Microsoft-Windows-Diagnosis-AdvancedTaskManager

Event	Title	Channel	Sample	Rule
5016	task_0	Operational	N	N
5017	task_05017	Operational	N	N
5018	task_05018	Operational	N	N
5100	ListUpdate	Operational	N	N
5101	ListUpdateInsert	Operational	N	N
5102	ListUpdateDelete	Operational	N	N
5103	task_05103	Operational	N	N
5200	PerfTrack_TM8_LaunchStart	Analytic	N	N
5201	PerfTrack_TM8_LaunchStop	Analytic	N	N
5202	PerfTrack_TM8_TabSwitchStart	Analytic	N	N
5203	PerfTrack_TM8_TabSwitchStop	Analytic	N	N
5204	PerfTrack_TM8_KillProcessStart	Analytic	N	N
5205	PerfTrack_TM8_KillProcessStop	Analytic	N	N
5301	TM8_Window_LaunchStart	Operational	N	N
5302	TM8_Window_LaunchStop	Operational	N	N
5303	Monitor_SetupStart	Operational	N	N
5304	Monitor_SetupStop	Operational	N	N
5351	Dashboard_SetupStart	Operational	N	N
5352	Dashboard_SetupStop	Operational	N	N
5353	Dashboard_Sidebar_InitStart	Operational	N	N
5354	Dashboard_Sidebar_InitStop	Operational	N	N
5355	Dashboard_Sidebar_CPU_InitStart	Operational	N	N
5356	Dashboard_Sidebar_CPU_InitStop	Operational	N	N
5357	Dashboard_Sidebar_Memory_InitStart	Operational	N	N
5358	Dashboard_Sidebar_Memory_InitStop	Operational	N	N
5359	Dashboard_Sidebar_Disk_InitStart	Operational	N	N
5360	Dashboard_Sidebar_Disk_InitStop	Operational	N	N
5361	Dashboard_Sidebar_Network_InitStart	Operational	N	N
5362	Dashboard_Sidebar_Network_InitStop	Operational	N	N
5363	Dashboard_LoadPageTemplateStart	Operational	N	N
5364	Dashboard_LoadPageTemplateStop	Operational	N	N
5365	Dashboard_CPUView_InitStart	Operational	N	N
5366	Dashboard_CPUView_InitStop	Operational	N	N
5367	Dashboard_MemoryView_InitStart	Operational	N	N
5368	Dashboard_MemoryView_InitStop	Operational	N	N
5369	Dashboard_DiskView_InitStart	Operational	N	N
5370	Dashboard_DiskView_InitStop	Operational	N	N
5371	Dashboard_NetworkView_InitStart	Operational	N	N
5372	Dashboard_NetworkView_InitStop	Operational	N	N
5373	Dashboard_RenderStart	Operational	N	N
5374	Dashboard_RenderStop	Operational	N	N
5375	Dashboard_SwitchResourceStart	Operational	N	N
5376	Dashboard_SwitchResourceStop	Operational	N	N
5379	Dashboard_Disk_EnumerateDisksStart	Operational	N	N
5380	Dashboard_Disk_EnumerateDisksStop	Operational	N	N
5381	Dashboard_Network_Adapter_EnumerateAdaptersStart	Operational	N	N
5382	Dashboard_Network_Adapter_EnumerateAdaptersStop	Operational	N	N
5383	Dashboard_Network_Adapter_RefreshAdaptersStart	Operational	N	N
5384	Dashboard_Network_Adapter_RefreshAdaptersStop	Operational	N	N
5385	Dashboard_Network_Adapter_WifiSetPropertiesStart	Operational	N	N
5386	Dashboard_Network_Adapter_WifiSetPropertiesStop	Operational	N	N
5387	Dashboard_Network_Adapter_WWanSetPropertiesStart	Operational	N	N
5388	Dashboard_Network_Adapter_WWanSetPropertiesStop	Operational	N	N
5389	Dashboard_ChangeSummaryViewStart	Operational	N	N
5390	Dashboard_ChangeSummaryViewStop	Operational	N	N
5391	Dashboard_TurnChartsOnOffStart	Operational	N	N
5392	Dashboard_TurnChartsOnOffStop	Operational	N	N
5393	Dashboard_AddDiskStart	Operational	N	N
5394	Dashboard_AddDiskStop	Operational	N	N
5395	Dashboard_RemoveDiskStart	Operational	N	N
5396	Dashboard_RemoveDiskStop	Operational	N	N
5397	Dashboard_AddAdapterStart	Operational	N	N
5398	Dashboard_AddAdapterStop	Operational	N	N
5399	Dashboard_RemoveAdapterStart	Operational	N	N
5400	Dashboard_RemoveAdapterStop	Operational	N	N
5401	Dashboard_DiskPerfIOCTLStart	Operational	N	N
5402	Dashboard_DiskPerfIOCTLStop	Operational	N	N
5403	Dashboard_ChartScaleChangedUpdate	Operational	N	N
5404	Dashboard_DiskLengthIOCTLStart	Operational	N	N
5405	Dashboard_DiskLengthIOCTLStop	Operational	N	N
5501	UI_RenderStart	Operational	N	N
5502	UI_RenderStop	Operational	N	N
5503	UI_DataSortStart	Operational	N	N
5504	UI_DataSortStop	Operational	N	N
5505	UI_ClickExpandoStart	Operational	N	N
5506	UI_ClickExpandoStop	Operational	N	N
5651	DataMonitor_AppInfo_UpdateStart	Operational	N	N
5652	DataMonitor_AppInfo_UpdateStop	Operational	N	N
5653	DataMonitor_WindowInfo_UpdateStart	Operational	N	N
5654	DataMonitor_WindowInfo_UpdateStop	Operational	N	N
5655	DataMonitor_AppServiceInfo_UpdateStart	Operational	N	N
5656	DataMonitor_AppServiceInfo_UpdateStop	Operational	N	N
5657	DataMonitor_TrayIconInfo_UpdateStart	Operational	N	N
5658	DataMonitor_TrayIconInfo_UpdateStop	Operational	N	N
5659	DataMonitor_UserInfo_UpdateStart	Operational	N	N
5660	DataMonitor_UserInfo_UpdateStop	Operational	N	N
6001	Actions_InvokeMenuStart	Operational	N	N
6002	Actions_InvokeMenuStop	Operational	N	N
6003	Actions_RightClickPopupStart	Operational	N	N
6004	Actions_RightClickPopupStop	Operational	N	N
6005	Actions_EndTask_ProcessStart	Operational	N	N
6006	Actions_EndTask_ProcessStop	Operational	N	N
6007	Actions_EndTask_WindowStart	Operational	N	N
6008	Actions_EndTask_WindowStop	Operational	N	N
6009	Actions_EndTask_ServiceStart	Operational	N	N
6010	Actions_EndTask_ServiceStop	Operational	N	N
6011	Actions_SortbyStart	Operational	N	N
6012	Actions_SortbyStop	Operational	N	N
6013	Actions_SortDUITreeStart	Operational	N	N
6014	Actions_SortDUITreeStop	Operational	N	N
6015	Actions_ColSwapStart	Operational	N	N
6016	Actions_ColSwapStop	Operational	N	N
6017	Actions_ColResizeStart	Operational	N	N
6018	Actions_ColResizeStop	Operational	N	N
6019	Actions_ChangeViewStart	Operational	N	N
6020	Actions_ChangeViewStop	Operational	N	N
6021	Monitor_ChangeViewStart	Operational	N	N
6022	Monitor_ChangeViewStop	Operational	N	N
6023	Actions_ConfirmCommandStart	Operational	N	N
6024	Actions_ConfirmCommandStop	Operational	N	N
6025	Actions_SwitchUser	Operational	N	N
6026	Actions_SendMessage	Operational	N	N
6027	Actions_LogoffUser	Operational	N	N
6028	Actions_DisconnectUser	Operational	N	N
7000	Startup_ImpactFile_ParseStart	Operational	N	N
7001	Startup_ImpactFile_ParseStop	Operational	N	N
7002	Startup_EnumerationStart	Operational	N	N
7003	Startup_EnumerationStop	Operational	N	N
7004	Startup_LoadItemsStart	Operational	N	N
7005	Startup_LoadItemsStop	Operational	N	N
7100	AppHistory_EnumerateInstalledAppsStart	Operational	N	N
7101	AppHistory_EnumerateInstalledAppsStop	Operational	N	N
7102	AppHistory_RegisterAndProcessStatsStart	Operational	N	N
7103	AppHistory_RegisterAndProcessStatsStop	Operational	N	N
7104	AppHistory_GetInterfaceCostStart	Operational	N	N
7105	AppHistory_GetInterfaceCostStop	Operational	N	N
7106	AppHistory_ParsePackageIconStart	Operational	N	N
7107	AppHistory_ParsePackageIconStop	Operational	N	N
7108	AppHistory_AddImmersiveApplicationStart	Operational	N	N
7109	AppHistory_AddImmersiveApplicationStop	Operational	N	N
7110	AppHistory_AddDesktopApplicationStart	Operational	N	N
7111	AppHistory_AddDesktopApplicationStop	Operational	N	N
7112	AppHistory_ProcessSrumRecordSetStart	Operational	N	N
7113	AppHistory_ProcessSrumRecordSetStop	Operational	N	N

Event ID 5016: task_0

Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer
`Size` Pointer

Event ID 5017: task_05017

Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer

Event ID 5018: task_05018

Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer
`Size` Pointer
`OrigAddress` Pointer

Event ID 5100: ListUpdate

Channel: Operational
Task: ListUpdate
Opcode: Update

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5101: ListUpdateInsert

Channel: Operational
Task: ListUpdate
Opcode: Insert

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5102: ListUpdateDelete

Channel: Operational
Task: ListUpdate
Opcode: Delete

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5103: task_05103

Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Function` AnsiString
`Line` UInt32
`ErrorText` UnicodeString

Event ID 5200: PerfTrack_TM8_LaunchStart

Channel: Analytic
Task: PerfTrack_TM8_Launch
Opcode: Start

Event ID 5201: PerfTrack_TM8_LaunchStop

Channel: Analytic
Task: PerfTrack_TM8_Launch
Opcode: Stop

Event ID 5202: PerfTrack_TM8_TabSwitchStart

Channel: Analytic
Task: PerfTrack_TM8_TabSwitch
Opcode: Start

Fields #

Name	Description
`TabId` UInt32

Event ID 5203: PerfTrack_TM8_TabSwitchStop

Channel: Analytic
Task: PerfTrack_TM8_TabSwitch
Opcode: Stop

Fields #

Name	Description
`TabId` UInt32

Event ID 5204: PerfTrack_TM8_KillProcessStart

Channel: Analytic
Task: PerfTrack_TM8_KillProcess
Opcode: Start

Fields #

Name	Description
`ProcessOrPackageName` UnicodeString
`Version` UnicodeString
`TimeDateStamp` UInt32
`ProcessId` UInt32

Event ID 5205: PerfTrack_TM8_KillProcessStop

Channel: Analytic
Task: PerfTrack_TM8_KillProcess
Opcode: Stop

Fields #

Name	Description
`ProcessOrPackageName` UnicodeString
`Version` UnicodeString
`TimeDateStamp` UInt32
`ProcessId` UInt32

Event ID 5301: TM8_Window_LaunchStart

Channel: Operational
Task: TM8_Window_Launch
Opcode: Start

Event ID 5302: TM8_Window_LaunchStop

Channel: Operational
Task: TM8_Window_Launch
Opcode: Stop

Event ID 5303: Monitor_SetupStart

Channel: Operational
Task: Monitor_Setup
Opcode: Start

Event ID 5304: Monitor_SetupStop

Channel: Operational
Task: Monitor_Setup
Opcode: Stop

Event ID 5351: Dashboard_SetupStart

Channel: Operational
Task: Dashboard_Setup
Opcode: Start

Event ID 5352: Dashboard_SetupStop

Channel: Operational
Task: Dashboard_Setup
Opcode: Stop

Event ID 5353: Dashboard_Sidebar_InitStart

Channel: Operational
Task: Dashboard_Sidebar_Init
Opcode: Start

Event ID 5354: Dashboard_Sidebar_InitStop

Channel: Operational
Task: Dashboard_Sidebar_Init
Opcode: Stop

Event ID 5355: Dashboard_Sidebar_CPU_InitStart

Channel: Operational
Task: Dashboard_Sidebar_CPU_Init
Opcode: Start

Event ID 5356: Dashboard_Sidebar_CPU_InitStop

Channel: Operational
Task: Dashboard_Sidebar_CPU_Init
Opcode: Stop

Event ID 5357: Dashboard_Sidebar_Memory_InitStart

Channel: Operational
Task: Dashboard_Sidebar_Memory_Init
Opcode: Start

Event ID 5358: Dashboard_Sidebar_Memory_InitStop

Channel: Operational
Task: Dashboard_Sidebar_Memory_Init
Opcode: Stop

Event ID 5359: Dashboard_Sidebar_Disk_InitStart

Channel: Operational
Task: Dashboard_Sidebar_Disk_Init
Opcode: Start

Event ID 5360: Dashboard_Sidebar_Disk_InitStop

Channel: Operational
Task: Dashboard_Sidebar_Disk_Init
Opcode: Stop

Event ID 5361: Dashboard_Sidebar_Network_InitStart

Channel: Operational
Task: Dashboard_Sidebar_Network_Init
Opcode: Start

Event ID 5362: Dashboard_Sidebar_Network_InitStop

Channel: Operational
Task: Dashboard_Sidebar_Network_Init
Opcode: Stop

Event ID 5363: Dashboard_LoadPageTemplateStart

Channel: Operational
Task: Dashboard_LoadPageTemplate
Opcode: Start

Fields #

Name	Description
`PageId` UInt32

Event ID 5364: Dashboard_LoadPageTemplateStop

Channel: Operational
Task: Dashboard_LoadPageTemplate
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5365: Dashboard_CPUView_InitStart

Channel: Operational
Task: Dashboard_CPUView_Init
Opcode: Start

Event ID 5366: Dashboard_CPUView_InitStop

Channel: Operational
Task: Dashboard_CPUView_Init
Opcode: Stop

Fields #

Name	Description
`ResourceName` UnicodeString
`ProcessorCoreCount` UInt32
`LogicalProcessorCount` UInt32
`NumaNodeCount` UInt32
`MaxCPUSpeed` UnicodeString
`CurrentCPUSpeed` UnicodeString
`Virtualization` UnicodeString

Event ID 5367: Dashboard_MemoryView_InitStart

Channel: Operational
Task: Dashboard_MemoryView_Init
Opcode: Start

Event ID 5368: Dashboard_MemoryView_InitStop

Channel: Operational
Task: Dashboard_MemoryView_Init
Opcode: Stop

Fields #

Name	Description
`ResourceName` UnicodeString
`MemorySpeed` UnicodeString
`SlotsUsed` UnicodeString
`AvailableMemory` UnicodeString
`CachedMemory` UnicodeString
`CommittedMemory` UnicodeString

Event ID 5369: Dashboard_DiskView_InitStart

Channel: Operational
Task: Dashboard_DiskView_Init
Opcode: Start

Event ID 5370: Dashboard_DiskView_InitStop

Channel: Operational
Task: Dashboard_DiskView_Init
Opcode: Stop

Event ID 5371: Dashboard_NetworkView_InitStart

Channel: Operational
Task: Dashboard_NetworkView_Init
Opcode: Start

Event ID 5372: Dashboard_NetworkView_InitStop

Channel: Operational
Task: Dashboard_NetworkView_Init
Opcode: Stop

Event ID 5373: Dashboard_RenderStart

Channel: Operational
Task: Dashboard_Render
Opcode: Start

Fields #

Name	Description
`PageId` UInt32

Event ID 5374: Dashboard_RenderStop

Channel: Operational
Task: Dashboard_Render
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5375: Dashboard_SwitchResourceStart

Channel: Operational
Task: Dashboard_SwitchResource
Opcode: Start

Event ID 5376: Dashboard_SwitchResourceStop

Channel: Operational
Task: Dashboard_SwitchResource
Opcode: Stop

Fields #

Name	Description
`OldPageId` UInt32
`NewPageId` UInt32

References #

Event ID 5379: Dashboard_Disk_EnumerateDisksStart

Channel: Operational
Task: Dashboard_Disk_EnumerateDisks
Opcode: Start

Event ID 5380: Dashboard_Disk_EnumerateDisksStop

Channel: Operational
Task: Dashboard_Disk_EnumerateDisks
Opcode: Stop

Fields #

Name	Description
`DiskCount` UInt32

References #

Ultimate Windows Security

Event ID 5381: Dashboard_Network_Adapter_EnumerateAdaptersStart

Channel: Operational
Task: Dashboard_Network_Adapter_EnumerateAdapters
Opcode: Start

References #

Ultimate Windows Security

Event ID 5382: Dashboard_Network_Adapter_EnumerateAdaptersStop

Channel: Operational
Task: Dashboard_Network_Adapter_EnumerateAdapters
Opcode: Stop

Fields #

Name	Description
`AdapterCount` UInt32

Event ID 5383: Dashboard_Network_Adapter_RefreshAdaptersStart

Channel: Operational
Task: Dashboard_Network_Adapter_RefreshAdapters
Opcode: Start

Event ID 5384: Dashboard_Network_Adapter_RefreshAdaptersStop

Channel: Operational
Task: Dashboard_Network_Adapter_RefreshAdapters
Opcode: Stop

Fields #

Name	Description
`AdapterCount` UInt32

Event ID 5385: Dashboard_Network_Adapter_WifiSetPropertiesStart

Channel: Operational
Task: Dashboard_Network_Adapter_WifiSetProperties
Opcode: Start

Event ID 5386: Dashboard_Network_Adapter_WifiSetPropertiesStop

Channel: Operational
Task: Dashboard_Network_Adapter_WifiSetProperties
Opcode: Stop

Fields #

Name	Description
`SSID` UnicodeString
`PhysicalNetworkType` UnicodeString
`SignalQuality` UInt32

Event ID 5387: Dashboard_Network_Adapter_WWanSetPropertiesStart

Channel: Operational
Task: Dashboard_Network_Adapter_WWanSetProperties
Opcode: Start

Event ID 5388: Dashboard_Network_Adapter_WWanSetPropertiesStop

Channel: Operational
Task: Dashboard_Network_Adapter_WWanSetProperties
Opcode: Stop

Fields #

Name	Description
`ServiceProvider` UnicodeString
`PhysicalNetworkType` UnicodeString
`SignalQuality` UInt32

Event ID 5389: Dashboard_ChangeSummaryViewStart

Channel: Operational
Task: Dashboard_ChangeSummaryView
Opcode: Start

Fields #

Name	Description
`Snap` UInt32
`CurrentView` UInt32

Event ID 5390: Dashboard_ChangeSummaryViewStop

Channel: Operational
Task: Dashboard_ChangeSummaryView
Opcode: Stop

Event ID 5391: Dashboard_TurnChartsOnOffStart

Channel: Operational
Task: Dashboard_TurnChartsOnOff
Opcode: Start

Fields #

Name	Description
`ChartsOn` UInt32
`CurrentView` UInt32

Event ID 5392: Dashboard_TurnChartsOnOffStop

Channel: Operational
Task: Dashboard_TurnChartsOnOff
Opcode: Stop

Event ID 5393: Dashboard_AddDiskStart

Channel: Operational
Task: Dashboard_AddDisk
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5394: Dashboard_AddDiskStop

Channel: Operational
Task: Dashboard_AddDisk
Opcode: Stop

Event ID 5395: Dashboard_RemoveDiskStart

Channel: Operational
Task: Dashboard_RemoveDisk
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5396: Dashboard_RemoveDiskStop

Channel: Operational
Task: Dashboard_RemoveDisk
Opcode: Stop

Event ID 5397: Dashboard_AddAdapterStart

Channel: Operational
Task: Dashboard_AddAdapter
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5398: Dashboard_AddAdapterStop

Channel: Operational
Task: Dashboard_AddAdapter
Opcode: Stop

Event ID 5399: Dashboard_RemoveAdapterStart

Channel: Operational
Task: Dashboard_RemoveAdapter
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5400: Dashboard_RemoveAdapterStop

Channel: Operational
Task: Dashboard_RemoveAdapter
Opcode: Stop

Event ID 5401: Dashboard_DiskPerfIOCTLStart

Channel: Operational
Task: Dashboard_DiskPerfIOCTL
Opcode: Start

Fields #

Name	Description
`DiskNumber` UInt32

Event ID 5402: Dashboard_DiskPerfIOCTLStop

Channel: Operational
Task: Dashboard_DiskPerfIOCTL
Opcode: Stop

Fields #

Name	Description
`Hresult` UInt32
`QueryByteReturned` UInt32

Event ID 5403: Dashboard_ChartScaleChangedUpdate

Channel: Operational
Task: Dashboard_ChartScaleChanged
Opcode: Update

Fields #

Name	Description
`ChartId` UnicodeString
`FromScaleIndex` UInt32
`FromScaleString` UnicodeString
`ToScaleIndex` UInt32
`ToScaleString` UnicodeString

Event ID 5404: Dashboard_DiskLengthIOCTLStart

Channel: Operational
Task: Dashboard_DiskLengthIOCTL
Opcode: Start

Fields #

Name	Description
`DiskNumber` UInt32

Event ID 5405: Dashboard_DiskLengthIOCTLStop

Channel: Operational
Task: Dashboard_DiskLengthIOCTL
Opcode: Stop

Fields #

Name	Description
`Hresult` UInt32
`QueryByteReturned` UInt32
`LengthInByte` UInt64

Event ID 5501: UI_RenderStart

Channel: Operational
Task: UI_Render
Opcode: Start

Fields #

Name	Description
`TabId` UInt32

Event ID 5502: UI_RenderStop

Channel: Operational
Task: UI_Render
Opcode: Stop

Fields #

Name	Description
`TabId` UInt32

Event ID 5503: UI_DataSortStart

Channel: Operational
Task: UI_DataSort
Opcode: Start

Event ID 5504: UI_DataSortStop

Channel: Operational
Task: UI_DataSort
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5505: UI_ClickExpandoStart

Channel: Operational
Task: UI_ClickExpando
Opcode: Start

Event ID 5506: UI_ClickExpandoStop

Channel: Operational
Task: UI_ClickExpando
Opcode: Stop

Event ID 5651: DataMonitor_AppInfo_UpdateStart

Channel: Operational
Task: DataMonitor_AppInfo_Update
Opcode: Start

Event ID 5652: DataMonitor_AppInfo_UpdateStop

Channel: Operational
Task: DataMonitor_AppInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5653: DataMonitor_WindowInfo_UpdateStart

Channel: Operational
Task: DataMonitor_WindowInfo_Update
Opcode: Start

Event ID 5654: DataMonitor_WindowInfo_UpdateStop

Channel: Operational
Task: DataMonitor_WindowInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5655: DataMonitor_AppServiceInfo_UpdateStart

Channel: Operational
Task: DataMonitor_AppServiceInfo_Update
Opcode: Start

Event ID 5656: DataMonitor_AppServiceInfo_UpdateStop

Channel: Operational
Task: DataMonitor_AppServiceInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5657: DataMonitor_TrayIconInfo_UpdateStart

Channel: Operational
Task: DataMonitor_TrayIconInfo_Update
Opcode: Start

Event ID 5658: DataMonitor_TrayIconInfo_UpdateStop

Channel: Operational
Task: DataMonitor_TrayIconInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5659: DataMonitor_UserInfo_UpdateStart

Channel: Operational
Task: DataMonitor_UserInfo_Update
Opcode: Start

Event ID 5660: DataMonitor_UserInfo_UpdateStop

Channel: Operational
Task: DataMonitor_UserInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 6001: Actions_InvokeMenuStart

Channel: Operational
Task: Actions_InvokeMenu
Opcode: Start

Event ID 6002: Actions_InvokeMenuStop

Channel: Operational
Task: Actions_InvokeMenu
Opcode: Stop

Fields #

Name	Description
`ItemType` UInt64
`MenuId` UInt32

Event ID 6003: Actions_RightClickPopupStart

Channel: Operational
Task: Actions_RightClickPopup
Opcode: Start

Event ID 6004: Actions_RightClickPopupStop

Channel: Operational
Task: Actions_RightClickPopup
Opcode: Stop

Fields #

Name	Description
`ItemType` UInt64

Event ID 6005: Actions_EndTask_ProcessStart

Channel: Operational
Task: Actions_EndTask_Process
Opcode: Start

Fields #

Name	Description
`ProcessId` UInt32

Event ID 6006: Actions_EndTask_ProcessStop

Channel: Operational
Task: Actions_EndTask_Process
Opcode: Stop

Fields #

Name	Description
`ProcessId` UInt32

Event ID 6007: Actions_EndTask_WindowStart

Channel: Operational
Task: Actions_EndTask_Window
Opcode: Start

Fields #

Name	Description
`WindowHandle` UInt32

Event ID 6008: Actions_EndTask_WindowStop

Channel: Operational
Task: Actions_EndTask_Window
Opcode: Stop

Fields #

Name	Description
`WindowHandle` UInt32

Event ID 6009: Actions_EndTask_ServiceStart

Channel: Operational
Task: Actions_EndTask_Service
Opcode: Start

Fields #

Name	Description
`ServiceName` UnicodeString

Event ID 6010: Actions_EndTask_ServiceStop

Channel: Operational
Task: Actions_EndTask_Service
Opcode: Stop

Fields #

Name	Description
`ServiceName` UnicodeString

Event ID 6011: Actions_SortbyStart

Channel: Operational
Task: Actions_Sortby
Opcode: Start

Event ID 6012: Actions_SortbyStop

Channel: Operational
Task: Actions_Sortby
Opcode: Stop

Event ID 6013: Actions_SortDUITreeStart

Channel: Operational
Task: Actions_SortDUITree
Opcode: Start

Event ID 6014: Actions_SortDUITreeStop

Channel: Operational
Task: Actions_SortDUITree
Opcode: Stop

Event ID 6015: Actions_ColSwapStart

Channel: Operational
Task: Actions_ColSwap
Opcode: Start

Event ID 6016: Actions_ColSwapStop

Channel: Operational
Task: Actions_ColSwap
Opcode: Stop

Event ID 6017: Actions_ColResizeStart

Channel: Operational
Task: Actions_ColResize
Opcode: Start

Event ID 6018: Actions_ColResizeStop

Channel: Operational
Task: Actions_ColResize
Opcode: Stop

Event ID 6019: Actions_ChangeViewStart

Channel: Operational
Task: Actions_ChangeView
Opcode: Start

Fields #

Name	Description
`FromTab` UInt32
`ToTab` UInt32

Event ID 6020: Actions_ChangeViewStop

Channel: Operational
Task: Actions_ChangeView
Opcode: Stop

Event ID 6021: Monitor_ChangeViewStart

Channel: Operational
Task: Monitor_ChangeView
Opcode: Start

Fields #

Name	Description
`FromTab` UInt32
`ToTab` UInt32

Event ID 6022: Monitor_ChangeViewStop

Channel: Operational
Task: Monitor_ChangeView
Opcode: Stop

Event ID 6023: Actions_ConfirmCommandStart

Channel: Operational
Task: Actions_ConfirmCommand
Opcode: Start

Fields #

Name	Description
`CommandId` UInt32

Event ID 6024: Actions_ConfirmCommandStop

Channel: Operational
Task: Actions_ConfirmCommand
Opcode: Stop

Event ID 6025: Actions_SwitchUser

Channel: Operational
Task: Actions_SwitchUser

Event ID 6026: Actions_SendMessage

Channel: Operational
Task: Actions_SendMessage

Event ID 6027: Actions_LogoffUser

Channel: Operational
Task: Actions_LogoffUser

Event ID 6028: Actions_DisconnectUser

Channel: Operational
Task: Actions_DisconnectUser

Event ID 7000: Startup_ImpactFile_ParseStart

Channel: Operational
Task: Startup_ImpactFile_Parse
Opcode: Start

Event ID 7001: Startup_ImpactFile_ParseStop

Channel: Operational
Task: Startup_ImpactFile_Parse
Opcode: Stop

Fields #

Name	Description
`CountOfItemsInStartupXML` UInt32

Event ID 7002: Startup_EnumerationStart

Channel: Operational
Task: Startup_Enumeration
Opcode: Start

Event ID 7003: Startup_EnumerationStop

Channel: Operational
Task: Startup_Enumeration
Opcode: Stop

Event ID 7004: Startup_LoadItemsStart

Channel: Operational
Task: Startup_LoadItems
Opcode: Start

Event ID 7005: Startup_LoadItemsStop

Channel: Operational
Task: Startup_LoadItems
Opcode: Stop

Event ID 7100: AppHistory_EnumerateInstalledAppsStart

Channel: Operational
Task: AppHistory_EnumerateInstalledApps
Opcode: Start

Event ID 7101: AppHistory_EnumerateInstalledAppsStop

Channel: Operational
Task: AppHistory_EnumerateInstalledApps
Opcode: Stop

Event ID 7102: AppHistory_RegisterAndProcessStatsStart

Channel: Operational
Task: AppHistory_RegisterAndProcessStats
Opcode: Start

Fields #

Name	Description
`SrumProvider` UInt32

Event ID 7103: AppHistory_RegisterAndProcessStatsStop

Channel: Operational
Task: AppHistory_RegisterAndProcessStats
Opcode: Stop

Fields #

Name	Description
`SrumProvider` UInt32

Event ID 7104: AppHistory_GetInterfaceCostStart

Channel: Operational
Task: AppHistory_GetInterfaceCost
Opcode: Start

Fields #

Name	Description
`InterfaceLUID` UInt64
`ProfileIndex` UInt32

Event ID 7105: AppHistory_GetInterfaceCostStop

Channel: Operational
Task: AppHistory_GetInterfaceCost
Opcode: Stop

Fields #

Name	Description
`InterfaceLUID` UInt64
`ProfileIndex` UInt32

Event ID 7106: AppHistory_ParsePackageIconStart

Channel: Operational
Task: AppHistory_ParsePackageIcon
Opcode: Start

Fields #

Name	Description
`PackageInstallPath` UnicodeString

Event ID 7107: AppHistory_ParsePackageIconStop

Channel: Operational
Task: AppHistory_ParsePackageIcon
Opcode: Stop

Fields #

Name	Description
`PackageInstallPath` UnicodeString

Event ID 7108: AppHistory_AddImmersiveApplicationStart

Channel: Operational
Task: AppHistory_AddImmersiveApplication
Opcode: Start

Event ID 7109: AppHistory_AddImmersiveApplicationStop

Channel: Operational
Task: AppHistory_AddImmersiveApplication
Opcode: Stop

Fields #

Name	Description
`PackageName` UnicodeString
`LongDisplayName` UnicodeString

Event ID 7110: AppHistory_AddDesktopApplicationStart

Channel: Operational
Task: AppHistory_AddDesktopApplication
Opcode: Start

Event ID 7111: AppHistory_AddDesktopApplicationStop

Channel: Operational
Task: AppHistory_AddDesktopApplication
Opcode: Stop

Fields #

Name	Description
`ExePath` UnicodeString

Event ID 7112: AppHistory_ProcessSrumRecordSetStart

Channel: Operational
Task: AppHistory_ProcessSrumRecordSet
Opcode: Start

Fields #

Name	Description
`SrumProvider` UInt32
`SrumRecordSetCount` UInt64

Event ID 7113: AppHistory_ProcessSrumRecordSetStop

Channel: Operational
Task: AppHistory_ProcessSrumRecordSet
Opcode: Stop

Provenance

ETW provider GUID 178dadaf-7ac4-4593-ab3e-a45fda6d0d55

Defined in Taskmgr.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB