Microsoft-Windows-PerfOS

41 events across 2 channels

Event	Title	Channel	Sample
1000	Unable to open one of the Windows operating system performance counter objects.	Application	N
1001	Unable to collect operating system performance data because one of the system …	Application	N
2000	Unable to collect Processor performance data.	Application	N
2001	Unable to collect Interrupt performance data.	Application	N
2002	Unable to collect File Cache performance data.	Application	N
2003	Unable to collect Process performance data.	Application	N
2004	Unable to collect Thread performance data.	Application	N
2005	Unable to collect Event performance data.	Application	N
2006	Unable to collect Semaphore performance data.	Application	N
2007	%	Operational	N
2008	Unable to collect Section performance data.	Application	N
2009	Unable to get system configuration information.	Application	N
2010	Unable to collect System performance data.	Application	N
2011	Unable to collect System Pagefile performance data.	Application	N
2012	Unable to collect System Process performance data.	Application	N
2013	Unable to collect System Exception performance data.	Application	N
2014	Unable to collect Registry Quota performance data.	Application	N
2015	Unable to collect System time information.	Application	N
2016	Unable to collect System Processor Idle performance data.	Application	N
2017	Unable to collect NUMA physical memory utilization data.	Application	N
8199	Unable to collect Mutex performance data.	Application	N
2147485648	Unable to collect Processor performance data.	Operational	N
2147485649	Unable to collect Interrupt performance data.	Operational	N
2147485650	Unable to collect File Cache performance data.	Operational	N
2147485651	Unable to collect Process performance data.	Operational	N
2147485652	Unable to collect Thread performance data.	Operational	N
2147485653	Unable to collect Event performance data.	Operational	N
2147485654	Unable to collect Semaphore performance data.	Operational	N
2147485655	param2007.	Operational	N
2147485656	Unable to collect Section performance data.	Operational	N
2147485658	Unable to collect System performance data.	Operational	N
2147485659	Unable to collect System Pagefile performance data.	Operational	N
2147485660	Unable to collect System Process performance data.	Operational	N
2147485661	Unable to collect System Exception performance data.	Operational	N
2147485662	Unable to collect Registry Quota performance data.	Operational	N
2147485663	Unable to collect System time information.	Operational	N
2147485664	Unable to collect System Processor Idle performance data.	Operational	N
2147485665	Unable to collect NUMA physical memory utilization data.	Operational	N
3221226472	Unable to open one of the Windows operating system performance counter objects.	Operational	N
3221226473	Unable to collect operating system performance data because one of the system …	Operational	N
3221227481	Unable to get system configuration information.	Operational	N

Event ID 1000: Unable to open one of the Windows operating system performance counter objects.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to open one of the Windows operating system performance counter objects. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to open one of the Windows operating system performance counter objects. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`Win32Error` UInt32

Event ID 1001: Unable to collect operating system performance data because one of the system performance counter objects failed to open.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect operating system performance data because one of the system performance counter objects failed to open.

Message #

Unable to collect operating system performance data because one of the system performance counter objects failed to open.

Event ID 2000: Unable to collect Processor performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Processor performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Processor performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2001: Unable to collect Interrupt performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Interrupt performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Interrupt performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2002: Unable to collect File Cache performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect File Cache performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect File Cache performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2003: Unable to collect Process performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Process performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Process performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2004: Unable to collect Thread performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Thread performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Thread performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2005: Unable to collect Event performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Event performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Event performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2006: Unable to collect Semaphore performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Semaphore performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Semaphore performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2007: %

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Event ID 2008: Unable to collect Section performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Section performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Section performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2009: Unable to get system configuration information.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to get system configuration information. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to get system configuration information. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2010: Unable to collect System performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect System performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2011: Unable to collect System Pagefile performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect System Pagefile performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System Pagefile performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2012: Unable to collect System Process performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect System Process performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System Process performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2013: Unable to collect System Exception performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect System Exception performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System Exception performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2014: Unable to collect Registry Quota performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Registry Quota performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Registry Quota performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2015: Unable to collect System time information.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect System time information. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System time information. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2016: Unable to collect System Processor Idle performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect System Processor Idle performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System Processor Idle performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2017: Unable to collect NUMA physical memory utilization data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect NUMA physical memory utilization data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect NUMA physical memory utilization data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 8199: Unable to collect Mutex performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Application

Description

Unable to collect Mutex performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Mutex performance data. The first four bytes (DWORD) of the Data section contains the status code.

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 2147485648: Unable to collect Processor performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect Processor performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Processor performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485649: Unable to collect Interrupt performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect Interrupt performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Interrupt performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485650: Unable to collect File Cache performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect File Cache performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect File Cache performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485651: Unable to collect Process performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect Process performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Process performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485652: Unable to collect Thread performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect Thread performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Thread performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485653: Unable to collect Event performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect Event performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Event performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485654: Unable to collect Semaphore performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect Semaphore performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Semaphore performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485655: param2007.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

%2007

Message #

%%2007

Fields #

Name	Description
`param1`
`param2`
`param3`
`param4`
`param5`
`param6`
`param7`
`param8`
`param9`
`param10`
`param11`
`param12`
`param13`
`param14`
`param15`
`param16`
`param17`
`param18`
`param19`
`param20`
`param21`
`param22`
`param23`
`param24`
`param25`
`param26`
`param27`
`param28`
`param29`
`param30`
`param31`
`param32`
`param33`
`param34`
`param35`
`param36`
`param37`
`param38`
`param39`
`param40`
`param41`
`param42`
`param43`
`param44`
`param45`
`param46`
`param47`
`param48`
`param49`
`param50`
`param51`
`param52`
`param53`
`param54`
`param55`
`param56`
`param57`
`param58`
`param59`
`param60`
`param61`
`param62`
`param63`
`param64`
`param65`
`param66`
`param67`
`param68`
`param69`
`param70`
`param71`
`param72`
`param73`
`param74`
`param75`
`param76`
`param77`
`param78`
`param79`
`param80`
`param81`
`param82`
`param83`
`param84`
`param85`
`param86`
`param87`
`param88`
`param89`
`param90`
`param91`
`param92`
`param93`
`param94`
`param95`
`param96`
`param97`
`param98`
`param99`
`param100`
`param101`
`param102`
`param103`
`param104`
`param105`
`param106`
`param107`
`param108`
`param109`
`param110`
`param111`
`param112`
`param113`
`param114`
`param115`
`param116`
`param117`
`param118`
`param119`
`param120`
`param121`
`param122`
`param123`
`param124`
`param125`
`param126`
`param127`
`param128`
`param129`
`param130`
`param131`
`param132`
`param133`
`param134`
`param135`
`param136`
`param137`
`param138`
`param139`
`param140`
`param141`
`param142`
`param143`
`param144`
`param145`
`param146`
`param147`
`param148`
`param149`
`param150`
`param151`
`param152`
`param153`
`param154`
`param155`
`param156`
`param157`
`param158`
`param159`
`param160`
`param161`
`param162`
`param163`
`param164`
`param165`
`param166`
`param167`
`param168`
`param169`
`param170`
`param171`
`param172`
`param173`
`param174`
`param175`
`param176`
`param177`
`param178`
`param179`
`param180`
`param181`
`param182`
`param183`
`param184`
`param185`
`param186`
`param187`
`param188`
`param189`
`param190`
`param191`
`param192`
`param193`
`param194`
`param195`
`param196`
`param197`
`param198`
`param199`
`param200`
`param201`
`param202`
`param203`
`param204`
`param205`
`param206`
`param207`
`param208`
`param209`
`param210`
`param211`
`param212`
`param213`
`param214`
`param215`
`param216`
`param217`
`param218`
