourceManagement
Opcode: DomainEnter

Message #

ManagedThreadID=%1;
AppDomainID=%2;
ClrInstanceID=%3

Fields #

Name	Description
`ManagedThreadID` UInt64
`AppDomainID` UInt64
`ClrInstanceID` UInt16

Event ID 88: ClrInstanceID=ClrInstanceID.

Channel: Operational
Task: ILStub
Opcode: StubGenerated

Message #

ClrInstanceID=%1;
ModuleID=%2;
StubMethodID=%3;
StubFlags=%4;
ManagedInteropMethodToken=%5;
ManagedInteropMethodNamespace=%6;
ManagedInteropMethodName=%7;
ManagedInteropMethodSignature=%8;
NativeMethodSignature=%9;
StubMethodSignature=%10;
StubMethodILCode=%11

Fields #

Name	Description
`ClrInstanceID` UInt16
`ModuleID` UInt64
`StubMethodID` UInt64
`StubFlags` UInt32
`ManagedInteropMethodToken` UInt32
`ManagedInteropMethodNamespace` UnicodeString
`ManagedInteropMethodName` UnicodeString
`ManagedInteropMethodSignature` UnicodeString
`NativeMethodSignature` UnicodeString
`StubMethodSignature` UnicodeString
`StubMethodILCode` UnicodeString

Event ID 89: ClrInstanceID=ClrInstanceID.

Channel: Operational
Task: ILStub
Opcode: StubCacheHit

Message #

ClrInstanceID=%1;
ModuleID=%2;
StubMethodID=%3;
ManagedInteropMethodToken=%4;
ManagedInteropMethodNamespace=%5;
ManagedInteropMethodName=%6;
ManagedInteropMethodSignature=%7

Fields #

Name	Description
`ClrInstanceID` UInt16
`ModuleID` UInt64
`StubMethodID` UInt64
`ManagedInteropMethodToken` UInt32
`ManagedInteropMethodNamespace` UnicodeString
`ManagedInteropMethodName` UnicodeString
`ManagedInteropMethodSignature` UnicodeString

Event ID 91: ContentionFlags=ContentionFlags.

Channel: Operational
Task: Contention
Opcode: Stop

Message #

ContentionFlags=%1;
ClrInstanceID=%2

Fields #

Name	Description
`ContentionFlags` UInt8
`ClrInstanceID` UInt16

Event ID 135: NONE

Channel: Operational
Task: Method
Opcode: DCStartCompleteV2

Event ID 136: NONE

Channel: Operational
Task: Method
Opcode: DCEndCompleteV2

Event ID 137: MethodID=MethodID.

Channel: Operational
Task: Method
Opcode: DCStartV2

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32

Event ID 138: MethodID=MethodID.

Channel: Operational
Task: Method
Opcode: DCStopV2

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32

Event ID 139: MethodID=MethodID.

Channel: Operational
Task: Method
Opcode: DCStartVerboseV2

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`MethodNamespace` UnicodeString
`MethodName` UnicodeString
`MethodSignature` UnicodeString

Event ID 140: MethodID=MethodID.

Channel: Operational
Task: Method
Opcode: DCStopVerboseV2

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6;
MethodNamespace=%7;
MethodName=%8;
MethodSignature=%9

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`MethodNamespace` UnicodeString
`MethodName` UnicodeString
`MethodSignature` UnicodeString

Event ID 141: MethodID=MethodID.

Channel: Operational
Task: Method
Opcode: Load

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`ClrInstanceID` UInt16
`ReJITID` UInt64

Event ID 142: MethodID=MethodID.

Channel: Operational
Task: Method
Opcode: Unload

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`ClrInstanceID` UInt16
`ReJITID` UInt64

Event ID 143: MethodID=MethodID.

Channel: Operational
Level: Informational
Task: Method
Opcode: LoadVerbose

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6;
MethodNamespace=%7;
MethodName=%8;
MethodSignature=%9

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`MethodNamespace` UnicodeString
`MethodName` UnicodeString
`MethodSignature` UnicodeString
`ClrInstanceID` UInt16
`ReJITID` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 143,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 37,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.945Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "MethodFlags": 9,
    "MethodID": 140730027441936,
    "MethodName": "lambda_method",
    "MethodNamespace": "dynamicClass",
    "MethodSignature": "pMT: 00007FFE788974E8  (pMT: 00007FFE96FF46F8)",
    "MethodSize": 103,
    "MethodStartAddress": 140730025802256,
    "MethodToken": 0,
    "ModuleID": 140730025481776
  },
  "message": ""
}

Event ID 144: MethodID=MethodID.

Channel: Operational
Task: Method
Opcode: UnloadVerbose

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6;
MethodNamespace=%7;
MethodName=%8;
MethodSignature=%9

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`MethodNamespace` UnicodeString
`MethodName` UnicodeString
`MethodSignature` UnicodeString
`ClrInstanceID` UInt16
`ReJITID` UInt64

Event ID 145: MethodID=MethodID.

Channel: Operational
Level: Verbose
Task: Method
Opcode: JittingStarted

Message #

MethodID=%1;
ModuleID=%2;
MethodToken=%3;
MethodILSize=%4;
MethodNamespace=%5;
MethodName=%6;
MethodSignature=%7

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodToken` UInt32
`MethodILSize` UInt32
`MethodNamespace` UnicodeString
`MethodName` UnicodeString
`MethodSignature` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 145,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 42,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.945Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "MethodID": 140730027441936,
    "MethodILSize": 0,
    "MethodName": "lambda_method",
    "MethodNamespace": "dynamicClass",
    "MethodSignature": "pMT: 00007FFE788974E8  (pMT: 00007FFE96FF46F8)",
    "MethodToken": 0,
    "ModuleID": 140730025481776
  },
  "message": ""
}

Event ID 149: ModuleID=ModuleID.

Channel: Operational
Task: Loader
Opcode: ModuleDCStartV2

Message #

ModuleID=%1;
AssemblyID=%2;
ModuleFlags=%3;ModuleILPath=%4;
ModuleNativePath=%5

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString

Event ID 150: ModuleID=ModuleID.

Channel: Operational
Task: Loader
Opcode: ModuleDCStopV2

Message #

ModuleID=%1;
AssemblyID=%2;
ModuleFlags=%3;ModuleILPath=%4;
ModuleNativePath=%5

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString

Event ID 151: ModuleID=ModuleID.

Channel: Operational
Task: Loader
Opcode: DomainModuleLoad

Message #

ModuleID=%1;
AssemblyID=%2;
AppDomainID=%3;
ModuleFlags=%4;
ModuleILPath=%5;ModuleNativePath=%6

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`AppDomainID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString
`ClrInstanceID` UInt16

Event ID 152: ModuleID=ModuleID.

Channel: Operational
Task: Loader
Opcode: ModuleLoad

Message #

ModuleID=%1;
AssemblyID=%2;
ModuleFlags=%3;ModuleILPath=%4;
ModuleNativePath=%5

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString
`ClrInstanceID` UInt16
`ManagedPdbSignature` GUID
`ManagedPdbAge` UInt32
`ManagedPdbBuildPath` UnicodeString
`NativePdbSignature` GUID
`NativePdbAge` UInt32
`NativePdbBuildPath` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "",
    "event_source_name": "",
    "event_id": 152,
    "version": 2,
    "level": 0,
    "task": 0,
    "opcode": 33,
    "keywords": 0,
    "time_created": "2026-07-19T02:32:42.982+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "BF440000-0BF1-0007-7FFF-4CBFF10BDD01"
    },
    "execution": {
      "process_id": 3180,
      "thread_id": 4700
    },
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AssemblyID": 2642889208320,
    "ClrInstanceID": 11,
    "ManagedPdbAge": 0,
    "ManagedPdbBuildPath": "",
    "ManagedPdbSignature": "{00000000-0000-0000-0000-000000000000}",
    "ModuleFlags": 12,
    "ModuleID": 140705680003920,
    "ModuleILPath": "Grounding.DynamicAssembly",
    "ModuleNativePath": "",
    "NativePdbAge": 0,
    "NativePdbBuildPath": "",
    "NativePdbSignature": "{00000000-0000-0000-0000-000000000000}",
    "Reserved1": 0
  },
  "message": ""
}

Event ID 153: ModuleID=ModuleID.

Channel: Operational
Task: Loader
Opcode: ModuleUnload

Message #

ModuleID=%1;
AssemblyID=%2;
ModuleFlags=%3;ModuleILPath=%4;
ModuleNativePath=%5

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString
`ClrInstanceID` UInt16
`ManagedPdbSignature` GUID
`ManagedPdbAge` UInt32
`ManagedPdbBuildPath` UnicodeString
`NativePdbSignature` GUID
`NativePdbAge` UInt32
`NativePdbBuildPath` UnicodeString

Event ID 154: AssemblyID=AssemblyID.

Channel: Operational
Level: Informational
Task: Loader
Opcode: AssemblyLoad

Message #

AssemblyID=%1;
AppDomainID=%2;
AssemblyFlags=%3;
FullyQualifiedAssemblyName=%4

Fields #

Name	Description
`AssemblyID` UInt64
`AppDomainID` UInt64
`BindingID` UInt64
`AssemblyFlags` UInt32
`FullyQualifiedAssemblyName` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 154,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 37,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:57.636Z",
    "version": 0
  },
  "event_data": {
    "AppDomainID": 140731634961536,
    "AssemblyFlags": 5,
    "AssemblyID": 2256989593248,
    "BindingID": 0,
    "ClrInstanceID": 11,
    "FullyQualifiedAssemblyName": "System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
  },
  "message": ""
}

Event ID 155: AssemblyID=AssemblyID.

Channel: Operational
Task: Loader
Opcode: AssemblyUnload

Message #

AssemblyID=%1;
AppDomainID=%2;
AssemblyFlags=%3;
FullyQualifiedAssemblyName=%4

Fields #

Name	Description
`AssemblyID` UInt64
`AppDomainID` UInt64
`BindingID` UInt64
`AssemblyFlags` UInt32
`FullyQualifiedAssemblyName` UnicodeString
`ClrInstanceID` UInt16

Event ID 156: AppDomainID=AppDomainID.

Channel: Operational
Task: Loader
Opcode: AppDomainLoad

Message #

AppDomainID=%1;
AppDomainFlags=%2;
AppDomainName=%3

Fields #

Name	Description
`AppDomainID` UInt64
`AppDomainFlags` UInt32
`AppDomainName` UnicodeString
`AppDomainIndex` UInt32
`ClrInstanceID` UInt16

Event ID 157: AppDomainID=AppDomainID.

Channel: Operational
Task: Loader
Opcode: AppDomainUnload

Message #

AppDomainID=%1;
AppDomainFlags=%2;
AppDomainName=%3

Fields #

Name	Description
`AppDomainID` UInt64
`AppDomainFlags` UInt32
`AppDomainName` UnicodeString
`AppDomainIndex` UInt32
`ClrInstanceID` UInt16

Event ID 158: ClrInstanceID=ClrInstanceID;%ModuleID=ModuleID.

Channel: Operational
Task: ClrPerfTrack
Opcode: ModuleRangeLoad

Message #

ClrInstanceID=%1;%ModuleID=%2;
RangeBegin=%3;
RangeSize=%4;
RangeType=%5

Fields #

Name	Description
`ClrInstanceID` UInt16
`ModuleID` UInt64
`RangeBegin` UInt32
`RangeSize` UInt32
`RangeType` UInt8

Event ID 181: VerificationFlags=VerificationFlags.

