DCStart events from EventPipe

[valco1994]

As far as I see, currently, EventPipe only sends events from Microsoft-Windows-DotNETRuntimeRundown at the end of the session. So, I can receive *DCEnd* events with EventPipe, but can't receive *DCStart* events, which are supposed to be sent when the session started.

It means, that I can't resolve stacks in real-time with EventPipe, while with ETW I can choose to resolve it in real-time or during post-processing.

Could you clarify, if it is a bug or it is supposed to be so by design and isn't going to be changed?
It would be very nice to have *DCStart* events with EventPipe.

[tommcdon]

@sywhang @josalem

[josalem]

One workaround is to start an EventPipe session with rundown enabled, then immediately end it to collect the rundown events at any point in time.

---

Looking at the code, we only invoke ETW::EnumerationLog::EndRundown in EventPipe (when a session ends). I don't see any calls to ETW::EnumerationLog::StartRuntdown so, this is currently by design, whether intentional or not. This is, however, something we can change, but most likely not for 5.0.

I think we could move/translate this chunk of code:

runtime/src/coreclr/src/vm/eventtrace.cpp

Lines 4662 to 4683 in f35d747

	if(g_fEEStarted && !g_fEEShutDown && bIsRundownTraceHandle)
	{
	// Start and End Method/Module Rundowns
	// Used to fire events that we missed since we started the controller after the process started
	// flags for immediate start rundown
	if(ETW_TRACING_CATEGORY_ENABLED(MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context,
	TRACE_LEVEL_INFORMATION,
	CLR_RUNDOWNSTART_KEYWORD))
	ETW::EnumerationLog::StartRundown();
	// flags delayed end rundown
	if(ETW_TRACING_CATEGORY_ENABLED(MICROSOFT_WINDOWS_DOTNETRUNTIME_RUNDOWN_PROVIDER_DOTNET_Context,
	TRACE_LEVEL_INFORMATION,
	CLR_RUNDOWNEND_KEYWORD))
	ETW::EnumerationLog::EndRundown();
	}
	if (g_fEEStarted && !g_fEEShutDown && (ControlCode == EVENT_CONTROL_CODE_CAPTURE_STATE))
	{
	ETW::EnumerationLog::EnumerateForCaptureState();
	}
	}

up a level, to here

runtime/src/coreclr/src/vm/eventtrace.cpp

Line 4323 in f35d747

VOID EtwCallbackCommon(

.

Better yet, we could do a larger audit of these two functions to validate we aren't artificially preventing some functionality of EventPipe. For now, this on our potential 6.0 backlog.

[valco1994]

Thank you for the clarification, @josalem.
I think this issue can be reclassified as a "Feature request" so.