`param219`
`param220`
`param221`
`param222`
`param223`
`param224`
`param225`
`param226`
`param227`
`param228`
`param229`
`param230`
`param231`
`param232`
`param233`
`param234`
`param235`
`param236`
`param237`
`param238`
`param239`
`param240`
`param241`
`param242`
`param243`
`param244`
`param245`
`param246`
`param247`
`param248`
`param249`
`param250`
`param251`
`param252`
`param253`
`param254`
`param255`
`param256`
`param257`
`param258`
`param259`
`param260`
`param261`
`param262`
`param263`
`param264`
`param265`
`param266`
`param267`
`param268`
`param269`
`param270`
`param271`
`param272`
`param273`
`param274`
`param275`
`param276`
`param277`
`param278`
`param279`
`param280`
`param281`
`param282`
`param283`
`param284`
`param285`
`param286`
`param287`
`param288`
`param289`
`param290`
`param291`
`param292`
`param293`
`param294`
`param295`
`param296`
`param297`
`param298`
`param299`
`param300`
`param301`
`param302`
`param303`
`param304`
`param305`
`param306`
`param307`
`param308`
`param309`
`param310`
`param311`
`param312`
`param313`
`param314`
`param315`
`param316`
`param317`
`param318`
`param319`
`param320`
`param321`
`param322`
`param323`
`param324`
`param325`
`param326`
`param327`
`param328`
`param329`
`param330`
`param331`
`param332`
`param333`
`param334`
`param335`
`param336`
`param337`
`param338`
`param339`
`param340`
`param341`
`param342`
`param343`
`param344`
`param345`
`param346`
`param347`
`param348`
`param349`
`param350`
`param351`
`param352`
`param353`
`param354`
`param355`
`param356`
`param357`
`param358`
`param359`
`param360`
`param361`
`param362`
`param363`
`param364`
`param365`
`param366`
`param367`
`param368`
`param369`
`param370`
`param371`
`param372`
`param373`
`param374`
`param375`
`param376`
`param377`
`param378`
`param379`
`param380`
`param381`
`param382`
`param383`
`param384`
`param385`
`param386`
`param387`
`param388`
`param389`
`param390`
`param391`
`param392`
`param393`
`param394`
`param395`
`param396`
`param397`
`param398`
`param399`
`param400`
`param401`
`param402`
`param403`
`param404`
`param405`
`param406`
`param407`
`param408`
`param409`
`param410`
`param411`
`param412`
`param413`
`param414`
`param415`
`param416`
`param417`
`param418`
`param419`
`param420`
`param421`
`param422`
`param423`
`param424`
`param425`
`param426`
`param427`
`param428`
`param429`
`param430`
`param431`
`param432`
`param433`
`param434`
`param435`
`param436`
`param437`
`param438`
`param439`
`param440`
`param441`
`param442`
`param443`
`param444`
`param445`
`param446`
`param447`
`param448`
`param449`
`param450`
`param451`
`param452`
`param453`
`param454`
`param455`
`param456`
`param457`
`param458`
`param459`
`param460`
`param461`
`param462`
`param463`
`param464`
`param465`
`param466`
`param467`
`param468`
`param469`
`param470`
`param471`
`param472`
`param473`
`param474`
`param475`
`param476`
`param477`
`param478`
`param479`
`param480`
`param481`
`param482`
`param483`
`param484`
`param485`
`param486`
`param487`
`param488`
`param489`
`param490`
`param491`
`param492`
`param493`
`param494`
`param495`
`param496`
`param497`
`param498`
`param499`
`param500`
`param501`
`param502`
`param503`
`param504`
`param505`
`param506`
`param507`
`param508`
`param509`
`param510`
`param511`
`param512`
`param513`
`param514`
`param515`
`param516`
`param517`
`param518`
`param519`
`param520`
`param521`
`param522`
`param523`
`param524`
`param525`
`param526`
`param527`
`param528`
`param529`
`param530`
`param531`
`param532`
`param533`
`param534`
`param535`
`param536`
`param537`
`param538`
`param539`
`param540`
`param541`
`param542`
`param543`
`param544`
`param545`
`param546`
`param547`
`param548`
`param549`
`param550`
`param551`
`param552`
`param553`
`param554`
`param555`
`param556`
`param557`
`param558`
`param559`
`param560`
`param561`
`param562`
`param563`
`param564`
`param565`
`param566`
`param567`
`param568`
`param569`
`param570`
`param571`
`param572`
`param573`
`param574`
`param575`
`param576`
`param577`
`param578`
`param579`
`param580`
`param581`
`param582`
`param583`
`param584`
`param585`
`param586`
`param587`
`param588`
`param589`
`param590`
`param591`
`param592`
`param593`
`param594`
`param595`
`param596`
`param597`
`param598`
`param599`
`param600`
`param601`
`param602`
`param603`
`param604`
`param605`
`param606`
`param607`
`param608`
`param609`
`param610`
`param611`
`param612`
`param613`
`param614`
`param615`
`param616`
`param617`
`param618`
`param619`
`param620`
`param621`
`param622`
`param623`
`param624`
`param625`
`param626`
`param627`
`param628`
`param629`
`param630`
`param631`
`param632`
`param633`
`param634`
`param635`
`param636`
`param637`
`param638`
`param639`
`param640`
`param641`
`param642`
`param643`
`param644`
`param645`
`param646`
`param647`
`param648`
`param649`
`param650`
`param651`
`param652`
`param653`
`param654`
`param655`
`param656`
`param657`
`param658`
`param659`
`param660`
`param661`
`param662`
`param663`
`param664`
`param665`
`param666`
`param667`
`param668`
`param669`
`param670`
`param671`
`param672`
`param673`
`param674`
`param675`
`param676`
`param677`
`param678`
`param679`
`param680`
`param681`
`param682`
`param683`
`param684`
`param685`
`param686`
`param687`
`param688`
`param689`
`param690`
`param691`
`param692`
`param693`
`param694`
`param695`
`param696`
`param697`
`param698`
`param699`
`param700`
`param701`
`param702`
`param703`
`param704`
`param705`
`param706`
`param707`
`param708`
`param709`
`param710`
`param711`
`param712`
`param713`
`param714`
`param715`
`param716`
`param717`
`param718`
`param719`
`param720`
`param721`
`param722`
`param723`
`param724`
`param725`
`param726`
`param727`
`param728`
`param729`
`param730`
`param731`
`param732`
`param733`
`param734`
`param735`
`param736`
`param737`
`param738`
`param739`
`param740`
`param741`
`param742`
`param743`
`param744`
`param745`
`param746`
`param747`
`param748`
`param749`
`param750`
`param751`
`param752`
`param753`
`param754`
`param755`
`param756`
`param757`
`param758`
`param759`
`param760`
`param761`
`param762`
`param763`
`param764`
`param765`
`param766`
`param767`
`param768`
`param769`
`param770`
`param771`
`param772`
`param773`
`param774`
`param775`
`param776`
`param777`
`param778`
`param779`
`param780`
`param781`
`param782`
`param783`
`param784`
`param785`
`param786`
`param787`
`param788`
`param789`
`param790`
`param791`
`param792`
`param793`
`param794`
`param795`
`param796`
`param797`
`param798`
`param799`
`param800`
`param801`
`param802`
`param803`
`param804`
`param805`
`param806`
`param807`
`param808`
`param809`
`param810`
`param811`
`param812`
`param813`
`param814`
`param815`
`param816`
`param817`
`param818`
`param819`
`param820`
`param821`
`param822`
`param823`
`param824`
`param825`
`param826`
`param827`
`param828`
`param829`
`param830`
`param831`
`param832`
`param833`
`param834`
`param835`
`param836`
`param837`
`param838`
`param839`
`param840`
`param841`
`param842`
`param843`
`param844`
`param845`
`param846`
`param847`
`param848`
`param849`
`param850`
`param851`
`param852`
`param853`
`param854`
`param855`
`param856`
`param857`
`param858`
`param859`
`param860`
`param861`
`param862`
`param863`
`param864`
`param865`
`param866`
`param867`
`param868`
`param869`
`param870`
`param871`
`param872`
`param873`
`param874`
`param875`
`param876`
`param877`
`param878`
`param879`
`param880`
`param881`
`param882`
`param883`
`param884`
`param885`
`param886`
`param887`
`param888`
`param889`
`param890`
`param891`
`param892`
`param893`
`param894`
`param895`
`param896`
`param897`
`param898`
`param899`
`param900`
`param901`
`param902`
`param903`
`param904`
`param905`
`param906`
`param907`
`param908`
`param909`
`param910`
`param911`
`param912`
`param913`
`param914`
`param915`
`param916`
`param917`
`param918`
`param919`
`param920`
`param921`
`param922`
`param923`
`param924`
`param925`
`param926`
`param927`
`param928`
`param929`
`param930`
`param931`
`param932`
`param933`
`param934`
`param935`
`param936`
`param937`
`param938`
`param939`
`param940`
`param941`
`param942`
`param943`
`param944`
`param945`
`param946`
`param947`
`param948`
`param949`
`param950`
`param951`
`param952`
`param953`
`param954`
`param955`
`param956`
`param957`
`param958`
`param959`
`param960`
`param961`
`param962`
`param963`
`param964`
`param965`
`param966`
`param967`
`param968`
`param969`
`param970`
