Boot Processes

uberAgent collects detailed information about each process running during the boot process like the command line and latency.

Details

• Source type: uberAgent:OnOffTransition:BootProcesses
• Used in dashboards: Single Boot Duration
• Enabled through configuration setting: BootDetail
• Related configuration settings: n/a
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
ProcName	Process name	String		svchost.exe
ProcID	Process ID	Number		456
ProcParentID	Parent process ID	Number		789
ProcStartTimeRelativeMs	Relative process start time	Number	ms	100
ProcLifetimeMs	Process lifetime	Number	ms	50
ProcCmdline	Process commandline	String		C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
ProcIOReadCount	Count of process I/O read operations	Number		91
ProcIOWriteCount	Count of process I/O write operations	Number		97
ProcIOReadMB	Amount of process I/O read operations data volume	Number	MB	50
ProcIOWriteMB	Amount of process I/O write operations data volume	Number	MB	50
ProcIOLatencyReadMs	Process I/O read operations latency	Number	ms	30
ProcIOLatencyWriteMs	Process I/O write operations latency	Number	ms	30
SessionID	Unique identifier that is generated by the machine when the session is created. Will be reassigned to other sessions after logoff.	Number		3
TotalBootDurationMs	Total boot duration	Number	ms	500000
SortOrder2	Sort order number to sort the table Boot process performance on the Single Boot dashboard correctly.	Number		29
BootUID	Unique UID for a boot generated by uberAgent	String		00000408-0049-004b-0bb9-8ed17e25d401

List of Calculated Fields

Field	Description	Data type	Unit	Where available	Example
SortOrder	Sort order number to sort the table Boot process performance on the Single Boot dashboard correctly.	Number		Splunk data model	1

Boot Process Detail

uberAgent collects detailed information about each process running during the boot process like the disk IO and latency.

Details

• Source type: uberAgent:OnOffTransition:BootProcessDetail
• Used in dashboards: Single Boot Duration
• Enabled through configuration setting: BootDetail
• Related configuration settings: n/a
• Supported platform: Windows

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
ProcessName	Process name	String		svchost.exe
ProcessIOReadCount	Count of process I/O read operations	Number		91
ProcessIOWriteCount	Count of process I/O write operations	Number		97
ProcessIOReadMB	Amount of process I/O read operations data volume	Number	MB	50
ProcessIOWriteMB	Amount of process I/O write operations data volume	Number	MB	50
ProcessIOLatencyMs	Process I/O operations latency	Number	ms	60
BootUID	Unique UID for a boot generated by uberAgent	String		00000408-0049-004b-0bb9-8ed17e25d401

List of Calculated Fields

Field	Description	Data type	Unit	Where available	Example
ProcessIOCount	ProcessIOReadCount+ProcessIOWriteCount	Number		Splunk data model	188
ProcName	Process name	String		Splunk data model	chrome.exe