Microsoft-Windows-PerfProc
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1001 | Unable to collect system process performance data because of an error during DLL … | Application | N | N |
| 2001 | Unable to collect process virtual memory information. | Application | N | N |
| 2002 | Unable to open the job object Message for query access. | Application | N | N |
| 2003 | Unable to query the job object Message for its accounting info. | Application | N | N |
| 2004 | Unable to query the Message object directory to look for job objects. | Application | N | N |
| 2005 | Unable to query the job object Message for its process IDs. | Application | N | N |
| 2006 | Unable to allocate memory for Job counters. | Application | N | N |
| 8192 | Unable to collect system process performance information. | Application | N | N |
Event ID 1001: Unable to collect system process performance data because of an error during DLL initialization.
#Event ID 2001: Unable to collect process virtual memory information.
#Event ID 2002: Unable to open the job object Message for query access.
#Event ID 2003: Unable to query the job object Message for its accounting info.
#Event ID 2004: Unable to query the Message object directory to look for job objects.
#Event ID 2005: Unable to query the job object Message for its process IDs.
#Provenance
ETW provider GUID 72d211e1-4c54-4a93-9520-4901681b2271
Defined in perfproc.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB