Description

The device (DeviceName) is suitable for a ReadyBoost cache. The random read speed is ReadRate KB/sec. The random write speed is WriteRate KB/sec.

Message #

The device (%1) is suitable for a ReadyBoost cache.  The random read speed is %3 KB/sec.  The random write speed is %4 KB/sec.

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it is not attached to a supported interface.

Message #

The device (%1) will not be used for a ReadyBoost cache because it is not attached to a supported interface.
     For USB devices, ReadyBoost requires that the device be connected to a USB 2.0 interface.

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it does not have enough free space. Free Space: IntValue MB.

Message #

The device (%1) will not be used for a ReadyBoost cache because it does not have enough free space. Free Space: %2 MB

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it has insufficient write performance: IORate KB/sec.

Message #

The device (%1) will not be used for a ReadyBoost cache because it has insufficient write performance: %2 KB/sec.

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it has insufficient read performance: IORate KB/sec.

Message #

The device (%1) will not be used for a ReadyBoost cache because it has insufficient read performance: %2 KB/sec.

Fields #

Description

The ReadyBoost service encountered an error during the analysis of the new device (DeviceName). Error code: ErrorCode.

Message #

The ReadyBoost service encountered an error during the analysis of the new device (%1). Error code: %2

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it is not formatted with FAT, FAT32, or NTFS. Current Format:%2.

Message #

The device (%1) will not be used for a ReadyBoost cache because it is not formatted with FAT, FAT32, or NTFS. Current Format:%2

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it does not exhibit uniform performance across the device. Size of fast region: IntValue MB.

Message #

The device (%1) will not be used for a ReadyBoost cache because it does not exhibit uniform performance across the device.  Size of fast region: %2 MB.

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because the device is too small. Size: IntValue MB. Minimum Size: SecondIntValue MB.

Message #

The device (%1) will not be used for a ReadyBoost cache because the device is too small. Size: %2 MB.  Minimum Size: %3 MB

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ReadyBoost",
    "guid": "E6307A09-292C-497E-AAD6-498F68E2B619",
    "event_source_name": "",
    "event_id": 1009,
    "version": 0,
    "level": 4,
    "task": 1019,
    "opcode": 0,
    "keywords": 9223372036854792192,
    "time_created": "2023-10-25T21:22:34.627310+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 2740,
      "thread_id": 2832
    },
    "channel": "Microsoft-Windows-ReadyBoost/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceName": "Unknown Unknown",
    "IntValue": 96,
    "SecondIntValue": 235
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

A ReadyBoost cache was successfully created on the device (DeviceName) of size IntValue MB.

Message #

A ReadyBoost cache was successfully created on the device (%1) of size %2 MB.

Fields #

Description

Caching was enabled for device (DeviceName).

Message #

Caching was enabled for device (%1).

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because a ReadyBoost cache already exists (on device StringLabel) and only one cache is supported at a given time.

Message #

The device (%1) will not be used for a ReadyBoost cache because a ReadyBoost cache already exists (on device %2) and only one cache is supported at a given time.

Fields #

Description

A ReadyBoost cache was successfully deleted on the device (DeviceName).

Message #

A ReadyBoost cache was successfully deleted on the device (%1).

Fields #

Description

Caching was disabled for device (DeviceName).

Message #

Caching was disabled for device (%1).

Fields #

Description

Summary of ReadyBoot Performance.

Message #

Summary of ReadyBoot Performance:
     Io Read Count: %12
     Io Read KB: %3
     Cache Hit Count: %13
     Cache Hit KB: %4
     Cache Hit Percentage: %9
     Cache Fragmentation: %10
     Compressed Data Size KB: %5
     Raw Data Size KB: %6
     Compression Ratio: %11
     Cache Size KB: %14
     Boot Prefetch Time us: %7
     Boot Prefetch Bytes Read: %8
     Boot Timestamp (UTC): %1
     Last Boot Plan Timestamp (UTC): %2
     Last Boot Plan Timestamp (Local): %16

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ReadyBoost",
    "guid": "E6307A09-292C-497E-AAD6-498F68E2B619",
    "event_source_name": "",
    "event_id": 1015,
    "version": 2,
    "level": 4,
    "task": 1016,
    "opcode": 0,
    "keywords": 9223372036854784000,
    "time_created": "2023-10-25T22:49:28.791349+00:00",
    "event_record_id": 27,
    "correlation": {},
    "execution": {
      "process_id": 1584,
      "thread_id": 5392
    },
    "channel": "Microsoft-Windows-ReadyBoost/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RB_IoReadBytes": 957741056,
    "RB_CacheHitBytes": 639155712,
    "RB_PrefetchBytes": 711483392,
    "RB_CacheHitPercentage": "86.88958156229337",
    "RB_IoReadCount": 31761,
    "RB_CacheHitCount": 27597,
    "RB_PrefetchReadCount": 17181,
    "RB_PrefetchDiskTimeUs": 28124905,
    "RB_SyncPrefetchIoBytes": 439320576,
    "RB_SyncPrefetchIoCount": 10433,
    "RB_SyncPhaseDurationUs": 9889786,
    "RB_PostSyncPhasePendCount": 0,
    "RB_Flags": 96
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

Boot plan calculation completed.

Message #

Boot plan calculation completed.
     Boot Plan Timestamp (UTC): %1
     Valid Boot Plan Obtained: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ReadyBoost",
    "guid": "E6307A09-292C-497E-AAD6-498F68E2B619",
    "event_source_name": "",
    "event_id": 1016,
    "version": 1,
    "level": 4,
    "task": 1016,
    "opcode": 0,
    "keywords": 9223372036854784000,
    "time_created": "2023-10-26T04:18:10.972559+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 1060,
      "thread_id": 3548
    },
    "channel": "Microsoft-Windows-ReadyBoost/Operational",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BootPlanTimestamp": "2023-10-25T21:18:10.357218Z",
    "ErrorCode": 1104,
    "Duration (ms)": 609,
    "Reason": 0
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

A defrag. operation has completed. A boot plan will be calculated soon. Defrag. Timestamp (UTC): DeviceName.

Message #

A defrag. operation has completed.  A boot plan will be calculated soon.  Defrag. Timestamp (UTC): %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ReadyBoost",
    "guid": "E6307A09-292C-497E-AAD6-498F68E2B619",
    "event_source_name": "",
    "event_id": 1017,
    "version": 1,
    "level": 4,
    "task": 1019,
    "opcode": 0,
    "keywords": 9223372036854792192,
    "time_created": "2023-10-26T04:17:59.788230+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 1060,
      "thread_id": 1880
    },
    "channel": "Microsoft-Windows-ReadyBoost/Operational",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceName": "Unknown Unknown"
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

ReadyBoot disk assessment completed.

Message #

ReadyBoot disk assessment completed.
     Disk Assessment Timestamp (UTC): %1
     Success: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ReadyBoost",
    "guid": "E6307A09-292C-497E-AAD6-498F68E2B619",
    "event_source_name": "",
    "event_id": 1018,
    "version": 1,
    "level": 4,
    "task": 1016,
    "opcode": 0,
    "keywords": 9223372036854784000,
    "time_created": "2023-10-25T22:36:43.767022+00:00",
    "event_record_id": 24,
    "correlation": {},
    "execution": {
      "process_id": 1640,
      "thread_id": 3768
    },
    "channel": "Microsoft-Windows-ReadyBoost/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DiskAssessmentTimestamp": "2023-10-25T15:36:42.388640Z",
    "ErrorCode": 0,
    "Duration (ms)": 1375
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it is remote, read-only, virtual, or otherwise unsupported.

Message #

The device (%1) will not be used for a ReadyBoost cache because it is remote, read-only, virtual, or otherwise unsupported.

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it contains a system volume.

Message #

The device (%1) will not be used for a ReadyBoost cache because it contains a system volume.

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it contains a configuration file which explicitly prohibits this.

Message #

The device (%1) will not be used for a ReadyBoost cache because it contains a configuration file which explicitly prohibits this.

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because the ReadyBoost driver is attached to its volume stack.

Message #

The device (%1) will not be used for a ReadyBoost cache because the ReadyBoost driver is attached to its volume stack.

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it is mounted read-only.

Message #

The device (%1) will not be used for a ReadyBoost cache because it is mounted read-only.

 This is usually caused by one of the following reasons:
 * Write-protected devices/media
 * BitLocker group policy settings prohibit write access to non-encrypted removable devices

Fields #

Fields #

Description

The device (DeviceName) will not be used for a ReadyBoost cache because it is a VHD (virtual hard disk).

Message #

The device (%1) will not be used for a ReadyBoost cache because it is a VHD (virtual hard disk).

Fields #

Description

The attach state for volume VolumePath (Unique Id: VolumeUniqueId) has changed.

Message #

The attach state for volume %6 (Unique Id: %1) has changed.
     Old ReadyBoost State: %2
     New ReadyBoost State: %3

     Old Hybrid Drive State: %4
     New Hybrid Drive State: %5

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ReadyBoost",
    "guid": "E6307A09-292C-497E-AAD6-498F68E2B619",
    "event_source_name": "",
    "event_id": 1026,
    "version": 1,
    "level": 4,
    "task": 1016,
    "opcode": 0,
    "keywords": 9223372036854784000,
    "time_created": "2023-10-26T04:17:59.786234+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 1060,
      "thread_id": 1880
    },
    "channel": "Microsoft-Windows-ReadyBoost/Operational",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VolumeUniqueId": "C>MKj%0735aP",
    "OldRdbAttachState": 3,
    "NewRdbAttachState": 0,
    "OldHbdrvAttachState": 0,
    "NewHbdrvAttachState": 0,
    "VolumePath": "\\DEVICE\\HARDDISKVOLUME4"
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

ReadyBoot has updated the system volume unique ID: VolumeUniqueId.

Message #

ReadyBoot has updated the system volume unique ID: %3
 ErrorCode: %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ReadyBoost",
    "guid": "E6307A09-292C-497E-AAD6-498F68E2B619",
    "event_source_name": "",
    "event_id": 1027,
    "version": 1,
    "level": 4,
    "task": 1016,
    "opcode": 0,
    "keywords": 9223372036854784000,
    "time_created": "2023-11-05T22:33:04.671740+00:00",
    "event_record_id": 32,
    "correlation": {},
    "execution": {
      "process_id": 1896,
      "thread_id": 2032
    },
    "channel": "Microsoft-Windows-ReadyBoost/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorCode": 0,
    "UniqueIdLength": 0,
    "VolumeUniqueId": ""
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

Caching on the solid state hybrid disk (Disk number: DiskNumber) has been disabled due to insufficient device performance.

Message #

Caching on the solid state hybrid disk (Disk number: %1) has been disabled due to insufficient device performance.

Fields #

Description

A speed test was performed on the Hybrid Disk.

Message #

A speed test was performed on the Hybrid Disk.
Test result: %1
ErrorCode: %7

Fields #