Windows Application Data Collection¶

The Windows documentation covers three data capabilities: RUM, Log, and HTTP Trace. .NET/C#, Native C/C++, WebView2, and Electron Native Bridge share the same Windows SDK product identity. Browser RUM in the Electron Renderer is only responsible for collection and serialization; trusted fields and Session are managed uniformly by the Main Process adaptation layer and the Windows Native Core, while queuing and uploading are handled by the Native Core.

Data Types¶

Data Domain	Purpose	Reporting Behavior
RUM	Records Session, View, Action, Resource, Error, and Long Task	Writes to the RUM queue and reports to the RUM Intake
Log	Records application logs and can associate the current RUM context	Writes to a separate Log queue and reports to the Logging Intake
HTTP Trace	Injects Trace Headers into outbound requests and can associate the corresponding RUM Resource	Does not independently report APM Spans

Global Attributes¶

Field	Type	Description
`app_id`	string	The application ID created in the console.
`service`	string	`GuanceConfig.ServiceName` for .NET, `guance_sdk_config.service_name` for Native, or the Electron native configuration.
`env`	string	`prod`, `gray`, `pre`, `common`, or `local`.
`version`	string	Application version.
`sdk_name`	string	Fixed to `df_windows_rum_sdk` for Windows .NET, Native Core, WebView2, and Electron Native Bridge.
`sdk_version`	string	The version of the current Windows SDK assembly or Native Core; the Electron Adapter must pass the Native SDK version delivered with the application, not the business application version.
`application_uuid`	string	Identifier for the current application installation instance.
`session_id`	string	Identifier for the current user Session.
`session_type`	string	Fixed to `user` for the Windows SDK.
`session_has_replay`	boolean	Indicates whether the current Session has produced uploadable Replay data.
`session_sample_rate`	number	The sampling rate for regular Sessions.
`session_on_error_sample_rate`	number	The additional sampling rate for Error Sessions.
`view_id`	string	Identifier for the current active View.
`action_id`	string	Identifier for the current active Action, written when present.
`userid`	string	Anonymous user identifier persisted by RUM application ID, or the user ID set via the user API.
`user_name`, `user_email`	string	Written after the user API is called.
`is_signin`	string	`T` when a user is set, otherwise `F`.
`os`, `os_version`	string	Windows name and version.
`os_version_major`	string	Windows major version.
`device`, `model`	string	Windows device and model information, written when available.
`arch`	string	Architecture of the device where the process is running.
`screen_size`	string	Primary display size, recorded when available.
`locale`	string	Current locale setting.
`network_type`	string	`wifi`, `ethernet`, `mobile`, `none`, or `unknown`.

Custom context only supplements fields that do not exist and cannot override reserved SDK fields.

Other Data Type Attributes¶

A Session is a user access process aggregated by the console based on events under the same session_id; no separate Session API call is required.

Type	Description	Typical Sources
View	Visible lifecycle and performance of a window or business page	Window/Form lifecycle, explicit WinUI 3 association, Native window events, WebView2 navigation
Action	User operation and its duration	Click, menu, selection, switch, input, keyboard shortcut, or manual Action
Resource	Network request, status, and duration	`HttpClient`, WinHTTP, WebView2 Fetch/XHR/Resource, or manual Resource
Error	Application and page errors	Unhandled .NET exceptions, Native crash recovery, WebView2 JavaScript errors, or manual Error
Long Task	Prolonged blocking of the UI main thread	Windows UI thread detection or manual Long Task

View¶

Field	Type	Description
`view_id`	string	Unique identifier of the View.
`view_name`	string	Name of the window, page, or business View.
`view_referrer`	string	Name of the previous View.
`time_spent`	integer	Duration of the View in nanoseconds.
`is_active`	boolean	Whether the View is still active at the time of reporting.
`view_action_count`	integer	Number of Actions generated in the View.
`view_resource_count`	integer	Number of Resources generated in the View.
`view_error_count`	integer	Number of Errors generated in the View.
`view_long_task_count`	integer	Number of Long Tasks generated in the View.
`view_update_time`	integer	Unix nanosecond timestamp of this View update.

