This rule collects events that detail the root causes of resume performance issues that have been detected by Windows Vista
Computer hibernation is one of the root causes of the degradation
Target | Microsoft.Windows.Client.Vista.Aggregate.Computer |
Category | EventCollection |
Enabled | True |
Event_ID | 352 |
Event Source | Microsoft-Windows-Diagnostics-Performance |
Alert Generate | False |
Remotable | True |
Event Log | Microsoft-Windows-Diagnostics-Performance/Operational |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
EventDS | DataSource | Microsoft.Windows.EventProvider | System.PrivilegedMonitoringAccount |
PublishToClientPerfRootCauseChannel | WriteAction | Microsoft.Windows.Client.Vista.Computer.PublishBaseData | Default |
<Rule ID="Microsoft.Windows.Client.Vista.Computer.ResumeHibernate.Collection" Enabled="true" Target="Microsoft.Windows.Client.Vista.Aggregate.Computer">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" RunAs="System!System.PrivilegedMonitoringAccount" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
<LogName>Microsoft-Windows-Diagnostics-Performance/Operational</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Microsoft-Windows-Diagnostics-Performance</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>352</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="PublishToClientPerfRootCauseChannel" TypeID="Microsoft.Windows.Client.Vista.Computer.PublishBaseData">
<ChannelId>02F14C7F-751D-4D6E-88C0-A7D7B2E590F3</ChannelId>
</WriteAction>
</WriteActions>
</Rule>