How to view generic event details with wpa?

Question

I record ETW events for CLR provider:

xperf -start clr -on e13c0d23-ccbc-4e12-931b-d9cc2eee27e4 -f clr.etl
...
xperf -stop clr

then open clr.etl in wpa.exe and see plenty of 'generic event'. But seems wpa do not display some data, which described in MSDN

All I can see is similar to this:

Process    Unknown
Id    1
Opcode Name
Task Name
Provider Name    e13c0d23-ccbc-4e12-931b-d9cc2eee27e4
Time    0,071731589s
Selection Duration    0,416407863s
Start Time    0,002151869s
End Time    0,418559732s
Data Points    1
Table Data    Point    Selection
Cpu    0    
ThreadId    50 440    
Sum of Count    1    23
Time (s)    0,071846769    

Loo like this is GCStart_V1 event, but I cant find for example field Reason

Is it possible see generic events data in wpa?

WPA version - 10.0.10586.212

Answer 1

It occurs on "normal" machines quite frequently that the CLR ETW provider registrations get messed up due to .NET Hotfixes and such. In that case you need to re/register it with (64 bit)

wevtutil um %windir%\Microsoft.NET\Framework64\v4.0.30319\CLR-ETW.man
wevtutil im %windir%\Microsoft.NET\Framework64\v4.0.30319\CLR-ETW.man

If your problem was that your view was not configured to view Field1 .. N of custom events then the answer from lowleveldesign is the right one.

Answer 2

A side note: I usually record the trace with at least those two kernel flags:

xperf -on PROC_THREAD+LOADER -start clr -on e13c0d23-ccbc-4e12-931b-d9cc2eee27e4
xperf -stop -stop clr -d clr.etl

Otherwise the process names might not be resolved in WPA.

Coming back to your question, it's a bit strange how custom fields are rendered in WPA, but after you overcome the initial pain, you will find its editor pretty useful. The field you mentioned is one of the custom fields specific to the given event. By default those fields are not displayed and you need to add them in the Advanced view window:

I dragged the Field1 before the Thread Name column. Then you need to select an event (not its parent but the row with the event), and you will notice that the column names for fields are changed accordingly:

Also, the Message field usually contains all the fields (their names and values), for example in this case: Reason=1; Count=2; ClrInstanceID=36