Microsoft-Windows-Kernel-Cache

5 events across 1 channel

Event	Title	Channel	Sample
101	Initialized VolumeCacheMap for device guid: VolumeDeviceGuid.	Operational	Y
102	Global Periodic Cache Information.	Operational	Y
103	Volume Periodic Cache Information.	Operational	Y
104	Volume Periodic Cache Read Latency Information.	Operational	Y
105	Volume Periodic Cache Write Latency Information.	Operational	Y

Event ID 101: Initialized VolumeCacheMap for device guid: VolumeDeviceGuid.

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: Informational
Task: VolumeCacheMap

Description

Initialized VolumeCacheMap for device guid: VolumeDeviceGuid.

Message #

Initialized VolumeCacheMap for device guid: %1.

Fields #

Name	Description
`VolumeDeviceGuid` GUID	Initialized VolumeCacheMap for device guid.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Cache",
    "guid": "{A2D34BF1-70AB-5B21-C819-5A0DD42748FD}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 101,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T16:32:44.9965077+00:00",
    "event_record_id": 258,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 200
    },
    "channel": "Microsoft-Windows-Kernel-Cache/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VolumeDeviceGuid": "{00000000-0000-0000-0000-000000000000}"
  },
  "message": "Initialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}."
}

Event ID 102: Global Periodic Cache Information.

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: Informational
Task: CacheGlobalPeriodic

Description

Global Periodic Cache Information.

Message #

Global Periodic Cache Information:

                       Period Duration (microseconds): %1
                       Number of NUMA Nodes: %18
                       Event Samples: %2
                       Total Number of Mapped VACBs: %3
                       Total Partition Samples: %4
                       Total Volume Samples: %5
                       Total Pages Yet to Write: %6
                       Total Dirty Pages: %7
                       Total Available Pages: %8
                       Total Number of Worker Threads: %9
                       Total Number of Active Worker Threads: %10
                       Total Average Available Pages: %11
                       Total Average Dirty Pages: %12
                       CopyRead Calls: %13
                       AsyncCopyRead Calls: %14
                       CopyWriteCalls: %15
                       SetValidData Calls: %16
                       FlushCache Calls: %17

Fields #

Name	Description
`PeriodDurationMicroSec` UInt64	[Global Periodic Cache Information] Period Duration (microseconds).
`EventSamples` UInt64	[Global Periodic Cache Information] Event Samples.
`TotalNumberOfMappedVacbs` UInt64	[Global Periodic Cache Information] Total Number of Mapped VACBs.
`TotalPartitionSamples` UInt64	[Global Periodic Cache Information] Total Partition Samples.
`TotalPagesYetToWrite` UInt64	[Global Periodic Cache Information] Total Pages Yet to Write.
`TotalDirtyPages` UInt64	[Global Periodic Cache Information] Total Dirty Pages.
`TotalAvailablePages` UInt64	[Global Periodic Cache Information] Total Available Pages.
`TotalNumberWorkerThreads` UInt64	[Global Periodic Cache Information] Total Number of Worker Threads.
`TotalNumberActiveWorkerThreads` UInt64	[Global Periodic Cache Information] Total Number of Active Worker Threads.
`TotalAverageAvailablePages` UInt64	[Global Periodic Cache Information] Total Average Available Pages.
`TotalAverageDirtyPages` UInt64	[Global Periodic Cache Information] Total Average Dirty Pages.
`CcCopyReadCalls` UInt64	[Global Periodic Cache Information] CopyRead Calls.
`CcAsyncCopyReadCalls` UInt64	[Global Periodic Cache Information] AsyncCopyRead Calls.
`CcCopyWriteCalls` UInt64	[Global Periodic Cache Information] CopyWriteCalls.
`CcSetValidDataCalls` UInt64	[Global Periodic Cache Information] SetValidData Calls.
`CcFlushCacheCalls` UInt64	[Global Periodic Cache Information] FlushCache Calls.
`NumberOfNUMANodes` UInt32	[Global Periodic Cache Information] Number of NUMA Nodes.
`TotalVolumeSamples` UInt64	[Global Periodic Cache Information] Total Volume Samples.
`TotalPhysicalPages`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Cache",
    "guid": "{A2D34BF1-70AB-5B21-C819-5A0DD42748FD}",
    "event_source_name": "",
    "event_id": 102,
    "version": 2,
    "level": 4,
    "task": 102,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:47:11.6225140+00:00",
    "event_record_id": 312,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 32
    },
    "channel": "Microsoft-Windows-Kernel-Cache/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PeriodDurationMicroSec": "3650315834",
    "EventSamples": "49",
    "TotalNumberOfMappedVacbs": "80369",
    "TotalPartitionSamples": "49",
    "TotalPagesYetToWrite": "327",
    "TotalDirtyPages": "18052",
    "TotalAvailablePages": "175299460",
    "TotalNumberWorkerThreads": "441",
    "TotalNumberActiveWorkerThreads": "0",
    "TotalAverageAvailablePages": "175294160",
    "TotalAverageDirtyPages": "21021",
    "CcCopyReadCalls": "27480",
    "CcAsyncCopyReadCalls": "0",
    "CcCopyWriteCalls": "14191",
    "CcSetValidDataCalls": "2658",
    "CcFlushCacheCalls": "9502",
    "NumberOfNUMANodes": "1"
  },
  "message": "Global Periodic Cache Information:\r\n\r\n                       Period Duration (microseconds): 3650315834\r\n                       Number of NUMA Nodes: 1\r\n                       Event Samples: 49\r\n                       Total Number of Mapped VACBs: 80369\r\n                       Total Partition Samples: 49\r\n                       Total Pages Yet to Write: 327\r\n                       Total Dirty Pages: 18052\r\n                       Total Available Pages: 175299460\r\n                       Total Number of Worker Threads: 441\r\n                       Total Number of Active Worker Threads: 0\r\n                       Total Average Available Pages: 175294160\r\n                       Total Average Dirty Pages: 21021\r\n                       CopyRead Calls: 27480\r\n                       AsyncCopyRead Calls: 0\r\n                       CopyWriteCalls: 14191\r\n                       SetValidData Calls: 2658\r\n                       FlushCache Calls: 9502"
}

Event ID 103: Volume Periodic Cache Information.

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: Informational
Task: CacheVolumePeriodic

Description

Volume Periodic Cache Information.

Message #

Volume Periodic Cache Information:

                       Device GUID: %1
                       Period Duration (microseconds): %2
                       Total Dirty Pages: %3
                       Maximum Dirty Pages: %4
                       Total Dirty Page Threshold: %5
                       Top Dirty Page Threshold: %6
                       Bottom Dirty Page Threshold: %7
                       Dirty Page Samples: %8
                       Total Lazy Writer Calls: %9
                       Total Lazy Writer Latency: %10
                       Total Lazy Writer Pages Flushed: %11
                       Lazy Writer Average Pages Per Second: %12
                       Total Pages Queued to Disk: %13
                       Maximum Pages Queued to Disk: %14
                       Pages Queued to Disk Samples: %15
                       Total Metadata Pages Queued to Disk: %16
                       Maximum Metadata Pages Queued to Disk: %17
                       Metadata Pages Queued to Disk Samples: %18
                       Read Total Bytes: %19
                       Read Paged-In Total Bytes: %20
                       Read-Ahead Total Bytes: %21
                       Cache Hit Ratio (%): %22
                       Total Writes: %23
                       Total Hard-Throttle Writes: %24
                       Total Soft-Throttle Writes: %25
                       Total Synchronous Read IO Count: %26
                       Total Synchronous Non-Blocking Read IO Count: %27
                       Total Failed Synchronous Non-Blocking Read IO Count: %28
                       Synchronous Read IO Maximum Latency (us): %29
                       Synchronous Read IO Non-Blocking Maximum Latency (us): %30
                       Total Synchronous Write IO Count: %31
                       Total Synchronous Non-Blocking Write IO Count: %32
                       Total Failed Synchronous Non-Blocking Write IO Count: %33
                       Synchronous Write IO Maximum Latency (us): %34
                       Synchronous Write IO Non-Blockinig Maximum Latency (us): %35
                       Total Asynchronous Read IO Count: %36
                       Asynchronous Read IO Maximum Latency (us): %37

