Monitor Event Classes

The following tables contain an alphabetical listing of the available Monitor event names. For each event name, a description is provided along with the associated Managed Code Framework class name and the corresponding fields that appear in the text output. All events listed in the text output of a monitoring session include the Time Stamp Counter (TSC), Process ID (PID), Thread ID (TID), and the core (CORE) on which the event occurred.

For example: 

20848276916965: Context Switch, CORE 4, Event generated by PID 0, TID 2
  Old Thread: 0, New Thread: 2, Old Process 0, New Process 0

 

To navigate these tables of events, scroll or click on a link below to jump to a particular section.

A | C | D | E | F | H | I | L | M | P | R | S | T | U | W | Examples

 

A

Name / Managed Code Framework Class Name Description Text Output Fields

Attach Line Based Interrupt

MonitorEventAttachInterruptLinedBased

Represents an application attaching to a line-based interrupt.

This event is generated when a call to RtAttachInterrupt is made to attach a line-based interrupt.
  • Handle: The handle for this interrupt attachment.
  • Stack Size: The stack size of the IST thread (if one exists), otherwise zero.
  • Function Addr: The IST function (or NULL if not used).
  • Context: The opaque context value to pass to the IST and ISR functions.
  • ISTThreadPriority: The priority of the interrupt handler (only if ISTFunction is non-NULL).
  • InterfaceType: The I/O bus interface type.
  • PCIBus: The I/O bus number.
  • SlotNumber: The I/O bus slot number.
  • Interrupt Lv1: The bus interrupt level.
  • Interrupt Vector: The I/O bus interrupt vector.
  • Shared: Whether the interrupt is shared or not.
  • InterruptMode: The interrupt mode (level-sensitive or latched).

Attach Message Based Interrupt

MonitorEventAttachInterruptMessagedBased

Represents attaching an IST or ISR to a message-based interrupt.

This event is generated when a call to RtAttachInterrupt is made to attach a message-based interrupt.
  • ISR Func Addr: The ISR function (or NULL if not used).
  • Processor Affinity Mask: A bit mask of processors on which the interrupt is enabled.
  • Handle: The handle for this interrupt attachment.
  • MSI: Whether the caller prefers that the device uses MSI instead of MSI-X interrupts.
  • IST Func Addr: The IST function (or NULL if not used).
  • ISR Func Addr: The ISR function (or NULL if not used).
  • Context: The context value passed to the IST and ISR functions.
  • Stack Size: The stack size of the IST thread (if one exists), otherwise zero.
  • IST Priority: The thread priority of the IST thread. This is only defined if ISTFunction is non-NULL.
  • BusNumber: The I/O bus number.
  • SlotNumber: The I/O bus slot number.
  • Processor Affinity Mask: A bit mask specifying the processors on which this interrupt is enabled

 

C

Name / Managed Code Framework Class Name Description Text Output Fields

CLOS Set

MonitorEventCLOSSet

Represents a change in Class of Service (CLOS) of a thread.

  • TargetThreadID: The thread ID of the target thread.
  • TargetProcessID: The thread ID of the target process.
  • newCLOS: The new thread CLOS.
  • oldCLOS: The CLOS of the thread prior to the change.

Context Switch

MonitorEventContextSwitch

 

Represents a context switch event.

This event is generated when a thread context switch happens. This event is disabled by default, because there can be several thousands of context switches per second.

NOTE: Context Switch events are enabled by default.
  • OldHFIClassID: The Intel® Hardware Feedback Interface (HFI) Class ID of the associated real-time thread at the time the thread was context-switched AWAY from a processor.
  • NewHFIClassID: The Intel® Hardware Feedback Interface (HFI) Class ID of the associated real-time thread at the time the thread was context-switched TO a processor.
  • Old Thread: The thread ID of the previous thread.
  • New Thread: The thread ID of the next thread.
  • Old Process: The process ID of the process to which oldThread belongs.
  • New Process: The process ID of the process to which newThread belongs. This can be the same as oldProcessID.

Contiguous Windows Memory Allocate

MonitorEventContiguousMemoryAlloc

Represents the successful allocation of physically contiguous memory by a call to RtAllocateContiguousMemory.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Address: The address of the allocated memory.
  • Size: The size of the allocation request.
  • Max Address: The highest physical address that can be part of the range allocated.

Contiguous Windows Memory Allocate Fail

MonitorEventContiguousMemoryAllocFailed

Represents a failed allocation of physically contiguous memory by a call to RtAllocateContiguousMemory.

This event is generated when RtAllocateContiguousMemory is called and it fails.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Size: The size of the allocation request.
  • Max Address: The highest physical address that can be part of the range allocated.

Contiguous Windows Memory Specify Cache Allocate

MonitorEventContiguousMemoryAllocSpecifyCache

Represents a successful allocation of physically contiguous memory by a call to RtAllocateContiguousMemorySpecifyCache.

This event is generated when RtAllocateContiguousMemorySpecifyCache is called and it succeeds.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Memory Address: The address of the allocated memory.
  • Size: The size of the allocation request.
  • Min Address: The lowest physical address that can be part of the range allocated.
  • Max Address: The highest physical address that can be part of the range allocated.
  • Boundary: The physical address multiple that the allocated memory must not cross. This is always a power of two.
  • CacheType: The type of caching allowed for the requested memory.

Contiguous Windows Memory Specify Cache Allocate Fail

MonitorEventContiguousMemoryAllocSpecifyCacheFailed

Represents a failed allocation of physically contiguous memory by a call to RtAllocateContiguousMemorySpecifyCache.

This event is generated when RtAllocateContiguousMemorySpecifyCache is called and it fails.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Size: The size of the allocation request.
  • Min Address: The lowest physical address that can be part of the range allocated.
  • Max Address: The highest physical address that can be part of the range allocated.
  • Boundary: The physical address multiple that the allocated memory must not cross. This is always a power of two.
  • CacheType: The type of caching allowed for the requested memory.

