{"id":659,"date":"2023-02-22T16:44:34","date_gmt":"2023-02-23T00:44:34","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/?p=659"},"modified":"2023-10-26T16:24:53","modified_gmt":"2023-10-26T23:24:53","slug":"etw-trace-processing-fails-with-error-code-0x80070032","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/etw-trace-processing-fails-with-error-code-0x80070032\/","title":{"rendered":"ETW Trace Processing Fails with Error Code 0x80070032"},"content":{"rendered":"

TL;DR<\/h2>\n

New values in an existing ETW event aren\u2019t supported, and a new version of the Windows Performance Toolkit (WPT) or the Microsoft.Windows.EventTracing.Processing.Toolkit NuGet library is needed to process traces with these events.<\/p>\n

About this failure<\/h2>\n

We began to receive reports of WPA failing to process traces with this error code in late 2022.<\/p>\n

Debugging revealed the error code was due to previously unseen values in an existing CLR event describing a ReJIT operation<\/a>. This event is used by WPA, XPerf, and EventTracing libraries to map address references from .NET binaries to source file and line information.<\/p>\n

A comment in our code revealed that, at the time the code was written, every existing trace had a value of zero in the ReJITID field of this event. Because no testing could be done with other values, the code was written to return ERROR_NOT_SUPPORTED rather than return potentially incorrect data.<\/p>\n

A quick search revealed this bug<\/a> which was opened in mid-2022, indicating that the CLR wasn\u2019t correctly setting this field\u2019s value. The bug was fixed for .NET 7 and events with the non-zero field values began appearing in traces, particularly when PowerShell updated to the latest .NET SDK.<\/p>\n

The workaround and fix<\/h2>\n

For the short-term, we\u2019ve removed the error case to unblock customers. This will result in the same behavior as before the CLR bug was fixed. In this case, it\u2019s possible that the source file and line information will be incorrect for some .NET symbols. Function names and other symbol information are not impacted.<\/p>\n

Long-term we will update our code to respect ReJIT operations to guarantee correct source file and line information after a ReJIT has been identified.<\/p>\n

Updated release locations<\/h2>\n

EventTracing requires Microsoft.Windows.EventTracing.Processing.Toolkit v1.11.0 or later: https:\/\/www.nuget.org\/packages\/Microsoft.Windows.EventTracing.Processing.Toolkit\/1.11.0<\/a><\/p>\n

[Update]: https:\/\/www.nuget.org\/packages\/Microsoft.Windows.EventTracing.Processing.All\/1.12.9<\/a> references the updated Microsoft.Windows.EventTracing.Processing.Toolkit package.<\/p>\n

Windows 11 ADK – 22H2: https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/get-started\/adk-install<\/a><\/p>\n

Windows 11 SDK Preview: https:\/\/www.microsoft.com\/en-us\/software-download\/windowsinsiderpreviewSDK<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

TL;DR New values in an existing ETW event aren\u2019t supported, and a new version of the Windows Performance Toolkit (WPT) or the Microsoft.Windows.EventTracing.Processing.Toolkit NuGet library is needed to process traces with these events. About this failure We began to receive reports of WPA failing to process traces with this error code in late 2022. Debugging […]<\/p>\n","protected":false},"author":70644,"featured_media":76,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-659","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-performance-diagnostics"],"acf":[],"blog_post_summary":"

TL;DR New values in an existing ETW event aren\u2019t supported, and a new version of the Windows Performance Toolkit (WPT) or the Microsoft.Windows.EventTracing.Processing.Toolkit NuGet library is needed to process traces with these events. About this failure We began to receive reports of WPA failing to process traces with this error code in late 2022. Debugging […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/posts\/659","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/users\/70644"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/comments?post=659"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/posts\/659\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/media\/76"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/media?parent=659"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/categories?post=659"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/performance-diagnostics\/wp-json\/wp\/v2\/tags?post=659"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}