Event Classes
The table below contains an alphabetical listing of the available Monitor event names. For each event name, a description is provided along with the associated Managed Code Framework class name and the corresponding fields that appear in the text output. All events listed in the text output of a monitoring session include the Time Stamp Counter (TSC), Process ID (PID), Thread ID (TID), and the core (CORE) on which the event occurred.
For example:
20848276916965: Context Switch, CORE 4, Event generated by PID 0, TID 2 Old Thread: 0, New Thread: 2, Old Process 0, New Process 0
To navigate the table of events, scroll the table or click on a link below to jump to a particular section.
A-C | D-F | H-L | M-R | S-T | U-W | Examples
| Name | Description | Managed Code Framework Class Name | Text Output Fields |
|---|---|---|---|
| A | |||
| Attach Line Based Interrupt |
Represents an application attaching to a line-based interrupt. This event is generated when a call to RtAttachInterrupt is made to attach a line-based interrupt. |
MonitorEventAttachInterruptLinedBased
|
Handle: The handle for this interrupt attachment. Stack Size: The stack size of the IST thread (if one exists), otherwise zero. Function Addr: The IST function (or NULL if not used). Context: The opaque context value to pass to the IST and ISR functions. ISTThreadPriority: The priority of the interrupt handler. This is only defined if ISTFunction is non-NULL. InterfaceType: The I/O bus interface type. PCIBus: The I/O bus number. SlotNumber: The I/O bus slot number. Interrupt Lv1: The bus interrupt level. Interrupt Vector: The I/O bus interrupt vector. Shared: Whether the interrupt is shared or not. InterruptMode: The interrupt mode (level-sensitive or latched). ISR Func Addr: The ISR function (or NULL if not used). Processor Affinity Mask: A bit mask specifying the processors on which this interrupt is enabled. |
| Attach Message Based Interrupt |
Represents attaching an IST or ISR to a message-based interrupt. This event is generated when a call to RtAttachInterrupt is made to attach a message-based interrupt. |
MonitorEventAttachInterruptMessagedBased | Handle: The handle for this interrupt attachment. MSI: Whether the caller prefers that the device uses MSI instead of MSI-X interrupts. IST Func Addr: The IST function (or NULL if not used). ISR Func Addr: The ISR function (or NULL if not used). Context: The context value passed to the IST and ISR functions. Stack Size: The stack size of the IST thread (if one exists), otherwise zero. IST Priority: The thread priority of the IST thread. This is only defined if ISTFunction is non-NULL. BusNumber: The I/O bus number. SlotNumber: The I/O bus slot number. Processor Affinity Mask: A bit mask specifying the processors on which this interrupt is enabled |
| C | |||
| CLOS Set |
Represents a change in Class of Service (CLOS) of a thread. |
MonitorEventCLOSSet | TargetThreadID: The thread ID of the target thread. TargetProcessID: The thread ID of the target process. newCLOS: The new thread CLOS. oldCLOS: The CLOS of the thread prior to the change. |
| Context Switch |
Represents a context switch event. This event is generated when a thread context switch happens. This event is disabled by default, because there can be several thousands of context switches per second. NOTE: Context Switch events are enabled by default. |
MonitorEventContextSwitch |
Old Thread: The thread ID of the previous thread. New Thread: The thread ID of the next thread. Old Process: The process ID of the process to which oldThread belongs. New Process: The process ID of the process to which newThread belongs. This can be the same as oldProcessID. |
| Contiguous Windows Memory Allocate |
Represents the successful allocation of physically contiguous memory by a call to RtAllocateContiguousMemory. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventContiguousMemoryAlloc |
Address: The address of the allocated memory. Size: The size of the allocation request. Max Address: The highest physical address that can be part of the range allocated. |
| Contiguous Windows Memory Allocate Fail |
Represents a failed allocation of physically contiguous memory by a call to RtAllocateContiguousMemory. This event is generated when RtAllocateContiguousMemory is called and it fails. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventContiguousMemoryAllocFailed |
Size: The size of the allocation request. Max Address: The highest physical address that can be part of the range allocated. |
| Contiguous Windows Memory Specify Cache Allocate |
Represents a successful allocation of physically contiguous memory by a call to RtAllocateContiguousMemorySpecifyCache. This event is generated when RtAllocateContiguousMemorySpecifyCache is called and it succeeds. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventContiguousMemoryAllocSpecifyCache |
Memory Address: The address of the allocated memory. Size: The size of the allocation request. Min Address: The lowest physical address that can be part of the range allocated. Max Address: The highest physical address that can be part of the range allocated. Boundary: The physical address multiple that the allocated memory must not cross. This is always a power of two. CacheType: The type of caching allowed for the requested memory. |
| Contiguous Windows Memory Specify Cache Allocate Fail |
Represents a failed allocation of physically contiguous memory by a call to RtAllocateContiguousMemorySpecifyCache. This event is generated when RtAllocateContiguousMemorySpecifyCache is called and it fails. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventContiguousMemoryAllocSpecifyCacheFailed |
Size: The size of the allocation request. Min Address: The lowest physical address that can be part of the range allocated. Max Address: The highest physical address that can be part of the range allocated. Boundary: The physical address multiple that the allocated memory must not cross. This is always a power of two. CacheType: The type of caching allowed for the requested memory. |
| Contiguous Memory Free |
Represents freeing physically contiguous memory via RtFreeContiguousMemory. This event is generated when RtFreeContiguousMemory is called and it succeeds. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventContiguousMemoryFree |
Address: The address being freed. |
| Contiguous Memory Free Fail |
Represents failed freeing of contiguous memory. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
|
MonitorEventContiguousMemoryFreeFail |
Address: The address that failed to become freed. Error: The error code indicating why the failure happened. |
| Critical Section Delete |
Represents a thread deleting a critical section. This event is generated when DeleteCriticalSection is called. |
MonitorEventCriticalSectionDelete | Critical Section: The address of the CRITICAL_SECTION object. |
| Critical Section Enter |
Represents a thread entering a critical section. This event is generated when TryEnterCriticalSection is successfully called. |
MonitorEventCriticalSectionEnter | Critical Section: The address of the CRITICAL_SECTION object. |
| Critical Section Init |
Represents the creation of a critical section. This event is generated when InitializeCriticalSection is called. |
MonitorEventCriticalSectionInit | Critical Section: The address of the CRITICAL_SECTION object. |
| Critical Section Leave |
Represents a thread leaving a critical section. This event is generated when LeaveCriticalSection is called |
MonitorEventCriticalSectionLeave | Critical Section: The address of the CRITICAL_SECTION object. |
| Custom |
Represents a custom event generated by user application code. This event generated by a call to RtGenerateEvent. NOTE: In Tracealyzer, custom events are displayed as user events. |
MonitorEventCustom |
UserKind: The user's custom event kind. Size: The number of valid bytes in array Data[]. Data[500]: Up to 500 bytes of user-supplied custom event data. |
| D | |||
| Data Lost |
Represents a Data Lost event. This event is generated when the RTX64 monitoring framework internal buffers become full, resulting in loss of monitoring event data. If you see this event, you should use the RTX64 Control Panel to increase the amount of non-paged pool memory allocated to monitoring and/or monitor fewer kinds of events. This event indicates that at least one but possibly many monitoring events were lost. The kind of the first lost event is given on the second line of this event. IMPORTANT! The size of this event must be small enough to fit in one MTB ring buffer slot. |
MonitorEventDataLost | Lost Event: The kind of event that was lost. |
| E | |||
| Event Create | Represents the creation of an event (the kind used for synchronization, not a Monitoring
Framework event).
This event is generated when RtCreateEvent is called. |
MonitorEventEventCreate |
Manual Reset: This is TRUE if the event is a manual reset event. Initially Signaled: This is TRUE if the event was created in the signalled state, FALSE if it was created in the reset state. State: This is TRUE if the event is signalled, FALSE if it is reset. Count: This is the number of threads waiting on this event. Ref Count: The reference count of this event. Name: The name of the event (if it has one). If the event has no name, this is the empty string. Handle: The handle for this event. |
| Event Destroy |
Represents the destruction of an event object. This event is generated after the last handle to an event object is closed. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. |
MonitorEventEventDestroy |
State: The state of the event: TRUE means signaled, FALSE means reset. Manual Reset: Whether or not the event is manual reset. Waiters: Number of waiters. Name: Event name |
| Event Open |
Represents opening of an event (the kind used for synchronization). This event is generated when RtOpenEvent is called. |
MonitorEventEventOpen |
Handle: The handle returned by this open operation. Manual Reset: This is TRUE if the event is a manual reset event. State: This is TRUE if the event is signalled, FALSE if it is reset. Reference Count: The reference count of this event after this open operation completes. ThreadsWaiting: This is the number of threads waiting on this event. Name: The name of the event (if it has one). If the event has no name, this is the empty string. |
| Event Pulse |
Represents a call to RtPulseEvent by a user application. |
MonitorEventEventPulse |
State: The state of the eventat the time of the call to RtPulseEvent(): TRUE means signaled, FALSE means reset. Manual Reset: Whether or not the event is manual reset. Waiters: Number of waiters on the event at the time of the call to RtPulseEvent(). Name: Event name if it has one, otherwise the empty string. |
| Event Reset | Represents a call to RtResetEvent by a user application. | MonitorEventEventReset |
State: The state of the eventat the time of the call to RtResetEvent: TRUE means signaled, FALSE means reset. Manual Reset: Whether or not the event is manual reset. Waiters: Number of waiters on the event at the time of the call to RtResetEvent(). Name: Event name if it has one, otherwise the empty string. |
| Event Set | Represents a call to RtSetEvent by a user application. | MonitorEventEventSet | State: The state of the eventat the time of the call to RtResetEvent: TRUE means signaled, FALSE means reset. Manual Reset: Whether or not the event is manual reset. Waiters: Number of waiters. Name: Event name. |
| Exception Interrupt |
Represents an exception interrupt that occurs on an RTSS processor. This event is generated when a low-level exception, such as an access violation, page fault, divide-by-zero, or double fault, occurs. This event does not represent a C++ or .NET exception. |
MonitorEventExceptionInterrupt |
Exception Code: The exception value. RIP: The RIP at the time the exception happened. RSP: The RSP at the time the exception happened. FP: The frame pointer at the time the exception happened. |
| F | |||
| Fast Semaphore Acquire |
Represents a thread acquiring a RTFAST_SEMAPHORE object. This event is generated when RtAcquireFastSemaphore is called. |
MonitorEventFastSemaphoreAcquire |
Fast Semaphore: The address of the RTFAST_SEMAPHORE object. |
| Fast Semaphore Initialize |
Represents a thread initializing a RTFAST_SEMAPHORE object. This event is generated when RtInitializeFastSemaphore is called. |
MonitorEventFastSemaphoreInit | Fast Semaphore: The address of the RTFAST_SEMAPHORE object. |
| Fast Semaphore Release |
Represents a thread releasing some waiters on a RTFAST_SEMAPHORE object. This event is generated RtReleaseFastSemaphore is called. |
MonitorEventFastSemaphoreRelease |
Fast Semaphore: The address of the RTFAST_SEMAPHORE object. Count: The number of waiting threads requested to be released. |
| Fast Semaphore Release All |
Represents a thread releasing all waiters a RTFAST_SEMAPHORE object. This event is generated when RtReleaseAllFastSemaphore is called. |
MonitorEventFastSemaphoreReleaseAll | Fast Semaphore: The address of the RTFAST_SEMAPHORE object. |
| File Object Create | Generated when a file has been opened by the subsystem. | MonitorEventFileCreate |
Handle: The handle to the file. FileName: The full path to the filename that was opened. |
| File Object Destroy | Generated when a file has been destroyed by the subsystem. | MonitorEventFileDestroy | Handle: The handle to the file.