Contiguous Memory Free

MonitorEventContiguousMemoryFree

Represents freeing physically contiguous memory via RtFreeContiguousMemory.

This event is generated when RtFreeContiguousMemory is called and it succeeds.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Address: The address being freed.

Contiguous Memory Free Fail

MonitorEventContiguousMemoryFreeFail

Represents failed freeing of contiguous memory.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.

 
  • Address: The address that failed to become freed.
  • Error: The error code indicating why the failure happened.

Critical Section Delete

MonitorEventCriticalSectionDelete

Represents a thread deleting a critical section.

This event is generated when DeleteCriticalSection is called.
  • Critical Section: The address of the CRITICAL_SECTION object.

Critical Section Enter

MonitorEventCriticalSectionEnter

Represents a thread entering a critical section.

This event is generated when TryEnterCriticalSection is successfully called.
  • Critical Section: The address of the CRITICAL_SECTION object.

Critical Section Init

MonitorEventCriticalSectionInit

Represents the creation of a critical section.

This event is generated when InitializeCriticalSection is called.
  • Critical Section: The address of the CRITICAL_SECTION object.

Critical Section Leave

MonitorEventCriticalSectionLeave

Represents a thread leaving a critical section.

This event is generated when LeaveCriticalSection is called
  • Critical Section: The address of the CRITICAL_SECTION object.

Custom

MonitorEventCustom

Represents a custom event generated by user application code.

This event generated by a call to RtGenerateEvent.

NOTE: In Tracealyzer, custom events are displayed as user events.
  • UserKind: The user's custom event kind.
  • Size: The number of valid bytes in array Data[].
  • Data[500]: Up to 500 bytes of user-supplied custom event data.

 

D

Name / Managed Code Framework Class Name Description Text Output Fields

Data Lost

MonitorEventDataLost

Represents a Data Lost event.

This event is generated when RTX64 Monitor's internal buffers become full, resulting in loss of monitoring event data. If you see this event, you should use the RTX64 Control Panel to increase the amount of non-paged pool memory allocated to monitoring and/or monitor fewer kinds of events. This event indicates that at least one but possibly many monitoring events were lost. The kind of the first lost event is given on the second line of this event.
  • Lost Event: The kind of event that was lost.

 

E

Name / Managed Code Framework Class Name Description Text Output Fields

Event Create

MonitorEventEventCreate

Represents the creation of an event (the kind used for synchronization, not an RTX64 Monitor event).

This event is generated when RtCreateEvent is called.
  • Manual Reset: This is TRUE if the event is a manual reset event.
  • Initially Signaled: This is TRUE if the event was created in the signalled state, FALSE if it was created in the reset state.
  • State: This is TRUE if the event is signalled, FALSE if it is reset.
  • Count: This is the number of threads waiting on this event.
  • Ref Count: The reference count of this event.
  • Name: The name of the event (if it has one). If the event has no name, this is the empty string.
  • Handle: The handle for this event.

Event Destroy

MonitorEventEventDestroy

Represents the destruction of an event object.

This event is generated after the last handle to an event object is closed.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.
  • State: The state of the event: TRUE means signaled, FALSE means reset.
  • Manual Reset: Whether or not the event is manual reset.
  • Waiters: Number of waiters.
  • Name: Event name

Event Open

MonitorEventEventOpen

Represents opening of an event (the kind used for synchronization).

This event is generated when RtOpenEvent is called.
  • Handle: The handle returned by this open operation.
  • Manual Reset: This is TRUE if the event is a manual reset event.
  • State: This is TRUE if the event is signalled, FALSE if it is reset.
  • Reference Count: The reference count of this event after this open operation completes.
  • ThreadsWaiting: This is the number of threads waiting on this event.
  • Name: The name of the event (if it has one). If the event has no name, this is the empty string.

Event Pulse

MonitorEventEventPulse

Represents a call to RtPulseEvent by a user application.
  • State: The state of the eventat the time of the call to RtPulseEvent(): TRUE means signaled, FALSE means reset.
  • Manual Reset: Whether or not the event is manual reset.
  • Waiters: Number of waiters on the event at the time of the call to RtPulseEvent().
  • Name: Event name if it has one, otherwise the empty string.

Event Reset

MonitorEventEventReset

 Represents a call to RtResetEvent by a user application.
  • State: The state of the event at the time of the call to RtResetEvent: TRUE means signaled, FALSE means reset.
  • Manual Reset: Whether or not the event is manual reset.
  • Waiters: Number of waiters on the event at the time of the call to RtResetEvent().
  • Name: Event name if it has one, otherwise the empty string.

Event Set

MonitorEventEventSet

 Represents a call to RtSetEvent by a user application.
  • State: The state of the event at the time of the call to RtResetEvent: TRUE means signaled, FALSE means reset.
  • Manual Reset: Whether or not the event is manual reset.
  • Waiters: Number of waiters.
  • Name: Event name.

Exception Interrupt

MonitorEventExceptionInterrupt

Represents an exception interrupt that occurs on an RTSS processor.

This event is generated when a low-level exception, such as an access violation, page fault, divide-by-zero, or double fault, occurs. This event does not represent a C++ or .NET exception.
  • Exception Code: The exception value.
  • RIP: The RIP at the time the exception happened.
  • RSP: The RSP at the time the exception happened.
  • FP: The frame pointer at the time the exception happened.

 

F

Name / Managed Code Framework Class Name Description Text Output Fields

Fast Semaphore Acquire

MonitorEventFastSemaphoreAcquire

Represents a thread acquiring a RTFAST_SEMAPHORE object.

This event is generated when RtAcquireFastSemaphore is called.
  • Fast Semaphore: The address of the RTFAST_SEMAPHORE object.