Channel: Operational
Task: StrongNameVerification
Opcode: Start

Message #

VerificationFlags=%1;
ErrorCode=%2;
FullyQualifiedAssemblyName=%3

Fields #

Name	Description
`VerificationFlags` UInt32
`ErrorCode` UInt32
`FullyQualifiedAssemblyName` UnicodeString
`ClrInstanceID` UInt16

Event ID 182: VerificationFlags=VerificationFlags.

Channel: Operational
Task: StrongNameVerification
Opcode: Stop

Message #

VerificationFlags=%1;
ErrorCode=%2;
FullyQualifiedAssemblyName=%3

Fields #

Name	Description
`VerificationFlags` UInt32
`ErrorCode` UInt32
`FullyQualifiedAssemblyName` UnicodeString
`ClrInstanceID` UInt16

Event ID 183: VerificationFlags=VerificationFlags.

Channel: Operational
Task: AuthenticodeVerification
Opcode: Start

Message #

VerificationFlags=%1;
ErrorCode=%2;
ModulePath=%3

Fields #

Name	Description
`VerificationFlags` UInt32
`ErrorCode` UInt32
`ModulePath` UnicodeString
`ClrInstanceID` UInt16

Event ID 184: VerificationFlags=VerificationFlags.

Channel: Operational
Task: AuthenticodeVerification
Opcode: Stop

Message #

VerificationFlags=%1;
ErrorCode=%2;
ModulePath=%3

Fields #

Name	Description
`VerificationFlags` UInt32
`ErrorCode` UInt32
`ModulePath` UnicodeString
`ClrInstanceID` UInt16

Event ID 185: MethodBeingCompiledNamespace=MethodBeingCompiledNamespace.

Channel: Operational
Level: Verbose
Task: Method
Opcode: InliningSucceeded

Message #

MethodBeingCompiledNamespace=%1;
MethodBeingCompiledName=%2;
MethodBeingCompiledNameSignature=%3;
InlinerNamespace=%4;
InlinerName=%5;
InlinerNameSignature=%6;
InlineeNamespace=%7;
InlineeName=%8;
InlineeNameSignature=%9;
ClrInstanceID=%10

Fields #

Name	Description
`MethodBeingCompiledNamespace` UnicodeString
`MethodBeingCompiledName` UnicodeString
`MethodBeingCompiledNameSignature` UnicodeString
`InlinerNamespace` UnicodeString
`InlinerName` UnicodeString
`InlinerNameSignature` UnicodeString
`InlineeNamespace` UnicodeString
`InlineeName` UnicodeString
`InlineeNameSignature` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 185,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 83,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.945Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "InlineeName": ".ctor",
    "InlineeNameSignature": "instance void  ()",
    "InlineeNamespace": "Microsoft.PowerShell.Commands.SelectStringCommand",
    "InlinerName": "lambda_method",
    "InlinerNameSignature": "pMT: 00007FFE788974E8  (pMT: 00007FFE96FF46F8)",
    "InlinerNamespace": "dynamicClass",
    "MethodBeingCompiledName": "lambda_method",
    "MethodBeingCompiledNameSignature": "pMT: 00007FFE788974E8  (pMT: 00007FFE96FF46F8)",
    "MethodBeingCompiledNamespace": "dynamicClass"
  },
  "message": ""
}

Event ID 186: MethodBeingCompiledNamespace=MethodBeingCompiledNamespace.

Channel: Operational
Level: Verbose
Task: Method
Opcode: InliningFailed

Message #

MethodBeingCompiledNamespace=%1;
MethodBeingCompiledName=%2;
MethodBeingCompiledNameSignature=%3;
InlinerNamespace=%4;
InlinerName=%5;
InlinerNameSignature=%6;
InlineeNamespace=%7;
InlineeName=%8;
InlineeNameSignature=%9;
FailAlways=%10;
FailReason=%11;
ClrInstanceID=%12

Fields #

Name	Description
`MethodBeingCompiledNamespace` UnicodeString
`MethodBeingCompiledName` UnicodeString
`MethodBeingCompiledNameSignature` UnicodeString
`InlinerNamespace` UnicodeString
`InlinerName` UnicodeString
`InlinerNameSignature` UnicodeString
`InlineeNamespace` UnicodeString
`InlineeName` UnicodeString
`InlineeNameSignature` UnicodeString
`FailAlways` Boolean
`FailReason` AnsiString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 186,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 84,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.945Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "FailAlways": false,
    "FailReason": "has ldstr VM restriction",
    "InlineeName": ".ctor",
    "InlineeNameSignature": "instance void  ()",
    "InlineeNamespace": "System.Management.Automation.Cmdlet",
    "InlinerName": "lambda_method",
    "InlinerNameSignature": "pMT: 00007FFE788974E8  (pMT: 00007FFE96FF46F8)",
    "InlinerNamespace": "dynamicClass",
    "MethodBeingCompiledName": "lambda_method",
    "MethodBeingCompiledNameSignature": "pMT: 00007FFE788974E8  (pMT: 00007FFE96FF46F8)",
    "MethodBeingCompiledNamespace": "dynamicClass"
  },
  "message": ""
}

Event ID 187: ClrInstanceID=ClrInstanceID.

Channel: Operational
Task: Runtime
Opcode: Start

Message #

ClrInstanceID=%1;
SKU=%2;
BclMajorVersion=%3;
BclMinorVersion=%4;
BclBuildNumber=%5;
BclQfeNumber=%6;
VMMajorVersion=%7;
VMMinorVersion=%8;
VMBuildNumber=%9;
VMQfeNumber=%10;
StartupFlags=%11;
StartupMode=%12;
CommandLine=%13;
ComObjectGUID=%14;
RuntimeDllPath=%15

Fields #

Name	Description
`ClrInstanceID` UInt16
`Sku` UInt16
`BclMajorVersion` UInt16
`BclMinorVersion` UInt16
`BclBuildNumber` UInt16
`BclQfeNumber` UInt16
`VMMajorVersion` UInt16
`VMMinorVersion` UInt16
`VMBuildNumber` UInt16
`VMQfeNumber` UInt16
`StartupFlags` UInt32
`StartupMode` UInt8
`CommandLine` UnicodeString
`ComObjectGuid` GUID
`RuntimeDllPath` UnicodeString

Event ID 188: MethodBeingCompiledNamespace=MethodBeingCompiledNamespace.

Channel: Operational
Level: Verbose
Task: Method
Opcode: TailCallSucceeded

Message #

MethodBeingCompiledNamespace=%1;
MethodBeingCompiledName=%2;
MethodBeingCompiledNameSignature=%3;
CallerNamespace=%4;
CallerName=%5;
CallerNameSignature=%6;
CalleeNamespace=%7;
CalleeName=%8;
CalleeNameSignature=%9;
TailPrefix=%10;
TailCallType=%11;
ClrInstanceID=%12

Fields #

Name	Description
`MethodBeingCompiledNamespace` UnicodeString
`MethodBeingCompiledName` UnicodeString
`MethodBeingCompiledNameSignature` UnicodeString
`CallerNamespace` UnicodeString
`CallerName` UnicodeString
`CallerNameSignature` UnicodeString
`CalleeNamespace` UnicodeString
`CalleeName` UnicodeString
`CalleeNameSignature` UnicodeString
`TailPrefix` Boolean
`TailCallType` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 188,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 85,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:54.126Z",
    "version": 0
  },
  "event_data": {
    "CalleeName": "set_InputObject",
    "CalleeNameSignature": "instance void  (class System.Management.Automation.PSObject)",
    "CalleeNamespace": "Microsoft.PowerShell.Commands.SelectStringCommand",
    "CallerName": "<null>",
    "CallerNameSignature": "<null>",
    "CallerNamespace": "<null>",
    "ClrInstanceID": 11,
    "MethodBeingCompiledName": "lambda_method",
    "MethodBeingCompiledNameSignature": "void  (pMT: 00007FFE96FF46F8,class System.Object,class System.Object)",
    "MethodBeingCompiledNamespace": "dynamicClass",
    "TailCallType": 0,
    "TailPrefix": false
  },
  "message": ""
}

Event ID 189: MethodBeingCompiledNamespace=MethodBeingCompiledNamespace.

