Microsoft-Windows-HAL
20 events across 2 channels
Event ID 1 — Initialization of the High Precision Event Timer failed due to a BIOS configuration problem.
Description
Initialization of the High Precision Event Timer failed due to a BIOS configuration problem.
Message #
Fields #
| Name | Description |
|---|---|
Initialization_status UInt32 | — |
Status UInt32 | — NTSTATUS reference |
Event ID 2 — Initialization of the High Precision Event Timer failed due to unsupported hardware.
Description
Initialization of the High Precision Event Timer failed due to unsupported hardware.
Message #
Fields #
| Name | Description |
|---|---|
Initialization_status UInt32 | — |
Status UInt32 | — NTSTATUS reference |
Event ID 3 — Initialization of the High Precision Event Timer failed due to an interrupt configuration problem.
Description
Initialization of the High Precision Event Timer failed due to an interrupt configuration problem.
Message #
Fields #
| Name | Description |
|---|---|
Initialization_status UInt32 | — |
Status UInt32 | — NTSTATUS reference |
Event ID 4 — Due to an unexpected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters.
Description
Due to an unexpected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters. Status: Status.
Message #
Fields #
| Name | Description |
|---|---|
Status UInt32 | — NTSTATUS reference |
Event ID 5 — Due to an expected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters.
Description
Due to an expected condition, the operating system will use another available platform timer in lieu of the processor's cycle counters. Status: Status.
Message #
Fields #
| Name | Description |
|---|---|
Status UInt32 | — NTSTATUS reference |
Event ID 7 — The processor cycle counter on processor TargetProcessor has been probed by processor LeadProcessor.
Description
The processor cycle counter on processor TargetProcessor has been probed by processor LeadProcessor. A counter delta of Delta was detected. The approximate communication delay between these processors was detected to be NopCycles.
Message #
Fields #
| Name | Description |
|---|---|
LeadProcessor Int32 | — |
TargetProcessor Int32 | — |
Delta Int64 | — |
NopCycles UInt32 | — |
Event ID 8 — The processor's cycle counters have been successfully synchronized from processor LeadProcessor within acceptable operating thresholds.
Event ID 9 — The processor cycle counter on processor TargetProcessor was synchronized against processor SourceProcessor using an adjustment of Bias cycles on attempt Wave.
Description
The processor cycle counter on processor TargetProcessor was synchronized against processor SourceProcessor using an adjustment of Bias cycles on attempt Wave. This resulted in a delta of Delta cycles.
Message #
Fields #
| Name | Description |
|---|---|
SourceProcessor Int32 | — |
TargetProcessor Int32 | — |
Delta Int64 | — |
Bias Int64 | — |
Wave UInt32 | — |
Event ID 10 — The synchronization of the processor's cycle counters was not able to synchronize the processors within acceptable operating thresholds.
Description
The synchronization of the processor's cycle counters was not able to synchronize the processors within acceptable operating thresholds. Status: Status.
Message #
Fields #
| Name | Description |
|---|---|
Status UInt32 | — NTSTATUS reference |
Event ID 11 — The High Precision Event Timer failed to deliver message signalled interrupts.
Description
The High Precision Event Timer failed to deliver message signalled interrupts. The operating system will fall back to line based interrupts for this timer.
Message #
Fields #
| Name | Description |
|---|---|
Initialization_status UInt32 | — |
Status UInt32 | — NTSTATUS reference |
Event ID 12 — The platform firmware has corrupted memory across the previous system power transition.
Event ID 13 — The system watchdog timer was triggered.
Description
The system watchdog timer was triggered.
Message #
Event ID 14 — The watchdog wake timer was triggered.
Description
The watchdog wake timer was triggered.
Message #
Event ID 15 — The iommu has detected an error.
Event ID 16 — IOMMU fault reporting has been initialized.
#Description
IOMMU fault reporting has been initialized.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-HAL",
"guid": "63D1E632-95CC-4443-9312-AF927761D52A",
"event_source_name": "",
"event_id": 16,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-11-06T06:24:57.962026+00:00",
"event_record_id": 1635,
"correlation": {},
"execution": {
"process_id": 4,
"thread_id": 8
},
"channel": "System",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 17 — The clock interrupt is backed by a platform timer instead of a per-processor source.
Description
The clock interrupt is backed by a platform timer instead of a per-processor source. System performance may be degraded.
Message #
Event ID 18 — The performance counter is not readable from user mode.
Description
The performance counter is not readable from user mode. System performance may be degraded.
Message #
Event ID 19 — DMA API failure detected.
Event ID 20 — The hardware real-time clock was not queried because evaluation of the ACPI Time and Alarm Device method failed.
Description
The hardware real-time clock was not queried because evaluation of the ACPI Time and Alarm Device method failed. Status: Status.
Message #
Fields #
| Name | Description |
|---|---|
Status UInt32 | — NTSTATUS reference |
Event ID 21 — The hardware real-time clock was not set because evaluation of the ACPI Time and Alarm Device method failed.
Description
The hardware real-time clock was not set because evaluation of the ACPI Time and Alarm Device method failed. Status: Status.
Message #
Fields #
| Name | Description |
|---|---|
Status UInt32 | — NTSTATUS reference |