Light Weight Monitoring using Extended Events


SQL Server 2008 introduces Extended Events for performance

SQL Server Extended Events is a general event-handling
system for server systems.

So  why another event handling system? We already have
activity monitor, Perfmon, SQL Profiler, DMVs,. However, Extended Events have
several major advantages:

1. Light Weight. This is the primary advantage of  Extended Events. Unlike
the profiler,  Extended Events won’t eat your resources. Microsoft predicts that
20,000 events/sec on a 2 GHZ Pentium with 1 GB RAM takes uses than 2% of the

2. Most of the counters available are cumulative, thus it is difficult to
find exact events.

3. Extended Events have a  highly scalable and highly configurable architecture
that allows DBAs  and developers to collect as much or as little information as
is necessary to troubleshoot or identify a problem.

If you wish to use this feature, make sure that you have SQL
Server 2008 SP1 installed as there were few bugs in the SQL Server 2008 RTM.


As this is a new feature, there are few concepts in Extended
Events which we need to understand first.


The Package is a container for Extended Events Objects.
There are four packages.

Package Name



Extended Events system objects. This is the default


SQL Server operating system related objects


SQL Server related objects


Used only for built-in SQL Server auditing. This is a
private package name.

Existing packages can be viewed from following query.

* FROM sys.dm_xe_packages

Packages can contain any Events, Targets, Actions, Types, Predicates
and Maps which will be discussed later.

Objects from different packages can be mixed when creating
Extended Events.

The following diagram shows what a package can contain.

The relationship of a module, packages, and object

Source: MSDN

This  Module can be either an executable or a DLL.


Events are the trace events that we are going to monitor.  You
can view the events from following query.

* FROM sys.dm_xe_objects WHERE
object_type = ‘event’

For each event there is a payload or event columns
associated with it.

For example, to view the columns for the cpu_config_changed
event, run following query.

SELECT * FROM  sys.dm_xe_object_columns

WHERE object_name = ‘cpu_config_changed’

Most of the time you will see read only columns and data
columns. In the above example, the first five are readonly columns while last
two are data columns.

These events are categorized by channel and keyword.


Actions   describe   the event. For example, from the action
you can identify parameters such as database_id, session_id, transaction_id.

You can view existing actions from following query.

SELECT  * FROM sys.dm_xe_objects

object_type = ‘action’



Targets are   where the events data will reside. There are
six targets for Extend Events.




Event bucketing

Number of times selected event occurred.

Synchronous and asynchronous

Event pairing

Shows incomplete events. There are some events which are   pairs
(lock acquired and lock released)


Event Tracing for Windows (ETW)

Use to correlate SQL Server events with Windows operating
system or application event data.


Event file

A binary file that all events are written to. There are options
to set the size of the file, the maximum of rolled over files and the file
increment size in MB.


Synchronous event counter

Counts the  events that have occurred.


Ring buffer

Used to hold the event data in memory on a first-in first-out
(FIFO) basis, or on a per-event FIFO basis


For ETW to work the SQL Server service account has to be in
the “Performance Log Users” group. This is a binary file that has to
be formatted with tracerpt.exe so that it can be readable.

When the event file is created, it can be read by using the
sys.fn_xe_file_target_read_file built in function.

In the Ring Buffer target, FIFO means that older events are
removed when new ones arrive and the buffer is full. The per-event FIFO holds a
specific number of each event type in the queue and removes them after the
buffer is full.

You can view the available targets by executing the following

SELECT * FROM sys.dm_xe_objects

WHERE object_type = ‘target’

The above query will return six additional targets which
were stated above. Those are security audit targets. These are private and can
only be used by SQL Server for built in auditing functionality.


Though events will fire, we
need to filter them. By filtering we can reduce the no of events to analyze. 
These filters are called Predicts. It is recommended to use  predicts as simple
as possible for  performance considerations. You can view the existing predicts
by running following query.

SELECT * FROM sys.dm_xe_objects

WHERE object_type in (‘pred_compare’, ‘pred_source’)


A type is a simple or complex
data type that is used in the event payload.

SELECT * FROM sys.dm_xe_objects

WHERE object_type in (type)


Maps are internal values to a
string, which enables the  user to find out what the value represents. Instead
of only being able to obtain a numeric value, a user can get a meaningful
description of the internal value. The following query shows how to obtain map

SELECT * FROM sys.dm_xe_objects

WHERE object_type in (‘map’)

If you need map values for
lock, you can get them from the following query.

SELECT map_key, map_value FROM sys.dm_xe_map_values

WHERE name = ‘lock_mode’


Pages: 1 2 3


No comments yet... Be the first to leave a reply!