Channel: Operational
Task: Method
Opcode: TailCallFailed

Message #

MethodBeingCompiledNamespace=%1;
MethodBeingCompiledName=%2;
MethodBeingCompiledNameSignature=%3;
CallerNamespace=%4;
CallerName=%5;
CallerNameSignature=%6;
CalleeNamespace=%7;
CalleeName=%8;
CalleeNameSignature=%9;
TailPrefix=%10;
FailReason=%11;
ClrInstanceID=%12

Fields #

Name	Description
`MethodBeingCompiledNamespace` UnicodeString
`MethodBeingCompiledName` UnicodeString
`MethodBeingCompiledNameSignature` UnicodeString
`CallerNamespace` UnicodeString
`CallerName` UnicodeString
`CallerNameSignature` UnicodeString
`CalleeNamespace` UnicodeString
`CalleeName` UnicodeString
`CalleeNameSignature` UnicodeString
`TailPrefix` Boolean
`FailReason` AnsiString
`ClrInstanceID` UInt16

Event ID 190: MethodID=MethodID.

Channel: Operational
Task: Method
Opcode: MethodILToNativeMap

Message #

MethodID=%1;
ReJITID=%2;
MethodExtent=%3;
CountOfMapEntries=%4;
ClrInstanceID=%5

Fields #

Name	Description
`MethodID` UInt64
`ReJITID` UInt64
`MethodExtent` UInt8
`CountOfMapEntries` UInt16
`ILOffsets` UInt32
`NativeOffsets` UInt32
`ClrInstanceID` UInt16

Event ID 200: BytesAllocated=BytesAllocated.

Channel: Operational
Level: Verbose
Task: GC
Opcode: IncreaseMemoryPressure

Message #

BytesAllocated=%1;
;
ClrInstanceID=%2

Fields #

Name	Description
`BytesAllocated` UInt64
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 200,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 200,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.961Z",
    "version": 0
  },
  "event_data": {
    "BytesAllocated": 1992,
    "ClrInstanceID": 11
  },
  "message": ""
}

Event ID 201: BytesFreed=BytesFreed.

Channel: Operational
Also via: realtime ETW trace
Level: Verbose
Task: GC
Opcode: DecreaseMemoryPressure

Message #

BytesFreed=%1;
;
ClrInstanceID=%2

Fields #

Name	Description
`BytesFreed` UInt64
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 201,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 201,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.463+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 15288
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BytesFreed": 1000,
    "ClrInstanceID": 9
  },
  "message": "GarbageCollection"
}

Event ID 202: HeapNum=.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: Mark

Description

HeapNum=HeapNum; ClrInstanceID=ClrInstanceID; Type=Type; Bytes=Bytes

Message #

HeapNum=%1;
ClrInstanceID=%2;
Type=%3;
Bytes=%4

Fields #

Name	Description
`HeapNum` UInt32
`ClrInstanceID` UInt16
`Type` UInt32
`Bytes` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 202,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 202,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.456+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17236,
      "thread_id": 11988
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Bytes": 177142,
    "ClrInstanceID": 7,
    "HeapNum": 0,
    "Type": 0
  },
  "message": "GarbageCollection"
}

Event ID 203: Heap=.