`param971`
`param972`
`param973`
`param974`
`param975`
`param976`
`param977`
`param978`
`param979`
`param980`
`param981`
`param982`
`param983`
`param984`
`param985`
`param986`
`param987`
`param988`
`param989`
`param990`
`param991`
`param992`
`param993`
`param994`
`param995`
`param996`
`param997`
`param998`
`param999`
`param1000`
`param1001`
`param1002`
`param1003`
`param1004`
`param1005`
`param1006`
`param1007`
`param1008`
`param1009`
`param1010`
`param1011`
`param1012`
`param1013`
`param1014`
`param1015`
`param1016`
`param1017`
`param1018`
`param1019`
`param1020`
`param1021`
`param1022`
`param1023`
`param1024`
`param1025`
`param1026`
`param1027`
`param1028`
`param1029`
`param1030`
`param1031`
`param1032`
`param1033`
`param1034`
`param1035`
`param1036`
`param1037`
`param1038`
`param1039`
`param1040`
`param1041`
`param1042`
`param1043`
`param1044`
`param1045`
`param1046`
`param1047`
`param1048`
`param1049`
`param1050`
`param1051`
`param1052`
`param1053`
`param1054`
`param1055`
`param1056`
`param1057`
`param1058`
`param1059`
`param1060`
`param1061`
`param1062`
`param1063`
`param1064`
`param1065`
`param1066`
`param1067`
`param1068`
`param1069`
`param1070`
`param1071`
`param1072`
`param1073`
`param1074`
`param1075`
`param1076`
`param1077`
`param1078`
`param1079`
`param1080`
`param1081`
`param1082`
`param1083`
`param1084`
`param1085`
`param1086`
`param1087`
`param1088`
`param1089`
`param1090`
`param1091`
`param1092`
`param1093`
`param1094`
`param1095`
`param1096`
`param1097`
`param1098`
`param1099`
`param1100`
`param1101`
`param1102`
`param1103`
`param1104`
`param1105`
`param1106`
`param1107`
`param1108`
`param1109`
`param1110`
`param1111`
`param1112`
`param1113`
`param1114`
`param1115`
`param1116`
`param1117`
`param1118`
`param1119`
`param1120`
`param1121`
`param1122`
`param1123`
`param1124`
`param1125`
`param1126`
`param1127`
`param1128`
`param1129`
`param1130`
`param1131`
`param1132`
`param1133`
`param1134`
`param1135`
`param1136`
`param1137`
`param1138`
`param1139`
`param1140`
`param1141`
`param1142`
`param1143`
`param1144`
`param1145`
`param1146`
`param1147`
`param1148`
`param1149`
`param1150`
`param1151`
`param1152`
`param1153`
`param1154`
`param1155`
`param1156`
`param1157`
`param1158`
`param1159`
`param1160`
`param1161`
`param1162`
`param1163`
`param1164`
`param1165`
`param1166`
`param1167`
`param1168`
`param1169`
`param1170`
`param1171`
`param1172`
`param1173`
`param1174`
`param1175`
`param1176`
`param1177`
`param1178`
`param1179`
`param1180`
`param1181`
`param1182`
`param1183`
`param1184`
`param1185`
`param1186`
`param1187`
`param1188`
`param1189`
`param1190`
`param1191`
`param1192`
`param1193`
`param1194`
`param1195`
`param1196`
`param1197`
`param1198`
`param1199`
`param1200`
`param1201`
`param1202`
`param1203`
`param1204`
`param1205`
`param1206`
`param1207`
`param1208`
`param1209`
`param1210`
`param1211`
`param1212`
`param1213`
`param1214`
`param1215`
`param1216`
`param1217`
`param1218`
`param1219`
`param1220`
`param1221`
`param1222`
`param1223`
`param1224`
`param1225`
`param1226`
`param1227`
`param1228`
`param1229`
`param1230`
`param1231`
`param1232`
`param1233`
`param1234`
`param1235`
`param1236`
`param1237`
`param1238`
`param1239`
`param1240`
`param1241`
`param1242`
`param1243`
`param1244`
`param1245`
`param1246`
`param1247`
`param1248`
`param1249`
`param1250`
`param1251`
`param1252`
`param1253`
`param1254`
`param1255`
`param1256`
`param1257`
`param1258`
`param1259`
`param1260`
`param1261`
`param1262`
`param1263`
`param1264`
`param1265`
`param1266`
`param1267`
`param1268`
`param1269`
`param1270`
`param1271`
`param1272`
`param1273`
`param1274`
`param1275`
`param1276`
`param1277`
`param1278`
`param1279`
`param1280`
`param1281`
`param1282`
`param1283`
`param1284`
`param1285`
`param1286`
`param1287`
`param1288`
`param1289`
`param1290`
`param1291`
`param1292`
`param1293`
`param1294`
`param1295`
`param1296`
`param1297`
`param1298`
`param1299`
`param1300`
`param1301`
`param1302`
`param1303`
`param1304`
`param1305`
`param1306`
`param1307`
`param1308`
`param1309`
`param1310`
`param1311`
`param1312`
`param1313`
`param1314`
`param1315`
`param1316`
`param1317`
`param1318`
`param1319`
`param1320`
`param1321`
`param1322`
`param1323`
`param1324`
`param1325`
`param1326`
`param1327`
`param1328`
`param1329`
`param1330`
`param1331`
`param1332`
`param1333`
`param1334`
`param1335`
`param1336`
`param1337`
`param1338`
`param1339`
`param1340`
`param1341`
`param1342`
`param1343`
`param1344`
`param1345`
`param1346`
`param1347`
`param1348`
`param1349`
`param1350`
`param1351`
`param1352`
`param1353`
`param1354`
`param1355`
`param1356`
`param1357`
`param1358`
`param1359`
`param1360`
`param1361`
`param1362`
`param1363`
`param1364`
`param1365`
`param1366`
`param1367`
`param1368`
`param1369`
`param1370`
`param1371`
`param1372`
`param1373`
`param1374`
`param1375`
`param1376`
`param1377`
`param1378`
`param1379`
`param1380`
`param1381`
`param1382`
`param1383`
`param1384`
`param1385`
`param1386`
`param1387`
`param1388`
`param1389`
`param1390`
`param1391`
`param1392`
`param1393`
`param1394`
`param1395`
`param1396`
`param1397`
`param1398`
`param1399`
`param1400`
`param1401`
`param1402`
`param1403`
`param1404`
`param1405`
`param1406`
`param1407`
`param1408`
`param1409`
`param1410`
`param1411`
`param1412`
`param1413`
`param1414`
`param1415`
`param1416`
`param1417`
`param1418`
`param1419`
`param1420`
`param1421`
`param1422`
`param1423`
`param1424`
`param1425`
`param1426`
`param1427`
`param1428`
`param1429`
`param1430`
`param1431`
`param1432`
`param1433`
`param1434`
`param1435`
`param1436`
`param1437`
`param1438`
`param1439`
`param1440`
`param1441`
`param1442`
`param1443`
`param1444`
`param1445`
`param1446`
`param1447`
`param1448`
`param1449`
`param1450`
`param1451`
`param1452`
`param1453`
`param1454`
`param1455`
`param1456`
`param1457`
`param1458`
`param1459`
`param1460`
`param1461`
`param1462`
`param1463`
`param1464`
`param1465`
`param1466`
`param1467`
`param1468`
`param1469`
`param1470`
`param1471`
`param1472`
`param1473`
`param1474`
`param1475`
`param1476`
`param1477`
`param1478`
`param1479`
`param1480`
`param1481`
`param1482`
`param1483`
`param1484`
`param1485`
`param1486`
`param1487`
`param1488`
`param1489`
`param1490`
`param1491`
`param1492`
`param1493`
`param1494`
`param1495`
`param1496`
`param1497`
`param1498`
`param1499`
`param1500`
`param1501`
`param1502`
`param1503`
`param1504`
`param1505`
`param1506`
`param1507`
`param1508`
`param1509`
`param1510`
`param1511`
`param1512`
`param1513`
`param1514`
`param1515`
`param1516`
`param1517`
`param1518`
`param1519`
`param1520`
`param1521`
`param1522`
`param1523`
`param1524`
`param1525`
`param1526`
`param1527`
`param1528`
`param1529`
`param1530`
`param1531`
`param1532`
`param1533`
`param1534`
`param1535`
`param1536`
`param1537`
`param1538`
`param1539`
`param1540`
`param1541`
`param1542`
`param1543`
`param1544`
`param1545`
`param1546`
`param1547`
`param1548`
`param1549`
`param1550`
`param1551`
`param1552`
`param1553`
`param1554`
`param1555`
`param1556`
`param1557`
`param1558`
`param1559`
`param1560`
`param1561`
`param1562`
`param1563`
`param1564`
`param1565`
`param1566`
`param1567`
`param1568`
`param1569`
`param1570`
`param1571`
`param1572`
`param1573`
`param1574`
`param1575`
`param1576`
`param1577`
`param1578`
`param1579`
`param1580`
`param1581`
`param1582`
`param1583`
`param1584`
`param1585`
`param1586`
`param1587`
`param1588`
`param1589`
`param1590`
`param1591`
`param1592`
`param1593`
`param1594`
`param1595`
`param1596`
`param1597`
`param1598`
`param1599`
`param1600`
`param1601`
`param1602`
`param1603`
`param1604`
`param1605`
`param1606`
`param1607`
`param1608`
`param1609`
`param1610`
`param1611`
`param1612`
`param1613`
`param1614`
`param1615`
`param1616`
`param1617`
`param1618`
`param1619`
`param1620`
`param1621`
`param1622`
`param1623`
`param1624`
`param1625`
`param1626`
`param1627`
`param1628`
`param1629`
`param1630`
`param1631`
`param1632`
`param1633`
`param1634`
`param1635`
`param1636`
`param1637`
`param1638`
`param1639`
`param1640`
`param1641`
`param1642`
`param1643`
`param1644`
`param1645`
`param1646`
`param1647`
`param1648`
`param1649`
`param1650`
`param1651`
`param1652`
`param1653`
`param1654`
`param1655`
`param1656`
`param1657`
`param1658`
`param1659`
`param1660`
`param1661`
`param1662`
`param1663`
`param1664`
`param1665`
`param1666`
`param1667`
`param1668`
`param1669`
`param1670`
`param1671`
`param1672`
`param1673`
`param1674`
`param1675`
`param1676`
`param1677`
`param1678`
`param1679`
`param1680`
`param1681`
`param1682`
`param1683`
`param1684`
`param1685`
`param1686`
`param1687`
`param1688`
`param1689`
`param1690`
`param1691`
`param1692`
`param1693`
`param1694`
`param1695`
`param1696`
`param1697`
`param1698`
`param1699`
`param1700`
`param1701`
`param1702`
`param1703`
`param1704`
`param1705`
`param1706`
`param1707`
`param1708`
`param1709`
`param1710`
`param1711`
`param1712`
`param1713`
`param1714`
`param1715`
`param1716`
`param1717`
`param1718`
`param1719`
`param1720`
`param1721`
`param1722`
`param1723`
`param1724`
`param1725`
`param1726`
`param1727`
`param1728`
`param1729`
`param1730`
`param1731`
`param1732`
`param1733`
`param1734`
`param1735`
`param1736`
`param1737`
`param1738`
`param1739`
`param1740`
`param1741`
`param1742`
`param1743`
`param1744`
`param1745`
`param1746`
`param1747`
`param1748`
`param1749`
`param1750`
`param1751`
`param1752`
`param1753`
`param1754`
`param1755`
`param1756`
`param1757`
`param1758`
`param1759`
`param1760`
`param1761`
`param1762`
`param1763`
`param1764`
`param1765`
`param1766`
`param1767`
`param1768`
`param1769`
`param1770`
`param1771`
`param1772`
`param1773`
`param1774`
`param1775`
`param1776`
`param1777`
`param1778`
`param1779`
`param1780`
`param1781`
`param1782`
`param1783`
`param1784`
`param1785`
`param1786`
`param1787`
`param1788`
`param1789`
`param1790`
`param1791`
`param1792`
`param1793`
`param1794`
`param1795`
`param1796`
`param1797`
`param1798`
`param1799`
`param1800`
`param1801`
`param1802`
`param1803`
`param1804`
`param1805`
`param1806`
`param1807`
`param1808`
`param1809`
`param1810`
`param1811`
`param1812`
`param1813`
`param1814`
`param1815`
`param1816`
`param1817`
`param1818`
`param1819`
`param1820`
`param1821`
`param1822`
`param1823`
`param1824`
`param1825`
`param1826`
`param1827`
`param1828`
`param1829`
`param1830`
`param1831`
`param1832`
`param1833`
`param1834`
`param1835`
`param1836`
`param1837`
`param1838`
`param1839`
`param1840`
`param1841`
`param1842`
`param1843`
`param1844`
`param1845`
`param1846`
`param1847`
`param1848`
`param1849`
`param1850`
`param1851`
`param1852`
`param1853`
`param1854`
`param1855`
`param1856`
`param1857`
`param1858`
`param1859`
`param1860`
`param1861`
`param1862`
`param1863`
`param1864`
`param1865`
`param1866`
`param1867`
`param1868`
`param1869`
`param1870`
`param1871`
`param1872`
`param1873`
`param1874`
`param1875`
`param1876`
`param1877`
`param1878`
`param1879`
`param1880`
`param1881`
`param1882`
`param1883`
`param1884`
`param1885`
`param1886`
`param1887`
`param1888`
`param1889`
`param1890`
`param1891`
`param1892`
`param1893`
`param1894`
`param1895`
`param1896`
`param1897`
`param1898`
`param1899`
`param1900`
`param1901`
`param1902`
`param1903`
`param1904`
`param1905`
`param1906`
`param1907`
`param1908`
`param1909`
`param1910`
`param1911`
`param1912`
`param1913`
`param1914`
`param1915`
`param1916`
`param1917`
`param1918`
`param1919`
`param1920`
`param1921`
`param1922`
`param1923`
`param1924`
`param1925`
`param1926`
`param1927`
`param1928`
`param1929`
`param1930`
`param1931`
`param1932`
`param1933`
`param1934`
`param1935`
`param1936`
`param1937`
`param1938`
`param1939`
`param1940`
`param1941`
`param1942`
`param1943`
`param1944`
`param1945`
`param1946`
`param1947`
`param1948`
`param1949`
`param1950`
`param1951`
`param1952`
`param1953`
`param1954`
`param1955`
`param1956`
`param1957`
`param1958`
`param1959`
`param1960`
`param1961`
`param1962`
`param1963`
`param1964`
`param1965`
`param1966`
`param1967`
`param1968`
`param1969`
`param1970`
`param1971`
`param1972`
`param1973`
`param1974`
`param1975`
`param1976`
`param1977`
`param1978`
`param1979`
`param1980`
`param1981`
`param1982`
`param1983`
`param1984`
`param1985`
`param1986`
`param1987`
`param1988`
`param1989`
`param1990`
`param1991`
`param1992`
`param1993`
`param1994`
`param1995`
`param1996`
`param1997`
`param1998`
`param1999`
`param2000`
`param2001`
`param2002`
`param2003`
`param2004`
`param2005`
`param2006`
`param2007`