Action¶

Field	Type	Description
`action_id`	string	Unique identifier of the Action.
`action_name`	string	Name of the control, command, or business action.
`action_type`	string	For example, `click`, `key`, `launch_cold`, or `launch_hot`.
`duration`	integer	Duration of the Action in nanoseconds.
`action_resource_count`	integer	Number of Resources within the Action scope.
`action_error_count`	integer	Number of Errors within the Action scope.
`action_long_task_count`	integer	Number of Long Tasks within the Action scope.
`app_pre_application_init_time`	integer	Time spent before application code runs during a launch Action.
`app_application_init_time`	integer	Time spent during the application initialization phase in a launch Action.
`app_first_frame_init_time`	integer	Time spent during the first frame phase in a launch Action.

Resource¶

Field	Type	Description
`resource_id`	string	Unique identifier of the Resource.
`resource_url`	string	Request URL processed according to the privacy policy.
`resource_url_host`	string	Request hostname.
`resource_url_path`	string	Request path.
`resource_url_path_group`	string	Normalized path grouping.
`resource_method`	string	HTTP method.
`resource_status`	integer	HTTP status code; not written when no response is received.
`resource_status_group`	string	Status code group, for example `2xx`.
`resource_type`	string	`http`, `native`, or a resource type passed by the application.
`duration`	integer	Total duration of the Resource in nanoseconds.
`resource_size`	integer	Response body size in bytes, written when available.
`resource_request_size`	integer	Request body size in bytes, written when available.
`resource_dns`, `resource_tcp`, `resource_ssl`, `resource_ttfb`	integer	Network phase durations in nanoseconds, written when reliably available.
`resource_http_protocol`	string	HTTP protocol version.
`trace_id`, `span_id`	string	Written when Trace and RUM association is enabled.
`request_header`, `response_header`	string	Header snapshots only written when privacy configuration allows.
`network_instrumentation`, `network_library`	string	Automatic collection entry point and identified network library.

Phase durations are also tagged with resource_timing_source, resource_timing_precision, resource_timing_duration, resource_timing_phase, and resource_ttfb_estimated to indicate the source and precision. When no reliable phase data is available, the SDK records only the total duration.

Error¶

Field	Type	Description
`error_type`	string	Uses the standard types from the table below for automatic collection; uses the type passed by the application for manual Errors.
`error_source`	string	`logger` for crashes and application exceptions, `network` for network errors, `webview` for WebView2 page errors.
`error_situation`	string	`run` indicates during runtime; `startup` for Native Crashes recovered on next launch.
`error_message`	string	Error summary; for crashes, includes diagnostic information such as exception type, exception code, or address.
`error_stack`	string	Full exception or call stack; at least the instruction address is recorded when a full Native call stack is not available.

Automatic Collection Types¶

Scenario	`error_type`	`error_source`	Description
Process termination due to an unhandled .NET exception	`windows_crash`	`logger`	`error_message` contains the full exception type and message; `error_stack` contains `Exception.ToString()`.
Unhandled SEH or C++ `std::terminate`	`native_crash`	`logger`	Crash information is safely persisted on disk and recovered on next launch; exception code, address, or `std::terminate` information is written to `error_message`.
Native UI Watchdog detects application unresponsiveness	`anr_error`	`logger`	Reported after the application resumes responsiveness; the duration is written to `error_message`.
`HttpClient` request exception, or automatic Resource returns HTTP 4xx/5xx	`network_error`	`network`	The Error is associated with the corresponding Resource and carries its URL, method, and status information.
WebView2 JavaScript Error	JavaScript `Error.name`, or `JavaScriptError` if absent	`webview`	`error_message` and `error_stack` come from the page exception.
WebView2 unhandled Promise rejection	`name` of the rejection, or `UnhandledPromiseRejection` if absent	`webview`	`error_message` and `error_stack` come from the rejection reason.
WebView2 navigation failure	`WebView2NavigationError`	`webview`	`error_message` contains the navigation failure status.
WebView2 process failure	`WebView2ProcessFailed`	`webview`	`error_message` contains the process failure type or reason.

Unobserved Task exceptions and UI thread exceptions caught by WinForms that allow the application to continue running are not crashes; error_type uses the corresponding .NET exception type, and error_source is logger. Exception classification and diagnostic details are uniformly reflected in error_type, error_message, and error_stack.

Long Task¶

Field	Type	Description
`duration`	integer	Duration of the Long Task in nanoseconds.
`long_task_stack`	string	Call stack recorded when available.
`long_task_source`	string	Source of automatic or manual collection.
`long_task_delay`	integer	Blocking delay detected by the UI thread.
`long_task_threshold`	integer	Active Long Task threshold.
`long_task_cooldown`	integer	Cooldown period for consecutive blocking reports.
`long_task_suppressed_count`	integer	Number of duplicate reports merged during the cooldown period.

