Microsoft-Windows-Kernel-Interrupt-Steering
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | InterruptSteeringMaskRundown | Operational | N | N |
| 2 | InterruptSteeringMaskChange | Operational | N | N |
| 3 | InterruptSteeringStateRundown | Operational | N | N |
| 4 | InterruptSteeringStateConnect | Operational | N | N |
| 5 | InterruptSteeringStateDisconnect | Operational | N | N |
| 6 | InterruptSteeringStateRetarget | Operational | N | N |
| 7 | InterruptSteeringProcRundown | Operational | N | N |
| 8 | InterruptSteeringProcChange | Operational | N | N |
Event ID 1: InterruptSteeringMaskRundown
#Fields #
| Name | Description |
|---|---|
LoadPercent UInt32 | Idle power management features on processor |
GsivCount UInt32 | |
MaskCount UInt32 | |
GroupCount UInt16 | |
Mask Pointer |
Event ID 2: InterruptSteeringMaskChange
#Fields #
| Name | Description |
|---|---|
LoadPercent UInt32 | Performance power management features on processor |
GsivCount UInt32 | |
MaskCount UInt32 | |
GroupCount UInt16 | |
Mask Pointer |
Event ID 3: InterruptSteeringStateRundown
#Fields #
| Name | Description |
|---|---|
Gsiv UInt32 | Throttle power management features on processor |
Group UInt16 | |
NewTarget Pointer | |
OldTarget Pointer | |
Vector UInt32 | |
ServiceRoutine Pointer | |
IsrLoad UInt64 | |
DpcLoad UInt64 |
Event ID 4: InterruptSteeringStateConnect
#Fields #
| Name | Description |
|---|---|
Gsiv UInt32 | Processor |
Group UInt16 | |
NewTarget Pointer | |
OldTarget Pointer | |
Vector UInt32 | |
ServiceRoutine Pointer | |
IsrLoad UInt64 | |
DpcLoad UInt64 |
Event ID 5: InterruptSteeringStateDisconnect
#Fields #
| Name | Description |
|---|---|
Gsiv UInt32 | |
Group UInt16 | |
NewTarget Pointer | |
OldTarget Pointer | |
Vector UInt32 | |
ServiceRoutine Pointer | |
IsrLoad UInt64 | |
DpcLoad UInt64 |
Event ID 6: InterruptSteeringStateRetarget
#Fields #
| Name | Description |
|---|---|
Gsiv UInt32 | |
Group UInt16 | |
NewTarget Pointer | |
OldTarget Pointer | |
Vector UInt32 | |
ServiceRoutine Pointer | |
IsrLoad UInt64 | |
DpcLoad UInt64 |
Provenance
ETW provider GUID 951b41ea-c830-44dc-a671-e2c9958809b8
Defined in microsoft-windows-kernel-processor-power-events.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB