viewer9 documentation

ProcessStatistics PML Operation

Sometimes near the end of a bootlog capture there is a block of these events with one for each process, followed by a SystemStatistics event. It is odd that this is a class=1 operation, because it seems more like class=4 ThreadProfiling and ProcessProfiling.

It has the same fields as ProcessExit: ExitStatus, UserTime, KernelTime, WorkingSet, PeakWorkingSet, PrivateBytes, and PeakPrivateBytes. But ExitStatus is likely unused here.

Example from 64-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

ProcessStatistics opcode=1,8

ev=965242

Time:2022-05-17 20:43:46.5336466
Duration:0.0000000
ResultCode:SUCCESS
Tid:2376
ExitStatus:0
UserTime:0.2343750
KernelTime:4.9062500
WorkingSet:9752576
PeakWorkingSet:9805824
PrivateBytes:3608576
PeakPrivateBytes:3674112

evdata[0-51] file offset 400643035

000 00 00 00 64 a2 ec 02 ....d...
800 00 00 00 46 c3 23 00 ....F.#.
1600 00 00 00 00 d0 94 00 ........
2400 00 00 00 00 a0 95 00 ........
3200 00 00 00 00 10 37 00 ......7.
4000 00 00 00 00 10 38 00 ......8.
4800 00 00 00 ....

ProcessStatistics is "Process Statistics" with a space in Procmon. And likewise, these corresponding detail field names have spaces in Procmon: Exit Status, User Time, Kernel Time, Private Bytes, Peak Private Bytes, Working Set, Peak Working Set.

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.