RUM Capability Matrix¶

Integration Method	View	Action	Resource	Error	Long Task
WPF	Automatic	Automatic	`HttpClient`	Unhandled exceptions	UI thread monitoring
WinForms	Automatic	Automatic	`HttpClient`	Unhandled exceptions	UI thread monitoring
WinUI 3	Automatic after window association	Automatic	`HttpClient`	Unhandled exceptions	UI thread monitoring
Native C/C++	Explicit via window events	Explicit via messages or commands	WinHTTP adapter or manual API	Crash recovery or manual API	`HWND` Watchdog or manual API
WebView2	Page navigation	Page interaction	Fetch/XHR/Resource	JavaScript Error	Does not collect renderer Long Tasks
Electron Native Bridge	Browser RUM	Browser RUM	Browser RUM	Browser RUM + Main Process events	Browser RUM; Renderer unresponsiveness reported by Main Process

The Native SDK does not install process-level Detour Hooks. Applications must explicitly pass HWND, WinHTTP Handles, or business lifecycle events. For integration methods, refer to Desktop UI Frameworks and RUM Manual Instrumentation.

Log Capability Matrix¶

Integration Method	Custom Log	Batch Log	Automatic Log Sources	RUM Association
.NET / C#	`GuanceSdk.AddLog()`	`GuanceSdk.AddLogs()`	Can collect `System.Diagnostics.Trace`	Configurable
Native C/C++	`guance_log_add()`	`guance_log_add_batch()`	Does not intercept Console, ETW, or third-party log libraries currently	Configurable
WebView2	Written by the Windows host	Written by the Windows host	Does not automatically bridge page Console	Uses the current RUM context of the host
Electron Native Bridge	Browser Logs API	Converted by the Browser Logs Adapter	Console, page errors, or custom scopes configured by Browser Logs	Uses Native Session, View, and Action context

Log uses a separate queue. When RUM association is enabled, the session_id, view_id, and action_id at the time the log is written are reported with the Log; logs already enqueued are not modified by subsequent context changes.

The core fields of a Log are message and status. It also carries service, env, version, SDK, application, device, and user fields; when RUM association is enabled, it additionally carries session_id, view_id, action_id, and their corresponding names. GlobalContext, user extended attributes, and event-level Properties are written as custom tags but cannot override reserved SDK fields.

Trace Capability Matrix¶

Integration Method	Automatic Boundaries	Manual Context	RUM Resource Association	Independent Span Reporting
.NET / C#	`HttpClient` diagnostic subscription or `RumHttpMessageHandler`	`ContextProvider`	Configurable	Not supported
Native C/C++	`guance_rum_winhttp.hpp`	`guance_trace_create_context()` or callback	Configurable	Not supported
WebView2	Page requests are handled by the WebView2/Browser side	Managed by the page SDK	Page Resource bridging	Not uploaded by the Windows SDK
Electron Native Bridge	Browser RUM SDK	Browser RUM SDK	Resources written to the Native RUM queue via Bridge	Not supported

HTTP Trace generates or propagates request headers and can write trace_id and span_id to the corresponding RUM Resource. If full APM Spans are required, the application still needs to use a separate APM Tracer. For specific formats and target filtering methods, refer to Trace Configuration.

Data Correlation¶

The five RUM data types share the current session_id.
Action, Resource, Error, and Long Task are associated with the current view_id.
Resources, Errors, and Long Tasks generated within an Action scope are associated with the corresponding action_id.
When a new View starts, the previous active View is ended.
User information updates affect only subsequent data and do not modify historical data.
Whether Log and HTTP Trace are associated with RUM is controlled by their respective EnableLinkRumData or enable_link_rum_data.

Resource Timing¶

Automatic HttpClient Resources record the total duration by default and mark the timing precision. DNS, TCP, TLS, and TTFB phases can be supplemented via HttpResourceTimingProvider or RumResourceTiming.FromPhases().

The Native WinHTTP adapter records request start, end, status, byte count, and Trace correlation information. Applications should not estimate or fabricate these fields when reliable phase durations are not available.

Data Privacy¶

For handling of Resource URL query parameters, HTTP Headers, Trace targets, and Log attributes, refer to Privacy and Permissions. User, custom context, and manual event attributes must be sanitized by the application before writing.