Channel: Operational
Task: GC
Opcode: GCJoin

Description

Heap=Heap; JoinTime=JoinTime; JoinType=JoinType; ClrInstanceID=ClrInstanceID; JoinID=JoinID

Message #

Heap=%1;
JoinTime=%2;
JoinType=%3;
ClrInstanceID=%4;
JoinID=%5

Fields #

Name	Description
`Heap` UInt32
`JoinTime` UInt32
`JoinType` UInt32
`ClrInstanceID` UInt16
`JoinID` UInt32

Event ID 204: ClrInstanceID=ClrInstanceID.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: PerHeapHistory

Message #

ClrInstanceID=%1;
FreeListAllocated=%2;
FreeListRejected=%3;
EndOfSegAllocated=%4;
CondemnedAllocated=%5;
PinnedAllocated=%6;
PinnedAllocatedAdvance=%7;%RunningFreeListEfficiency=%8;
CondemnReasons0=%9;
CondemnReasons1=%10;
CompactMechanisms=%11;
ExpandMechanisms=%12;
HeapIndex=%13;
ExtraGen0Commit=%14;
Count=%15

Fields #

Name	Description
`ClrInstanceID` UInt16
`FreeListAllocated` Pointer
`FreeListRejected` Pointer
`EndOfSegAllocated` Pointer
`CondemnedAllocated` Pointer
`PinnedAllocated` Pointer
`PinnedAllocatedAdvance` Pointer
`RunningFreeListEfficiency` UInt32
`CondemnReasons0` UInt32
`CondemnReasons1` UInt32
`CompactMechanisms` UInt32
`ExpandMechanisms` UInt32
`HeapIndex` UInt32
`ExtraGen0Commit` Pointer
`Count` UInt32
`Values` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 204,
    "version": 3,
    "level": 4,
    "task": 1,
    "opcode": 204,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.457+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "CompactMechanisms": 0,
    "CondemnReasons0": 10,
    "CondemnReasons1": 8193,
    "CondemnedAllocated": "0x0",
    "Count": 4,
    "EndOfSegAllocated": "0x0",
    "ExpandMechanisms": 0,
    "ExtraGen0Commit": "0x8A8",
    "FreeListAllocated": "0x0",
    "FreeListRejected": "0x0",
    "HeapIndex": 0,
    "PinnedAllocated": "0x0",
    "PinnedAllocatedAdvance": "0x0",
    "RunningFreeListEfficiency": 0,
    "Values": "10070100000000000000000000000000A00B0000000000001800000000000000000000000000000000000000000000000000000000000000500200000000000038AA00000000000000008000000000001800000000000000000000000000000000000000000000002807010000000000E057000000000000F00200000000000088AC0000000000000000000000000000000000000000000000000400000000001800000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000280C01000000000000000000000000000000000000000000280C0100000000000000000000000000A00000000000000000000000000000000000000000000000880B0100000000000000300000000000"
  },
  "message": "GarbageCollection"
}

Event ID 205: FinalYoungestDesired=FinalYoungestDesired.

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: GC
Opcode: GlobalHeapHistory

Message #

FinalYoungestDesired=%1;
NumHeaps=%2;
CondemnedGeneration=%3;
Gen0ReductionCountD=%4;
Reason=%5;
GlobalMechanisms=%6;
ClrInstanceID=%7;
PauseMode=%8;
MemoryPressure=%9

Fields #

Name	Description
`FinalYoungestDesired` UInt64
`NumHeaps` Int32
`CondemnedGeneration` UInt32
`Gen0ReductionCount` UInt32
`Reason` UInt32
`GlobalMechanisms` UInt32
`ClrInstanceID` UInt16
`PauseMode` UInt32
`MemoryPressure` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntime",
    "guid": "{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}",
    "event_source_name": "",
    "event_id": 205,
    "version": 2,
    "level": 4,
    "task": 1,
    "opcode": 205,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:22:23.457+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3240,
      "thread_id": 19108
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "CondemnedGeneration": 2,
    "FinalYoungestDesired": 8388608,
    "Gen0ReductionCount": 0,
    "GlobalMechanisms": 28,
    "MemoryPressure": 28,
    "NumHeaps": 1,
    "PauseMode": 0,
    "Reason": 1
  },
  "message": "GarbageCollection"
}

Event ID 206: GCName=GCName;ClrInstanceID=ClrInstanceID.

