Windows event log · Microsoft-Windows-Diagnostics-Performance/Operational101 Boot Performance Monitoring Degradation

  • Windows operational
  • 6 fields
  • Microsoft-Windows-Diagnostics-Performance%4Operational.evtx
  • Microsoft-Windows-Diagnostics-Performance

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • ExecutableInfo%Path%
    • %Path% = /Event/EventData/Data[@Name="Path"]
  • PayloadData1%Name%
    • %Name% = /Event/EventData/Data[@Name="Name"]
  • PayloadData2%FriendlyName%
    • %FriendlyName% = /Event/EventData/Data[@Name="FriendlyName"]
  • PayloadData3DegradationTime: %DegradationTime%
    • %DegradationTime% = /Event/EventData/Data[@Name="DegradationTime"]
  • PayloadData4ProductName: %ProductName%
    • %ProductName% = /Event/EventData/Data[@Name="ProductName"]
  • PayloadData5StartTime: %StartTime%
    • %StartTime% = /Event/EventData/Data[@Name="StartTime"]

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Diagnostics-Performance" Guid="{cfc18ec0-96b1-4eba-961b-622caee05b0a}"/>
    <EventID>101</EventID>
    <Version>1</Version>
    <Level>3</Level>
    <Task>4002</Task>
    <Opcode>33</Opcode>
    <Keywords>0x8000000000010000</Keywords>
    <TimeCreated SystemTime="2022-06-16T15:06:42.2718140Z"/>
    <EventRecordID>583</EventRecordID>
    <Correlation ActivityID="{06f2c9dc-8192-0003-01e7-f2069281d801}"/>
    <Execution ProcessID="4936" ThreadID="6992"/>
    <Channel>Microsoft-Windows-Diagnostics-Performance/Operational</Channel>
    <Computer>COMPUTER NAME</Computer>
    <Security UserID="S-1-5-19"/>
  </System>
  <EventData>
    <Data Name="StartTime">2022-06-16T15:01:58.9212636Z</Data>
    <Data Name="NameLength">12</Data>
    <Data Name="Name">svchost.exe</Data>
    <Data Name="FriendlyNameLength">34</Data>
    <Data Name="FriendlyName">Host Process for Windows Services</Data>
    <Data Name="VersionLength">36</Data>
    <Data Name="Version">10.0.19041.1 (WinBuild.160101.0800)</Data>
    <Data Name="TotalTime">3865</Data>
    <Data Name="DegradationTime">1341</Data>
    <Data Name="PathLength">32</Data>
    <Data Name="Path">C:\Windows\System32\svchost.exe</Data>
    <Data Name="ProductNameLength">37</Data>
    <Data Name="ProductName">Microsoft® Windows® Operating System</Data>
    <Data Name="CompanyNameLength">22</Data>
    <Data Name="CompanyName">Microsoft Corporation</Data>
  </EventData>
</Event>

References

1 link

Source: evtx/Maps/Microsoft-Windows-Diagnostics-Performance-Operational_Microsoft-Windows-Diagnostics-Performance_101.map(opens in new tab) by Tony Knutson and contributors(opens in new tab), MIT License(opens in new tab)