XEvent Timestamp is a large integer value not the expected datatime value

The timestamp column for XEvent is stored internally as an offset from the start of the trace.   The XEvent header contains the starting, UTC time and each event stores the offset in ticks from the value stored in the header.

On a system where the time is adjusted, for example daylight savings time falls backward, the offset stored in the individual trace record can become a negative value.

There is a bug in the common, XEvent reader code that impacts the TSQL reader as well as the client reader (SSMS, XEvent Linq reader, …).   Instead of reading the value as a signed value the value is read as unsigned.   This causes the unsigned value to look like 0xFFFFFFFFFFFF####.   The signed value should be –#### but it is incorrectly treated as a unsigned.   This large of an offset is illegal and causes the reader to return an error.

When using the TSQL reader function (sys.fn_xe_file_target_read) an incorrect value returned from the reader for timestamp is output as the calculated, tick offset value (%I64u) instead of the datetime value.

A correct event looks like:

…. timestamp="2015-04-11T11:19:24.265Z">                               

Incorrect event might look like: 

…. timestamp="18446744070113720036">

Attempting to open the file in SSMS (management Studio) results in the following error.

image

Bob Dorr - Principal SQL Server Escalation Engineer