Windows event log · Microsoft-Windows-Diagnostics-Performance/Operational101 Boot Performance Monitoring Degradation
- Windows operational
- 6 fields
Microsoft-Windows-Diagnostics-Performance%4Operational.evtxMicrosoft-Windows-Diagnostics-Performance
Fields EvtxECmd extracts
6 columns in the EvtxECmd CSV
- ExecutableInfo
%Path%- %Path% = /Event/EventData/Data[@Name="Path"]
- PayloadData1
%Name%- %Name% = /Event/EventData/Data[@Name="Name"]
- PayloadData2
%FriendlyName%- %FriendlyName% = /Event/EventData/Data[@Name="FriendlyName"]
- PayloadData3
DegradationTime: %DegradationTime%- %DegradationTime% = /Event/EventData/Data[@Name="DegradationTime"]
- PayloadData4
ProductName: %ProductName%- %ProductName% = /Event/EventData/Data[@Name="ProductName"]
- PayloadData5
StartTime: %StartTime%- %StartTime% = /Event/EventData/Data[@Name="StartTime"]
Sample event
Event XML from the map file
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Diagnostics-Performance" Guid="{cfc18ec0-96b1-4eba-961b-622caee05b0a}"/>
<EventID>101</EventID>
<Version>1</Version>
<Level>3</Level>
<Task>4002</Task>
<Opcode>33</Opcode>
<Keywords>0x8000000000010000</Keywords>
<TimeCreated SystemTime="2022-06-16T15:06:42.2718140Z"/>
<EventRecordID>583</EventRecordID>
<Correlation ActivityID="{06f2c9dc-8192-0003-01e7-f2069281d801}"/>
<Execution ProcessID="4936" ThreadID="6992"/>
<Channel>Microsoft-Windows-Diagnostics-Performance/Operational</Channel>
<Computer>COMPUTER NAME</Computer>
<Security UserID="S-1-5-19"/>
</System>
<EventData>
<Data Name="StartTime">2022-06-16T15:01:58.9212636Z</Data>
<Data Name="NameLength">12</Data>
<Data Name="Name">svchost.exe</Data>
<Data Name="FriendlyNameLength">34</Data>
<Data Name="FriendlyName">Host Process for Windows Services</Data>
<Data Name="VersionLength">36</Data>
<Data Name="Version">10.0.19041.1 (WinBuild.160101.0800)</Data>
<Data Name="TotalTime">3865</Data>
<Data Name="DegradationTime">1341</Data>
<Data Name="PathLength">32</Data>
<Data Name="Path">C:\Windows\System32\svchost.exe</Data>
<Data Name="ProductNameLength">37</Data>
<Data Name="ProductName">Microsoft® Windows® Operating System</Data>
<Data Name="CompanyNameLength">22</Data>
<Data Name="CompanyName">Microsoft Corporation</Data>
</EventData>
</Event>References
1 link
Source: evtx/Maps/Microsoft-Windows-Diagnostics-Performance-Operational_Microsoft-Windows-Diagnostics-Performance_101.map(opens in new tab) by Tony Knutson and contributors(opens in new tab), MIT License(opens in new tab)