Channel: Operational
Task: GC
Opcode: GCLoaded

Message #

GCName=%1;ClrInstanceID=%2

Fields #

Name	Description
`GCName` UnicodeString
`ClrInstanceID` UInt16

Event ID 240: DebugIPCEventStart

Channel: Operational
Task: DebugIPCEvent
Opcode: Start

Event ID 241: DebugIPCEventStop

Channel: Operational
Task: DebugIPCEvent
Opcode: Stop

Event ID 242: DebugExceptionProcessingStart

Channel: Operational
Task: DebugExceptionProcessing
Opcode: Start

Event ID 243: DebugExceptionProcessingStop

Channel: Operational
Task: DebugExceptionProcessing
Opcode: Stop

Event ID 250: EntryEIP=EntryEIP.

Channel: Operational
Level: Informational
Task: ExceptionCatch
Opcode: Start

Message #

EntryEIP=%1;
MethodID=%2;
MethodName=%3;
ClrInstanceID=%4

Fields #

Name	Description
`EntryEIP` UInt64
`MethodID` UInt64
`MethodName` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 250,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.959Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "EntryEIP": 140730869167354,
    "MethodID": 140730860639480,
    "MethodName": "instance class [System.Management.Automation]Microsoft.PowerShell.Commands.Internal.Format.LineOutput [Microsoft.PowerShell.Commands.Utility] Microsoft.PowerShell.Commands.OutStringCommand::InstantiateLineOutputInterface()"
  },
  "message": ""
}

Event ID 251: NONE

Channel: Operational
Level: Informational
Task: ExceptionCatch
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 251,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.960Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 252: EntryEIP=EntryEIP.

Channel: Operational
Level: Informational
Task: ExceptionFinally
Opcode: Start

Message #

EntryEIP=%1;
MethodID=%2;
MethodName=%3;
ClrInstanceID=%4

Fields #

Name	Description
`EntryEIP` UInt64
`MethodID` UInt64
`MethodName` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 252,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:58.424Z",
    "version": 0
  },
  "event_data": {
    "ClrInstanceID": 11,
    "EntryEIP": 140731572818650,
    "MethodID": 140731561287704,
    "MethodName": "string [mscorlib] System.IO.LongPathHelper::Normalize(string,uint32,bool,bool)"
  },
  "message": ""
}

Event ID 253: NONE

Channel: Operational
Level: Informational
Task: ExceptionFinally
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 253,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:58.424Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 254: EntryEIP=EntryEIP.

Channel: Operational
Task: ExceptionFilter
Opcode: Start

Message #

EntryEIP=%1;
MethodID=%2;
MethodName=%3;
ClrInstanceID=%4

Fields #

Name	Description
`EntryEIP` UInt64
`MethodID` UInt64
`MethodName` UnicodeString
`ClrInstanceID` UInt16

Event ID 255: NONE

Channel: Operational
Task: ExceptionFilter
Opcode: Stop

Event ID 256: NONE

Channel: Operational
Level: Informational
Task: Exception
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DotNETRuntime/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 256,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7176,
      "thread_id": 7316
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-DotNETRuntime",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 07:50:53.960Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Provenance

ETW provider GUID {E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}

Defined in clretwrc.dll, which carries the event manifest.

WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26
Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.
WS2022-20348.4893, sample captured from a live trace, binary version 4.8.4161.0 built by: NET48REL1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 4.8.4161.0, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 4.8.9221.0, captured 2026-06-02 — Manifest XML pack, 2.0 MB
JD-WIN11-22H2-1, sample captured from a live trace, binary version 4.8.9310.0, captured 2026-07-19
Sealighter user-mode ETW capture of a Reflection.Emit dynamic module.