FileName: The full path to the filename that was opened. |
| H | |||
| Handle Close |
Represents the closing of a handle. This event is generated CloseHandle is called on any handle. |
MonitorEventHandleClosed |
Handle: The handle being closed. ObjectType: The type code of the object that this handle references. The type codes are given as OT_*macros at the top of RTSS\Include\Object.h. Reference Count: The reference count of the object after being decremented for the close operation. |
| Heap Allocate |
Represents a successful memory allocation using HeapAlloc. This event is generated HeapAlloc or HeapReAlloc is called. |
MonitorEventHeapAlloc |
Address: The address of the allocated memory. Size: The size of the allocation request. Heap: The handle to the heap from which to allocate the memory. Flags: The flags parameter passed to HeapAlloc(). |
| Heap Allocation Fail | Represents a failed memory allocation using HeapAlloc. | MonitorEventHeapAllocFailed | Size: The size of the allocation request. Heap: The handle to the heap from which to allocate the memory. Flags: The flags parameter passed to HeapAlloc(). |
| Heap Create |
Represents the creation of a heap. This event is generated when HeapCreate is called. |
MonitorEventHeapCreate |
Creation Options: This is the options parameter passed to HeapCreate() when this heap was created. Init Size: This is the initial size parameter passed to HeapCreate() when this heap was created. Max Size: This is the maximum size parameter passed to HeapCreate() when this heap was created. Unique Mutex ID: This is the unique ID of the mutex associated with this heap (if there is one), otherwise this is zero. Handle: The handle for this heap. |
| Heap Destroy |
Represents the destruction of a heap. This event is generated when HeapDestroy is called. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. |
MonitorEventHeapDestroy |
Size: Size of the heap when it was destroyed Handle: Handle to the destroyed heap. |
| Heap Free |
Represents freeing memory via HeapFree(). This event is generated when HeapFree is called. |
MonitorEventHeapFree |
Address: The address being freed. Handle: The handle to the heap. Flags: The flags parameter passed to HeapFree(). |
| Heap Free Fail | Represents failed freeing of memory via HeapFree(). | MonitorEventHeapFreeFail |
Address: The address that failed to become freed. Handle: The handle to the heap. Flags: The flags parameter passed to HeapFree(). Error: The error code indicating why the failure happened. |
| Heap Re-Allocate | Represents a successful call to HeapReAlloc. | MonitorEventHeapReAlloc |
Old address: The address of the memory before re-allocation. New address: The address of the memory after re-allocation. Old size: The size of the memory before re-allocation. New size: The size of the memory after re-allocation. Handle: The handle of the heap that was passed to HeapReAlloc. Flags: The Flags parameter passed to HeapReAlloc. |
| I | |||
| Ideal Processor Set |
Represents a thread setting its ideal processor. This event is generated when SetThreadIdealProcessor is called. |
MonitorEventIdealProcessorSet |
Handle: The handle of the thread whose ideal processor is being set. Target TID: The thread ID of the target thread. Target PID: The process ID of the process that owns the target thread. New Ideal Processor: The processor number of the new ideal processor for the target thread. Previous Ideal Processor: The processor number of the previous ideal processor for the target thread. |
| IST Handler |
Represents invocation of an IST handler function. This event is generated when an IST interrupt handler is called. |
MonitorEventIstHandler |
Function Ptr: A pointer to the application-supplied IST handler function. Context: The opaque context value to be passed to the IST handler function. TID: The thread ID of the IST thread. Vector: The system interrupt vector number. Mask: The mask for this interrupt. Shared: TRUE if this interrupt is shared, FALSE otherwise. MsixTableAddr: MSI-X table address. Processor: The processor to which this IST thread is affined. |
| L | |||
| Line Based Interrupt Release |
Represents the release of a previously attached line-based interrupt. This event is generated when RtReleaseInterrupt is called to release a line-based interrupt. |
MonitorEventInterruptLineBasedRelease |
Handle: The handle for this interrupt attachment. ISTFunction addr: The IST function (or NULL if not used). ISRFunction addr: The ISR function (or NULL if not used). Context: The opaque context value to pass to the IST and ISR functions. ISTThreadPriority: The priority of the interrupt handler. This is only defined if ISTFunction is non-NULL. |
| Local Memory Alloc |
Represents a successful allocation from the local memory pool. This event is generated when local memory is allocated, as with RtAllocateLocalMemory, or when a process is configured to use Local Memory for all allocations. |
MonitorEventLocalMemoryAlloc |
Address: The memory address of the allocated memory. Size: The requested size of the allocated memory. Flags: This is either RTALLOC_NOT_ZERO_MEMORY, which means the allocated memory was not filled with zero bytes, or zero, which means the allocated memory was filled with zero bytes. |
| Local Memory Alloc Fail |
Represents a failed allocation from the local memory pool. |
MonitorEventLocalMemoryAllocFailed |
Error: The error code indicating why the failure happened. Size: The requested size of the allocated memory. Flags: This is either RTALLOC_NOT_ZERO_MEMORY, which means the allocated memory was not filled with zero bytes, or zero, which means the allocated memory was filled with zero bytes. |
| Local Memory Expand |
Represents the expansion of the RTSS process' MSpace. This event is generated the local memory pool expands by calling RtExpandMSpace. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventLocalMemoryExpand | ExpandSize: The amount by which the MSpace expanded (in bytes). |
| Local Memory Free |
Represents freeing local memory. This event is generated when local memory is freed, as with RtFreeLocalMemory or when a process is configured to use local memory for all allocations. |
MonitorEventLocalMemoryFree | Address: The address being freed. |
| Local Memory Free Fail | Represents failed freeing of local memory. | MonitorEventLocalMemoryFreeFail |
Address: The address that failed to become freed. Error: The error code indicating why the failure happened. |
| Local Memory Shrink |
Represents the shrinking of the RTSS Process' MSpace. This event is generated when the MSpace shrinks from a call to RtShrinkMSpace. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventLocalMemoryShrink | Shrink Size: The amount by which the MSpace shrank (in bytes). |
| M | |||
| Memory Map | Represents a successful call to RtMapMemory. | MonitorEventMemoryMap |
Virtual Address: The virtual address at which the physical memory is mapped. Physical Address: The physical address passed to RtMapMemory(). Size: The size of the memory to be mapped (in bytes). CacheType: The cache type to use for the mapped memory. |
| Memory Unmap | Represents a successful call to RtUnmapMemory. | MonitorEventMemoryUnmap | Virtual Address: The virtual address at which the physical memory is mapped. |
| Message Based Interrupt Release |
Represents the release of a previously attached message-based interrupt. This event is generated when RtReleaseInterrupt is called to release a message-based interrupt. |
MonitorEventInterruptMessagebasedRelease |
Handle: The handle for this interrupt attachment. ISTFunction addr: The IST function called to handle the interrupt. NULL if no function given. ISRFunction addr: The ISR function called to handle the interrupt. NULL if no function given. Context: The context value passed to the IST and ISR functions. ISTThreadPriority: The thread priority of the IST thread. This is only defined if ISTFunction is non-NULL. |
| Module Load |
Represents a successful load of a module (RTSS or RTDLL). This event is generated when a module is loaded, either by launching a new real-time process or by implicitly or explicitly loading an RTDLL. |
MonitorEventModuleLoad | Path: The pathname of the module. |
| Module Unload |
Represents a successful unload of a module (RTSS or RTDLL). This event is generated when a module is unloaded, either at process termination or when an RTDLL is unloaded by a call to FreeLibrary. |
MonitorEventModuleUnload | Path: The pathname of the module. |
| Mutex Create |
Represents a mutex creation event. This event is generated when RtCreateMutex is called. |
MonitorEventMutexCreate |
Count: Acquisition count (0 if free). Abandoned: TRUE if mutex was abandoned. Initial Owner: Initial ownership state. OwnerPID: Process that currently owns the mutex (or 0 if no owner). OwnerTID: Thread that currently owns the mutex (or 0 if no owner). Priority: Mutex level priority, it is used when priority Promotion is in effect. Threads Waiting: The number of threads waiting on this mutex. Reference Count: The reference count of this mutex. Name: Mutex name. If it's an unnamed mutex, this is the empty string. Handle: The handle for this mutex. |
| Mutex Destroy |
Acquisition count (0 if free). This event is generated when the last handle to a mutex is closed. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. |
MonitorEventMutexDestroy |
Count: Acquisition count (0 if free) Abandoned: TRUE if mutex was abandoned Owner PID: Process that currently owns the mutex (or 0 if no owner). Owner TID: Thread that currently owns the mutex (or 0 if no owner). Priority: Mutex level priority, it is used when priority Promotion is in effect. Threads Waiting: The number of threads waiting on this mutex. Name: Mutex name. If it's an unnamed mutex, this is the empty string. |
| Mutex Open |
Represents opening of a mutex. This event is generated when RtOpenMutex is called. |
MonitorEventMutexOpen |
Handle: The handle for this mutex returned by this open operation. Count: Acquisition count (0 if free) Abandoned: TRUE if mutex was abandoned OwnerPID: Process that currently owns the mutex (or 0 if no owner). OwnerTID: Thread that currently owns the mutex (or 0 if no owner). Priority: Mutex level priority, it is used when priority Promotion is in effect. Threads Waiting: The number of threads waiting on this mutex. Referenced: The reference count of this mutex after this open operation completes. Name: Mutex name. If it's an unnamed mutex, this is the empty string. |
| Mutex Release |
Represents a mutex being released by a call to RtReleaseMutex. NOTE: NOTE: If the mutex recursion count is greater than zero after RtReleaseMutex() returns, the mutex remains locked by the current thread. |
MonitorEventMutexRelease |
MutexCount: The recursion count of the mutex. If this is non-zero, the mutex is locked. If this is greater than one, the owning thread has locked it more than once. Threads Waiting: The number of threads waiting on the mutex after RtReleaseMutex() returns. Handle: The handle to the mutex being released. Name[MAX_PATH]: The name of the mutex. If it has no name, this is the empty string. |
| P | |||
| Priority Demotion |
Represents priority demotion. This event is generated when thread priority demotion occurs. |
MonitorEventPriorityDemotion |
Target TID: The thread ID of the thread getting the priority demotion. Target PID: The process ID of the process that owns the thread getting the priority demotion. New Priority: The new priority of the demoted thread. Previous Priority: The previous priority of the demoted thread. |
| Priority Promotion |
Represents priority promotion to solve priority inversion. This event is generated when thread priority promotion occurs. |
MonitorEventPriorityPromotion |
Target TID: The thread ID of the thread getting the priority promotion. Target PID: The process ID of the process that owns the thread getting the priority promotion. New Priority: The new priority of the promoted thread. Previous Priority: The previous priority of the promoted thread. |
| Process Affinity Mask Set |
Represents the setting of a process's processor affinity mask. This event is generated when RtSetProcessAffinityMask is called. |
MonitorEventProcessAffinityMaskSet |
Target PID: The process ID of the target thread (the thread having its affinity mask set). New Mask: The new thread affinity mask. Previous Mask: The previous thread affinity mask. Affined Processor: The new affined processor number for the target process. |
| Process Create |
Represents the creation of a real-time process. NOTE: This event also represent proxy processes. When the process being created is a proxy process, this event appears as ProxyProcessCreate. |
MonitorEventProcessCreate |
Exec: The pathname to the executable this process is running. This is always NUL-terminated, even at the expense of truncating the pathname. Cmd: The command line used to start this process. This is always NUL-terminated. This string may be truncated and not show the entire command line. Spawned PID: The process ID. Spawned TID: The thread ID of the initial thread. Affinity Mask: The processor affinity mask. Affined Processor: The affined processor number. Local Mem: true if the process uses local memory by default for allocations, false otherwise. Ref Count: The reference count of this process. Flags: Internal process flags. Handle: The handle for this process. Local memory MSpace fieldsInternalMSpace: The process's internal MSpace pointer. ExternalMSpace: The process's external MSpace pointer. InternalMSpaceCommit: Whether the process's internal MSpace is committed at process start. ExternalMSpaceCommit: Whether the process's external MSpace is committed at process start. InternalMSpaceInitialSize: The initial size of the process's internal MSpace. ExternalMSpaceInitialSize: The initial size of the process's external MSpace. InternalMSpaceExpandable: Whether the process's internal MSpace is expandable. InternalMSpaceExpandSize: The size by which the process's internal MSpace can expand. ExternalMSpaceExpandable: Whether the process's external MSpace is expandable. ExternalMSpaceExpandSize: The size by which the process’s external MSpace can expand. InternalMSpaceShrinkable: Whether the process's internal MSpace is shrinkable. ExternalMSpaceShrinkable: Whether the process's external MSpace is shrinkable. |
| Process Destroy |
Represents the destruction of a process. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. NOTE: This event also represents proxy processes. When the process being destroyed is a proxy process, this event appears as ProxyProcessDestroy in the output. |
MonitorEventProcessDestroy |
Destroyed PID: The process ID. Exit Code: The process's exit code. Affinity Mask: The processor affinity mask. Processor: The affined processor number. Flags: Internal process flags. |
| Process Open |
Represents opening of a process. This event is generated when RtOpenProcess is called. |
MonitorEventProcessOpen |
ProcessID: The ID of the process being opened. Handle: The handle to the newly opened process. Processor Affinity Mask: The processor affinity mask. Processor: The affined processor number. Reference Count: The reference count of this process after being incremented for this open operation. Flags: Internal process flags. Path: The pathname to the executable this process is running. This is always NUL-terminated, even at the expense of truncating the pathname. |
| R | |||
| Resume Thread | Represents a call to ResumeThread from a user application. | MonitorEventThreadResume |
Target TID: The ID of the thread being resumed. Target PID: The ID of the process that owns the thread being resumed. Suspend Count: The previous suspend count returned by ResumeThread() to the user application. |
| S | |||
| Semaphore Create |
Represents the creation of a semaphore. This event is generated when RtCreateSemaphore is called. |
MonitorEventSemaphoreCreate |
Max Count: The maximum count of this semaphore. Current Count: The current semphore count. Threads Waiting: The number of threads waiting on this semaphore. Ref Count: The reference count of the semaphore. Name: The name of the semaphore (if it has one). If it has no name, this is the empty string. Handle: The handle for this semaphore. |
| Semaphore Destroy |
Represents the destruction of a semaphore. This event is generated after the last handle to a semphore object is closed. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. |
MonitorEventSemaphoreDestroy | Max Count: The maximum count of this semaphore. Current Count: The semphore count at the time it was destroyed. Threads Waiting: The number of threads waiting on this semaphore. Name: The name of the semaphore (if it has one). If it has no name, this is the empty string. |
| Semaphore Open |
Represents opening of a semaphore. This event is generated when RtOpenSemaphore is called. |
MonitorEventSemaphoreOpen |
Handle: The handle for this semaphore. Max Count: The maximum count of this semaphore.Count: The current semphore count. Threads Waiting: The number of threads waiting on this semaphore. Referenced: The reference count of the semaphore after this open operation completes. Name: The name of the semaphore (if it has one). If it has no name, this is the empty string. |
| Semaphore Release | Represents a semaphore being released by a call to RtReleaseSemaphore. | MonitorEventSemaphoreRelease |
Release Count: The release count passed to RtReleaseSemaphore(). New Count: The new semaphore count after incrementing the old count by ReleaseCount and waking zero or more waiting threads. Previous Count: The semaphore count at the moment RtReleaseSemaphore() was called. Threads Waiting: The number of threads waiting on the mutex after RtReleaseSemaphore() returns. Name: The name of the semaphore. If it has no name, this is the empty string. |
| Session Marker | Represents an internal marker event generated by the Monitoring Framework. This event is used to mark the enabling/disabling of monitoring and other interesting internal events. | MonitorEventMarker |
MarkerKind: The kind of marker this event represents. SystemTime: The system time as returned by KeQuerySystemTime() at the time this event was generated. Magic[4]: A four-byte magic value that must be "IZFL" with no terminating NUL byte. |
| Shared Memory Create |
Represents the creation of a shared memory region. This event is generated when RtCreateSharedMemory is called. |
MonitorEventSharedMemoryCreate |
Flags: The permission flags for the shared memory region. Size: The size of the shared memory region. Address: The address of the start of the shared memory region. Ref Count: The reference count of the shared memory region. Name: The name of the shared memory region (if it has one). If it has no name, this is the empty string. Handle: The handle for this shared memory region. |
| Shared Memory Destroy |
Represents the destruction of a shared memory object. This event is generated after the last handle to a shared memory region is closed. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. |
MonitorEventSharedMemoryDestroy | Flags: The permission flags for the shared memory region. Size: The size of the shared memory region. Address: The address of the start of the shared memory region. Name: The name of the shared memory region (if it has one). If it has no name, this is the empty string. |
| Shared Memory Open |
Represents opening of a shared memory region. This event is generated when RtOpenSharedMemory is called. |
MonitorEventSharedMemoryOpen |
Handle: The handle for this shared memory region. Flags: The permission flags for the shared memory region.Size: The size of the shared memory region. Address: The address of the start of the shared memory region. Ref Count: The reference count of the shared memory region after this open operation completes. Name: The name of the shared memory region (if it has one). If it has no name, this is the empty string. |
| Shutdown Handler Create |
Represents the creation of a shutdown handler. This event is generated when RtAttachShutdownHandler is called. |
MonitorEventShutdownHandlerCreate |
Func: A pointer to the handler function for this shutdown handler. Context: The context value to be passed to the handler function. TID: The ID of the thread that will call the handler function. Thread Priority: The priority of the thread that will call the handler function. Handle: The handle for this shutdown handler. |
| Shutdown Handler Destroy |
Represents the destruction of a shutdown handler. This event is generated after RtReleaseShutdownHandler is called. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. |
MonitorEventShutdownHandlerDestroy | Handle: The handle for this shutdown handler. |
| SRI to Windows Event | Generated when an SRI over to Windows has been initiated. (no unique ID) | MonitorEventSriToWindows | FunctionName: The name of the function that is sent to Windows for resources. |
| SRI to Windows Return Event | Generated when an SRI over to Windows has returned. (no unique ID) | MonitorEventSriToWindowsReturn | FunctionName: The name of the function that is sent to Windows for resources. |
| Subsystem Stop |
Represents the RTX64 subsystem stopping. |
MonitorEventSubsystemStop | Time: The system time when this event was generated. |
| Suspend Thread |
Represents a call to SuspendThread from a user application. |
MonitorEventSuspendThread |
Target TID: The ID of the thread being suspended. Target PID: The ID of the process that owns the thread being suspended. Suspend Count: The previous suspend count returned by SuspendThread() to the user application. |
| T | |||
| Thread Terminate | Generated when a thread terminates. | MonitorEventThreadTerminate | ExitCode: an integer value of what the thread’s exit code was. |
| Timer Cancel | Represents a timer being cancelled. | MonitorEventCancelTimer |
Function: The user-supplied timer function. Context: The user-supplied opaque context value. Clock: The timer clock. Period: The timer period. ThreadPriority: The timer thread priority. |
| TLS Alloc | Represents a call to TlsAlloc by a user application. | MonitorEventTLSAlloc | Index: The TLS index returned by TlsAlloc(). |
| TLS Free | Represents a call to TlsFree by a user application. | MonitorEventTLSFree |
Index: The TLS index passed to TlsFree(). Error: If Status is FALSE, this holds the error code describing the error, otherwise it is undefined. |
| TLS Free Fail | Represents a failed call to TlsFree by a user application. | MonitorEventTLSFreeFail |
Index: The TLS index that failed to pass to TlsFree(). Error: The error code indicating why the failure happened. |
| Thread Affinity Mask Set |
Represents the setting of a thread's processor affinity mask. This event is generated when SetThreadAffinityMask is called. |
MonitorEventThreadAffinityMaskSet |
Target TID: The thread ID of the target thread. Target PID: The process ID of the process that owns the target thread. New Mask: The new thread affinity mask. Previous Mask: The previous thread affinity mask. Affined Processor: The new affined processor number for the target thread. |
| Thread Create |
Represents the creation of a thread. This event is generated for both user threads and proxy threads. This event is generated when a real-time thread is created, either automatically as when a process starts or by a call to RtCreateThread. |
MonitorEventThreadCreate |
Spawned TID: The thread ID. Spawned PID: This thread's process ID. StackSize: The thread's stack size. Start Function: The thread's start function. Argument: The argument passed to this thread's start function. Priority: The thread priority. Time Quantum: The thread's time quantum. Suspend Count: This thread's suspend count. Process Affinity: This thread's processor affinity mask. State: The thread state at creation time. Ref Count: The reference count of this thread. Flags: The thread flags. Handle: The handle for this thread. |
| Thread Destroy |
Represents the destruction of a thread. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. |
MonitorEventThreadDestroy | Current TID: The thread ID. Current ProcessID: This thread's process ID. StackSize: The thread's stack size. Exit Code: The thread's exit code. Priority: The thread priority. Time Quantum: The thread's time quantum. Suspend Count: This thread's suspend count. Affinity Mask: This thread's processor affinity mask. Processor: This thread's affined processor number. State: The thread state at destruction time. Flags: The thread flags. |
| Thread Open | Represents the instance a real-time thread is opened. This occurs when a real-time process calls OpenThread. | MonitorEventThreadOpen | StackSize: The thread's stack size. Start Function: The thread's start function. Argument: The argument passed to this thread's start function. Priority: The thread priority. Time Quantum: The thread's time quantum. Suspend Count: This thread's suspend count. Process Affinity: This thread's processor affinity mask. State: The thread state at creation time. Ref Count: The reference count of this thread. Flags: The thread flags. Handle: The handle for this thread. |
|
Thread Priority Set |
Represents a change to a thread's priority via RtSetThreadPriority or SetThreadThreadPriority. This event is generated when RtSetThreadPriority is called or when the RTX64 subsystem performs internal thread scheduling operations. |
MonitorEventThreadPrioritySet |
Target TID: The ID of the thread having it's priority changed. Target PID: The ID of the process that owns the thread having it's priority changed. New Priority: The new priority of the thread. Previous Priority: The previous priority of the thread. |
| Thread Time Quantum Set | Represents a change to a thread's time quantum via RtSetThreadTimeQuantum. | MonitorEventThreadQuantumSet |
Target TID: The ID of the thread having it's time quantum changed. Target PID: The ID of the process that owns the thread having it's time quantum changed. New Time Quantum: The new time quantum of the thread. Previous Time Quantum: The previous time quantum of the thread. |
| Thread Sleeping |
Represents a thread sleeping. This event is generated when Sleep or RtSleepFt is called. |
MonitorEventThreadSleep | Sleep Duration: The duration of the sleep in 100 nanosecond intervals. |
| Time Quantum Expire |
Represents the expiration of a thread's time quantum. |
MonitorEventTimeQuantumExpired |
Time Quantum: The current thread's time quantum at the time it expired. Priority: The current thread's priority at the time it expired. |
| Timer Cancel | This event is generated when RtCancelTimer is called. | MonitorEventTimerCancel |
Func Addr: The user-supplied timer function. Context: The user-supplied opaque context value. Clock: The timer clock. Timer Period: The timer period. Timer ThreadID: The ID of the timer thread. TimerPriority: The timer thread priority. Timer Handle: The handle of the cancelled event. |
| Timer Create |
Represents a timer creation event. This event is generated when RtCreateTimer is called. |
MonitorEventTimerCreate |
Stack Size: The thread stack size of the timer thread. Func Addr: The user-supplied timer function. Context: The user-supplied opaque context value. ThreadPriority: The timer thread priority. Clock: The timer clock. Affinity: The processor affinity mask passed to RtCreateTimer(Ex) by the user. Processor: The processor to which the timer thread is affined. Timer Period: The timer period. Timer ThreadID: The timer thread ID. Handle: The handle for this timer. |
| Timer Destroy |
Represents the destruction of an timer object. This event is generated after RtDeleteTimer is called. NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero. |
MonitorEventTimerDestroy | Func Addr: The user-supplied timer function. Context: The user-supplied opaque context value. Clock: The timer clock. Period: The timer period. Timer ThreadID: The timer thread ID. ThreadPriority: The timer thread priority. |
| Timer Expire | Represents a timer expiration. | MonitorEventTimerExpire | Function: The timer callback function. Context: The user-supplied opaque context value. Clock: The timer clock. Period: The timer period. ThreadID: The timer thread ID. ThreadPriority: The timer thread priority. |
| Timer Set | Represents a timer being set. | MonitorEventTimerSet | Function: The user-supplied timer function. Context: The user-supplied opaque context value. Relative: Was the timer set using relative or absolute times. Clock: The timer clock. Expiration Period: The initial expiration period. Interval Period: The repeating expiration interval. ThreadID: The timer thread ID. ThreadPriority: The timer thread priority. Timer Handle: The handle of the set event. |
| U | |||
| Unhandled Exception Filter Set | Represents a call to SetUnhandledExceptionFilter. | MonitorEventUnhandledExceptionFilter |
New Filter Function: A pointer to the newly-installed unhandled exception filter function. This is NULL if SetUnhandledExceptionFilter is resetting unhandled exception filtering to the default behavior. Previous Filter Function: A pointer to the previously-installed unhandled exception filter function. This is NULL if there was no previously-installed filter function. |
| Unhandled Exception Filter Call |
Represents a call to a user-supplied unhandled exception filter function that was installed using SetUnhandledExceptionFilter. This event is generated when an unhandled exception filter function is called. |
MonitorEventUnhandledExceptionFilterCalled |
Filter Function: A pointer to the unhandled exception filter function that was called. Exception ADDR: The exception address from the EXCEPTION_RECORD structure passed to the filter function. Code: The exception code from the EXCEPTION_RECORD structure passed to the filter function. Flags: The exception flags from the EXCEPTION_RECORD structure passed to the filter function. NumberParameters: The number of exception parameters in array ExceptionInformation from the EXCEPTION_RECORD structure passed to the filter function. Exception Information: The exception parameters array from the EXCEPTION_RECORD structure passed to the filter function. |
| W | |||
| WaitForMultipleObjectsEX Return |
Represents a call to RtWaitForMultipleObjectsEx returning, either successfully or not. This event is generated when WaitForMultipleObjects or WaitForMultipleObjectsEx returns. |
MonitorEventWFMOEXReturned |
Count: The number of object handles passed to RtWaitForMultipleObjectsEx(). Handles: The handles passed to RtWaitForMultipleObjectsEx(). Timeout: The timeout (in 100 ns intervals) passed to RtWaitForMultipleObjectsEx(). Object Types: The types of the objects on which the current thread was waiting. Zero indicates the array element does not represent an object. Returned: The value returned by RtWaitForMultipleObjectsEx(). |
| WaitForMultipleObjectsEX Wait |
Represents a call to RtWaitForMultipleObjectsEx waiting a set of synchronization objects. This event is generated when WaitForMultipleObjects or WaitForMultipleObjectsEx blocks execution to wait on one or more objects. Each handle being waited on is listed (along with the type of object referenced by the handle) starting on the third line of this event. |
MonitorEventWFMOEXWait | Count: The number of object handles passed to RtWaitForMultipleObjectsEx(). Handles: The handles passed to RtWaitForMultipleObjectsEx(). Timeout: The timeout (in 100 ns intervals) passed to RtWaitForMultipleObjectsEx(). Object Types: The types of the objects on which the current thread is about to wait. Zero indicates the array element does not represent an object. |
| WaitForSingleObjectEX Return | Represents a call to RtWaitForSingleObjectEx returning, either successfully or not. | MonitorEventWFSOEXReturned |
Handle: The handle passed to RtWaitForSingleObjectEx(). Timeout: The timeout (in 100 ns intervals) passed to RtWaitForSingleObjectEx(). Object Type: The type of the object on which the current thread was waiting. Returned: The value returned by RtWaitForSingleObjectEx(). Waiting Threads: The current number of threads waiting on the object (not including the current thread). |
| WaitForSingleObjectEX Wait |
Represents a call to RtWaitForSingleObjectEx waiting for a synchronization object. This event is generated when WaitForSingleObject or WaitForSingleObjectEx blocks execution to wait on an object. |
MonitorEventWFSOEXWait | Handle: The handle passed to RtWaitForSingleObjectEx(). Timeout: The timeout (in 100 ns intervals) passed to RtWaitForSingleObjectEx(). Object Type: The type of the object on which the current thread is about to wait. Waiting Threads: The current number of threads waiting on the object (including the current thread). |
| Watchdog Reset | Represents an instance where a watchdog timer reset occurs on certain cores. | MonitorEventWatchdogReset |
Affinity: The affinity mask representing the processors where the watchdog timer was reset Core: The core(s) on which the watchdog reset occurred. |
| Windows Memory Allocate |
Represents a successful allocation of memory from Windows by a real-time process. This event is generated when Windows memory is allocated by the RTX64 subsystem, either for internal use or as the result of a request from a user application (i.e., a call to malloc or new). NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventWindowsMemoryAlloc |
Address: The address of the allocated memory. Size: The size of the allocation request. |
| Windows Memory Allocation Fail |
Represents a failed allocation of memory from Windows by a real-time process. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventWindowsMemoryAllocFailed | Size: The size of the allocation request. |
| Windows Memory Free |
Represents freeing memory to Windows. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventWindowsMemoryFree | Address: The address being freed. |
| Windows Memory Free Fail |
Represents failed freeing of memory to Windows. NOTE: This monitoring event is not generated in RTX64 4.3 and later versions. |
MonitorEventWindowsMemoryFreeFail |
Address: The address that failed to become freed. Error: The error code indicating why the failure happened. |
Examples
Below are examples of Event Classes as they appear in text output of a monitoring session.
Heap Create
Heap Create: TSC 14313774442814, PID 1001, TID 12, CORE 2
Handle: 0xFFFFFA80`1BEFD000, Creation Options: 0x0, Init Size: 4096, Max Size: 0, Unique Mutex Id: 0
Heap Destroy
Heap Destroy: TSC 14330549202694, PID 1001, TID 12, CORE 2
Handle: 0xFFFFFA80`1BF06000, Size: 0
Heap Free
Heap Free: TSC 14313776522750, PID 1001, TID 12, CORE 2
Address: 0xFFFFFA80`198F6110, Handle: 0xFFFFFA80`1BEFD000, Flags: 0x0
Related Topics:
