| viewer9 documentation | Index Home |
SystemStatistics PML Operation
This event can occur at or near the end of a bootlog capture preceeded by a block of ProcessStatistics events for the processes.
PageSize (not shown in Procmon) is in bytes and is used to calculate CommitPeak.
CommitPeak is in bytes and is calculated by multiplying PageSize by the peak commitment page count at evdata[60] (see PML Binary Data and Results Offsets).
SystemCalls and ContextSwitches are 32-bit integers.
Example from 64-bit PML
Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.
SystemStatistics opcode=1,9
ev=584534
| Time: | 2021-01-16 17:26:55.2484409 |
| Duration: | 0.0000000 |
| ResultCode: | SUCCESS |
| Tid: | 11512 |
| PageSize: | 4096 |
| CommitPeak: | 4699230208 |
| SystemCalls: | 10998901 |
| ContextSwitches: | 2451607 |
evdata[0-315] file offset 309970942
| 0 | 00 10 00 00 ec 95 01 31 | .......1 |
| 8 | 00 00 00 00 f8 32 4e 1a | .....2N. |
| 16 | 00 00 00 00 90 2a 2d b2 | .....*-. |
| 24 | 00 00 00 00 82 a8 b2 01 | ........ |
| 32 | 00 00 00 00 a6 9e 01 00 | ........ |
| 40 | d2 0f 01 00 30 c8 1b 00 | ....0... |
| 48 | 8a 2a 30 00 f6 0e 11 00 | .*0..... |
| 56 | 99 0b 49 00 89 81 11 00 | ..I..... |
| 64 | 1f 39 2c 00 ab 17 01 00 | .9,..... |
| 72 | 26 f6 11 00 00 00 00 00 | &....... |
| 80 | 29 90 15 00 8a da 07 00 | )....... |
| 88 | 12 5d 01 00 00 00 00 00 | .]...... |
| 96 | 00 00 00 00 00 00 00 00 | ........ |
| 104 | 00 00 00 00 bb 00 00 00 | ........ |
| 112 | 07 00 00 00 f3 9b 00 00 | ........ |
| 120 | 70 dc 00 00 00 00 00 00 | p....... |
| 128 | 00 00 00 00 00 00 00 00 | ........ |
| 136 | 00 00 00 00 de cc be 00 | ........ |
| 144 | 02 00 00 00 13 1c 00 00 | ........ |
| 152 | 02 00 00 00 00 00 00 00 | ........ |
| 160 | 00 00 00 00 02 2a a5 00 | .....*.. |
| 168 | b2 45 00 00 55 90 00 00 | .E..U... |
| 176 | f9 0b 00 00 00 00 00 00 | ........ |
| 184 | d6 5e 01 00 00 00 00 00 | .^...... |
| 192 | 01 00 00 00 00 00 00 00 | ........ |
| 200 | 00 00 00 00 00 00 00 00 | ........ |
| 208 | 00 00 00 00 00 00 00 00 | ........ |
| 216 | f6 66 0f 00 00 00 00 00 | .f...... |
| 224 | c7 26 00 00 e7 da 00 00 | .&...... |
| 232 | 03 00 00 00 59 f5 00 00 | ....Y... |
| 240 | 1f a3 00 00 65 01 00 00 | ....e... |
| 248 | 91 02 00 00 16 6b 01 00 | .....k.. |
| 256 | b0 01 00 00 7b 77 00 00 | .....w.. |
| 264 | 00 00 00 00 32 00 00 00 | ....2... |
| 272 | 00 00 00 00 00 00 00 00 | ........ |
| 280 | 03 a3 00 00 f7 0b 00 00 | ........ |
| 288 | 35 0f 09 00 ba 20 00 00 | 5.... .. |
| 296 | f2 4d 09 00 97 68 25 00 | .M...h%. |
| 304 | 00 00 00 00 00 00 00 00 | ........ |
| 312 | 75 d4 a7 00 | u... |
Call Stack stacksize=22
| StackAddress | mod | ModName | ModPath |
|---|---|---|---|
| 0xfffff80559413939 | 11 | FLTMGR.SYS + 0x43939 | C:\WINDOWS\System32\drivers\FLTMGR.SYS |
| 0xfffff805594134ab | 11 | FLTMGR.SYS + 0x434ab | C:\WINDOWS\System32\drivers\FLTMGR.SYS |
| 0xfffff8055940be13 | 11 | FLTMGR.SYS + 0x3be13 | C:\WINDOWS\System32\drivers\FLTMGR.SYS |
| 0xfffff8055d252f55 | 13 | ntoskrnl.exe + 0x252f55 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8055d254544 | 13 | ntoskrnl.exe + 0x254544 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8055d5fec2d | 13 | ntoskrnl.exe + 0x5fec2d | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8055d62751e | 13 | ntoskrnl.exe + 0x62751e | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8055d5eb19a | 13 | ntoskrnl.exe + 0x5eb19a | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8055d66d14f | 13 | ntoskrnl.exe + 0x66d14f | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8055d66cd29 | 13 | ntoskrnl.exe + 0x66cd29 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8055d4071b5 | 13 | ntoskrnl.exe + 0x4071b5 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0x7ffa1f32ca54 | 324 | ntdll.dll + 0x9ca54 | C:\WINDOWS\SYSTEM32\ntdll.dll |
| 0x7ffa1a3b202f | 278 | apphelp.dll + 0x4202f | C:\WINDOWS\SYSTEM32\apphelp.dll |
| 0x7ffa092123b8 | 252 | fltLib.dll + 0x23b8 | C:\WINDOWS\SYSTEM32\FLTLIB.DLL |
| 0x7ff6c1f31f9d | 220 | Procmon64.exe + 0x11f9d | C:\Users\Ben\AppData\Local\Programs\SysInternals\Procmon64.exe |
| 0x7ff6c1f62eaa | 220 | Procmon64.exe + 0x42eaa | C:\Users\Ben\AppData\Local\Programs\SysInternals\Procmon64.exe |
| 0x7ff6c1f64aba | 220 | Procmon64.exe + 0x44aba | C:\Users\Ben\AppData\Local\Programs\SysInternals\Procmon64.exe |
| 0x7ff6c1f71b39 | 220 | Procmon64.exe + 0x51b39 | C:\Users\Ben\AppData\Local\Programs\SysInternals\Procmon64.exe |
| 0x7ff6c1f8e219 | 220 | Procmon64.exe + 0x6e219 | C:\Users\Ben\AppData\Local\Programs\SysInternals\Procmon64.exe |
| 0x7ff6c1f9f192 | 220 | Procmon64.exe + 0x7f192 | C:\Users\Ben\AppData\Local\Programs\SysInternals\Procmon64.exe |
| 0x7ffa1d8f7034 | 309 | kernel32.dll + 0x17034 | C:\WINDOWS\System32\KERNEL32.DLL |
| 0x7ffa1f2dd0d1 | 324 | ntdll.dll + 0x4d0d1 | C:\WINDOWS\SYSTEM32\ntdll.dll |
SystemStatistics is "System Statistics" with a space in Procmon. And likewise, these corresponding detail field names have spaces in Procmon: Commit Peak, System Calls, Context Switches.
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.