{"id":189,"date":"2016-04-25T01:20:03","date_gmt":"2016-04-25T01:20:03","guid":{"rendered":"http:\/\/eventlogxp.com\/blog\/?p=189"},"modified":"2016-05-21T14:23:42","modified_gmt":"2016-05-21T14:23:42","slug":"windows-boot-performance-diagnostics-1","status":"publish","type":"post","link":"https:\/\/eventlogxp.com\/blog\/windows-boot-performance-diagnostics-1\/","title":{"rendered":"Windows boot performance diagnostics. Part 1"},"content":{"rendered":"

Have you ever seen that your computer starts booting slowly? Or it slowly restores its state from hibernation. Maybe you observe performance issues when shutdown or hibernate process? In this article, I will show you how you can use Event Log Explorer to find performance problems linked with the startup\/shutdown\/hibernate\/resume processes.<\/p>\n

Starting from Windows Vista, Microsoft provides a bunch of event logs for different system purposes. In Windows Event Viewer, these logs are located in a special branch: “Applications and Services Logs”. Windows records performance diagnostics events into Microsoft-Windows-Diagnostics-Performance\/Operational event log. To open this log in Windows Event Viewer, open Applications and Services Logs branch, then open Microsoft, then open Windows, then select Diagnostics-Performance and click on Operational.\u00a0 In Event Log Explorer you can do it easier: open your computer in the tree, then open Microsoft-Windows folder and then click\u00a0 Microsoft-Windows-Diagnostics-Performance\/Operational.<\/p>\n

\"Microsoft-Windows-Diagnostics-Performance\"<\/a><\/p>\n

Now you can see a list of different diagnostic events. As you can see, events with the same event ID may have different types \u2013 Warning, Error and Critical. It looks like these event types depend on the duration of the startup\/shutdown process. Another observation \u2013 theses events contain many important parameters internally, but you can’t see them in the event description (Windows Event Viewer doesn’t display them as well). The only way to display these parameters is to double click on the event to display event properties and switch to XML tab.<\/p>\n

Compare:
\n\"diagnostics-performance<\/a><\/p>\n

Unfortunately, I didn’t find a detailed documentation about all these events, so I did some research. First, I got meaning of events in Microsoft-Windows-Diagnostics-Performance:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Event ID<\/td>\nEvent Description<\/td>\n<\/tr>\n
Boot Performance Monitoring<\/strong><\/td>\n<\/tr>\n
100<\/td>\nWindows has started up<\/td>\n<\/tr>\n
101<\/td>\nThis application took longer than usual to start up, resulting in a performance degradation in the system startup process<\/td>\n<\/tr>\n
102<\/td>\nThis driver took longer to initialize, resulting in a performance degradation in the system start up process<\/td>\n<\/tr>\n
103<\/td>\nThis startup service took longer than expected to startup, resulting in a performance degradation in the system start up process<\/td>\n<\/tr>\n
104<\/td>\nCore system took longer to initialize, resulting in a performance degradation in the system start up process<\/td>\n<\/tr>\n
105<\/td>\nForeground optimizations (prefetching) took longer to complete, resulting in a performance degradation in the system start up process<\/td>\n<\/tr>\n
106<\/td>\nBackground optimizations (prefetching) took longer to complete, resulting in a performance degradation in the system start up process<\/td>\n<\/tr>\n
107<\/td>\nApplication of machine policy caused a slow down in the system start up process<\/td>\n<\/tr>\n
108<\/td>\nApplication of user policy caused a slow down in the system start up process<\/td>\n<\/tr>\n
109<\/td>\nThis device took longer to initialize, resulting in a performance degradation in the system start up process<\/td>\n<\/tr>\n
110<\/td>\nSession manager initialization caused a slow down in the startup process<\/td>\n<\/tr>\n
Shutdown Performance Monitoring<\/strong><\/td>\n<\/tr>\n
200<\/td>\nWindows has shutdown<\/td>\n<\/tr>\n
201<\/td>\nThis application caused a delay in the system shutdown process<\/td>\n<\/tr>\n
202<\/td>\nThis device caused a delay in the system shutdown process<\/td>\n<\/tr>\n
203<\/td>\nThis service caused a delay in the system shutdown process<\/td>\n<\/tr>\n
Standby Performance Monitoring<\/strong><\/td>\n<\/tr>\n
300<\/td>\nWindows has resumed from standby<\/td>\n<\/tr>\n
301<\/td>\nThis application caused a delay during standby<\/td>\n<\/tr>\n
302<\/td>\nThis driver caused a delay during standby while servicing a device<\/td>\n<\/tr>\n
303<\/td>\nThis service caused a delay during hybrid-sleep<\/td>\n<\/tr>\n
304<\/td>\nCreation of the hiber-file was slower than expected<\/td>\n<\/tr>\n
305<\/td>\nPersisting disk caches was slower than expected<\/td>\n<\/tr>\n
306<\/td>\nPreparing the video subsystem for sleep was slower than expected<\/td>\n<\/tr>\n
307<\/td>\nPreparing Winlogon for sleep was slower than expected<\/td>\n<\/tr>\n
308<\/td>\nPreparing system memory for sleep was slower than expected<\/td>\n<\/tr>\n
309<\/td>\nPreparing core system for sleep was slower than expected<\/td>\n<\/tr>\n
310<\/td>\nPreparing system worker threads for sleep was slower than expected<\/td>\n<\/tr>\n
350<\/td>\nBios initialization time was greater than 250ms (logo requirement) during system resume<\/td>\n<\/tr>\n
351<\/td>\nThis driver responded slower than expected to the resume request while servicing this device<\/td>\n<\/tr>\n
352<\/td>\nReading the hiber-file was slower than expected<\/td>\n<\/tr>\n
System Performance Monitoring<\/strong><\/td>\n<\/tr>\n
400<\/td>\nInformation about the system performance monitoring event<\/td>\n<\/tr>\n
401<\/td>\nThis process is using up processor time and is impacting the performance of Windows<\/td>\n<\/tr>\n
402<\/td>\nThis process is doing excessive disk activities and is impacting the performance of Windows<\/td>\n<\/tr>\n
403<\/td>\nThis driver is using up too many resources and is impacting the performance of Windows<\/td>\n<\/tr>\n
404<\/td>\nThis driver is waiting longer than expected on a device<\/td>\n<\/tr>\n
405<\/td>\nThis file is fragmented and is impacting the performance of Windows<\/td>\n<\/tr>\n
406<\/td>\nDisk IO to this file is taking longer than expected<\/td>\n<\/tr>\n
407<\/td>\nThis process is using up too much system memory<\/td>\n<\/tr>\n
408<\/td>\nMany processes are using too much system memory<\/td>\n<\/tr>\n
Desktop Window Manager Monitoring<\/strong><\/td>\n<\/tr>\n
500<\/td>\nThe Desktop Window Manager is experiencing heavy resource contention<\/td>\n<\/tr>\n
501<\/td>\nThe Desktop Window Manager is experiencing heavy resource contention<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Since we research boot\/shutdown\/standby\/resume performance, we should pay attention to 1xx, 2xx and 3xx events. We can see that events 100, 200 and 300 are basic events followed by 1xx, 2xx and 3xx which give extra information about the problem.<\/p>\n

E.g. I can see two events<\/p>\n

Event 100 :\r\n\r\nWindows has started up:\r\n\u00a0 \u00a0 Boot Duration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 34857ms\r\n\u00a0 \u00a0 IsDegradation\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\r\n\u00a0 \u00a0 Incident Time (UTC)\u00a0 :\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 18.11.2015 23:58:10\r\n<\/pre>\n
 <\/p>\n
Event 102:\r\n\r\nThis driver took longer to initialize, resulting in a performance degradation in the system start up process:\r\n\u00a0 \u00a0 File Name \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 \u00a0: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0mssmbios\r\n\u00a0 \u00a0 Friendly Name \u00a0 \u00a0 \u00a0\u00a0 \u00a0:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 System Management BIOS Driver\r\n\u00a0 \u00a0 Version\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6.1.7600.16385 (win7_rtm.090713-1255)\r\n\u00a0 \u00a0 Total Time\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1027ms\r\n\u00a0 \u00a0 Degradation Time\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1026ms\r\n\u00a0 \u00a0 Incident Time (UTC) \u00a0 :\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 18.11.2015 23:58:10\r\n<\/pre>\n
So we can see that System Management BIOS Driver caused the delay in the system boot up.<\/p>\n
Unfortunately sometimes events 100, 200 and 300 occur alone without followed events. In this case it is impossible to detect the reason of the delay using Diagnostics-Performance event log.<\/p>\n
You should pay attention to parameters of Event 100 (Microsoft-Windows-Diagnostics-Performance):<\/p>\n
 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \r\n System<\/strong>\r\n ...\r\n EventData<\/strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootTsVersion <\/strong>2\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootStartTime\u00a0 <\/strong>2015-11-18T20:58:10.671600300Z\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootEndTime\u00a0\u00a0\u00a0 <\/strong>2015-11-18T20:58:10.671600300Z\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SystemBootInstance\u00a0\u00a0\u00a0\u00a0 <\/strong>89\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 UserBootInstance\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>84\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootTime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>34857\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 MainPathBootTime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>12657\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootKernelInitTime\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>21\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootDriverInitTime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>3101\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootDevicesInitTime\u00a0\u00a0\u00a0 <\/strong>18\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootPrefetchInitTime\u00a0 <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootPrefetchBytes\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootAutoChkTime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootSmssInitTime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>5084\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootCriticalServicesInitTime\u00a0\u00a0\u00a0 <\/strong>436\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootUserProfileProcessingTime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>2683\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootMachineProfileProcessingTime\u00a0\u00a0\u00a0 <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootExplorerInitTime\u00a0\u00a0 <\/strong>848\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootNumStartupApps\u00a0 <\/strong>24\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootPostBootTime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>22200\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootIsRebootAfterInstall\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>false\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootRootCauseStepImprovementBits <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootRootCauseGradualImprovementBits\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootRootCauseStepDegradationBits\u00a0\u00a0\u00a0 <\/strong>4\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootRootCauseGradualDegradationBits\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootIsDegradation\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>False\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootIsStepDegradation\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>false\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootIsGradualDegradation\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>false\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootImprovementDelta\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootDegradationDelta <\/strong>0\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootIsRootCauseIdentified\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>true\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OSLoaderDuration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>735\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootPNPInitStartTimeMS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>21\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BootPNPInitDuration\u00a0\u00a0\u00a0 <\/strong>1342\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OtherKernelInitDuration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>332\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SystemPNPInitStartTimeMS\u00a0\u00a0\u00a0\u00a0 <\/strong>1665\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SystemPNPInitDuration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>1776\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SessionInitStartTimeMS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>3451\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Session0InitDuration\u00a0\u00a0\u00a0 <\/strong>2088\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Session1InitDuration\u00a0\u00a0\u00a0 <\/strong>339\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SessionInitOtherDuration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>2656\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 WinLogonStartTimeMS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>8536\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 OtherLogonInitActivityDuration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>587\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 UserLogonWaitDuration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>3551\r\n<\/pre>\n
Most of parameters are self-descriptive.<\/p>\n
Pay attention that BootTime= MainPathBootTime + BootPostBootTime<\/p>\n
MainPathBootTime is the time (in milliseconds) \u00a0from when the Windows Logo first appears on screen and until your desktop or logon prompt is presented.<\/p>\n
BootPostBootTime is the time (in milliseconds) from the logon screen or desktop showing up and until the system become actually usable (the system has reached 80% idle).<\/p>\n
In\u00a0 many cases (but not\u00a0in my sample), the problem with long boot time is linked with Windows Prefetcher \u2013 you will see that BootPrefetchInitTime is set to a large value, e.g. 60000 or more. In this case you can play with Superfetch service and Superfetch caching parameters (registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters). If you have just changed your HDD or SSD, you should re-run the assessment in Performance Information and Tools applet (or just run Winsat command as winsat.exe diskformal) to make Windows use the best prefetch strategy.<\/p>\n
Now you have some background information about\u00a0Diagnostics-Performance events.\u00a0In the\u00a0next part<\/a> I will show how Event Log Explorer helps to detect boot performance issues.<\/p>\n\"Facebook\"<\/a>\"twitter\"<\/a>\"reddit\"<\/a>\"pinterest\"<\/a>\"linkedin\"<\/a>\"mail\"<\/a>","protected":false},"excerpt":{"rendered":"
Have you ever seen that your computer starts booting slowly? Or it slowly restores its state from hibernation. Maybe you observe performance issues when shutdown or hibernate process? In this article, I will show you how you can use Event Log Explorer to find performance problems linked with the startup\/shutdown\/hibernate\/resume processes. Starting from Windows Vista, Microsoft provides a bunch of event logs for different system\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":2,"featured_media":197,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[39],"tags":[21,9],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/189"}],"collection":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/comments?post=189"}],"version-history":[{"count":8,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/189\/revisions"}],"predecessor-version":[{"id":246,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/189\/revisions\/246"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media\/197"}],"wp:attachment":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media?parent=189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/categories?post=189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/tags?post=189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}