Microsoft-Windows-Kernel-Cache

5 events across 1 channel

Event ID	Title	Channel
101	Initialized VolumeCacheMap for device guid.	Operational
102	Global Periodic Cache Information: Period Duration (microseconds): %1 Number of …	Operational
103	Volume Periodic Cache Information: Device GUID: %1 Period Duration …	Operational
104	Volume Periodic Cache Read Latency Information: Device GUID: %1 Period Duration …	Operational
105	Volume Periodic Cache Write Latency Information: Device GUID: %1 Period Duration …	Operational

Event ID 101 — Initialized VolumeCacheMap for device guid.

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: 4
Samples: 1

Message

Initialized VolumeCacheMap for device guid: %1.

Fields

Name	Description
`VolumeDeviceGuid`	Initialized VolumeCacheMap for device guid.

Example Event

system:
  provider: Microsoft-Windows-Kernel-Cache
  guid: A2D34BF1-70AB-5B21-C819-5A0DD42748FD
  event_source_name: ''
  event_id: 101
  version: 0
  level: 4
  task: 101
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T06:25:20.815436+00:00'
  event_record_id: 62
  correlation: {}
  execution:
    process_id: 4
    thread_id: 96
  channel: Microsoft-Windows-Kernel-Cache/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  VolumeDeviceGuid: F8B2740A-2324-44DB-BBF8-80523FE5334B
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 102 — Global Periodic Cache Information: Period Duration (microseconds): %1 Number of NUMA Nodes: %18 Event Samples: %2 Total Number of Mapped VACBs: %3 ...

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: 4
Samples: 1

Message

Global Periodic Cache Information:

                       Period Duration (microseconds): %1
                       Number of NUMA Nodes: %18
                       Event Samples: %2
                       Total Number of Mapped VACBs: %3
                       Total Partition Samples: %4
                       Total Volume Samples: %5
                       Total Pages Yet to Write: %6
                       Total Dirty Pages: %7
                       Total Available Pages: %8
                       Total Number of Worker Threads: %9
                       Total Number of Active Worker Threads: %10
                       Total Average Available Pages: %11
                       Total Average Dirty Pages: %12
                       CopyRead Calls: %13
                       AsyncCopyRead Calls: %14
                       CopyWriteCalls: %15
                       SetValidData Calls: %16
                       FlushCache Calls: %17

Fields

Name	Description
`PeriodDurationMicroSec`	[Global Periodic Cache Information] Period Duration (microseconds).
`EventSamples`	[Global Periodic Cache Information] Event Samples.
`TotalNumberOfMappedVacbs`	[Global Periodic Cache Information] Total Number of Mapped VACBs.
`TotalPartitionSamples`	[Global Periodic Cache Information] Total Partition Samples.
`TotalVolumeSamples`	[Global Periodic Cache Information] Total Volume Samples.
`TotalPagesYetToWrite`	[Global Periodic Cache Information] Total Pages Yet to Write.
`TotalDirtyPages`	[Global Periodic Cache Information] Total Dirty Pages.
`TotalAvailablePages`	[Global Periodic Cache Information] Total Available Pages.
`TotalNumberWorkerThreads`	[Global Periodic Cache Information] Total Number of Worker Threads.
`TotalNumberActiveWorkerThreads`	[Global Periodic Cache Information] Total Number of Active Worker Threads.
`TotalAverageAvailablePages`	[Global Periodic Cache Information] Total Average Available Pages.
`TotalAverageDirtyPages`	[Global Periodic Cache Information] Total Average Dirty Pages.
`CcCopyReadCalls`	[Global Periodic Cache Information] CopyRead Calls.
`CcAsyncCopyReadCalls`	[Global Periodic Cache Information] AsyncCopyRead Calls.
`CcCopyWriteCalls`	[Global Periodic Cache Information] CopyWriteCalls.
`CcSetValidDataCalls`	[Global Periodic Cache Information] SetValidData Calls.
`CcFlushCacheCalls`	[Global Periodic Cache Information] FlushCache Calls.
`NumberOfNUMANodes`	[Global Periodic Cache Information] Number of NUMA Nodes.

Example Event

system:
  provider: Microsoft-Windows-Kernel-Cache
  guid: A2D34BF1-70AB-5B21-C819-5A0DD42748FD
  event_source_name: ''
  event_id: 102
  version: 3
  level: 4
  task: 102
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T01:55:43.038583+00:00'
  event_record_id: 98
  correlation: {}
  execution:
    process_id: 4
    thread_id: 20724
  channel: Microsoft-Windows-Kernel-Cache/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  PeriodDurationMicroSec: 3644934575
  EventSamples: 29
  TotalNumberOfMappedVacbs: 138048
  TotalPartitionSamples: 29
  TotalVolumeSamples: 116
  TotalPagesYetToWrite: 19570
  TotalDirtyPages: 54912
  TotalAvailablePages: 17380487
  TotalNumberWorkerThreads: 464
  TotalNumberActiveWorkerThreads: 0
  TotalAverageAvailablePages: 134464943
  TotalAverageDirtyPages: 72254
  CcCopyReadCalls: 3616969
  CcAsyncCopyReadCalls: 3935
  CcCopyWriteCalls: 475546
  CcSetValidDataCalls: 44286
  CcFlushCacheCalls: 237825
  NumberOfNUMANodes: 1
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 103 — Volume Periodic Cache Information: Device GUID: %1 Period Duration (microseconds): %2 Total Dirty Pages: %3 Maximum Dirty Pages: %4 Total Dirty Pag...

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: 4
Samples: 1

Message

Volume Periodic Cache Information:

                       Device GUID: %1
                       Period Duration (microseconds): %2
                       Total Dirty Pages: %3
                       Maximum Dirty Pages: %4
                       Total Dirty Page Threshold: %5
                       Top Dirty Page Threshold: %6
                       Bottom Dirty Page Threshold: %7
                       Dirty Page Samples: %8
                       Total Lazy Writer Calls: %9
                       Total Lazy Writer Latency: %10
                       Total Lazy Writer Pages Flushed: %11
                       Lazy Writer Average Pages Per Second: %12
                       Total Pages Queued to Disk: %13
                       Maximum Pages Queued to Disk: %14
                       Pages Queued to Disk Samples: %15
                       Total Metadata Pages Queued to Disk: %16
                       Maximum Metadata Pages Queued to Disk: %17
                       Metadata Pages Queued to Disk Samples: %18
                       Read Total Bytes: %19
                       Read Paged-In Total Bytes: %20
                       Read-Ahead Total Bytes: %21
                       Cache Hit Ratio (%): %22
                       Total Writes: %23
                       Total Hard-Throttle Writes: %24
                       Total Soft-Throttle Writes: %25
                       Total Synchronous Read IO Count: %26
                       Total Synchronous Non-Blocking Read IO Count: %27
                       Total Failed Synchronous Non-Blocking Read IO Count: %28
                       Synchronous Read IO Maximum Latency (us): %29
                       Synchronous Read IO Non-Blocking Maximum Latency (us): %30
                       Total Synchronous Write IO Count: %31
                       Total Synchronous Non-Blocking Write IO Count: %32
                       Total Failed Synchronous Non-Blocking Write IO Count: %33
                       Synchronous Write IO Maximum Latency (us): %34
                       Synchronous Write IO Non-Blockinig Maximum Latency (us): %35
                       Total Asynchronous Read IO Count: %36
                       Asynchronous Read IO Maximum Latency (us): %37

Fields

Name	Description
`VolumeDeviceGuid`	[Volume Periodic Cache Information] Device GUID.
`PeriodDurationMicroSec`	[Volume Periodic Cache Information] Period Duration (microseconds).
`TotalDirtyPages`	[Volume Periodic Cache Information] Total Dirty Pages.
`MaxDirtyPages`	[Volume Periodic Cache Information] Maximum Dirty Pages.
`TotalDirtyPageThreshold`	[Volume Periodic Cache Information] Total Dirty Page Threshold.
`TopDirtyPageThreshold`	[Volume Periodic Cache Information] Top Dirty Page Threshold.
`BottomDirtyPageThreshold`	[Volume Periodic Cache Information] Bottom Dirty Page Threshold.
`DirtyPageSamples`	[Volume Periodic Cache Information] Dirty Page Samples.
`LazyWriterCalls`	[Volume Periodic Cache Information] Total Lazy Writer Calls.
`TotalLazyWriterLatency`	[Volume Periodic Cache Information] Total Lazy Writer Latency.
`TotalLazyWriterPagesFlushed`	[Volume Periodic Cache Information] Total Lazy Writer Pages Flushed.
`LazyWriterAvgPagesPerSecond`	[Volume Periodic Cache Information] Lazy Writer Average Pages Per Second.
`TotalPagesQueuedToDisk`	[Volume Periodic Cache Information] Total Pages Queued to Disk.
`MaxPagesQueuedToDisk`	[Volume Periodic Cache Information] Maximum Pages Queued to Disk.
`PagesQueuedToDiskSamples`	[Volume Periodic Cache Information] Pages Queued to Disk Samples.
`TotalLoggedPagesQueuedToDisk`	[Volume Periodic Cache Information] Total Metadata Pages Queued to Disk.
`MaxLoggedPagesQueuedToDisk`	[Volume Periodic Cache Information] Maximum Metadata Pages Queued to Disk.
`LoggedPagesQueuedToDiskSamples`	[Volume Periodic Cache Information] Metadata Pages Queued to Disk Samples.
`ReadTotalBytes`	[Volume Periodic Cache Information] Read Total Bytes.
`ReadPagedInTotalBytes`	[Volume Periodic Cache Information] Read Paged-In Total Bytes.
`ReadAheadTotalBytes`	[Volume Periodic Cache Information] Read-Ahead Total Bytes.
`CacheHitRatio`	[Volume Periodic Cache Information] ).
`TotalWrites`	[Volume Periodic Cache Information] Total Writes.
`TotalHardThrottleWrites`	[Volume Periodic Cache Information] Total Hard-Throttle Writes.
`TotalSoftThrottleWrites`	[Volume Periodic Cache Information] Total Soft-Throttle Writes.
`TotalSynchronousReadIoCount`	[Volume Periodic Cache Information] Total Synchronous Read IO Count.
`TotalSynchronousNonBlockingReadIoCount`	[Volume Periodic Cache Information] Total Synchronous Non-Blocking Read IO Count.
`TotalFailedSynchronousNonBlockingReadIoCount`	[Volume Periodic Cache Information] Total Failed Synchronous Non-Blocking Read IO Count.
`SynchronousReadIoMaxLatency`	[Volume Periodic Cache Information] Synchronous Read IO Maximum Latency (us).
`SynchronousReadIoNonBlockingMaxLatency`	[Volume Periodic Cache Information] Synchronous Read IO Non-Blocking Maximum Latency (us).
`TotalSynchronousWriteIoCount`	[Volume Periodic Cache Information] Total Synchronous Write IO Count.
`TotalSynchronousNonBlockingWriteIoCount`	[Volume Periodic Cache Information] Total Synchronous Non-Blocking Write IO Count.
`TotalFailedSynchronousNonBlockingWriteIoCount`	[Volume Periodic Cache Information] Total Failed Synchronous Non-Blocking Write IO Count.
`SynchronousWriteIoMaxLatency`	[Volume Periodic Cache Information] Synchronous Write IO Maximum Latency (us).
`SynchronousWriteIoNonBlockingMaxLatency`	[Volume Periodic Cache Information] Synchronous Write IO Non-Blockinig Maximum Latency (us).
`TotalAsynchronousReadIoCount`	[Volume Periodic Cache Information] Total Asynchronous Read IO Count.
`AsynchronousReadIoMaxLatency`	[Volume Periodic Cache Information] Asynchronous Read IO Maximum Latency (us).