Fields #

Name	Description
`VolumeDeviceGuid` GUID	[Volume Periodic Cache Information] Device GUID.
`PeriodDurationMicroSec` UInt64	[Volume Periodic Cache Information] Period Duration (microseconds).
`TotalDirtyPages` UInt64	[Volume Periodic Cache Information] Total Dirty Pages.
`MaxDirtyPages` UInt64	[Volume Periodic Cache Information] Maximum Dirty Pages.
`DirtyPageSamples` UInt64	[Volume Periodic Cache Information] Dirty Page Samples.
`TotalPagesQueuedToDisk` UInt64	[Volume Periodic Cache Information] Total Pages Queued to Disk.
`MaxPagesQueuedToDisk` UInt64	[Volume Periodic Cache Information] Maximum Pages Queued to Disk.
`PagesQueuedToDiskSamples` UInt64	[Volume Periodic Cache Information] Pages Queued to Disk Samples.
`TotalLoggedPagesQueuedToDisk` UInt64	[Volume Periodic Cache Information] Total Metadata Pages Queued to Disk.
`MaxLoggedPagesQueuedToDisk` UInt64	[Volume Periodic Cache Information] Maximum Metadata Pages Queued to Disk.
`LoggedPagesQueuedToDiskSamples` UInt64	[Volume Periodic Cache Information] Metadata Pages Queued to Disk Samples.
`ReadTotalBytes` UInt64	[Volume Periodic Cache Information] Read Total Bytes.
`ReadPagedInTotalBytes` UInt64	[Volume Periodic Cache Information] Read Paged-In Total Bytes.
`ReadAheadTotalBytes` UInt64	[Volume Periodic Cache Information] Read-Ahead Total Bytes.
`CacheHitRatio` UInt64	[Volume Periodic Cache Information] ).
`TotalWrites` UInt64	[Volume Periodic Cache Information] Total Writes.
`TotalHardThrottleWrites` UInt64	[Volume Periodic Cache Information] Total Hard-Throttle Writes.
`TotalSoftThrottleWrites` UInt64	[Volume Periodic Cache Information] Total Soft-Throttle Writes.
`TotalSynchronousReadIoCount` UInt64	[Volume Periodic Cache Information] Total Synchronous Read IO Count.
`TotalSynchronousNonBlockingReadIoCount` UInt64	[Volume Periodic Cache Information] Total Synchronous Non-Blocking Read IO Count.
`TotalFailedSynchronousNonBlockingReadIoCount` UInt64	[Volume Periodic Cache Information] Total Failed Synchronous Non-Blocking Read IO Count.
`SynchronousReadIoMaxLatency` UInt64	[Volume Periodic Cache Information] Synchronous Read IO Maximum Latency (us).
`SynchronousReadIoNonBlockingMaxLatency` UInt64	[Volume Periodic Cache Information] Synchronous Read IO Non-Blocking Maximum Latency (us).
`TotalSynchronousWriteIoCount` UInt64	[Volume Periodic Cache Information] Total Synchronous Write IO Count.
`TotalSynchronousNonBlockingWriteIoCount` UInt64	[Volume Periodic Cache Information] Total Synchronous Non-Blocking Write IO Count.
`TotalFailedSynchronousNonBlockingWriteIoCount` UInt64	[Volume Periodic Cache Information] Total Failed Synchronous Non-Blocking Write IO Count.
`SynchronousWriteIoMaxLatency` UInt64	[Volume Periodic Cache Information] Synchronous Write IO Maximum Latency (us).
`SynchronousWriteIoNonBlockingMaxLatency` UInt64	[Volume Periodic Cache Information] Synchronous Write IO Non-Blockinig Maximum Latency (us).
`TotalAsynchronousReadIoCount` UInt64	[Volume Periodic Cache Information] Total Asynchronous Read IO Count.
`AsynchronousReadIoMaxLatency` UInt64	[Volume Periodic Cache Information] Asynchronous Read IO Maximum Latency (us).
`TotalDirtyPageThreshold` UInt64	[Volume Periodic Cache Information] Total Dirty Page Threshold.
`TopDirtyPageThreshold` UInt64	[Volume Periodic Cache Information] Top Dirty Page Threshold.
`BottomDirtyPageThreshold` UInt64	[Volume Periodic Cache Information] Bottom Dirty Page Threshold.
`LazyWriterCalls` UInt64	[Volume Periodic Cache Information] Total Lazy Writer Calls.
`TotalLazyWriterLatency` UInt64	[Volume Periodic Cache Information] Total Lazy Writer Latency.
`TotalLazyWriterPagesFlushed` UInt64	[Volume Periodic Cache Information] Total Lazy Writer Pages Flushed.
`LazyWriterAvgPagesPerSecond` UInt64	[Volume Periodic Cache Information] Lazy Writer Average Pages Per Second.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Cache",
    "guid": "{A2D34BF1-70AB-5B21-C819-5A0DD42748FD}",
    "event_source_name": "",
    "event_id": 103,
    "version": 1,
    "level": 4,
    "task": 103,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:47:11.6225164+00:00",
    "event_record_id": 313,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 32
    },
    "channel": "Microsoft-Windows-Kernel-Cache/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VolumeDeviceGuid": "{77ac4d73-0000-0000-0000-100000000000}",
    "PeriodDurationMicroSec": "3650315834",
    "TotalDirtyPages": "16083804",
    "MaxDirtyPages": "1556",
    "DirtyPageSamples": "35105",
    "TotalPagesQueuedToDisk": "852840",
    "MaxPagesQueuedToDisk": "259",
    "PagesQueuedToDiskSamples": "14112",
    "TotalLoggedPagesQueuedToDisk": "57163",
    "MaxLoggedPagesQueuedToDisk": "49",
    "LoggedPagesQueuedToDiskSamples": "14116",
    "ReadTotalBytes": "6897723924",
    "ReadPagedInTotalBytes": "0",
    "ReadAheadTotalBytes": "0",
    "CacheHitRatio": "100",
    "TotalWrites": "13719",
    "TotalHardThrottleWrites": "0",
    "TotalSoftThrottleWrites": "0",
    "TotalSynchronousReadIoCount": "27311",
    "TotalSynchronousNonBlockingReadIoCount": "169",
    "TotalFailedSynchronousNonBlockingReadIoCount": "0",
    "SynchronousReadIoMaxLatency": "0",
    "SynchronousReadIoNonBlockingMaxLatency": "0",
    "TotalSynchronousWriteIoCount": "13257",
    "TotalSynchronousNonBlockingWriteIoCount": "831",
    "TotalFailedSynchronousNonBlockingWriteIoCount": "0",
    "SynchronousWriteIoMaxLatency": "25156",
    "SynchronousWriteIoNonBlockingMaxLatency": "0",
    "TotalAsynchronousReadIoCount": "0",
    "AsynchronousReadIoMaxLatency": "0"
  },
  "message": "Volume Periodic Cache Information:\r\n\r\n                       Device GUID: {77ac4d73-0000-0000-0000-100000000000}\r\n                       Period Duration (microseconds): 3650315834\r\n                       Total Dirty Pages: 16083804\r\n                       Maximum Dirty Pages: 1556\r\n                       Dirty Page Samples: 35105\r\n                       Total Pages Queued to Disk: 852840\r\n                       Maximum Pages Queued to Disk: 259\r\n                       Pages Queued to Disk Samples: 14112\r\n                       Total Metadata Pages Queued to Disk: 57163\r\n                       Maximum Metadata Pages Queued to Disk: 49\r\n                       Metadata Pages Queued to Disk Samples: 14116\r\n                       Read Total Bytes: 6897723924\r\n                       Read Paged-In Total Bytes: 0\r\n                       Read-Ahead Total Bytes: 0\r\n                       Cache Hit Ratio (%): 100\r\n                       Total Writes: 13719\r\n                       Total Hard-Throttle Writes: 0\r\n                       Total Soft-Throttle Writes: 0\r\n                       Total Synchronous Read IO Count: 27311\r\n                       Total Synchronous Non-Blocking Read IO Count: 169\r\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\r\n                       Synchronous Read IO Maximum Latency (us): 0\r\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\r\n                       Total Synchronous Write IO Count: 13257\r\n                       Total Synchronous Non-Blocking Write IO Count: 831\r\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\r\n                       Synchronous Write IO Maximum Latency (us): 25156\r\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\r\n                       Total Asynchronous Read IO Count: 0\r\n                       Asynchronous Read IO Maximum Latency (us): 0"
}

Event ID 104: Volume Periodic Cache Read Latency Information.

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: Informational
Task: CacheVolumeReadLatencies

Description

Volume Periodic Cache Read Latency Information.

Message #

Volume Periodic Cache Read Latency Information:

                       Device GUID: %1
                       Period Duration (microseconds): %2

                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]

                       Synchronous Read IO Counts: [%3, %4, %5, %6, %7, %8, %9, %10, %11, %12, %13, %14]
                       Synchronous Read IO Total Latencies (us): [%15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
                       Synchronous Read Non-Blocking IO Counts: [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38]
                       Synchronous Read Non-Blocking IO Total Latencies (us): [%39, %40, %41, %42, %43, %44, %45, %46, %47, %48, %49, %50]
                       Asynchronous Read IO Counts: [%51, %52, %53, %54, %55, %56, %57, %58, %59, %60, %61, %62]
                       Asynchronous Read IO Total Latencies (us): [%63, %64, %65, %66, %67, %68, %69, %70, %71, %72, %73, %74]

Fields #

Name	Description
`VolumeDeviceGuid` GUID	[Volume Periodic Cache Read Latency Information] Device GUID.
`PeriodDurationMicroSec` UInt64	[Volume Periodic Cache Read Latency Information] Period Duration (microseconds).
`SynchronousReadIoCountsBucket1` UInt64
`SynchronousReadIoCountsBucket2` UInt64
`SynchronousReadIoCountsBucket3` UInt64
`SynchronousReadIoCountsBucket4` UInt64
`SynchronousReadIoCountsBucket5` UInt64
`SynchronousReadIoCountsBucket6` UInt64
`SynchronousReadIoCountsBucket7` UInt64
`SynchronousReadIoCountsBucket8` UInt64
`SynchronousReadIoCountsBucket9` UInt64
`SynchronousReadIoCountsBucket10` UInt64
`SynchronousReadIoCountsBucket11` UInt64
`SynchronousReadIoCountsBucket12` UInt64
`SynchronousReadTotalLatencyBucket1` UInt64
`SynchronousReadTotalLatencyBucket2` UInt64
`SynchronousReadTotalLatencyBucket3` UInt64
`SynchronousReadTotalLatencyBucket4` UInt64
`SynchronousReadTotalLatencyBucket5` UInt64
`SynchronousReadTotalLatencyBucket6` UInt64
`SynchronousReadTotalLatencyBucket7` UInt64
`SynchronousReadTotalLatencyBucket8` UInt64
`SynchronousReadTotalLatencyBucket9` UInt64
`SynchronousReadTotalLatencyBucket10` UInt64
`SynchronousReadTotalLatencyBucket11` UInt64
`SynchronousReadTotalLatencyBucket12` UInt64
`SynchronousReadNonBlockingIoCountsBucket1` UInt64
`SynchronousReadNonBlockingIoCountsBucket2` UInt64
`SynchronousReadNonBlockingIoCountsBucket3` UInt64
`SynchronousReadNonBlockingIoCountsBucket4` UInt64
`SynchronousReadNonBlockingIoCountsBucket5` UInt64
`SynchronousReadNonBlockingIoCountsBucket6` UInt64
`SynchronousReadNonBlockingIoCountsBucket7` UInt64
`SynchronousReadNonBlockingIoCountsBucket8` UInt64
`SynchronousReadNonBlockingIoCountsBucket9` UInt64
`SynchronousReadNonBlockingIoCountsBucket10` UInt64
`SynchronousReadNonBlockingIoCountsBucket11` UInt64
`SynchronousReadNonBlockingIoCountsBucket12` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket1` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket2` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket3` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket4` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket5` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket6` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket7` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket8` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket9` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket10` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket11` UInt64
`SynchronousReadNonBlockingTotalLatencyBucket12` UInt64
`AsynchronousReadIoCountsBucket1` UInt64
`AsynchronousReadIoCountsBucket2` UInt64
`AsynchronousReadIoCountsBucket3` UInt64
`AsynchronousReadIoCountsBucket4` UInt64
`AsynchronousReadIoCountsBucket5` UInt64
`AsynchronousReadIoCountsBucket6` UInt64
`AsynchronousReadIoCountsBucket7` UInt64
`AsynchronousReadIoCountsBucket8` UInt64
`AsynchronousReadIoCountsBucket9` UInt64
`AsynchronousReadIoCountsBucket10` UInt64
`AsynchronousReadIoCountsBucket11` UInt64
`AsynchronousReadIoCountsBucket12` UInt64
`AsynchronousReadTotalLatencyBucket1` UInt64
`AsynchronousReadTotalLatencyBucket2` UInt64
`AsynchronousReadTotalLatencyBucket3` UInt64
`AsynchronousReadTotalLatencyBucket4` UInt64
`AsynchronousReadTotalLatencyBucket5` UInt64
`AsynchronousReadTotalLatencyBucket6` UInt64
`AsynchronousReadTotalLatencyBucket7` UInt64
`AsynchronousReadTotalLatencyBucket8` UInt64
`AsynchronousReadTotalLatencyBucket9` UInt64
`AsynchronousReadTotalLatencyBucket10` UInt64
`AsynchronousReadTotalLatencyBucket11` UInt64
`AsynchronousReadTotalLatencyBucket12` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Cache",
    "guid": "{A2D34BF1-70AB-5B21-C819-5A0DD42748FD}",
    "event_source_name": "",
    "event_id": 104,
    "version": 1,
    "level": 4,
    "task": 104,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:47:11.6225183+00:00",
    "event_record_id": 314,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 32
    },
    "channel": "Microsoft-Windows-Kernel-Cache/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VolumeDeviceGuid": "{77ac4d73-0000-0000-0000-100000000000}",
    "PeriodDurationMicroSec": "3650315834",
    "SynchronousReadIoCountsBucket1": "27311",
    "SynchronousReadIoCountsBucket2": "0",
    "SynchronousReadIoCountsBucket3": "0",
    "SynchronousReadIoCountsBucket4": "0",
    "SynchronousReadIoCountsBucket5": "0",
    "SynchronousReadIoCountsBucket6": "0",
    "SynchronousReadIoCountsBucket7": "0",
    "SynchronousReadIoCountsBucket8": "0",
    "SynchronousReadIoCountsBucket9": "0",
    "SynchronousReadIoCountsBucket10": "0",
    "SynchronousReadIoCountsBucket11": "0",
    "SynchronousReadIoCountsBucket12": "0",
    "SynchronousReadTotalLatencyBucket1": "0",
    "SynchronousReadTotalLatencyBucket2": "0",
    "SynchronousReadTotalLatencyBucket3": "0",
    "SynchronousReadTotalLatencyBucket4": "0",
    "SynchronousReadTotalLatencyBucket5": "0",
    "SynchronousReadTotalLatencyBucket6": "0",
    "SynchronousReadTotalLatencyBucket7": "0",
    "SynchronousReadTotalLatencyBucket8": "0",
    "SynchronousReadTotalLatencyBucket9": "0",
    "SynchronousReadTotalLatencyBucket10": "0",
    "SynchronousReadTotalLatencyBucket11": "0",
    "SynchronousReadTotalLatencyBucket12": "0",
    "SynchronousReadNonBlockingIoCountsBucket1": "169",
    "SynchronousReadNonBlockingIoCountsBucket2": "0",
    "SynchronousReadNonBlockingIoCountsBucket3": "0",
    "SynchronousReadNonBlockingIoCountsBucket4": "0",
    "SynchronousReadNonBlockingIoCountsBucket5": "0",
    "SynchronousReadNonBlockingIoCountsBucket6": "0",
    "SynchronousReadNonBlockingIoCountsBucket7": "0",
    "SynchronousReadNonBlockingIoCountsBucket8": "0",
    "SynchronousReadNonBlockingIoCountsBucket9": "0",
    "SynchronousReadNonBlockingIoCountsBucket10": "0",
    "SynchronousReadNonBlockingIoCountsBucket11": "0",
    "SynchronousReadNonBlockingIoCountsBucket12": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket1": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket2": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket3": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket4": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket5": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket6": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket7": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket8": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket9": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket10": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket11": "0",
    "SynchronousReadNonBlockingTotalLatencyBucket12": "0",
    "AsynchronousReadIoCountsBucket1": "0",
    "AsynchronousReadIoCountsBucket2": "0",
    "AsynchronousReadIoCountsBucket3": "0",
    "AsynchronousReadIoCountsBucket4": "0",
    "AsynchronousReadIoCountsBucket5": "0",
    "AsynchronousReadIoCountsBucket6": "0",
    "AsynchronousReadIoCountsBucket7": "0",
    "AsynchronousReadIoCountsBucket8": "0",
    "AsynchronousReadIoCountsBucket9": "0",
    "AsynchronousReadIoCountsBucket10": "0",
    "AsynchronousReadIoCountsBucket11": "0",
    "AsynchronousReadIoCountsBucket12": "0",
    "AsynchronousReadTotalLatencyBucket1": "0",
    "AsynchronousReadTotalLatencyBucket2": "0",
    "AsynchronousReadTotalLatencyBucket3": "0",
    "AsynchronousReadTotalLatencyBucket4": "0",
    "AsynchronousReadTotalLatencyBucket5": "0",
    "AsynchronousReadTotalLatencyBucket6": "0",
    "AsynchronousReadTotalLatencyBucket7": "0",
    "AsynchronousReadTotalLatencyBucket8": "0",
    "AsynchronousReadTotalLatencyBucket9": "0",
    "AsynchronousReadTotalLatencyBucket10": "0",
    "AsynchronousReadTotalLatencyBucket11": "0",
    "AsynchronousReadTotalLatencyBucket12": "0"
  },
  "message": "Volume Periodic Cache Read Latency Information:\r\n\r\n                       Device GUID: {77ac4d73-0000-0000-0000-100000000000}\r\n                       Period Duration (microseconds): 3650315834\r\n\r\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\r\n\r\n                       Synchronous Read IO Counts: [27311, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\r\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\r\n                       Synchronous Read Non-Blocking IO Counts: [169, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\r\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\r\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\r\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]"
}

Event ID 105: Volume Periodic Cache Write Latency Information.

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: Informational
Task: CacheVolumeWriteLatencies

Description

Volume Periodic Cache Write Latency Information.

Message #

Volume Periodic Cache Write Latency Information:

                       Device GUID: %1
                       Period Duration (microseconds): %2

                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]

                       Synchronous Write IO Counts: [%3, %4, %5, %6, %7, %8, %9, %10, %11, %12, %13, %14]
                       Synchronous Write IO Total Latencies (us): [%15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
                       Synchronous Write Non-Blocking IO Counts: [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38]
                       Synchronous Write Non-Blocking IO Total Latencies (us): [%39, %40, %41, %42, %43, %44, %45, %46, %47, %48, %49, %50]

Fields #

Name	Description
`VolumeDeviceGuid` GUID	[Volume Periodic Cache Write Latency Information] Device GUID.
`PeriodDurationMicroSec` UInt64	[Volume Periodic Cache Write Latency Information] Period Duration (microseconds).
`SynchronousWriteIoCountsBucket1` UInt64
`SynchronousWriteIoCountsBucket2` UInt64
`SynchronousWriteIoCountsBucket3` UInt64
`SynchronousWriteIoCountsBucket4` UInt64
`SynchronousWriteIoCountsBucket5` UInt64
`SynchronousWriteIoCountsBucket6` UInt64
`SynchronousWriteIoCountsBucket7` UInt64
`SynchronousWriteIoCountsBucket8` UInt64
`SynchronousWriteIoCountsBucket9` UInt64
`SynchronousWriteIoCountsBucket10` UInt64
`SynchronousWriteIoCountsBucket11` UInt64
`SynchronousWriteIoCountsBucket12` UInt64
`SynchronousWriteTotalLatencyBucket1` UInt64
`SynchronousWriteTotalLatencyBucket2` UInt64
`SynchronousWriteTotalLatencyBucket3` UInt64
`SynchronousWriteTotalLatencyBucket4` UInt64
`SynchronousWriteTotalLatencyBucket5` UInt64
`SynchronousWriteTotalLatencyBucket6` UInt64
`SynchronousWriteTotalLatencyBucket7` UInt64
`SynchronousWriteTotalLatencyBucket8` UInt64
`SynchronousWriteTotalLatencyBucket9` UInt64
`SynchronousWriteTotalLatencyBucket10` UInt64
`SynchronousWriteTotalLatencyBucket11` UInt64
`SynchronousWriteTotalLatencyBucket12` UInt64
`SynchronousWriteNonBlockingIoCountsBucket1` UInt64
`SynchronousWriteNonBlockingIoCountsBucket2` UInt64
`SynchronousWriteNonBlockingIoCountsBucket3` UInt64
`SynchronousWriteNonBlockingIoCountsBucket4` UInt64
`SynchronousWriteNonBlockingIoCountsBucket5` UInt64
`SynchronousWriteNonBlockingIoCountsBucket6` UInt64
`SynchronousWriteNonBlockingIoCountsBucket7` UInt64
`SynchronousWriteNonBlockingIoCountsBucket8` UInt64
`SynchronousWriteNonBlockingIoCountsBucket9` UInt64
`SynchronousWriteNonBlockingIoCountsBucket10` UInt64
`SynchronousWriteNonBlockingIoCountsBucket11` UInt64
`SynchronousWriteNonBlockingIoCountsBucket12` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket1` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket2` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket3` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket4` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket5` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket6` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket7` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket8` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket9` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket10` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket11` UInt64
`SynchronousWriteNonBlockingTotalLatencyBucket12` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Cache",
    "guid": "{A2D34BF1-70AB-5B21-C819-5A0DD42748FD}",
    "event_source_name": "",
    "event_id": 105,
    "version": 1,
    "level": 4,
    "task": 105,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:47:11.6225197+00:00",
    "event_record_id": 315,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 32
    },
    "channel": "Microsoft-Windows-Kernel-Cache/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VolumeDeviceGuid": "{77ac4d73-0000-0000-0000-100000000000}",
    "PeriodDurationMicroSec": "3650315834",
    "SynchronousWriteIoCountsBucket1": "13137",
    "SynchronousWriteIoCountsBucket2": "57",
    "SynchronousWriteIoCountsBucket3": "55",
    "SynchronousWriteIoCountsBucket4": "6",
    "SynchronousWriteIoCountsBucket5": "2",
    "SynchronousWriteIoCountsBucket6": "0",
    "SynchronousWriteIoCountsBucket7": "0",
    "SynchronousWriteIoCountsBucket8": "0",
    "SynchronousWriteIoCountsBucket9": "0",
    "SynchronousWriteIoCountsBucket10": "0",
    "SynchronousWriteIoCountsBucket11": "0",
    "SynchronousWriteIoCountsBucket12": "0",
    "SynchronousWriteTotalLatencyBucket1": "12964",
    "SynchronousWriteTotalLatencyBucket2": "38178",
    "SynchronousWriteTotalLatencyBucket3": "94028",
    "SynchronousWriteTotalLatencyBucket4": "68787",
    "SynchronousWriteTotalLatencyBucket5": "41491",
    "SynchronousWriteTotalLatencyBucket6": "0",
    "SynchronousWriteTotalLatencyBucket7": "0",
    "SynchronousWriteTotalLatencyBucket8": "0",
    "SynchronousWriteTotalLatencyBucket9": "0",
    "SynchronousWriteTotalLatencyBucket10": "0",
    "SynchronousWriteTotalLatencyBucket11": "0",
    "SynchronousWriteTotalLatencyBucket12": "0",
    "SynchronousWriteNonBlockingIoCountsBucket1": "831",
    "SynchronousWriteNonBlockingIoCountsBucket2": "0",
    "SynchronousWriteNonBlockingIoCountsBucket3": "0",
    "SynchronousWriteNonBlockingIoCountsBucket4": "0",
    "SynchronousWriteNonBlockingIoCountsBucket5": "0",
    "SynchronousWriteNonBlockingIoCountsBucket6": "0",
    "SynchronousWriteNonBlockingIoCountsBucket7": "0",
    "SynchronousWriteNonBlockingIoCountsBucket8": "0",
    "SynchronousWriteNonBlockingIoCountsBucket9": "0",
    "SynchronousWriteNonBlockingIoCountsBucket10": "0",
    "SynchronousWriteNonBlockingIoCountsBucket11": "0",
    "SynchronousWriteNonBlockingIoCountsBucket12": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket1": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket2": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket3": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket4": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket5": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket6": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket7": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket8": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket9": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket10": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket11": "0",
    "SynchronousWriteNonBlockingTotalLatencyBucket12": "0"
  },
  "message": "Volume Periodic Cache Write Latency Information:\r\n\r\n                       Device GUID: {77ac4d73-0000-0000-0000-100000000000}\r\n                       Period Duration (microseconds): 3650315834\r\n\r\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\r\n\r\n                       Synchronous Write IO Counts: [13137, 57, 55, 6, 2, 0, 0, 0, 0, 0, 0, 0]\r\n                       Synchronous Write IO Total Latencies (us): [12964, 38178, 94028, 68787, 41491, 0, 0, 0, 0, 0, 0, 0]\r\n                       Synchronous Write Non-Blocking IO Counts: [831, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\r\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]"
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID a2d34bf1-70ab-5b21-c819-5a0dd42748fd

Defined in microsoft-windows-kernel-cc-events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-Kernel-Cache

Event ID 101: Initialized VolumeCacheMap for device guid: VolumeDeviceGuid.

Description

Message #

Fields #

Example Event #

Event ID 102: Global Periodic Cache Information.

Description

Message #

Fields #

Example Event #

Event ID 103: Volume Periodic Cache Information.

Description

Message #

Fields #

Example Event #

Event ID 104: Volume Periodic Cache Read Latency Information.

Description

Message #

Fields #

Example Event #

Event ID 105: Volume Periodic Cache Write Latency Information.

Description

Message #

Fields #

Example Event #

Provenance

Downloads

Keyboard shortcuts

Search operators