Track down DLL loading in .NET using Event Tracing for Windows (ETW)
Sometime ago I was doing some performance work for start-up of an .NET application ,and it so happened the CLR Perf team had blogged specifically about this. One of critical pieces to start-up speed is loading only necessary Dll’s. And loading these Dll’s on demand reduces the memory consumption, reduces look-up ,which could potentially save few hundred milliseconds based on different configuration. I am going to be using the same example as the CLR perf team had used. Here is the sample code.
using System.IO;
using System.Xml.Linq;
internal class Program
{
private static void ProcessArgs(string[] args)
{
if (args.Length == 2 && args[0] == "text")
File.WriteAllText(args[1], "Here is the data I am writing");
else if (args.Length == 2 && args[0] == "xml")
{
var myXml = new XElement("data", "Here is the data I am writing");
myXml.Save(args[1]);
}
}
private static int Main(string[] args)
{
ProcessArgs(args);
return 0;
}
}
In this sample code we wouldn’t want to load System.Xml.Linq.dll to be loaded if the command line option was set to “text”. In the past to diagnose the load of System.Xml.Linq.dll I would have to attached the windbg and set a break-point on load of System.Xml.Linq using sxe:ld and then get the call-stack using !clrstack. With the ETW it is as simple starting and stopping a trace.
xperf -start clr -on e13c0d23-ccbc-4e12-931b-d9cc2eee27e4:0x400010dc:0xffffffff -f clrevents.etl
This is the clr guid for etw “e13c0d23-ccbc-4e12-931b-d9cc2eee27e4:0x400010dc” and the keyword is 0x400010dc, which is for Fusion,Loader,Jit and Stackwalk combined together. So we are essentially asking clr to log events for Jit,Loader, Fusion and as well as stack-walk information.
After issuing the command start the console app
EtwProvider.exe text text
Stop the trace
xperf -stop clr
And here is the sample output from the etl file
| Opcode name | MethodNameSpace | MethodName | MethodSignature |
| JittingStarted | “Program” | “ProcessArgs” | “void (class System.String[])” |
| Walk | [0x719c9909 : 0x719c9a8d] | ||
| AssemblyLoad | “System.Xml.Linq; Version=4.0.0.0; Culture=neutral; PublicKeyToken=b77a5c561934e089″ | 15 | |
| Walk | [0x719c9909 : 0x719c9a8d] |
The above table represents the ordered trace where the Jit compiler is trying to compile ProcessArgs method ,which is in-turn causing the System.Xml.Linq.dll to be loaded. The reason for doing this is because the Jit compiler is not aware of which code path would be taken and that’s the reason for loading the dll even though command line was text and not xml.
The idea behind this post is not show how the dll loading can be avoided, this has been already demonstrated in the CLR blog. I am trying to demonstrate how we can leverage ETW tracing , which is non-invasive and we don’t have to jump though hoops to get the information.

Just FYI, In just a few days (by the end of the end of the month), we are going to be publishing a library called ‘TraceEvent’ which makes programatic parsing ETW data much simpler, and a ‘sample’ app called ‘perfMonitor’ that dumpes ETW data as XML (just to show how to use TraceEvent). You would probably be intrested in taking a look.
Vance Morrison
March 25, 2010 at 6:31 pm
[...] to Vance Morrison for letting me know about [...]
Exploring Event Tracing for Windows (ETW) within Task Parallel Library (TPL) using PerfMonitor « Naveen's Blog
March 30, 2010 at 11:03 pm
on my Windows 7, the “opcode code” show numbers instead of text (LoadVerbose…). am i missing something?
Michael
May 1, 2011 at 10:45 pm