Microsoft-Windows-PerfDisk

12 events across 2 channels

Event	Title	Channel	Sample
1000	Unable to open the Disk performance object (Win32 error code NTSTATUS).	Application	N
1001	The attempt to collect Disk Performance data failed because the DLL did not open …	Operational	N
1002	Unable to allocate a dynamic memory buffer.	Application	N
1003	Only one thread at a time can call the performance data collection function.	Application	N
2000	Unable to read the Logical Volume information (Win32 error code Win32 Error).	Application	N
2001	Unable to read performance data for the Disk performance counters (Win32 error …	Application	N
2147484648	Unable to open the Disk performance object.	Operational	N
2147485648	Unable to read the Logical Volume information.	Operational	N
2147485649	Unable to read performance data for the Disk performance counters.	Operational	N
3221226473	The attempt to collect Disk Performance data failed because the DLL did not open …	Operational	N
3221226474	Unable to allocate a dynamic memory buffer.	Operational	N
3221226475	Only one thread at a time can call the performance data collection function.	Operational	N

Event ID 1000: Unable to open the Disk performance object (Win32 error code NTSTATUS).

Provider: Microsoft-Windows-PerfDisk
Channel: Application

Description

Unable to open the Disk performance object (Win32 error code NTSTATUS).

Message #

Unable to open the Disk performance object (Win32 error code %1).

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 1001: The attempt to collect Disk Performance data failed because the DLL did not open successfully

Provider: Microsoft-Windows-PerfDisk
Channel: Operational

Event ID 1002: Unable to allocate a dynamic memory buffer.

Provider: Microsoft-Windows-PerfDisk
Channel: Application

Description

Unable to allocate a dynamic memory buffer.

Message #

Unable to allocate a dynamic memory buffer.

Event ID 1003: Only one thread at a time can call the performance data collection function.

Provider: Microsoft-Windows-PerfDisk
Channel: Application

Description

Only one thread at a time can call the performance data collection function. A second thread attempted to call the collection function while it was in use by another thread.

Message #

Only one thread at a time can call the performance data collection function. A second thread attempted to call the collection function while it was in use by another thread.

Event ID 2000: Unable to read the Logical Volume information (Win32 error code Win32 Error).

Provider: Microsoft-Windows-PerfDisk
Channel: Application

Description

Unable to read the Logical Volume information (Win32 error code Win32 Error).

Message #

Unable to read the Logical Volume information (Win32 error code %1).

Fields #

Name	Description
`Win32Error` UInt32

Event ID 2001: Unable to read performance data for the Disk performance counters (Win32 error code Win32 Error).

Provider: Microsoft-Windows-PerfDisk
Channel: Application

Description

Unable to read performance data for the Disk performance counters (Win32 error code Win32 Error).

Message #

Unable to read performance data for the Disk performance counters (Win32 error code %1).

Fields #

Name	Description
`Win32Error` UInt32

Event ID 2147484648: Unable to open the Disk performance object.

Provider: Microsoft-Windows-PerfDisk
Channel: Operational

Description

Unable to open the Disk performance object. The first four bytes (DWORD) of the Data section of the event viewer contains the status code.

Message #

Unable to open the Disk performance object. The first four bytes (DWORD) of the Data section of the event viewer contains the status code.

Event ID 2147485648: Unable to read the Logical Volume information.

Provider: Microsoft-Windows-PerfDisk
Channel: Operational

Description

Unable to read the Logical Volume information. The first four bytes (DWORD) of the Data section of the event viewer contains the status code.

Message #

Unable to read the Logical Volume information. The first four bytes (DWORD) of the Data section of the event viewer contains the status code.

Event ID 2147485649: Unable to read performance data for the Disk performance counters.

Provider: Microsoft-Windows-PerfDisk
Channel: Operational

Description

Unable to read performance data for the Disk performance counters.

Message #

Unable to read performance data for the Disk performance counters.

Event ID 3221226473: The attempt to collect Disk Performance data failed because the DLL did not open successfully.

Provider: Microsoft-Windows-PerfDisk
Channel: Operational

Description

The attempt to collect Disk Performance data failed because the DLL did not open successfully.

Message #

The attempt to collect Disk Performance data failed because the DLL did not open successfully.

Event ID 3221226474: Unable to allocate a dynamic memory buffer.

Provider: Microsoft-Windows-PerfDisk
Channel: Operational

Description

Unable to allocate a dynamic memory buffer.

Message #

Unable to allocate a dynamic memory buffer.

Event ID 3221226475: Only one thread at a time can call the performance data collection function.

Provider: Microsoft-Windows-PerfDisk
Channel: Operational

Description

Only one thread at a time can call the performance data collection function. A second thread attempted to call the collection function while it was in use by another thread.

Message #

Only one thread at a time can call the performance data collection function. A second thread attempted to call the collection function while it was in use by another thread.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 7f9d83de-8abb-457f-98e8-4ad161449ecc

Defined in perfdisk.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-PerfDisk

Event ID 1000: Unable to open the Disk performance object (Win32 error code NTSTATUS).

Description

Message #

Fields #

Event ID 1001: The attempt to collect Disk Performance data failed because the DLL did not open successfully

Event ID 1002: Unable to allocate a dynamic memory buffer.

Description

Message #

Event ID 1003: Only one thread at a time can call the performance data collection function.

Description

Message #

Event ID 2000: Unable to read the Logical Volume information (Win32 error code Win32 Error).

Description

Message #

Fields #

Event ID 2001: Unable to read performance data for the Disk performance counters (Win32 error code Win32 Error).

Description

Message #

Fields #

Event ID 2147484648: Unable to open the Disk performance object.

Description

Message #

Event ID 2147485648: Unable to read the Logical Volume information.

Description

Message #

Event ID 2147485649: Unable to read performance data for the Disk performance counters.

Description

Message #

Event ID 3221226473: The attempt to collect Disk Performance data failed because the DLL did not open successfully.

Description

Message #

Event ID 3221226474: Unable to allocate a dynamic memory buffer.

Description

Message #

Event ID 3221226475: Only one thread at a time can call the performance data collection function.

Description

Message #

Provenance

Downloads