Example Event

system:
  provider: Microsoft-Windows-Kernel-Cache
  guid: A2D34BF1-70AB-5B21-C819-5A0DD42748FD
  event_source_name: ''
  event_id: 103
  version: 2
  level: 4
  task: 103
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T01:55:43.038617+00:00'
  event_record_id: 102
  correlation: {}
  execution:
    process_id: 4
    thread_id: 20724
  channel: Microsoft-Windows-Kernel-Cache/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  VolumeDeviceGuid: 00000000-0000-0000-0000-000000000000
  PeriodDurationMicroSec: 3644934575
  TotalDirtyPages: 0
  MaxDirtyPages: 0
  TotalDirtyPageThreshold: 0
  TopDirtyPageThreshold: 0
  BottomDirtyPageThreshold: 0
  DirtyPageSamples: 0
  LazyWriterCalls: 0
  TotalLazyWriterLatency: 0
  TotalLazyWriterPagesFlushed: 0
  LazyWriterAvgPagesPerSecond: 0
  TotalPagesQueuedToDisk: 0
  MaxPagesQueuedToDisk: 0
  PagesQueuedToDiskSamples: 0
  TotalLoggedPagesQueuedToDisk: 0
  MaxLoggedPagesQueuedToDisk: 0
  LoggedPagesQueuedToDiskSamples: 0
  ReadTotalBytes: 2097152
  ReadPagedInTotalBytes: 1048576
  ReadAheadTotalBytes: 0
  CacheHitRatio: 50
  TotalWrites: 0
  TotalHardThrottleWrites: 0
  TotalSoftThrottleWrites: 0
  TotalSynchronousReadIoCount: 8
  TotalSynchronousNonBlockingReadIoCount: 0
  TotalFailedSynchronousNonBlockingReadIoCount: 0
  SynchronousReadIoMaxLatency: 1581
  SynchronousReadIoNonBlockingMaxLatency: 0
  TotalSynchronousWriteIoCount: 0
  TotalSynchronousNonBlockingWriteIoCount: 0
  TotalFailedSynchronousNonBlockingWriteIoCount: 0
  SynchronousWriteIoMaxLatency: 0
  SynchronousWriteIoNonBlockingMaxLatency: 0
  TotalAsynchronousReadIoCount: 0
  AsynchronousReadIoMaxLatency: 0
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 104 — Volume Periodic Cache Read Latency Information: Device GUID: %1 Period Duration (microseconds): %2 Latency Bucket Values: [256us, 1ms, 4ms, 16ms, 6...

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: 4
Samples: 1

Message

Volume Periodic Cache Read Latency Information:

                       Device GUID: %1
                       Period Duration (microseconds): %2

                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]

                       Synchronous Read IO Counts: [%3, %4, %5, %6, %7, %8, %9, %10, %11, %12, %13, %14]
                       Synchronous Read IO Total Latencies (us): [%15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
                       Synchronous Read Non-Blocking IO Counts: [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38]
                       Synchronous Read Non-Blocking IO Total Latencies (us): [%39, %40, %41, %42, %43, %44, %45, %46, %47, %48, %49, %50]
                       Asynchronous Read IO Counts: [%51, %52, %53, %54, %55, %56, %57, %58, %59, %60, %61, %62]
                       Asynchronous Read IO Total Latencies (us): [%63, %64, %65, %66, %67, %68, %69, %70, %71, %72, %73, %74]

Fields

Name	Description
`VolumeDeviceGuid`	[Volume Periodic Cache Read Latency Information] Device GUID.
`PeriodDurationMicroSec`	[Volume Periodic Cache Read Latency Information] Period Duration (microseconds).
`SynchronousReadIoCountsBucket1`	—
`SynchronousReadIoCountsBucket2`	—
`SynchronousReadIoCountsBucket3`	—
`SynchronousReadIoCountsBucket4`	—
`SynchronousReadIoCountsBucket5`	—
`SynchronousReadIoCountsBucket6`	—
`SynchronousReadIoCountsBucket7`	—
`SynchronousReadIoCountsBucket8`	—
`SynchronousReadIoCountsBucket9`	—
`SynchronousReadIoCountsBucket10`	—
`SynchronousReadIoCountsBucket11`	—
`SynchronousReadIoCountsBucket12`	—
`SynchronousReadTotalLatencyBucket1`	—
`SynchronousReadTotalLatencyBucket2`	—
`SynchronousReadTotalLatencyBucket3`	—
`SynchronousReadTotalLatencyBucket4`	—
`SynchronousReadTotalLatencyBucket5`	—
`SynchronousReadTotalLatencyBucket6`	—
`SynchronousReadTotalLatencyBucket7`	—
`SynchronousReadTotalLatencyBucket8`	—
`SynchronousReadTotalLatencyBucket9`	—
`SynchronousReadTotalLatencyBucket10`	—
`SynchronousReadTotalLatencyBucket11`	—
`SynchronousReadTotalLatencyBucket12`	—
`SynchronousReadNonBlockingIoCountsBucket1`	—
`SynchronousReadNonBlockingIoCountsBucket2`	—
`SynchronousReadNonBlockingIoCountsBucket3`	—
`SynchronousReadNonBlockingIoCountsBucket4`	—
`SynchronousReadNonBlockingIoCountsBucket5`	—
`SynchronousReadNonBlockingIoCountsBucket6`	—
`SynchronousReadNonBlockingIoCountsBucket7`	—
`SynchronousReadNonBlockingIoCountsBucket8`	—
`SynchronousReadNonBlockingIoCountsBucket9`	—
`SynchronousReadNonBlockingIoCountsBucket10`	—
`SynchronousReadNonBlockingIoCountsBucket11`	—
`SynchronousReadNonBlockingIoCountsBucket12`	—
`SynchronousReadNonBlockingTotalLatencyBucket1`	—
`SynchronousReadNonBlockingTotalLatencyBucket2`	—
`SynchronousReadNonBlockingTotalLatencyBucket3`	—
`SynchronousReadNonBlockingTotalLatencyBucket4`	—
`SynchronousReadNonBlockingTotalLatencyBucket5`	—
`SynchronousReadNonBlockingTotalLatencyBucket6`	—
`SynchronousReadNonBlockingTotalLatencyBucket7`	—
`SynchronousReadNonBlockingTotalLatencyBucket8`	—
`SynchronousReadNonBlockingTotalLatencyBucket9`	—
`SynchronousReadNonBlockingTotalLatencyBucket10`	—
`SynchronousReadNonBlockingTotalLatencyBucket11`	—
`SynchronousReadNonBlockingTotalLatencyBucket12`	—
`AsynchronousReadIoCountsBucket1`	—
`AsynchronousReadIoCountsBucket2`	—
`AsynchronousReadIoCountsBucket3`	—
`AsynchronousReadIoCountsBucket4`	—
`AsynchronousReadIoCountsBucket5`	—
`AsynchronousReadIoCountsBucket6`	—
`AsynchronousReadIoCountsBucket7`	—
`AsynchronousReadIoCountsBucket8`	—
`AsynchronousReadIoCountsBucket9`	—
`AsynchronousReadIoCountsBucket10`	—
`AsynchronousReadIoCountsBucket11`	—
`AsynchronousReadIoCountsBucket12`	—
`AsynchronousReadTotalLatencyBucket1`	—
`AsynchronousReadTotalLatencyBucket2`	—
`AsynchronousReadTotalLatencyBucket3`	—
`AsynchronousReadTotalLatencyBucket4`	—
`AsynchronousReadTotalLatencyBucket5`	—
`AsynchronousReadTotalLatencyBucket6`	—
`AsynchronousReadTotalLatencyBucket7`	—
`AsynchronousReadTotalLatencyBucket8`	—
`AsynchronousReadTotalLatencyBucket9`	—
`AsynchronousReadTotalLatencyBucket10`	—
`AsynchronousReadTotalLatencyBucket11`	—
`AsynchronousReadTotalLatencyBucket12`	—

Example Event

system:
  provider: Microsoft-Windows-Kernel-Cache
  guid: A2D34BF1-70AB-5B21-C819-5A0DD42748FD
  event_source_name: ''
  event_id: 104
  version: 1
  level: 4
  task: 104
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T01:55:43.038618+00:00'
  event_record_id: 103
  correlation: {}
  execution:
    process_id: 4
    thread_id: 20724
  channel: Microsoft-Windows-Kernel-Cache/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  VolumeDeviceGuid: 00000000-0000-0000-0000-000000000000
  PeriodDurationMicroSec: 3644934575
  SynchronousReadIoCountsBucket1: 5
  SynchronousReadIoCountsBucket2: 2
  SynchronousReadIoCountsBucket3: 1
  SynchronousReadIoCountsBucket4: 0
  SynchronousReadIoCountsBucket5: 0
  SynchronousReadIoCountsBucket6: 0
  SynchronousReadIoCountsBucket7: 0
  SynchronousReadIoCountsBucket8: 0
  SynchronousReadIoCountsBucket9: 0
  SynchronousReadIoCountsBucket10: 0
  SynchronousReadIoCountsBucket11: 0
  SynchronousReadIoCountsBucket12: 0
  SynchronousReadTotalLatencyBucket1: 249
  SynchronousReadTotalLatencyBucket2: 1186
  SynchronousReadTotalLatencyBucket3: 1581
  SynchronousReadTotalLatencyBucket4: 0
  SynchronousReadTotalLatencyBucket5: 0
  SynchronousReadTotalLatencyBucket6: 0
  SynchronousReadTotalLatencyBucket7: 0
  SynchronousReadTotalLatencyBucket8: 0
  SynchronousReadTotalLatencyBucket9: 0
  SynchronousReadTotalLatencyBucket10: 0
  SynchronousReadTotalLatencyBucket11: 0
  SynchronousReadTotalLatencyBucket12: 0
  SynchronousReadNonBlockingIoCountsBucket1: 0
  SynchronousReadNonBlockingIoCountsBucket2: 0
  SynchronousReadNonBlockingIoCountsBucket3: 0
  SynchronousReadNonBlockingIoCountsBucket4: 0
  SynchronousReadNonBlockingIoCountsBucket5: 0
  SynchronousReadNonBlockingIoCountsBucket6: 0
  SynchronousReadNonBlockingIoCountsBucket7: 0
  SynchronousReadNonBlockingIoCountsBucket8: 0
  SynchronousReadNonBlockingIoCountsBucket9: 0
  SynchronousReadNonBlockingIoCountsBucket10: 0
  SynchronousReadNonBlockingIoCountsBucket11: 0
  SynchronousReadNonBlockingIoCountsBucket12: 0
  SynchronousReadNonBlockingTotalLatencyBucket1: 0
  SynchronousReadNonBlockingTotalLatencyBucket2: 0
  SynchronousReadNonBlockingTotalLatencyBucket3: 0
  SynchronousReadNonBlockingTotalLatencyBucket4: 0
  SynchronousReadNonBlockingTotalLatencyBucket5: 0
  SynchronousReadNonBlockingTotalLatencyBucket6: 0
  SynchronousReadNonBlockingTotalLatencyBucket7: 0
  SynchronousReadNonBlockingTotalLatencyBucket8: 0
  SynchronousReadNonBlockingTotalLatencyBucket9: 0
  SynchronousReadNonBlockingTotalLatencyBucket10: 0
  SynchronousReadNonBlockingTotalLatencyBucket11: 0
  SynchronousReadNonBlockingTotalLatencyBucket12: 0
  AsynchronousReadIoCountsBucket1: 0
  AsynchronousReadIoCountsBucket2: 0
  AsynchronousReadIoCountsBucket3: 0
  AsynchronousReadIoCountsBucket4: 0
  AsynchronousReadIoCountsBucket5: 0
  AsynchronousReadIoCountsBucket6: 0
  AsynchronousReadIoCountsBucket7: 0
  AsynchronousReadIoCountsBucket8: 0
  AsynchronousReadIoCountsBucket9: 0
  AsynchronousReadIoCountsBucket10: 0
  AsynchronousReadIoCountsBucket11: 0
  AsynchronousReadIoCountsBucket12: 0
  AsynchronousReadTotalLatencyBucket1: 0
  AsynchronousReadTotalLatencyBucket2: 0
  AsynchronousReadTotalLatencyBucket3: 0
  AsynchronousReadTotalLatencyBucket4: 0
  AsynchronousReadTotalLatencyBucket5: 0
  AsynchronousReadTotalLatencyBucket6: 0
  AsynchronousReadTotalLatencyBucket7: 0
  AsynchronousReadTotalLatencyBucket8: 0
  AsynchronousReadTotalLatencyBucket9: 0
  AsynchronousReadTotalLatencyBucket10: 0
  AsynchronousReadTotalLatencyBucket11: 0
  AsynchronousReadTotalLatencyBucket12: 0
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 105 — Volume Periodic Cache Write Latency Information: Device GUID: %1 Period Duration (microseconds): %2 Latency Bucket Values: [256us, 1ms, 4ms, 16ms, ...

Provider: Microsoft-Windows-Kernel-Cache
Channel: Operational
Level: 4
Samples: 1

Message

Volume Periodic Cache Write Latency Information:

                       Device GUID: %1
                       Period Duration (microseconds): %2

                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]

                       Synchronous Write IO Counts: [%3, %4, %5, %6, %7, %8, %9, %10, %11, %12, %13, %14]
                       Synchronous Write IO Total Latencies (us): [%15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
                       Synchronous Write Non-Blocking IO Counts: [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38]
                       Synchronous Write Non-Blocking IO Total Latencies (us): [%39, %40, %41, %42, %43, %44, %45, %46, %47, %48, %49, %50]

Fields

Name	Description
`VolumeDeviceGuid`	[Volume Periodic Cache Write Latency Information] Device GUID.
`PeriodDurationMicroSec`	[Volume Periodic Cache Write Latency Information] Period Duration (microseconds).
`SynchronousWriteIoCountsBucket1`	—
`SynchronousWriteIoCountsBucket2`	—
`SynchronousWriteIoCountsBucket3`	—
`SynchronousWriteIoCountsBucket4`	—
`SynchronousWriteIoCountsBucket5`	—
`SynchronousWriteIoCountsBucket6`	—
`SynchronousWriteIoCountsBucket7`	—
`SynchronousWriteIoCountsBucket8`	—
`SynchronousWriteIoCountsBucket9`	—
`SynchronousWriteIoCountsBucket10`	—
`SynchronousWriteIoCountsBucket11`	—
`SynchronousWriteIoCountsBucket12`	—
`SynchronousWriteTotalLatencyBucket1`	—
`SynchronousWriteTotalLatencyBucket2`	—
`SynchronousWriteTotalLatencyBucket3`	—
`SynchronousWriteTotalLatencyBucket4`	—
`SynchronousWriteTotalLatencyBucket5`	—
`SynchronousWriteTotalLatencyBucket6`	—
`SynchronousWriteTotalLatencyBucket7`	—
`SynchronousWriteTotalLatencyBucket8`	—
`SynchronousWriteTotalLatencyBucket9`	—
`SynchronousWriteTotalLatencyBucket10`	—
`SynchronousWriteTotalLatencyBucket11`	—
`SynchronousWriteTotalLatencyBucket12`	—
`SynchronousWriteNonBlockingIoCountsBucket1`	—
`SynchronousWriteNonBlockingIoCountsBucket2`	—
`SynchronousWriteNonBlockingIoCountsBucket3`	—
`SynchronousWriteNonBlockingIoCountsBucket4`	—
`SynchronousWriteNonBlockingIoCountsBucket5`	—
`SynchronousWriteNonBlockingIoCountsBucket6`	—
`SynchronousWriteNonBlockingIoCountsBucket7`	—
`SynchronousWriteNonBlockingIoCountsBucket8`	—
`SynchronousWriteNonBlockingIoCountsBucket9`	—
`SynchronousWriteNonBlockingIoCountsBucket10`	—
`SynchronousWriteNonBlockingIoCountsBucket11`	—
`SynchronousWriteNonBlockingIoCountsBucket12`	—
`SynchronousWriteNonBlockingTotalLatencyBucket1`	—
`SynchronousWriteNonBlockingTotalLatencyBucket2`	—
`SynchronousWriteNonBlockingTotalLatencyBucket3`	—
`SynchronousWriteNonBlockingTotalLatencyBucket4`	—
`SynchronousWriteNonBlockingTotalLatencyBucket5`	—
`SynchronousWriteNonBlockingTotalLatencyBucket6`	—
`SynchronousWriteNonBlockingTotalLatencyBucket7`	—
`SynchronousWriteNonBlockingTotalLatencyBucket8`	—
`SynchronousWriteNonBlockingTotalLatencyBucket9`	—
`SynchronousWriteNonBlockingTotalLatencyBucket10`	—
`SynchronousWriteNonBlockingTotalLatencyBucket11`	—
`SynchronousWriteNonBlockingTotalLatencyBucket12`	—

Example Event

system:
  provider: Microsoft-Windows-Kernel-Cache
  guid: A2D34BF1-70AB-5B21-C819-5A0DD42748FD
  event_source_name: ''
  event_id: 105
  version: 1
  level: 4
  task: 105
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T01:55:43.038619+00:00'
  event_record_id: 104
  correlation: {}
  execution:
    process_id: 4
    thread_id: 20724
  channel: Microsoft-Windows-Kernel-Cache/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  VolumeDeviceGuid: 00000000-0000-0000-0000-000000000000
  PeriodDurationMicroSec: 3644934575
  SynchronousWriteIoCountsBucket1: 0
  SynchronousWriteIoCountsBucket2: 0
  SynchronousWriteIoCountsBucket3: 0
  SynchronousWriteIoCountsBucket4: 0
  SynchronousWriteIoCountsBucket5: 0
  SynchronousWriteIoCountsBucket6: 0
  SynchronousWriteIoCountsBucket7: 0
  SynchronousWriteIoCountsBucket8: 0
  SynchronousWriteIoCountsBucket9: 0
  SynchronousWriteIoCountsBucket10: 0
  SynchronousWriteIoCountsBucket11: 0
  SynchronousWriteIoCountsBucket12: 0
  SynchronousWriteTotalLatencyBucket1: 0
  SynchronousWriteTotalLatencyBucket2: 0
  SynchronousWriteTotalLatencyBucket3: 0
  SynchronousWriteTotalLatencyBucket4: 0
  SynchronousWriteTotalLatencyBucket5: 0
  SynchronousWriteTotalLatencyBucket6: 0
  SynchronousWriteTotalLatencyBucket7: 0
  SynchronousWriteTotalLatencyBucket8: 0
  SynchronousWriteTotalLatencyBucket9: 0
  SynchronousWriteTotalLatencyBucket10: 0
  SynchronousWriteTotalLatencyBucket11: 0
  SynchronousWriteTotalLatencyBucket12: 0
  SynchronousWriteNonBlockingIoCountsBucket1: 0
  SynchronousWriteNonBlockingIoCountsBucket2: 0
  SynchronousWriteNonBlockingIoCountsBucket3: 0
  SynchronousWriteNonBlockingIoCountsBucket4: 0
  SynchronousWriteNonBlockingIoCountsBucket5: 0
  SynchronousWriteNonBlockingIoCountsBucket6: 0
  SynchronousWriteNonBlockingIoCountsBucket7: 0
  SynchronousWriteNonBlockingIoCountsBucket8: 0
  SynchronousWriteNonBlockingIoCountsBucket9: 0
  SynchronousWriteNonBlockingIoCountsBucket10: 0
  SynchronousWriteNonBlockingIoCountsBucket11: 0
  SynchronousWriteNonBlockingIoCountsBucket12: 0
  SynchronousWriteNonBlockingTotalLatencyBucket1: 0
  SynchronousWriteNonBlockingTotalLatencyBucket2: 0
  SynchronousWriteNonBlockingTotalLatencyBucket3: 0
  SynchronousWriteNonBlockingTotalLatencyBucket4: 0
  SynchronousWriteNonBlockingTotalLatencyBucket5: 0
  SynchronousWriteNonBlockingTotalLatencyBucket6: 0
  SynchronousWriteNonBlockingTotalLatencyBucket7: 0
  SynchronousWriteNonBlockingTotalLatencyBucket8: 0
  SynchronousWriteNonBlockingTotalLatencyBucket9: 0
  SynchronousWriteNonBlockingTotalLatencyBucket10: 0
  SynchronousWriteNonBlockingTotalLatencyBucket11: 0
  SynchronousWriteNonBlockingTotalLatencyBucket12: 0
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline