February 22nd, 2023

ETW Trace Processing Fails with Error Code 0x80070032

TL;DR

New values in an existing ETW event aren’t supported, and a new version of the Windows Performance Toolkit (WPT) or the Microsoft.Windows.EventTracing.Processing.Toolkit NuGet library is needed to process traces with these events.

About this failure

We began to receive reports of WPA failing to process traces with this error code in late 2022.

Debugging revealed the error code was due to previously unseen values in an existing CLR event describing a ReJIT operation. This event is used by WPA, XPerf, and EventTracing libraries to map address references from .NET binaries to source file and line information.

A comment in our code revealed that, at the time the code was written, every existing trace had a value of zero in the ReJITID field of this event. Because no testing could be done with other values, the code was written to return ERROR_NOT_SUPPORTED rather than return potentially incorrect data.

A quick search revealed this bug which was opened in mid-2022, indicating that the CLR wasn’t correctly setting this field’s value. The bug was fixed for .NET 7 and events with the non-zero field values began appearing in traces, particularly when PowerShell updated to the latest .NET SDK.

The workaround and fix

For the short-term, we’ve removed the error case to unblock customers. This will result in the same behavior as before the CLR bug was fixed. In this case, it’s possible that the source file and line information will be incorrect for some .NET symbols. Function names and other symbol information are not impacted.

Long-term we will update our code to respect ReJIT operations to guarantee correct source file and line information after a ReJIT has been identified.

Updated release locations

EventTracing requires Microsoft.Windows.EventTracing.Processing.Toolkit v1.11.0 or later: https://www.nuget.org/packages/Microsoft.Windows.EventTracing.Processing.Toolkit/1.11.0

[Update]: https://www.nuget.org/packages/Microsoft.Windows.EventTracing.Processing.All/1.12.9 references the updated Microsoft.Windows.EventTracing.Processing.Toolkit package.

Windows 11 ADK – 22H2: https://learn.microsoft.com/en-us/windows-hardware/get-started/adk-install

Windows 11 SDK Preview: https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewSDK

Author

3 comments

Discussion is closed. Login to edit/delete existing comments.

  • Alois Kraus

    The Nuget package Microsoft.Windows.EventTracing.Processing.All 1.11.109 which is 4 months old is not working. The mentioned package with the fix Microsoft.Windows.EventTracing.Processing.Toolkit with version 1.11.0 is one month old. How is one meant to consume the updated package because it is not included in the Microsoft.Windows.EventTracing.Processing.All package which is the supposed go to package to reference TraceProcessing library? Version wise it looks ok but the content if the ..All package is not up to...

    Read more
  • Jason Walker · Edited

    I’m trying to analyze a boot trace and I get this error during loading of the .etl. Windows 10 22H2. Is there a working version for Win10 22H2? Is the Win11 ADK compatible?

    edit: Win11 ADK linked above works

  • Ferdinand Oeinck

    When I try to install the ADK Preview on Windows 11 arm64 (Parallels, MacBookAir M1), WPA.EXE is not installed! WPR.EXE is , strange…