Packages come with a pair of descriptors (or Extended Events categories). Importantly, you use descriptors to find related events in the package. Therefore, you will find using these descriptors helpful in creating an XEvent session to troubleshoot your specific issue.

XEvents packages have two basic types of categories. In other words, these classifiers are called keywords and channels.

XEvent Channels

An XEvents channel is defined just the same as a radio station or TV channel. Similarly, the XEvents channel indicates a stream of interest. In addition, it identifies the target audience for the event.

Different issues require different channels. As a result, your interest in a Channel will change day by day.

The post Extended Events Categories: An Introduction appeared first on SQL XEvents.

In this article, I will start diving into some of this metadata a little deeper as we progress through some of the core concepts surrounding Extended Events. At the base of these core concepts is the data that relates to objects. This is not your ordinary objects like we see in a database such as tables, views, procs and so forth. These are the types of objects that are specific to XEvents.

XEvents Objects

In Extended Events, all of the objects that help to build an extended event session are exposed through the Dynamic Management View (DMV) sys.dm_xe_objects. That should not be too much of a surprise after reading my introduction on the topic – here.

Querying that DMV, one will see there are numerous objects. With each release of SQL Server, this list grows larger and larger. With all of these objects, where does one really begin? Well, a good place to start is to figure out the types of objects that are available to use.

The post Extended Events Objects: an Introduction appeared first on SQL XEvents.

Let’s Learn

The first core building block to the data that builds Extended Events is the concept around packages.

When I think of package, I like to think of a container that gives me access to one or more smaller items. Take the concept of a package and consider an alternate name for it. Personally, I think of the word parcel and that I need to have it shipped, or that I am expecting to receive one from any of the popular couriers. Only this is obviously something electronic and could potentially contain much much more than any traditional parcel would contain.

Microsoft exposes the packages that contain all of the components of extended events via the DMV sys.dm_xe_packages. Combine this DMV with another DMV not specific to Extended Events and we can see which DLL on the file-system exposes that particular package and grants us access to various components of Extended events. That second DMV is sys.dm_os_loaded_modules.

Packages in XEvents

Knowing the source of the Extended Event object is useful in some cases. Being able to pull out the pertinent information isn’t terribly difficult either. I can run a query like the following and get just about everything I might want to know about the package (well maybe not if I want to know the memory address as well, but that is an easy fix).

SELECT xp.name AS PackageName
		,xp.description AS PackageDesc
		,xp.capabilities_desc
		,REVERSE(LEFT(REVERSE(olm.name),CHARINDEX('\',REVERSE(olm.name))-1)) AS DLLName
		,olm.file_version
		,xp.module_guid
	FROM sys.dm_xe_packages xp
		INNER JOIN sys.dm_os_loaded_modules olm
			ON xp.module_address = olm.base_address;

Running that on a SQL Server 2014 instance, I will see results like this:

When you look at my results, will see that there is one that is highlighted – package0. This package is basically like the utility drawer – it contains most of everything that you will need to (or maybe want to) use with extended events. At least that is the definition of the package. A package contains all of the data maps, data types, operators, actions, and targets.

There is another very interesting package that is visible with this particular query. That is the SecAudit package. When you look further into the SecAudit package, you will find that it is used by SQL Audits. You cannot use SecAudit package directly, since the contents of the package are accessed automatically by the SQL Audit feature. That is a topic for a different discussion.

When I execute the above query against a SQL Server 2017 instance, I am greeted with a slightly different result set. Take a look at the following image and take note of the sections blocked out in red.

Each of these new packages represents a new realm of functionality to be supported by the Extended Events feature. This is wonderful news demonstrating that the feature is definitely evolving and improving.

Wrapping it up

The goal of this article has been to help demonstrate the basic concept of “packages” in Extended Events. I have defined the concept as well as provided samples of how to explore this core concept.

This article has been an updated rewrite of the version that originally appeared on my blog – here.

The post Learn about Packages in Extended Events appeared first on SQL XEvents.