Event ID 2147485656: Unable to collect Section performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect Section performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Section performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485658: Unable to collect System performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect System performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485659: Unable to collect System Pagefile performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect System Pagefile performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System Pagefile performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485660: Unable to collect System Process performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect System Process performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System Process performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485661: Unable to collect System Exception performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect System Exception performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System Exception performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485662: Unable to collect Registry Quota performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect Registry Quota performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect Registry Quota performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485663: Unable to collect System time information.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect System time information. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System time information. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485664: Unable to collect System Processor Idle performance data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect System Processor Idle performance data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect System Processor Idle performance data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 2147485665: Unable to collect NUMA physical memory utilization data.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect NUMA physical memory utilization data. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to collect NUMA physical memory utilization data. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 3221226472: Unable to open one of the Windows operating system performance counter objects.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to open one of the Windows operating system performance counter objects. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to open one of the Windows operating system performance counter objects. The first four bytes (DWORD) of the Data section contains the status code.

Event ID 3221226473: Unable to collect operating system performance data because one of the system performance counter objects failed to open.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to collect operating system performance data because one of the system performance counter objects failed to open.

Message #

Unable to collect operating system performance data because one of the system performance counter objects failed to open.

Event ID 3221227481: Unable to get system configuration information.

Provider: Microsoft-Windows-PerfOS
Channel: Operational

Description

Unable to get system configuration information. The first four bytes (DWORD) of the Data section contains the status code.

Message #

Unable to get system configuration information. The first four bytes (DWORD) of the Data section contains the status code.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID f82fb576-e941-4956-a2c7-a0cf83f6450a

Defined in perfos.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)