Fast Semaphore Initialize

MonitorEventFastSemaphoreInit

Represents a thread initializing a RTFAST_SEMAPHORE object.

This event is generated when RtInitializeFastSemaphore is called.
  • Fast Semaphore: The address of the RTFAST_SEMAPHORE object.

Fast Semaphore Release

MonitorEventFastSemaphoreRelease

Represents a thread releasing some waiters on a RTFAST_SEMAPHORE object.

This event is generated RtReleaseFastSemaphore is called.
  • Fast Semaphore: The address of the RTFAST_SEMAPHORE object.
  • Count: The number of waiting threads requested to be released.

Fast Semaphore Release All

MonitorEventFastSemaphoreReleaseAll

Represents a thread releasing all waiters a RTFAST_SEMAPHORE object.

This event is generated when RtReleaseAllFastSemaphore is called.
  • Fast Semaphore: The address of the RTFAST_SEMAPHORE object.

File Object Create

MonitorEventFileCreate

 Generated when a file has been opened by the subsystem.
  • Handle: The handle to the file.
  • FileName: The full path to the filename that was opened.

File Object Destroy

MonitorEventFileDestroy

 Generated when a file has been destroyed by the subsystem.
  • Handle: The handle to the file.
  • FileName: The full path to the filename that was opened.

 

H

Name / Managed Code Framework Class Name Description Text Output Fields

Handle Close

MonitorEventHandleClosed

Represents the closing of a handle.

This event is generated when CloseHandle is called on any handle.
  • Handle: The handle being closed.
  • Object Name: The name of the object whose handle is being closed.
  • ObjectType: The type code of the object that this handle references. The type codes are given as OT_*macros at the top of RTSS\Include\Object.h.
  • Reference Count: The reference count of the object after being decremented for the close operation.

Heap Allocate

MonitorEventHeapAlloc

Represents a successful memory allocation using HeapAlloc.

This event is generated HeapAlloc or HeapReAlloc is called.
  • Address: The address of the allocated memory.
  • Size: The size of the allocation request.
  • Heap: The handle to the heap from which to allocate the memory.
  • Flags: The flags parameter passed to HeapAlloc().

Heap Allocation Fail

MonitorEventHeapAllocFailed

 Represents a failed memory allocation using HeapAlloc.
  • Size: The size of the allocation request.
  • Heap: The handle to the heap from which to allocate the memory.
  • Flags: The flags parameter passed to HeapAlloc().

Heap Create

MonitorEventHeapCreate

Represents the creation of a heap.

This event is generated when HeapCreate is called.
  • Creation Options: This is the options parameter passed to HeapCreate() when this heap was created.
  • Init Size: This is the initial size parameter passed to HeapCreate() when this heap was created.
  • Max Size: This is the maximum size parameter passed to HeapCreate() when this heap was created.
  • Unique Mutex ID: This is the unique ID of the mutex associated with this heap (if there is one), otherwise this is zero.
  • Handle: The handle for this heap.

Heap Destroy

MonitorEventHeapDestroy

Represents the destruction of a heap.

This event is generated when HeapDestroy is called.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.
  • Size: Size of the heap when it was destroyed
  • Handle: Handle to the destroyed heap.

Heap Free

MonitorEventHeapFree

Represents freeing memory via HeapFree().

This event is generated when HeapFree is called.
  • Address: The address being freed.
  • Handle: The handle to the heap.
  • Flags: The flags parameter passed to HeapFree().

Heap Free Fail

MonitorEventHeapFreeFail

Represents failed freeing of memory via HeapFree().

 
  • Address: The address that failed to become freed.
  • Handle: The handle to the heap.
  • Flags: The flags parameter passed to HeapFree().
  • Error: The error code indicating why the failure happened.

Heap Re-Allocate

MonitorEventHeapReAlloc

Represents a successful call to HeapReAlloc.

 
  • Old address: The address of the memory before re-allocation.
  • New address: The address of the memory after re-allocation.
  • Old size: The size of the memory before re-allocation.
  • New size: The size of the memory after re-allocation.
  • Handle: The handle of the heap that was passed to HeapReAlloc.
  • Flags: The Flags parameter passed to HeapReAlloc.

 

I

Name / Managed Code Framework Class Name Description Text Output Fields

Ideal Processor Set

MonitorEventIdealProcessorSet

Represents a thread setting its ideal processor.

This event is generated when SetThreadIdealProcessor is called.
  • Handle: The handle of the thread whose ideal processor is being set.
  • Target TID: The thread ID of the target thread.
  • Target PID: The process ID of the process that owns the target thread.
  • New Ideal Processor: The processor number of the new ideal processor for the target thread.
  • Previous Ideal Processor: The processor number of the previous ideal processor for the target thread.

IST Handler

MonitorEventIstHandler

Represents invocation of an IST handler function.

This event is generated when an IST interrupt handler is called.
  • Function Ptr: A pointer to the application-supplied IST handler function.
  • Context: The opaque context value to be passed to the IST handler function.
  • TID: The thread ID of the IST thread.
  • Vector: The system interrupt vector number.
  • Mask: The mask for this interrupt.
  • Shared: TRUE if this interrupt is shared, FALSE otherwise.
  • MsixTableAddr: MSI-X table address.
  • Processor: The processor to which this IST thread is affined.

 

L

Name / Managed Code Framework Class Name Description Text Output Fields

Line Based Interrupt Release

MonitorEventInterruptLineBasedRelease

Represents the release of a previously attached line-based interrupt.

This event is generated when RtReleaseInterrupt is called to release a line-based interrupt.
  • Handle: The handle for this interrupt attachment.
  • ISTFunction addr: The IST function (or NULL if not used).
  • ISRFunction addr: The ISR function (or NULL if not used).
  • Context: The opaque context value to pass to the IST and ISR functions.
  • ISTThreadPriority: The priority of the interrupt handler. This is only defined if ISTFunction is non-NULL.

Local Memory Alloc

MonitorEventLocalMemoryAlloc

Represents a successful allocation from the local memory pool.

This event is generated when local memory is allocated, as with RtAllocateLocalMemory, or when a process is configured to use Local Memory for all allocations.
  • Address: The memory address of the allocated memory.
  • Size: The requested size of the allocated memory.
  • Flags: This is either RTALLOC_NOT_ZERO_MEMORY, which means the allocated memory was not filled with zero bytes, or zero, which means the allocated memory was filled with zero bytes.

Local Memory Alloc Fail

MonitorEventLocalMemoryAllocFailed

Represents a failed allocation from the local memory pool.
  • Error: The error code indicating why the failure happened.
  • Size: The requested size of the allocated memory.
  • Flags: This is either RTALLOC_NOT_ZERO_MEMORY, which means the allocated memory was not filled with zero bytes, or zero, which means the allocated memory was filled with zero bytes.

Local Memory Expand

MonitorEventLocalMemoryExpand

Represents the expansion of the RTSS process' MSpace.

This event is generated the local memory pool expands by calling RtExpandMSpace.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • ExpandSize: The amount by which the MSpace expanded (in bytes).

Local Memory Free

MonitorEventLocalMemoryFree

Represents freeing local memory.

This event is generated when local memory is freed, as with RtFreeLocalMemory or when a process is configured to use local memory for all allocations.
  • Address: The address being freed.

Local Memory Free Fail

MonitorEventLocalMemoryFreeFail

 Represents failed freeing of local memory.
  • Address: The address that failed to become freed.
  • Error: The error code indicating why the failure happened.

Local Memory Shrink

MonitorEventLocalMemoryShrink

Represents the shrinking of the RTSS Process' MSpace.

This event is generated when the MSpace shrinks from a call to RtShrinkMSpace.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Shrink Size: The amount by which the MSpace shrank (in bytes).

 

M

Name / Managed Code Framework Class Name Description Text Output Fields

Memory Map

MonitorEventMemoryMap

Represents a successful call to RtMapMemory.
  • Virtual Address: The virtual address at which the physical memory is mapped.
  • Physical Address: The physical address passed to RtMapMemory().
  • Size: The size of the memory to be mapped (in bytes).
  • CacheType: The cache type to use for the mapped memory.

Memory Unmap

MonitorEventMemoryUnmap

Represents a successful call to RtUnmapMemory.
  • Virtual Address: The virtual address at which the physical memory is mapped.

Message Based Interrupt Release

MonitorEventInterruptMessagebasedRelease

Represents the release of a previously attached message-based interrupt.

This event is generated when RtReleaseInterrupt is called to release a message-based interrupt.
  • Handle: The handle for this interrupt attachment.
  • ISTFunction addr: The IST function called to handle the interrupt. NULL if no function given.
  • ISRFunction addr: The ISR function called to handle the interrupt. NULL if no function given.
  • Context: The context value passed to the IST and ISR functions.
  • ISTThreadPriority: The thread priority of the IST thread. This is only defined if ISTFunction is non-NULL.

Module Load

MonitorEventModuleLoad

Represents a successful load of a module (RTSS or RTDLL).

This event is generated when a module is loaded, either by launching a new real-time process or by implicitly or explicitly loading an RTDLL.
  • Path: The pathname of the module.

Module Unload

MonitorEventModuleUnload

Represents a successful unload of a module (RTSS or RTDLL).

This event is generated when a module is unloaded, either at process termination or when an RTDLL is unloaded by a call to FreeLibrary.
  • Path: The pathname of the module.

Mutex Create

MonitorEventMutexCreate

Represents a mutex creation event.

This event is generated when RtCreateMutex is called.
  • Count: Acquisition count (0 if free).
  • Abandoned: TRUE if mutex was abandoned.
  • Initial Owner: Initial ownership state.
  • OwnerPID: Process that currently owns the mutex (or 0 if no owner).
  • OwnerTID: Thread that currently owns the mutex (or 0 if no owner).
  • Priority: Mutex level priority, it is used when priority Promotion is in effect.
  • Threads Waiting: The number of threads waiting on this mutex.
  • Reference Count: The reference count of this mutex.
  • Name: Mutex name. If it's an unnamed mutex, this is the empty string.
  • Handle: The handle for this mutex.

Mutex Destroy

MonitorEventMutexDestroy

Acquisition count (0 if free).

This event is generated when the last handle to a mutex is closed.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.
  • Count: Acquisition count (0 if free)
  • Abandoned: TRUE if mutex was abandoned
  • Owner PID: Process that currently owns the mutex (or 0 if no owner).
  • Owner TID: Thread that currently owns the mutex (or 0 if no owner).
  • Priority: Mutex level priority, it is used when priority Promotion is in effect.
  • Threads Waiting: The number of threads waiting on this mutex.
  • Name: Mutex name. If it's an unnamed mutex, this is the empty string.

Mutex Open

MonitorEventMutexOpen

Represents opening of a mutex.

This event is generated when RtOpenMutex is called.
  • Handle: The handle for this mutex returned by this open operation.
  • Count: Acquisition count (0 if free)
  • Abandoned: TRUE if mutex was abandoned
  • OwnerPID: Process that currently owns the mutex (or 0 if no owner).
  • OwnerTID: Thread that currently owns the mutex (or 0 if no owner).
  • Priority: Mutex level priority, it is used when priority Promotion is in effect.
  • Threads Waiting: The number of threads waiting on this mutex.
  • Referenced: The reference count of this mutex after this open operation completes.
  • Name: Mutex name. If it's an unnamed mutex, this is the empty string.

Mutex Release

MonitorEventMutexRelease

Represents a mutex being released by a call to RtReleaseMutex.

NOTE: NOTE: If the mutex recursion count is greater than zero after RtReleaseMutex() returns, the mutex remains locked by the current thread.

  • MutexCount: The recursion count of the mutex. If this is non-zero, the mutex is locked. If this is greater than one, the owning thread has locked it more than once.
  • Threads Waiting: The number of threads waiting on the mutex after RtReleaseMutex() returns.
  • Handle: The handle to the mutex being released.
  • Name[MAX_PATH]: The name of the mutex. If it has no name, this is the empty string.

 

P

Name / Managed Code Framework Class Name Description Text Output Fields

Priority Demotion

MonitorEventPriorityDemotion

Represents priority demotion.

This event is generated when thread priority demotion occurs.
  • Target TID: The thread ID of the thread getting the priority demotion.
  • Target PID: The process ID of the process that owns the thread getting the priority demotion.
  • New Priority: The new priority of the demoted thread.
  • Previous Priority: The previous priority of the demoted thread.

Priority Promotion

MonitorEventPriorityPromotion

Represents priority promotion to solve priority inversion.

This event is generated when thread priority promotion occurs.
  • Target TID: The thread ID of the thread getting the priority promotion.
  • Target PID: The process ID of the process that owns the thread getting the priority promotion.
  • New Priority: The new priority of the promoted thread.
  • Previous Priority: The previous priority of the promoted thread.

Process Affinity Mask Set

MonitorEventProcessAffinityMaskSet

Represents the setting of a process's processor affinity mask.

This event is generated when RtSetProcessAffinityMask is called.
  • Target PID: The process ID of the target thread (the thread having its affinity mask set).
  • New Mask: The new thread affinity mask.
  • Previous Mask: The previous thread affinity mask.
  • Affined Processor: The new affined processor number for the target process.

Process Create

MonitorEventProcessCreate

Represents the creation of a real-time process.

NOTE: This event also represents proxy processes. When the process being created is a proxy process, this event appears as Proxy Process Create.
  • Exec: The pathname to the executable this process is running. This is always NUL-terminated, even at the expense of truncating the pathname.
  • Cmd: The command line used to start this process. This is always NUL-terminated. This string may be truncated and not show the entire command line.
  • Spawned PID: The process ID.
  • Spawned TID: The thread ID of the initial thread.
  • Affinity Mask: The processor affinity mask.
  • Affined Processor: The affined processor number.
  • Local Mem: true if the process uses local memory by default for allocations, false otherwise.
  • Ref Count: The reference count of this process.
  • Flags: Internal process flags.
  • Handle: The handle for this process.
   
Local memory MSpace fields
  • InternalMSpace: The process's internal MSpace pointer.
  • ExternalMSpace: The process's external MSpace pointer.
  • InternalMSpaceCommit: Whether the process's internal MSpace is committed at process start.
  • ExternalMSpaceCommit: Whether the process's external MSpace is committed at process start.
  • InternalMSpaceInitialSize: The initial size of the process's internal MSpace.
  • ExternalMSpaceInitialSize: The initial size of the process's external MSpace.
  • InternalMSpaceExpandable: Whether the process's internal MSpace is expandable.
  • InternalMSpaceExpandSize: The size by which the process's internal MSpace can expand.
  • ExternalMSpaceExpandable: Whether the process's external MSpace is expandable.
   
  • ExternalMSpaceExpandSize: The size by which the process’s external MSpace can expand.
  • InternalMSpaceShrinkable: Whether the process's internal MSpace is shrinkable.
  • ExternalMSpaceShrinkable: Whether the process's external MSpace is shrinkable.

Process Destroy

MonitorEventProcessDestroy

Represents the destruction of a process.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.

NOTE: This event also represents proxy processes. When the process being destroyed is a proxy process, this event appears as Proxy Process Destroy in the output.
  • Destroyed PID: The process ID.
  • Exit Code: The process's exit code.
  • Affinity Mask: The processor affinity mask.
  • Processor: The affined processor number.
  • Flags: Internal process flags.

Process Open

MonitorEventProcessOpen

Represents opening of a process.

This event is generated when RtOpenProcess is called.
  • ProcessID: The ID of the process being opened.
  • Handle: The handle to the newly opened process.
  • Processor Affinity Mask: The processor affinity mask.
  • Processor: The affined processor number.
  • Reference Count: The reference count of this process after being incremented for this open operation.
  • Flags: Internal process flags.
  • Path: The pathname to the executable this process is running. This is always NUL-terminated, even at the expense of truncating the pathname.

 

R

Name / Managed Code Framework Class Name Description Text Output Fields

Resume Thread

MonitorEventThreadResume

 Represents a call to ResumeThread from a user application.
  • Target TID: The ID of the thread being resumed.
  • Target PID: The ID of the process that owns the thread being resumed.
  • Suspend Count: The previous suspend count returned by ResumeThread() to the user application.

 

S

Name / Managed Code Framework Class Name Description Text Output Fields

Semaphore Create

MonitorEventSemaphoreCreate

Represents the creation of a semaphore.

This event is generated when RtCreateSemaphore is called.
  • Max Count: The maximum count of this semaphore.
  • Current Count: The current semaphore count.
  • Threads Waiting: The number of threads waiting on this semaphore.
  • Ref Count: The reference count of the semaphore.
  • Name: The name of the semaphore (if it has one). If it has no name, this is the empty string.
  • Handle: The handle for this semaphore.

Semaphore Destroy

MonitorEventSemaphoreDestroy

Represents the destruction of a semaphore.

This event is generated after the last handle to a semaphore object is closed.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.
  • Max Count: The maximum count of this semaphore.
  • Current Count: The semaphore count at the time it was destroyed.
  • Threads Waiting: The number of threads waiting on this semaphore.
  • Name: The name of the semaphore (if it has one). If it has no name, this is the empty string.

Semaphore Open

MonitorEventSemaphoreOpen

Represents opening of a semaphore.

This event is generated when RtOpenSemaphore is called.
  • Handle: The handle for this semaphore.
  • Max Count: The maximum count of this semaphore.
  • Count: The current semaphore count.
  • Threads Waiting: The number of threads waiting on this semaphore.
  • Referenced: The reference count of the semaphore after this open operation completes.
  • Name: The name of the semaphore (if it has one). If it has no name, this is the empty string.

Semaphore Release

MonitorEventSemaphoreRelease

 Represents a semaphore being released by a call to RtReleaseSemaphore.
  • Release Count: The release count passed to RtReleaseSemaphore().
  • New Count: The new semaphore count after incrementing the old count by ReleaseCount and waking zero or more waiting threads.
  • Previous Count: The semaphore count at the moment RtReleaseSemaphore() was called.
  • Threads Waiting: The number of threads waiting on the mutex after RtReleaseSemaphore() returns.
  • Name: The name of the semaphore. If it has no name, this is the empty string.

Session Marker

MonitorEventMarker

 Represents an internal marker event generated by RTX64 Monitor. This event is used to mark the enabling/disabling of monitoring and other interesting internal events.
  • MarkerKind: The kind of marker this event represents.
  • SystemTime: The system time as returned by KeQuerySystemTime() at the time this event was generated.
  • Magic[4]: A four-byte magic value that must be "IZFL" with no terminating NUL byte.

Shared Memory Create

MonitorEventSharedMemoryCreate

Represents the creation of a shared memory region.

This event is generated when RtCreateSharedMemory is called.
  • Flags: The permission flags for the shared memory region.
  • Size: The size of the shared memory region.
  • Address: The address of the start of the shared memory region.
  • Ref Count: The reference count of the shared memory region.
  • Name: The name of the shared memory region (if it has one). If it has no name, this is the empty string.
  • Handle: The handle for this shared memory region.

Shared Memory Destroy

MonitorEventSharedMemoryDestroy

Represents the destruction of a shared memory object.

This event is generated after the last handle to a shared memory region is closed.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.
  • Flags: The permission flags for the shared memory region.
  • Size: The size of the shared memory region.
  • Address: The address of the start of the shared memory region.
  • Name: The name of the shared memory region (if it has one). If it has no name, this is the empty string.

Shared Memory Open

MonitorEventSharedMemoryOpen

Represents opening of a shared memory region.

This event is generated when RtOpenSharedMemory is called.
  • Handle: The handle for this shared memory region.
  • Flags: The permission flags for the shared memory region.
  • Size: The size of the shared memory region.
  • Address: The address of the start of the shared memory region.
  • Ref Count: The reference count of the shared memory region after this open operation completes.
  • Name: The name of the shared memory region (if it has one). If it has no name, this is the empty string.

Shutdown Handler Create

MonitorEventShutdownHandlerCreate

Represents the creation of a shutdown handler.

This event is generated when RtAttachShutdownHandler is called.
  • Func: A pointer to the handler function for this shutdown handler.
  • Context: The context value to be passed to the handler function.
  • TID: The ID of the thread that will call the handler function.
  • Thread Priority: The priority of the thread that will call the handler function.
  • Handle: The handle for this shutdown handler.

Shutdown Handler Destroy

MonitorEventShutdownHandlerDestroy

Represents the destruction of a shutdown handler.

This event is generated after RtReleaseShutdownHandler is called.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.
  • Handle: The handle for this shutdown handler.

SRI to Windows Event

MonitorEventSriToWindows

 Generated when an SRI over to Windows has been initiated. (no unique ID)
  • FunctionName: The name of the function that is sent to Windows for resources.

SRI to Windows Return Event

MonitorEventSriToWindowsReturn

 Generated when an SRI over to Windows has returned. (no unique ID)
  • FunctionName: The name of the function that is sent to Windows for resources.

Subsystem Stop

MonitorEventSubsystemStop

Represents the RTX64 subsystem stopping.
  • Time: The system time when this event was generated.

Suspend Thread

MonitorEventSuspendThread

Represents a call to SuspendThread from a user application.
  • Target TID: The ID of the thread being suspended.
  • Target PID: The ID of the process that owns the thread being suspended.
  • Suspend Count: The previous suspend count returned by SuspendThread() to the user application.

 

T

Name / Managed Code Framework Class Name Description Text Output Fields

Thread Affinity Mask Set

MonitorEventThreadAffinityMaskSet

Represents the setting of a thread's processor affinity mask.

This event is generated when SetThreadAffinityMask is called.
  • Target TID: The thread ID of the target thread.
  • Target PID: The process ID of the process that owns the target thread.
  • New Mask: The new thread affinity mask.
  • Previous Mask: The previous thread affinity mask.
  • Affined Processor: The new affined processor number for the target thread.

Thread Create

MonitorEventThreadCreate

Represents the creation of a thread. This event is generated for both user threads and proxy threads.

This event is generated when a real-time thread is created, either automatically as when a process starts or by a call to RtCreateThread.
  • Spawned TID: The thread ID.
  • Spawned PID: This thread's process ID.
  • StackSize: The thread's stack size.
  • Start Function: The thread's start function.
  • Argument: The argument passed to this thread's start function.
  • Priority: The thread priority.
  • Time Quantum: The thread's time quantum.
  • Suspend Count: This thread's suspend count.
  • Process Affinity: This thread's processor affinity mask.
  • State: The thread state at creation time.
  • Ref Count: The reference count of this thread.
  • Flags: The thread flags.
  • Handle: The handle for this thread.

Thread Destroy

MonitorEventThreadDestroy

Represents the destruction of a thread.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.
  • Current TID: The thread ID.
  • Current ProcessID: This thread's process ID.
  • StackSize: The thread's stack size.
  • Exit Code: The thread's exit code.
  • HFIClassID: The Intel® Hardware Feedback Interface (HFI) Class ID of the associated real-time thread at the time the thread terminated.
  • Priority: The thread priority.
  • Time Quantum: The thread's time quantum.
  • Suspend Count: This thread's suspend count.
  • Affinity Mask: This thread's processor affinity mask.
  • Processor: This thread's affined processor number.
  • State: The thread state at destruction time.
  • Flags: The thread flags.

Thread Open

MonitorEventThreadOpen

 Represents the instance a real-time thread is opened. This occurs when a real-time process calls OpenThread.
  • StackSize: The thread's stack size.
  • Start Function: The thread's start function.
  • Argument: The argument passed to this thread's start function.
  • Priority: The thread priority.
  • Time Quantum: The thread's time quantum.
  • Suspend Count: This thread's suspend count.
  • Process Affinity: This thread's processor affinity mask.
  • State: The thread state at creation time.
  • Ref Count: The reference count of this thread.
  • Flags: The thread flags.
  • Handle: The handle for this thread.

Thread Priority Set

MonitorEventThreadPrioritySet

Represents a change to a thread's priority via RtSetThreadPriority or SetThreadThreadPriority.

This event is generated when RtSetThreadPriority is called or when the RTX64 subsystem performs internal thread scheduling operations.
  • Target TID: The ID of the thread having its priority changed.
  • Target PID: The ID of the process that owns the thread having its priority changed.
  • New Priority: The new priority of the thread.
  • Previous Priority: The previous priority of the thread.

Thread Terminate

MonitorEventThreadTerminate

 Generated when a thread terminates.
  • ExitCode: an integer value of what the thread’s exit code was.

Thread Time Quantum Set

MonitorEventThreadQuantumSet

 Represents a change to a thread's time quantum via RtSetThreadTimeQuantum.
  • Target TID: The ID of the thread having it's time quantum changed.
  • Target PID: The ID of the process that owns the thread having it's time quantum changed.
  • New Time Quantum: The new time quantum of the thread.
  • Previous Time Quantum: The previous time quantum of the thread.

Thread Sleeping

MonitorEventThreadSleep

Represents a thread sleeping.

This event is generated when Sleep or RtSleepFt is called.
  • Sleep Duration: The duration of the sleep in 100-nanosecond units.

Time Quantum Expire

MonitorEventTimeQuantumExpired

Represents the expiration of a thread's time quantum.
  • Time Quantum: The current thread's time quantum at the time it expired.
  • Priority: The current thread's priority at the time it expired.

Timer Cancel

MonitorEventTimerCancel

 This event is generated when RtCancelTimer is called.
  • Func Addr: The user-supplied timer function.
  • Context: The user-supplied opaque context value.
  • Clock: The timer clock.
  • Timer Period: The timer period.
  • Timer ThreadID: The ID of the timer thread.
  • TimerPriority: The timer thread priority.
  • Timer Handle: The handle of the canceled event.

Timer Create

MonitorEventTimerCreate

Represents a timer creation event.

This event is generated when RtCreateTimer is called.
  • Stack Size: The thread stack size of the timer thread.
  • Func Addr: The user-supplied timer function.
  • Context: The user-supplied opaque context value.
  • ThreadPriority: The timer thread priority.
  • Clock: The timer clock.
  • Affinity: The processor affinity mask passed to RtCreateTimer(Ex) by the user.
  • Processor: The processor to which the timer thread is affined.
  • Timer Period: The timer period.
  • Timer ThreadID: The timer thread ID.
  • Handle: The handle for this timer.

Timer Destroy

MonitorEventTimerDestroy

Represents the destruction of an timer object.

This event is generated after RtDeleteTimer is called.

NOTE: This event can happen an arbitrary amount of time after the reference count on the corresponding subsystem object reaches zero.
  • Func Addr: The user-supplied timer function.
  • Context: The user-supplied opaque context value.
  • Clock: The timer clock.
  • Period: The timer period.
  • Timer ThreadID: The timer thread ID.
  • ThreadPriority: The timer thread priority.

Timer Expire

MonitorEventTimerExpire

 Represents a timer expiration.
  • Function: The timer callback function.
  • Context: The user-supplied opaque context value.
  • Clock: The timer clock.
  • Period: The timer period.
  • ThreadID: The timer thread ID.
  • ThreadPriority: The timer thread priority.

Timer Set

MonitorEventTimerSet

 Represents a timer being set.
  • Function: The user-supplied timer function.
  • Context: The user-supplied opaque context value.
  • Relative: Was the timer set using relative or absolute times.
  • Clock: The timer clock.
  • Expiration Period: The initial expiration period.
  • Interval Period: The repeating expiration interval.
  • ThreadID: The timer thread ID.
  • ThreadPriority: The timer thread priority.
  • Timer Handle: The handle of the set event.

TLS Alloc

MonitorEventTLSAlloc

 Represents a call to TlsAlloc by a user application.
  • Index: The TLS index returned by TlsAlloc().

TLS Free

MonitorEventTLSFree

 Represents a call to TlsFree by a user application.
  • Index: The TLS index passed to TlsFree().
  • Status: The status value returned by TlsFree().
  • Error: If Status is FALSE, this holds the error code describing the error, otherwise it is undefined.

TLS Free Fail

MonitorEventTLSFreeFail

 Represents a failed call to TlsFree by a user application.
  • Index: The TLS index that failed to pass to TlsFree().
  • Error: The error code indicating why the failure happened.

 

U

Name / Managed Code Framework Class Name Description Text Output Fields

Unhandled Exception Filter Set

MonitorEventUnhandledExceptionFilter

 Represents a call to SetUnhandledExceptionFilter.
  • New Filter Function: A pointer to the newly-installed unhandled exception filter function. This is NULL if SetUnhandledExceptionFilter is resetting unhandled exception filtering to the default behavior.
  • Previous Filter Function: A pointer to the previously-installed unhandled exception filter function. This is NULL if there was no previously-installed filter function.

Unhandled Exception Filter Call

MonitorEventUnhandledExceptionFilterCalled

Represents a call to a user-supplied unhandled exception filter function that was installed using SetUnhandledExceptionFilter.

This event is generated when an unhandled exception filter function is called.

  • Filter Function: A pointer to the unhandled exception filter function that was called.
  • Exception ADDR: The exception address from the EXCEPTION_RECORD structure passed to the filter function.
  • Code: The exception code from the EXCEPTION_RECORD structure passed to the filter function.
  • Flags: The exception flags from the EXCEPTION_RECORD structure passed to the filter function.
  • NumberParameters: The number of exception parameters in array ExceptionInformation from the EXCEPTION_RECORD structure passed to the filter function.
  • Exception Information: The exception parameters array from the EXCEPTION_RECORD structure passed to the filter function.

 

W

Name / Managed Code Framework Class Name Description Text Output Fields

WaitForMultipleObjectsEX Return

MonitorEventWFMOEXReturned

Represents a call to RtWaitForMultipleObjectsEx returning, either successfully or not.

This event is generated when WaitForMultipleObjects or WaitForMultipleObjectsEx returns.
  • Count: The number of object handles passed to RtWaitForMultipleObjectsEx().
  • Handles: The handles passed to RtWaitForMultipleObjectsEx().
  • Timeout: The timeout (in 100 ns intervals) passed to RtWaitForMultipleObjectsEx().
  • Object Types: The types of the objects on which the current thread was waiting. Zero indicates the array element does not represent an object.
  • Returned: The value returned by RtWaitForMultipleObjectsEx().

WaitForMultipleObjectsEX Wait

MonitorEventWFMOEXWait

Represents a call to RtWaitForMultipleObjectsEx waiting a set of synchronization objects.

This event is generated when WaitForMultipleObjects or WaitForMultipleObjectsEx blocks execution to wait on one or more objects. Each handle being waited on is listed (along with the type of object referenced by the handle) starting on the third line of this event.
  • Count: The number of object handles passed to RtWaitForMultipleObjectsEx().
  • Handles: The handles passed to RtWaitForMultipleObjectsEx().
  • Timeout: The timeout (in 100 ns intervals) passed to RtWaitForMultipleObjectsEx().
  • Object Types: The types of the objects on which the current thread is about to wait. Zero indicates the array element does not represent an object.

WaitForSingleObjectEX Return

MonitorEventWFSOEXReturned

Represents a call to RtWaitForSingleObjectEx returning, either successfully or not.

 
  • Handle: The handle passed to RtWaitForSingleObjectEx().
  • Timeout: The timeout (in 100 ns intervals) passed to RtWaitForSingleObjectEx().
  • Object Type: The type of the object on which the current thread was waiting.
  • Returned: The value returned by RtWaitForSingleObjectEx().
  • Waiting Threads: The current number of threads waiting on the object (not including the current thread).

WaitForSingleObjectEX Wait

MonitorEventWFSOEXWait

Represents a call to RtWaitForSingleObjectEx waiting for a synchronization object.

This event is generated when WaitForSingleObject or WaitForSingleObjectEx blocks execution to wait on an object.
  • Handle: The handle passed to RtWaitForSingleObjectEx().
  • Timeout: The timeout (in 100 ns intervals) passed to RtWaitForSingleObjectEx().
  • Object Type: The type of the object on which the current thread is about to wait.
  • Waiting Threads: The current number of threads waiting on the object (including the current thread).

Watchdog Reset

MonitorEventWatchdogReset

Represents an instance where a watchdog timer reset occurs.

 
  • Affinity: The affinity mask representing the processors where the watchdog timer was reset
  • Core: The core(s) on which the watchdog reset occurred.

Windows Memory Allocate

MonitorEventWindowsMemoryAlloc

Represents a successful allocation of memory from Windows by a real-time process.

This event is generated when Windows memory is allocated by the RTX64 subsystem, either for internal use or as the result of a request from a user application (i.e., a call to malloc or new).

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Address: The address of the allocated memory.
  • Size: The size of the allocation request.

Windows Memory Allocation Fail

MonitorEventWindowsMemoryAllocFailed

Represents a failed allocation of memory from Windows by a real-time process.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Size: The size of the allocation request.

Windows Memory Free

MonitorEventWindowsMemoryFree

Represents freeing memory to Windows.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Address: The address being freed.

Windows Memory Free Fail

MonitorEventWindowsMemoryFreeFail

Represents failed freeing of memory to Windows.

NOTE: This monitoring event is not generated in RTX64 4.3 and later versions.
  • Address: The address that failed to become freed.
  • Error: The error code indicating why the failure happened.

 

Examples

Below are examples of Event Classes as they appear in text output of a monitoring session.

Heap Create

Heap Create: TSC 14313774442814, PID 1001, TID 12, CORE 2

Handle: 0xFFFFFA80`1BEFD000, Creation Options: 0x0, Init Size: 4096, Max Size: 0, Unique Mutex Id: 0

Heap Destroy

Heap Destroy: TSC 14330549202694, PID 1001, TID 12, CORE 2

Handle: 0xFFFFFA80`1BF06000, Size: 0

Heap Free

Heap Free: TSC 14313776522750, PID 1001, TID 12, CORE 2

Address: 0xFFFFFA80`198F6110, Handle: 0xFFFFFA80`1BEFD000, Flags: 0x0

 

Related Topics: