Boot Processes
uberAgent collects detailed information about each process running during the boot process like the command line and latency.
Details
- Source type:
uberAgent:OnOffTransition:BootProcesses
- Used in dashboards: Single Boot Duration
- Enabled through configuration setting:
BootDetail
- Related configuration settings: n/a
- Supported platform: Windows
List of Fields in the Raw Agent Data
Field |
Description |
Data type |
Unit |
Example |
ProcName |
Process name. |
String |
|
svchost.exe |
ProcID |
Process ID. |
Number |
|
456 |
ProcParentID |
Parent process ID. |
Number |
|
789 |
ProcStartTimeRelativeMs |
Relative process start time. |
Number |
ms |
100 |
ProcLifetimeMs |
Process lifetime. |
Number |
ms |
50 |
ProcCmdline |
Process commandline. |
String |
|
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p |
ProcIOReadCount |
Count of process I/O read operations. |
Number |
|
91 |
ProcIOWriteCount |
Count of process I/O write operations. |
Number |
|
97 |
ProcIOReadMB |
Amount of process I/O read operations data volume. |
Number |
MB |
50 |
ProcIOWriteMB |
Amount of process I/O write operations data volume. |
Number |
MB |
50 |
ProcIOLatencyReadMs |
Process I/O read operations latency. |
Number |
ms |
30 |
ProcIOLatencyWriteMs |
Process I/O write operations latency. |
Number |
ms |
30 |
SessionID |
Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff. |
Number |
|
3 |
TotalBootDurationMs |
Total boot duration. |
Number |
ms |
500000 |
SortOrder2 |
Sort order number to sort the table Boot process performance on the Single Boot dashboard correctly. |
Number |
|
29 |
BootUID |
Unique UID for a boot generated by uberAgent. |
String |
|
00000408-0049-004b-0bb9-8ed17e25d401 |
List of Calculated Fields
Field |
Description |
Data type |
Unit |
Where available |
Example |
SortOrder |
Sort order number to sort the table Boot process performance on the Single Boot dashboard correctly. |
Number |
|
Splunk data model |
1 |
Boot Process Detail
uberAgent collects detailed information about each process running during the boot process like the disk IO and latency.
Details
- Source type:
uberAgent:OnOffTransition:BootProcessDetail
- Used in dashboards: Single Boot Duration
- Enabled through configuration setting:
BootDetail
- Related configuration settings: n/a
- Supported platform: Windows
List of Fields in the Raw Agent Data
Field |
Description |
Data type |
Unit |
Example |
ProcessName |
Process name. |
String |
|
svchost.exe |
ProcessIOReadCount |
Count of process I/O read operations. |
Number |
|
91 |
ProcessIOWriteCount |
Count of process I/O write operations. |
Number |
|
97 |
ProcessIOReadMB |
Amount of process I/O read operations data volume. |
Number |
MB |
50 |
ProcessIOWriteMB |
Amount of process I/O write operations data volume. |
Number |
MB |
50 |
ProcessIOLatencyMs |
Process I/O operations latency. |
Number |
ms |
60 |
BootUID |
Unique UID for a boot generated by uberAgent. |
String |
|
00000408-0049-004b-0bb9-8ed17e25d401 |
List of Calculated Fields
Field |
Description |
Data type |
Unit |
Where available |
Example |
ProcessIOCount |
ProcessIOReadCount+ProcessIOWriteCount. |
Number |
|
Splunk data model |
188 |
ProcName |
Process name. |
String |
|
Splunk data model |
chrome.exe |