detection.wiki

Microsoft-Windows-Ntfs › Event 171

Event ID 171 — File-Level Trim Summary.

Provider
Microsoft-Windows-Ntfs
Channel
Operational
Level
Informational
Opcode
Info

Description

File-Level Trim Summary.

Message #

File-Level Trim Summary:

           Volume Id: %1
           Volume name: %3
           Is boot volume: %4
           
           Period duration (us): %5
           
           Operation count: %6
           Reposted operation count: %7
           Failed operation count: %8
           Operation range count: %9
           Operation byte count: %10
           Operation long range byte count %11
           Unaligned range count: %12
           Bytes in unaligned ranges: %13
           Operation trim extent count: %14
           Non-blocking aligned trim byte count: %15
           Reclaimed byte count: %16
           
           Byte count bucket values: [%18]
           
           Operation counts: [%19, %20, %21, %22, %23, %24, %25, %26, %27, %28, %29, %30]
           Operation byte counts: [%31, %32, %33, %34, %35, %36, %37, %38, %39, %40, %41, %42]
           Operation bytes reclaimed: [%43, %44, %45, %46, %47, %48, %49, %50, %51, %52, %53, %54]
           Operation latency (us): [%55, %56, %57, %58, %59, %60, %61, %62, %63, %64, %65, %67]
           
           Latency bucket values: [%68]
           
           Operation latency count: [%69, %70, %71, %72, %73, %74, %75, %76, %77, %78, %79, %80, %81, %82, %83]
           
           Top failure status codes and instance counts:
               %84      %85
               %86      %87
               %88      %89
               %90      %91
               %92      %93

Fields #

NameDescription
VolumeCorrelationId GUID[File-Level Trim Summary] Volume Id.
VolumeNameLength UInt16—
VolumeName UnicodeString[File-Level Trim Summary] Volume name.
IsBootVolume Boolean[File-Level Trim Summary] Is boot volume.
PeriodDurationMicrosSec Int64[File-Level Trim Summary] Period duration (us).
OperationCount UInt64[File-Level Trim Summary] Operation count.
RepostedOperationCount UInt64[File-Level Trim Summary] Reposted operation count.
FailedOperationCount UInt64[File-Level Trim Summary] Failed operation count.
OperationRangeCount UInt64[File-Level Trim Summary] Operation range count.
OperationByteCount UInt64[File-Level Trim Summary] Operation byte count.
OperationLongRangeByteCount UInt64—
UnalignedRangeCount UInt64[File-Level Trim Summary] Unaligned range count.
BytesInUnalignedRanges UInt64[File-Level Trim Summary] Bytes in unaligned ranges.
OperationTrimExtentCount UInt64[File-Level Trim Summary] Operation trim extent count.
NonBlockAlignedTrimByteCount UInt64[File-Level Trim Summary] Non-blocking aligned trim byte count.
ReclaimedByteCount UInt64[File-Level Trim Summary] Reclaimed byte count.
ByteCountLabelsLength UInt16—
ByteCountLabels UnicodeString—
OperationCountBuckets1 UInt64—
OperationCountBuckets2 UInt64—
OperationCountBuckets3 UInt64—
OperationCountBuckets4 UInt64—
OperationCountBuckets5 UInt64—
OperationCountBuckets6 UInt64—
OperationCountBuckets7 UInt64—
OperationCountBuckets8 UInt64—
OperationCountBuckets9 UInt64—
OperationCountBuckets10 UInt64—
OperationCountBuckets11 UInt64—
OperationCountBuckets12 UInt64—
OperationByteCountBuckets1 UInt64—
OperationByteCountBuckets2 UInt64—
OperationByteCountBuckets3 UInt64—
OperationByteCountBuckets4 UInt64—
OperationByteCountBuckets5 UInt64—
OperationByteCountBuckets6 UInt64—
OperationByteCountBuckets7 UInt64—
OperationByteCountBuckets8 UInt64—
OperationByteCountBuckets9 UInt64—
OperationByteCountBuckets10 UInt64—
OperationByteCountBuckets11 UInt64—
OperationByteCountBuckets12 UInt64—
OperationBytesReclaimedBuckets1 UInt64—
OperationBytesReclaimedBuckets2 UInt64—
OperationBytesReclaimedBuckets3 UInt64—
OperationBytesReclaimedBuckets4 UInt64—
OperationBytesReclaimedBuckets5 UInt64—
OperationBytesReclaimedBuckets6 UInt64—
OperationBytesReclaimedBuckets7 UInt64—
OperationBytesReclaimedBuckets8 UInt64—
OperationBytesReclaimedBuckets9 UInt64—
OperationBytesReclaimedBuckets10 UInt64—
OperationBytesReclaimedBuckets11 UInt64—
OperationBytesReclaimedBuckets12 UInt64—
OperationLatencyBuckets1 UInt64—
OperationLatencyBuckets2 UInt64—
OperationLatencyBuckets3 UInt64—
OperationLatencyBuckets4 UInt64—
OperationLatencyBuckets5 UInt64—
OperationLatencyBuckets6 UInt64—
OperationLatencyBuckets7 UInt64—
OperationLatencyBuckets8 UInt64—
OperationLatencyBuckets9 UInt64—
OperationLatencyBuckets10 UInt64—
OperationLatencyBuckets11 UInt64—
OperationLatencyBuckets12 UInt64—
LatencyBucketLabelsLength UInt16—
LatencyBucketLabelsLabels UnicodeString—
OperationCountLatencyBuckets1 UInt64—
OperationCountLatencyBuckets2 UInt64—
OperationCountLatencyBuckets3 UInt64—
OperationCountLatencyBuckets4 UInt64—
OperationCountLatencyBuckets5 UInt64—
OperationCountLatencyBuckets6 UInt64—
OperationCountLatencyBuckets7 UInt64—
OperationCountLatencyBuckets8 UInt64—
OperationCountLatencyBuckets9 UInt64—
OperationCountLatencyBuckets10 UInt64—
OperationCountLatencyBuckets11 UInt64—
OperationCountLatencyBuckets12 UInt64—
OperationCountLatencyBuckets13 UInt64—
OperationCountLatencyBuckets14 UInt64—
OperationCountLatencyBuckets15 UInt64—
OperationFailureStatusCode1 HexInt32Top failure status codes and instance counts
OperationFailureCount1 UInt64—
OperationFailureStatusCode2 HexInt32—
OperationFailureCount2 UInt64—
OperationFailureStatusCode3 HexInt32—
OperationFailureCount3 UInt64—
OperationFailureStatusCode4 HexInt32—
OperationFailureCount4 UInt64—
OperationFailureStatusCode5 HexInt32—
OperationFailureCount5 UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Ntfs",
    "guid": "3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482",
    "event_source_name": "",
    "event_id": 171,
    "version": 3,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611967493406195712,
    "time_created": "2023-11-05T22:47:04.962167+00:00",
    "event_record_id": 182,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 52
    },
    "channel": "Microsoft-Windows-Ntfs/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VolumeCorrelationId": "7597D2A3-4404-4F99-B979-6233378A81BF",
    "VolumeNameLength": 2,
    "VolumeName": "C:",
    "IsBootVolume": true,
    "PeriodDurationMicrosSec": 899757629,
    "OperationCount": 2,
    "RepostedOperationCount": 0,
    "FailedOperationCount": 0,
    "OperationRangeCount": 2,
    "OperationByteCount": 0,
    "OperationLongRangeByteCount": 18446744073709551614,
    "UnalignedRangeCount": 0,
    "BytesInUnalignedRanges": 0,
    "OperationTrimExtentCount": 2,
    "NonBlockAlignedTrimByteCount": 0,
    "ReclaimedByteCount": 2030043136,
    "ByteCountLabelsLength": 80,
    "ByteCountLabels": "4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB",
    "OperationCountBuckets1": 0,
    "OperationCountBuckets2": 0,
    "OperationCountBuckets3": 0,
    "OperationCountBuckets4": 0,
    "OperationCountBuckets5": 0,
    "OperationCountBuckets6": 0,
    "OperationCountBuckets7": 0,
    "OperationCountBuckets8": 0,
    "OperationCountBuckets9": 0,
    "OperationCountBuckets10": 0,
    "OperationCountBuckets11": 0,
    "OperationCountBuckets12": 2,
    "OperationByteCountBuckets1": 0,
    "OperationByteCountBuckets2": 0,
    "OperationByteCountBuckets3": 0,
    "OperationByteCountBuckets4": 0,
    "OperationByteCountBuckets5": 0,
    "OperationByteCountBuckets6": 0,
    "OperationByteCountBuckets7": 0,
    "OperationByteCountBuckets8": 0,
    "OperationByteCountBuckets9": 0,
    "OperationByteCountBuckets10": 0,
    "OperationByteCountBuckets11": 0,
    "OperationByteCountBuckets12": 0,
    "OperationBytesReclaimedBuckets1": 0,
    "OperationBytesReclaimedBuckets2": 0,
    "OperationBytesReclaimedBuckets3": 0,
    "OperationBytesReclaimedBuckets4": 0,
    "OperationBytesReclaimedBuckets5": 54,
    "OperationBytesReclaimedBuckets6": 0,
    "OperationBytesReclaimedBuckets7": 70,
    "OperationBytesReclaimedBuckets8": 0,
    "OperationBytesReclaimedBuckets9": 0,
    "OperationBytesReclaimedBuckets10": 0,
    "OperationBytesReclaimedBuckets11": 0,
    "OperationBytesReclaimedBuckets12": 0,
    "OperationLatencyBuckets1": 0,
    "OperationLatencyBuckets2": 0,
    "OperationLatencyBuckets3": 0,
    "OperationLatencyBuckets4": 0,
    "OperationLatencyBuckets5": 0,
    "OperationLatencyBuckets6": 0,
    "OperationLatencyBuckets7": 0,
    "OperationLatencyBuckets8": 0,
    "OperationLatencyBuckets9": 0,
    "OperationLatencyBuckets10": 0,
    "OperationLatencyBuckets11": 0,
    "OperationLatencyBuckets12": 248,
    "LatencyBucketLabelsLength": 79,
    "LatencyBucketLabelsLabels": "256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+",
    "OperationCountLatencyBuckets1": 2,
    "OperationCountLatencyBuckets2": 0,
    "OperationCountLatencyBuckets3": 0,
    "OperationCountLatencyBuckets4": 0,
    "OperationCountLatencyBuckets5": 0,
    "OperationCountLatencyBuckets6": 0,
    "OperationCountLatencyBuckets7": 0,
    "OperationCountLatencyBuckets8": 0,
    "OperationCountLatencyBuckets9": 0,
    "OperationCountLatencyBuckets10": 0,
    "OperationCountLatencyBuckets11": 0,
    "OperationCountLatencyBuckets12": 0,
    "OperationCountLatencyBuckets13": 0,
    "OperationCountLatencyBuckets14": 0,
    "OperationCountLatencyBuckets15": 0,
    "OperationFailureStatusCode1": "0x0",
    "OperationFailureCount1": 0,
    "OperationFailureStatusCode2": "0x0",
    "OperationFailureCount2": 0,
    "OperationFailureStatusCode3": "0x0",
    "OperationFailureCount3": 0,
    "OperationFailureStatusCode4": "0x0",
    "OperationFailureCount4": 0,
    "OperationFailureStatusCode5": "0x0",
    "OperationFailureCount5": 0
  },
  "message": ""
}

References #