detection.wiki

Microsoft-Windows-Kernel-Cache › Event 104

Event ID 104 — Volume Periodic Cache Read Latency Information.

Provider
Microsoft-Windows-Kernel-Cache
Channel
Operational
Level
Informational
Task
CacheVolumeReadLatencies

Description

Volume Periodic Cache Read Latency Information.

Message #

Volume Periodic Cache Read Latency Information:

                       Device GUID: %1
                       Period Duration (microseconds): %2

                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]

                       Synchronous Read IO Counts: [%3, %4, %5, %6, %7, %8, %9, %10, %11, %12, %13, %14]
                       Synchronous Read IO Total Latencies (us): [%15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
                       Synchronous Read Non-Blocking IO Counts: [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38]
                       Synchronous Read Non-Blocking IO Total Latencies (us): [%39, %40, %41, %42, %43, %44, %45, %46, %47, %48, %49, %50]
                       Asynchronous Read IO Counts: [%51, %52, %53, %54, %55, %56, %57, %58, %59, %60, %61, %62]
                       Asynchronous Read IO Total Latencies (us): [%63, %64, %65, %66, %67, %68, %69, %70, %71, %72, %73, %74]

Fields #

NameDescription
VolumeDeviceGuid GUID[Volume Periodic Cache Read Latency Information] Device GUID.
PeriodDurationMicroSec UInt64[Volume Periodic Cache Read Latency Information] Period Duration (microseconds).
SynchronousReadIoCountsBucket1 UInt64—
SynchronousReadIoCountsBucket2 UInt64—
SynchronousReadIoCountsBucket3 UInt64—
SynchronousReadIoCountsBucket4 UInt64—
SynchronousReadIoCountsBucket5 UInt64—
SynchronousReadIoCountsBucket6 UInt64—
SynchronousReadIoCountsBucket7 UInt64—
SynchronousReadIoCountsBucket8 UInt64—
SynchronousReadIoCountsBucket9 UInt64—
SynchronousReadIoCountsBucket10 UInt64—
SynchronousReadIoCountsBucket11 UInt64—
SynchronousReadIoCountsBucket12 UInt64—
SynchronousReadTotalLatencyBucket1 UInt64—
SynchronousReadTotalLatencyBucket2 UInt64—
SynchronousReadTotalLatencyBucket3 UInt64—
SynchronousReadTotalLatencyBucket4 UInt64—
SynchronousReadTotalLatencyBucket5 UInt64—
SynchronousReadTotalLatencyBucket6 UInt64—
SynchronousReadTotalLatencyBucket7 UInt64—
SynchronousReadTotalLatencyBucket8 UInt64—
SynchronousReadTotalLatencyBucket9 UInt64—
SynchronousReadTotalLatencyBucket10 UInt64—
SynchronousReadTotalLatencyBucket11 UInt64—
SynchronousReadTotalLatencyBucket12 UInt64—
SynchronousReadNonBlockingIoCountsBucket1 UInt64—
SynchronousReadNonBlockingIoCountsBucket2 UInt64—
SynchronousReadNonBlockingIoCountsBucket3 UInt64—
SynchronousReadNonBlockingIoCountsBucket4 UInt64—
SynchronousReadNonBlockingIoCountsBucket5 UInt64—
SynchronousReadNonBlockingIoCountsBucket6 UInt64—
SynchronousReadNonBlockingIoCountsBucket7 UInt64—
SynchronousReadNonBlockingIoCountsBucket8 UInt64—
SynchronousReadNonBlockingIoCountsBucket9 UInt64—
SynchronousReadNonBlockingIoCountsBucket10 UInt64—
SynchronousReadNonBlockingIoCountsBucket11 UInt64—
SynchronousReadNonBlockingIoCountsBucket12 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket1 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket2 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket3 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket4 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket5 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket6 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket7 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket8 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket9 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket10 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket11 UInt64—
SynchronousReadNonBlockingTotalLatencyBucket12 UInt64—
AsynchronousReadIoCountsBucket1 UInt64—
AsynchronousReadIoCountsBucket2 UInt64—
AsynchronousReadIoCountsBucket3 UInt64—
AsynchronousReadIoCountsBucket4 UInt64—
AsynchronousReadIoCountsBucket5 UInt64—
AsynchronousReadIoCountsBucket6 UInt64—
AsynchronousReadIoCountsBucket7 UInt64—
AsynchronousReadIoCountsBucket8 UInt64—
AsynchronousReadIoCountsBucket9 UInt64—
AsynchronousReadIoCountsBucket10 UInt64—
AsynchronousReadIoCountsBucket11 UInt64—
AsynchronousReadIoCountsBucket12 UInt64—
AsynchronousReadTotalLatencyBucket1 UInt64—
AsynchronousReadTotalLatencyBucket2 UInt64—
AsynchronousReadTotalLatencyBucket3 UInt64—
AsynchronousReadTotalLatencyBucket4 UInt64—
AsynchronousReadTotalLatencyBucket5 UInt64—
AsynchronousReadTotalLatencyBucket6 UInt64—
AsynchronousReadTotalLatencyBucket7 UInt64—
AsynchronousReadTotalLatencyBucket8 UInt64—
AsynchronousReadTotalLatencyBucket9 UInt64—
AsynchronousReadTotalLatencyBucket10 UInt64—
AsynchronousReadTotalLatencyBucket11 UInt64—
AsynchronousReadTotalLatencyBucket12 UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Cache",
    "guid": "A2D34BF1-70AB-5B21-C819-5A0DD42748FD",
    "event_source_name": "",
    "event_id": 104,
    "version": 1,
    "level": 4,
    "task": 104,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:55:43.038618+00:00",
    "event_record_id": 103,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 20724
    },
    "channel": "Microsoft-Windows-Kernel-Cache/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VolumeDeviceGuid": "00000000-0000-0000-0000-000000000000",
    "PeriodDurationMicroSec": 3644934575,
    "SynchronousReadIoCountsBucket1": 5,
    "SynchronousReadIoCountsBucket2": 2,
    "SynchronousReadIoCountsBucket3": 1,
    "SynchronousReadIoCountsBucket4": 0,
    "SynchronousReadIoCountsBucket5": 0,
    "SynchronousReadIoCountsBucket6": 0,
    "SynchronousReadIoCountsBucket7": 0,
    "SynchronousReadIoCountsBucket8": 0,
    "SynchronousReadIoCountsBucket9": 0,
    "SynchronousReadIoCountsBucket10": 0,
    "SynchronousReadIoCountsBucket11": 0,
    "SynchronousReadIoCountsBucket12": 0,
    "SynchronousReadTotalLatencyBucket1": 249,
    "SynchronousReadTotalLatencyBucket2": 1186,
    "SynchronousReadTotalLatencyBucket3": 1581,
    "SynchronousReadTotalLatencyBucket4": 0,
    "SynchronousReadTotalLatencyBucket5": 0,
    "SynchronousReadTotalLatencyBucket6": 0,
    "SynchronousReadTotalLatencyBucket7": 0,
    "SynchronousReadTotalLatencyBucket8": 0,
    "SynchronousReadTotalLatencyBucket9": 0,
    "SynchronousReadTotalLatencyBucket10": 0,
    "SynchronousReadTotalLatencyBucket11": 0,
    "SynchronousReadTotalLatencyBucket12": 0,
    "SynchronousReadNonBlockingIoCountsBucket1": 0,
    "SynchronousReadNonBlockingIoCountsBucket2": 0,
    "SynchronousReadNonBlockingIoCountsBucket3": 0,
    "SynchronousReadNonBlockingIoCountsBucket4": 0,
    "SynchronousReadNonBlockingIoCountsBucket5": 0,
    "SynchronousReadNonBlockingIoCountsBucket6": 0,
    "SynchronousReadNonBlockingIoCountsBucket7": 0,
    "SynchronousReadNonBlockingIoCountsBucket8": 0,
    "SynchronousReadNonBlockingIoCountsBucket9": 0,
    "SynchronousReadNonBlockingIoCountsBucket10": 0,
    "SynchronousReadNonBlockingIoCountsBucket11": 0,
    "SynchronousReadNonBlockingIoCountsBucket12": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket1": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket2": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket3": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket4": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket5": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket6": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket7": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket8": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket9": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket10": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket11": 0,
    "SynchronousReadNonBlockingTotalLatencyBucket12": 0,
    "AsynchronousReadIoCountsBucket1": 0,
    "AsynchronousReadIoCountsBucket2": 0,
    "AsynchronousReadIoCountsBucket3": 0,
    "AsynchronousReadIoCountsBucket4": 0,
    "AsynchronousReadIoCountsBucket5": 0,
    "AsynchronousReadIoCountsBucket6": 0,
    "AsynchronousReadIoCountsBucket7": 0,
    "AsynchronousReadIoCountsBucket8": 0,
    "AsynchronousReadIoCountsBucket9": 0,
    "AsynchronousReadIoCountsBucket10": 0,
    "AsynchronousReadIoCountsBucket11": 0,
    "AsynchronousReadIoCountsBucket12": 0,
    "AsynchronousReadTotalLatencyBucket1": 0,
    "AsynchronousReadTotalLatencyBucket2": 0,
    "AsynchronousReadTotalLatencyBucket3": 0,
    "AsynchronousReadTotalLatencyBucket4": 0,
    "AsynchronousReadTotalLatencyBucket5": 0,
    "AsynchronousReadTotalLatencyBucket6": 0,
    "AsynchronousReadTotalLatencyBucket7": 0,
    "AsynchronousReadTotalLatencyBucket8": 0,
    "AsynchronousReadTotalLatencyBucket9": 0,
    "AsynchronousReadTotalLatencyBucket10": 0,
    "AsynchronousReadTotalLatencyBucket11": 0,
    "AsynchronousReadTotalLatencyBucket12": 0
  },
  "message": ""
}

References #