Boot Processes
uberAgent collects detailed information about each process running during the boot process like the command line and latency.
Details
- Source type:
uberAgent:OnOffTransition:BootProcesses
- Used in dashboards: Single Boot Duration
- Enabled through configuration setting:
BootDetail
- Related configuration settings: n/a
- Supported platform: Windows
List of Fields in the Raw Agent Data
| Field |
Description |
Data type |
Unit |
Example |
| ProcName |
Process name. |
String |
|
svchost.exe |
| ProcID |
Process ID. |
Number |
|
456 |
| ProcParentID |
Parent process ID. |
Number |
|
789 |
| ProcStartTimeRelativeMs |
Relative process start time. |
Number |
ms |
100 |
| ProcLifetimeMs |
Process lifetime. |
Number |
ms |
50 |
| ProcCmdline |
Process commandline. |
String |
|
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p |
| ProcIOReadCount |
Count of process I/O read operations. |
Number |
|
91 |
| ProcIOWriteCount |
Count of process I/O write operations. |
Number |
|
97 |
| ProcIOReadMB |
Amount of process I/O read operations data volume. |
Number |
MB |
50 |
| ProcIOWriteMB |
Amount of process I/O write operations data volume. |
Number |
MB |
50 |
| ProcIOLatencyReadMs |
Process I/O read operations latency. |
Number |
ms |
30 |
| ProcIOLatencyWriteMs |
Process I/O write operations latency. |
Number |
ms |
30 |
| SessionID |
Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff. |
Number |
|
3 |
| TotalBootDurationMs |
Total boot duration. |
Number |
ms |
500000 |
| SortOrder2 |
Sort order number to sort the table Boot process performance on the Single Boot dashboard correctly. |
Number |
|
29 |
| BootUID |
Unique UID for a boot generated by uberAgent. |
String |
|
00000408-0049-004b-0bb9-8ed17e25d401 |
List of Calculated Fields
| Field |
Description |
Data type |
Unit |
Where available |
Example |
| SortOrder |
Sort order number to sort the table Boot process performance on the Single Boot dashboard correctly. |
Number |
|
Splunk data model |
1 |
Boot Process Detail
uberAgent collects detailed information about each process running during the boot process like the disk IO and latency.
Details
- Source type:
uberAgent:OnOffTransition:BootProcessDetail
- Used in dashboards: Single Boot Duration
- Enabled through configuration setting:
BootDetail
- Related configuration settings: n/a
- Supported platform: Windows
List of Fields in the Raw Agent Data
| Field |
Description |
Data type |
Unit |
Example |
| ProcessName |
Process name. |
String |
|
svchost.exe |
| ProcessIOReadCount |
Count of process I/O read operations. |
Number |
|
91 |
| ProcessIOWriteCount |
Count of process I/O write operations. |
Number |
|
97 |
| ProcessIOReadMB |
Amount of process I/O read operations data volume. |
Number |
MB |
50 |
| ProcessIOWriteMB |
Amount of process I/O write operations data volume. |
Number |
MB |
50 |
| ProcessIOLatencyMs |
Process I/O operations latency. |
Number |
ms |
60 |
| BootUID |
Unique UID for a boot generated by uberAgent. |
String |
|
00000408-0049-004b-0bb9-8ed17e25d401 |
List of Calculated Fields
| Field |
Description |
Data type |
Unit |
Where available |
Example |
| ProcessIOCount |
ProcessIOReadCount+ProcessIOWriteCount. |
Number |
|
Splunk data model |
188 |
| ProcName |
Process name. |
String |
|
Splunk data model |
chrome.exe |