Microsoft-Windows-RTWorkQueue-Threading
64 events across 1 channel
Event ID 4435: WorkQueue Execute: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID AsyncResult=AsyncResult.
#Event ID 4436: WorkQueue Execute: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID AsyncResult=AsyncResult.
#Event ID 4437: WorkQueue Queue: WorkQueuePtr=WorkQueuePointer Start threads=QueueDepth AsyncResult=AsyncResult.
#Event ID 4438: WorkQueue Queue: WorkQueuePtr=WorkQueuePointer End threads=QueueDepth AsyncResult=AsyncResult.
#Event ID 4439: WorkQueue Thread: Start workqueue_ptr=WorkQueuePointer WorkQueueID=WordQueueID ThreadCount=ThreadCount.
#Event ID 4440: WorkQueue Thread: End workqueue_ptr=WorkQueuePointer WorkQueueID=WordQueueID ThreadCount=ThreadCount.
#Event ID 4454: MMCSS Registration Enter Queue=Queue ThreadID=ThreadID Handle=Handle Error=Error Class=Class Pri=Priority TaskID=TaskID.
#Event ID 4455: MMCSS Registration Enter Queue=Queue ThreadID=ThreadID Handle=Handle Error=Error Class=Class Pri=Priority TaskID=TaskID.
#Event ID 4472: WorkQueue Queue: WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID QOS_Supported=Flags.
#Event ID 4473: WorkQueue Queue: WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID.
#Event ID 4474: WorkQueue Execute Callback: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID BaseWorkQueueID=BaseWorkQueueID ThreadID=ThreadID AsyncResult=AsyncResult AsyncResultPtr=AsyncResultVTable L...
#Description
WorkQueue Execute Callback: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID BaseWorkQueueID=BaseWorkQueueID ThreadID=ThreadID AsyncResult=AsyncResult AsyncResultPtr=AsyncResultVTable LongRunning=LongRunning.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
BaseWorkQueueID UInt32 | |
ThreadID UInt32 | |
AsyncResult Pointer | |
AsyncResultVTable Pointer | |
LongRunning Boolean |
Event ID 4475: WorkQueue Execute Callback: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID BaseWorkQueueID=BaseWorkQueueID ThreadID=ThreadID AsyncResult=AsyncResult AsyncResultPtr=AsyncResultVTable Lon...
#Description
WorkQueue Execute Callback: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID BaseWorkQueueID=BaseWorkQueueID ThreadID=ThreadID AsyncResult=AsyncResult AsyncResultPtr=AsyncResultVTable LongRunning=LongRunning.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
BaseWorkQueueID UInt32 | |
ThreadID UInt32 | |
AsyncResult Pointer | |
AsyncResultVTable Pointer | |
LongRunning Boolean |
Event ID 4476: WorkQueue MMCSS: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Class=Class Pri=Priority TaskId=TaskID.
#Event ID 4477: WorkQueue MMCSS: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Class=Class Pri=Priority TaskId=TaskID.
#Event ID 4478: WorkQueue UpdateDeadlines: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskId=TaskID Previous=PreviousDeadline Next=NextDeadline Delay=lDelay_ms.
#Description
WorkQueue UpdateDeadlines: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskId=TaskID Previous=PreviousDeadline Next=NextDeadline Delay=lDelay_ms.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
TaskID UInt32 | |
PreviousDeadline Int64 | |
NextDeadline Int64 | |
lDelay_ms Int32 | |
lPreDelay_ms Int32 | |
NextDeadline_RelToNow_us Int64 |
Event ID 4479: WorkQueue UpdateDeadlines: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskId=TaskID Previous=PreviousDeadline Next=NextDeadline Delay=lDelay_ms.
#Description
WorkQueue UpdateDeadlines: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskId=TaskID Previous=PreviousDeadline Next=NextDeadline Delay=lDelay_ms.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
TaskID UInt32 | |
PreviousDeadline Int64 | |
NextDeadline Int64 | |
lDelay_ms Int32 | |
lPreDelay_ms Int32 |
Event ID 4480: WorkQueue AddDeadline: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.
#Description
WorkQueue AddDeadline: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
ItemPointer Pointer | |
ItemID UInt32 | |
GlobalDeadline Int64 | |
DeltaAhead_usec Int64 |
Event ID 4481: WorkQueue AddDeadline: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.
#Description
WorkQueue AddDeadline: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
ItemPointer Pointer | |
ItemID UInt32 | |
GlobalDeadline Int64 | |
DeltaAhead_usec Int64 |
Event ID 4482: WorkQueue AddImmediateDeadline: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.
#Description
WorkQueue AddImmediateDeadline: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
ItemPointer Pointer | |
ItemID UInt32 | |
GlobalDeadline Int64 | |
DeltaAhead_usec Int64 |
Event ID 4483: WorkQueue AddImmediateDeadline: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.
#Description
WorkQueue AddImmediateDeadline: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
ItemPointer Pointer | |
ItemID UInt32 | |
GlobalDeadline Int64 | |
DeltaAhead_usec Int64 |
Event ID 4484: WorkQueue DeadlineYield: Start workQueueID=WorkQueueID Delay=Yield.
#Event ID 4485: WorkQueue DeadlineYield: End workQueueID=WorkQueueID Delay=Yield.
#Event ID 4486: WorkQueue DeadlineQueue: WorkQueuePtr=WorkQueuePointer workQueueID=WorkQueueID count=TotalCount immediateCount=ImmediateCount nextDeadline=NextDeadline nextItem=ItemPointer.
#Description
WorkQueue DeadlineQueue: WorkQueuePtr=WorkQueuePointer workQueueID=WorkQueueID count=TotalCount immediateCount=ImmediateCount nextDeadline=NextDeadline nextItem=ItemPointer.
Message #
Fields #
| Name | Description |
|---|---|
WorkQueuePointer Pointer | |
WorkQueueID UInt32 | |
TotalCount UInt32 | |
ImmediateCount UInt32 | |
NextDeadline Int64 | |
ItemPointer Pointer | |
ItemID UInt32 | |
NextDeadline_RelToNow_us Int64 | |
NextDeadline_AddTimeRelNow_us Int64 |
Event ID 4487: WorkQueue LongRunning: Start workQueueID=WorkQueueID.
#Event ID 4488: WorkQueue LongRunning: End workQueueID=WorkQueueID.
#Event ID 4489: WorkQueue: StartTimer QueuePtr=WorkQueuePointer QueueID=WorkQueueID TimerPtr=TimerPointer Timeout=Timeout IsPeriodic=IsPeriodic.
#Event ID 4490: WorkQueue: ExecuteTimer QueuePtr=WorkQueuePointer QueueID=WorkQueueID TimerPtr=TimerPointer.
#Event ID 4491: SubscribePPMChangeWNF queryStatus=queryStatus subscribeStatus=subscribeStatus changeStamp=changeStamp.
#Event ID 4492: PPMChangeWnfCallback ChangeStamp=ChangeStamp CurChangeStamp=CurChangeStamp PPMMode=PPMMode QOSSupported=QOSSupported Length=Length.
#Event ID 4493: UpdateSelectWorkQueuesCpuGroupMask Enter ProcessorGroup=ProcessorGroup ProcessorMask=ProcessorMask.
#Event ID 4494: UpdateSelectWorkQueuesCpuGroupMask Leave ProcessorGroup=ProcessorGroup ProcessorMask=ProcessorMask hr=hResult.
#Event ID 4495: SubscribeCpuGroupMaskChangeWNF queryStatus=queryStatus subscribeStatus=subscribeStatus changeStamp=changeStamp.
#Event ID 4496: UpdateWorkqueueCpuGroupMask workQueue=dwWorkQueue Class=Class ProcesssorGroup=ProcessorGroup ProcesssorMask=ProcessorMask.
#Event ID 4497: CpuGroupMaskChangeWnfCallback ChangeStamp=ChangeStamp CurChangeStamp=CurChangeStamp ProcessorGroup=ProcessorGroup ProcessorMask=ProcessorMask Length=Length.
#Event ID 4498: SetThreadCpuGroupMask pWorkQueue=pWorkQueue Class=Class Priority=Priority ThreadId=ThreadId CurProcessorGroup=CurProcessorGroup CurProcessorMask=CurProcessorMask NewProcessorGroup=NewProcessorGroup...
#Description
SetThreadCpuGroupMask pWorkQueue=pWorkQueue Class=Class Priority=Priority ThreadId=ThreadId CurProcessorGroup=CurProcessorGroup CurProcessorMask=CurProcessorMask NewProcessorGroup=NewProcessorGroup NewProcessorMask=NewProcessorMask status=Status.
Message #
Fields #
| Name | Description |
|---|---|
pWorkQueue Pointer | |
Class UnicodeString | |
Priority Int32 | |
ThreadId Int32 | |
CurProcessorGroup UInt64 | |
CurProcessorMask UInt64 | |
NewProcessorGroup UInt64 | |
NewProcessorMask UInt64 | |
Status Int32 | NTSTATUS reference |
Event ID 4499: WorkQueue Start Notification WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID.
#Event ID 4500: WorkQueue End Notification WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID.
#Event ID 4501: WorkQueue Debounce: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.
#Event ID 4502: WorkQueue Debounce: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.
#Event ID 4503: WorkQueue Buffering: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.
#Event ID 4504: WorkQueue Buffering: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.
#Event ID 4505: Platform AllocIndex start: Platform=Platform WorkQueueID=WorkQueueID Index=Index.
#Event ID 4506: Platform AllocIndex stop: Platform=Platform WorkQueueID=WorkQueueID Index=Index.
#Event ID 4507: Platform Init start: Platform=Platform.
#Event ID 4508: Platform Init stop: Platform=Platform.
#Event ID 4509: Platform Shutdown start: Platform=Platform.
#Event ID 4510: Platform Shutdown stop: Platform=Platform.
#Event ID 4511: Platform Shutdown timeout: Platform=Platform.
#Event ID 4512: Platform Shutdown_WorkQueue start: Platform=Platform workqueue=WorkQueue index=Index.
#Event ID 4513: Platform Shutdown_WorkQueue stop: Platform=Platform workqueue=WorkQueue index=Index.
#Event ID 4514: WorkQueue RunLimit: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.
#Event ID 4515: WorkQueue RunLimit: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.
#Event ID 4516: WorkQueue RunLimit: Exceeded workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.
#Event ID 4517: TaskGroup: Start TaskGroup=TaskGroup.
#Event ID 4518: TaskGroup: End TaskGroup=TaskGroup.
#Event ID 4519: TaskGroup RefCount TaskGroup=TaskGroup RefCount=RefCount.
#Event ID 4520: TaskGroup ObjectCount ObjectCount=ObjectCount.
#Event ID 4521: TaskGroup Reinit TaskGroup=TaskGroup TaskID=TaskID.
#Event ID 4522: Platform Init shutdown in progress: Platform=Platform.
#Event ID 4523: Platform Shutdown aborted: Platform=Platform.
#Event ID 4524: WorkQueue GetMMCSSFailure: workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID statePtr=rtStatePointer hr=hr.
#Event ID 4525: WorkQueue MMCSS: RegCount workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID taskId=TaskID regCount=RegCount.
#Event ID 4526: WorkQueue DeadlineYield: Start workQueueID=WorkQueueID Delay=TaskID.
#Event ID 4527: WorkQueue DeadlineYield: End workQueueID=WorkQueueID Delay=TaskID.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID e18d0fc9-9515-4232-98e4-89e456d8551b
Defined in rtworkq.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3912, captured 2026-06-02