diff --git a/build/repo.targets b/build/repo.targets
index c61fdb7f35..fe6a0b4c50 100644
--- a/build/repo.targets
+++ b/build/repo.targets
@@ -68,6 +68,7 @@
       <AncmFiles Include="$(RepositoryRoot)src\RequestHandler\bin\$(Configuration)\Win32\aspnetcorerh.pdb" Link="x86\aspnetcorerh.pdb" />
       <!-- Schema-->
       <AncmFiles Include="$(RepositoryRoot)src\AspNetCore\bin\$(Configuration)\x64\aspnetcore_schema.xml" Link="aspnetcore_schema.xml" />
+      <AncmFiles Include="$(RepositoryRoot)src\AspNetCore\bin\$(Configuration)\x64\ancm.mof" Link="ancm.mof" />
     </ItemGroup>
 
     <ZipArchive File="$(AncmZipOutputPath)"
diff --git a/src/AspNetCore/AspNetCore.vcxproj b/src/AspNetCore/AspNetCore.vcxproj
index f705fc81a1..d1de3bd151 100644
--- a/src/AspNetCore/AspNetCore.vcxproj
+++ b/src/AspNetCore/AspNetCore.vcxproj
@@ -243,6 +243,7 @@
     </ProjectReference>
   </ItemGroup>
   <ItemGroup>
+    <None Include="ancm.mof" />
     <None Include="Source.def" />
   </ItemGroup>
   <ItemGroup>
@@ -252,6 +253,9 @@
     <Content Include="aspnetcore_schema.xml">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
     </Content>
+    <Content Include="ancm.mof">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
   </ItemGroup>
   <ItemGroup>
     <Xml Include="aspnetcore_schema.xml" />
diff --git a/src/AspNetCore/ancm.mof b/src/AspNetCore/ancm.mof
new file mode 100644
index 0000000000..5a50b19914
--- /dev/null
+++ b/src/AspNetCore/ancm.mof
@@ -0,0 +1,208 @@
+#pragma classflags("forceupdate")
+#pragma namespace ("\\\\.\\Root\\WMI")
+#pragma autorecover
+
+/*
+ * AspNetCore module trace events layout
+ * Uncomment the following class to run mof2trace to generate header file
+ * comment it back before checking it in */
+[Dynamic,
+  Description("IIS: WWW Server"),
+  Guid("{3a2a4e84-4c21-4981-ae10-3fda0d9b0f83}"),
+  locale("MS\\0x409")]
+class IIS_Trace:EventTrace
+{
+    [Description ("Enable Flags") : amended,
+        ValueDescriptions{
+            "AspNetCore module events" } : amended,
+        DefineValues{
+            "ETW_IIS_ANCM" },
+        Values{
+            "ANCM" },
+        ValueMap{
+            "0x10000" }
+    ]
+    uint32 Flags;
+
+    [Description ("Levels") : amended,
+        ValueDescriptions{
+            "Abnormal exit or termination",
+            "Severe errors",
+            "Warnings",
+            "Information",
+            "Detailed information" } : amended,
+         DefineValues{
+            "TRACE_LEVEL_FATAL",
+            "TRACE_LEVEL_ERROR",
+            "TRACE_LEVEL_WARNING",
+            "TRACE_LEVEL_INFORMATION",
+            "TRACE_LEVEL_VERBOSE" },
+        Values{
+            "Fatal",
+            "Error",
+            "Warning",
+            "Information",
+            "Verbose" },
+        ValueMap{
+            "0x1",
+            "0x2",
+            "0x3",
+            "0x4",
+            "0x5" },
+        ValueType("index")
+    ]
+    uint32 Level;
+};
+*/
+
+[Dynamic,
+ Description("ANCM runtime events") : amended,
+ Guid("{82ADEAD7-12B2-4781-BDCA-5A4B6C757191}"),
+ EventVersion(1),
+ DisplayName("ANCM"),
+ EventANCMRuntime,
+ locale("MS\\0x409")
+]
+class ANCM_Events:IIS_Trace
+{
+};
+
+[Dynamic,
+ Description("Start application success") : amended,
+ EventType(1),
+ EventLevel(4),
+ EventTypeName("ANCM_START_APPLICATION_SUCCESS") : amended
+]
+class ANCMAppStart:ANCM_Events
+{
+    [WmiDataId(1),
+     Description("Context ID") : amended,
+     extension("Guid"),
+     ActivityID,
+     read]
+     object  ContextId;
+    [WmiDataId(2),
+     Description("Application Description") : amended,
+     StringTermination("NullTerminated"),
+     format("w"),
+     read]
+     string AppDescription;
+};
+
+[Dynamic,
+ Description("Start application failed") : amended,
+ EventType(2),
+ EventLevel(2),
+ EventTypeName("ANCM_START_APPLICATION_FAIL") : amended
+]
+class ANCMAppStartFail:ANCM_Events
+{
+    [WmiDataId(1),
+     Description("Context ID") : amended,
+     extension("Guid"),
+     ActivityID,
+     read]
+     object  ContextId;
+    [WmiDataId(2),
+     Description("Application Start Failure Description") : amended,
+     StringTermination("NullTerminated"),
+     format("w"),
+     read]
+     string FailureDescription;
+};
+
+[Dynamic,
+ Description("Start forwarding request") : amended,
+ EventType(3),
+ EventLevel(4),
+ EventTypeName("ANCM_REQUEST_FORWARD_START") : amended
+]
+class ANCMForwardStart:ANCM_Events
+{
+    [WmiDataId(1),
+     Description("Context ID") : amended,
+     extension("Guid"),
+     ActivityID,
+     read]
+     object  ContextId;
+};
+
+[Dynamic,
+ Description("Finish forwarding request") : amended,
+ EventType(4),
+ EventLevel(4),
+ EventTypeName("ANCM_REQUEST_FORWARD_END") : amended
+]
+class ANCMForwardEnd:ANCM_Events
+{
+    [WmiDataId(1),
+     Description("Context ID") : amended,
+     extension("Guid"),
+     ActivityID,
+     read]
+     object  ContextId;
+};
+
+[Dynamic,
+ Description("Forwarding request failure") : amended,
+ EventType(5),
+ EventLevel(2),
+ EventTypeName("ANCM_REQUEST_FORWARD_FAIL") : amended
+]
+class ANCMForwardFail:ANCM_Events
+{
+    [WmiDataId(1),
+     Description("Context ID") : amended,
+     extension("Guid"),
+     ActivityID,
+     read]
+     object  ContextId;
+    [WmiDataId(2),
+     Description("Error code") : amended,
+     format("x"),
+     read]
+     uint32  ErrorCode;
+};
+
+[Dynamic,
+ Description("Receiving callback from WinHttp") : amended,
+ EventType(6),
+ EventLevel(4),
+ EventTypeName("ANCM_WINHTTP_CALLBACK") : amended
+]
+class ANCMWinHttpCallBack:ANCM_Events
+{
+    [WmiDataId(1),
+     Description("Context ID") : amended,
+     extension("Guid"),
+     ActivityID,
+     read]
+     object  ContextId;
+    [WmiDataId(2),
+     Description("InternetStatus") : amended,
+     format("x"),
+     read]
+     uint32  InternetStatus;
+};
+
+[Dynamic,
+ Description("Inprocess executing request failure") : amended,
+ EventType(7),
+ EventLevel(2),
+ EventTypeName("ANCM_EXECUTE_REQUEST_FAIL") : amended
+]
+class ANCMExecuteFailed:ANCM_Events
+{
+    [WmiDataId(1),
+     Description("Context ID") : amended,
+     extension("Guid"),
+     ActivityID,
+     read]
+     object  ContextId;
+    [WmiDataId(2),
+     Description("InternetStatus") : amended,
+     format("x"),
+     read]
+     uint32  ErrorCode;
+};
+
diff --git a/src/RequestHandler/aspnetcore_event.h b/src/RequestHandler/aspnetcore_event.h
index 11f9e248a2..2c13d20d1e 100644
--- a/src/RequestHandler/aspnetcore_event.h
+++ b/src/RequestHandler/aspnetcore_event.h
@@ -230,7 +230,7 @@ public:
     };
     //
     // Event: mof class name ANCMForwardStart,
-    // Description: Start fardwarding request
+    // Description: Start forwarding request
     // EventTypeName: ANCM_REQUEST_FORWARD_START
     // EventType: 3
     // EventLevel: 4