The Kernel-Power Event Provider

Starting with Windows Vista, the Power Manager in the Windows kernel registers an event provider and writes events to it:

Provider GUID:	{331C3B3A-2005-44C2-AC5E-77220C37D6B4}
Provider Name:	Microsoft-Windows-Kernel-Power
Symbolic Name:	POP_ETW_PROVIDER

The kernel, of course, knows of the provider only by the Provider GUID. The Provider Name is what's stored in the registry for this GUID. It's then the Name that the Event Viewer shows for the Provider in the Details tab for an event that actually has occurred and been logged. It's also the name to use when referring to this provider in such tools as WEVTUTIL and the Performance Monitor. The Symbolic Name is what public symbol files for the kernel show as the programming label for the GUID as an internal kernel variable.

An instrumentation manifest for the Microsoft-Windows-Kernel-Power provider is compiled into Microsoft-Windows-Kernel-Power-Events.dll (but ADVAPI32.DLL in version 6.0) as a resource named WEVT_TEMPLATE. This event template is the source of the plain-language names that the command wevtutil gp Microsoft-Windows-Kernel-Power extracts for channels, opcodes, levels, tasks and keywords. Its location is known already in the registry when Windows is installed.

As for any event provider, the compiled instrumentation manifest can be de-compiled to something like the XML it was written in, albeit without recovering symbolic names that compilation did not transfer to the manifest. Microsoft’s WEVTUTIL has options that can make a good start at this, and hackers have surely written tools that do better or differently. If that were the end of presenting the possible events, then this page would not exist.

The aim here is instead to capture something of the events’ development through successive versions, both in the compiled manifests and in the kernel’s code for writing the events. Notably, the manifests are sometimes wrong (not that this will surprise any programmer who has ever tried preparing one and keeping it synchronised with the code). With sufficient resources and attention, the presentation below may someday develop into describing what causes each of the possible events and what their parameters of event data mean. Remember, though, that such documentation really is Microsoft’s to write.

Channels

Four channels are defined for the provider. Each takes a different selection of the many possible events.

Channel ID	Channel Name	Versions
8	System	6.0 and higher
16	Microsoft-Windows-Kernel-Power/Diagnostic	6.0 and higher
17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic	6.1 and higher
18	Microsoft-Windows-Kernel-Power/Thermal-Operational	6.1 and higher

The System log is familiar to all system administrators and many users. The Event Viewer shows it prominently among the Windows Logs. The others appear in the Event Viewer as "Applications and Services Logs". The two diagnostic channels are not ordinarily enabled and are not even presented as logs that might be enabled except if the "Show Analytic and Debug Logs" option is checked.

There is a good argument that the most important of the possible events are directed to the System log, and that this is therefore all that most Windows users and even system administrators ever need to know, but do not miss that far many more of the possible events go to a diagnostic channel (16) and are thus not seen unless they are specially sought. To see more events than just the few that go to the System log, enable one or more of the other channels or create a custom log. The latter is anyway necessary for the more than two dozen events (presented below as The 300 Series) which are not directed to any channel.

Events

Also in the registry is that plain-language descriptions of events, such as show in the Event Viewer, are resolved from the same DLL's message-table resource (which is in practice in the language-specific MUI file). Note that the vast majority of the possible Kernel-Power events, and not even all that go to the System log, get a friendly description.

The tables that presently follow are of all Kernel-Power events that are listed in any compiled instrumentation manifest for kernel versions up to and including the 2004 release of Windows 10. Special attention is given to which events have code in the kernel for writing the event, and in which versions.

Names given for channels, levels, opcodes, tasks and keywords are from the compiled event template. Though Microsoft defines friendly names for all levels and some opcodes, none are defined for any tasks or keywords, and it seems clearer (if only for now) to keep to the unfriendly names for all.

Some conventions are applied for brevity. The version, opcode and task are omitted unless they are non-zero, but beware that zero is not meaningless: the name "win:Info" is formally defined for opcode zero. The high byte of the keyword is not rendered as text since it reliably corresponds to the channel. Where rows, are broken out according to the event version or kernel version, the separate rows are sometimes, even often, not alternatives but are instead to be understood as additive. This applies especially to the Event Data: new event versions ordinarily extend the parameters, rather than replace any.

Main Series

All the original events, for Windows Vista, are numbered sequentially from 1. They roughly doubled in a decade, and keep being added. That the pace has since slowed may be to avoid collision with the series that Windows 8 started at 200. New events for the later releases of Windows 10 tend instead to be added to the series that begins at 500. Meanwhile, here is how far the original main series reaches in successive versions:

• 72 in early 6.0 (before SP1);
• 78 in late 6.0;
• 110 in 6.1;
• 140 in 6.2;
• 145 in 6.3;
• 168 in 10.0;
• 171 in 1511;
• 178 in 1607;
• 185 in 1703;
• 186 in 1709 and 1803;
• 187 in 1809;
• 189 in 1903 and 2004.

Though many have fallen out of use in the sense that they are not known to the kernel in later versions, their IDs are not reused and information about them is retained in the compiled event template, presumably so that tools running on a new Windows can interpret logs collected from computers that run an old Windows.

POP_ETW_EVENT_POWERTRANSITION_START

Event 1 is known to the kernel in version 6.0 and higher.

Event ID:	1
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	1	win:Critical
Opcode:	1	win:Start
Task:	33	PowerTransition
Keyword:	0x40000000`00000009	po:Scenario po:Performance	6.0 to 1809
	0x40000000`00003009	po:Scenario po:Performance po:SleepDiagnistic po:WdiDiagnostic	1903 and higher
Event Data:	Reason Flags Time

Quite what sense there is to ranking events 1 and 2 as Critical when they merely record even the ordinary start and end of an ordinary power transition is anyone's guess. That the transition completes is critically important, of course, but its success is no more than reassuring Information—even for a diagnostic log. What needs anyone's Critical attention is not the success, only the failure.

Whether these events ought to be Critical, or not, consider that even being rated as critical by someone at Microsoft does not suffice for getting a plain-language description. Right from the start, Microsoft makes plain that easy interpretation of the diagnostic channel is for Microsoft’s analysts: look, if you want, but don’t expect help.

POP_ETW_EVENT_POWERTRANSITION_END

Event 2 is known to the kernel in version 6.0 and higher.

Event ID:	2
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	1	win:Critical
Opcode:	2	win:Stop
Task:	33	PowerTransition
Keyword:	0x40000000`00000009	po:Scenario po:Performance	6.0 to 1809
	0x40000000`00001009	po:Scenario po:Performance po:SleepDiagnostic	1903 and higher
Event Data:	Status Time

POP_ETW_EVENT_QUERYAPPS

Event 3 is known to the kernel in version 6.0 only. This is the lowest-numbered of 19 events that the kernel has no code for writing in version 6.1 and higher.

Event ID:	3
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	34	QueryApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

This event, among others, was made meaningless by an under-appreciated (and arguably under-explained) simplification of power management that had begun for Windows Vista but was not yet completed.

In Microsoft’s original architecture for power management, applications and services were queried about each proposed suspension of power as if the kernel sought approval. As Microsoft’s documentation still says of the obsolete case PBT_APMQUERYSUSPEND of the WM_POWERBROADCAST message (and the corresponding service control): “Requests permission to suspend the computer.” To refuse permission, an application returns the magic value 0x424D45144 (BROADCAST_QUERY_DENY).

This is, inevitably, a complication. The kernel has to call WIN32K.SYS to ask for a broadcast to windows and services, and has to call it separately for each session. WIN32K must in turn send the message to every window in each desktop, in series, taking care to stop if any returns the magic value. It translates this to an error code, STATUS_CANCELLED, for the kernel which then must unwind whatever it had yet done for the power action. Much of this is an expense for any broadcast, but Microsoft apparently decided that broadcasting to query for permission to suspend was more cost than benefit, and that Windows Vista would bring its removal.

Arguably not clear in the contemporaneous documentation is that the broadcast is not gone from Windows Vista. The kernel still has code for asking WIN32K (or whoever else provides the expected callout function) to query applications and services for approval. The WIN32K.SYS for Windows Vista continues to broadcast the message but it no longer interprets the magic value as an error to return to the kernel.

The queries are thus defeated in WIN32K, not in the kernel. As far as concerns the Windows Vista kernel, it still broadcasts for querying and still abandons the power suspension if the broadcast fails—and its new event provider logs that all this goes on. The code for querying wasn’t removed from the kernel (and WIN32K) until Windows 7, and then the corresponding events are discontinued.

POP_ETW_EVENT_QUERYAPPS_STATUS

Event 4 is known to the kernel in version 6.0 only.

Event ID:	4
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	34	QueryApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	Status

POP_ETW_EVENT_QUERYSERVICES

Event 5 is known to the kernel in version 6.0 only.

Event ID:	5
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	35	QueryServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_QUERYSERVICES_STATUS

Event 6 is known to the kernel in version 6.0 only.

Event ID:	6
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	35	QueryServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	Status

POP_ETW_EVENT_IRPSTART

Event 7 is known to the kernel in version 6.0 and higher. This event exists in two versions. The version 6.0 kernel writes only version 0 of the event. Later versions of the kernel write only version 1 of the event. The only difference is that version 1 adds one parameter to the event data.

Event ID:	7
Version:	0		6.0 and higher
	1		6.1 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	39	Irp
Keyword:	0x40000000`00000008	po:Performance
Event Data:	Irp PowerStateType MinorFunction TargetDevice InstanceNameLength InstanceName		versions 0 and 1
	PowerState		version 1 only

It perhaps never can actually happen, but the kernel omits the InstanceName if the InstanceNameLength is zero.

POP_ETW_EVENT_IRPFINISH

Event 8 is known to the kernel in version 6.0 and higher.

Event ID:	8
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	39	Irp
Keyword:	0x40000000`00000008	po:Performance
Event Data:	Irp Status FailedDriver

POP_ETW_EVENT_APPVETO

Event 9 is known to the kernel in version 6.0 only.

Event ID:	9
Channel:	8	System
Level:	4	win:Informational
Opcode:	35	Veto
Task:	34	QueryApps
Keyword:	0x80000000`00000004	po:Diagnostic	6.0 to 1511
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1607 to 1809
	0x80000000`00002404	po:Diagnostic po:DiagnosticLight po:WdiDiagnostic	1903 and higher
Event Data:	Pid Window AppNameLength AppName

This event has the plain-language description:

The application AppName stopped the power transition.

POP_ETW_EVENT_SERVICEVETO

Event 10 is known to the kernel in version 6.0 only.

Event ID:	10
Channel:	8	System
Level:	4	win:Informational
Opcode:	35	Veto
Task:	35	QueryServices
Keyword:	0x80000000`00000004	po:Diagnostic	6.0 to 1511
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1607 to 1809
	0x80000000`00002404	po:Diagnostic po:DiagnosticLight po:WdiDiagnostic	1903 and higher
Event Data:	Pid ServiceNameLength ServiceName

This event has the plain-language description:

The service ServiceName stopped the power transition.

POP_ETW_EVENT_IRPWAITING

Event 11 is known to the kernel in versions 6.0 to 6.1.

Event ID:	11
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	58	IrpWaiting	6.1 and higher
Keyword:	0x40000000`00000000
Event Data:	Irp

POP_ETW_EVENT_QUERYAPP

Event 12 is known to the kernel in version 6.0 only.

Event ID:	12
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	34	QueryApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	Pid NameLength Name

POP_ETW_EVENT_QUERYAPP_END

Event 13 is known to the kernel in version 6.0 only.

Event ID:	13
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	34	QueryApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	Pid

POP_ETW_EVENT_QUERYSERVICE

Event 14 is known to the kernel in version 6.0 only.

Event ID:	14
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	35	QueryServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	NameLength Name

POP_ETW_EVENT_QUERYSERVICE_END

Event 15 is known to the kernel in version 6.0 only.

Event ID:	15
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	35	QueryServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	NameLength Name

POP_ETW_EVENT_SUSPENDAPP

Event 16 is known to the kernel in version 6.0 and higher.

Event ID:	16
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	37	SuspendApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	Pid NameLength Name

POP_ETW_EVENT_SUSPENDAPP_END

Event 17 is known to the kernel in version 6.0 and higher.

Event ID:	17
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	37	SuspendApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	Pid

POP_ETW_EVENT_SUSPENDSERVICE

Event 18 is known to the kernel in version 6.0 and higher.

Event ID:	18
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	38	SuspendServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	NameLength Name

Event 19 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUSPENDSERVICE_END

Event ID:	19
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	38	SuspendServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	NameLength Name

POP_ETW_EVENT_IRP_DRIVERACQUIRE

Event 20 is known to the kernel in version 6.0 and higher.

Event ID:	20
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	40	Driver
Keyword:	0x40000000`00000008	po:Performance
Event Data:	Irp Device DriverName

POP_ETW_EVENT_IRP_DRIVERRELEASE

Event 21 is known to the kernel in version 6.0 and higher.

Event ID:	21
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	40	Driver
Keyword:	0x40000000`00000008	po:Performance
Event Data:	Irp Device

POP_ETW_EVENT_SUSPENDAPPS

Event 22 is known to the kernel in version 6.0 and higher.

Event ID:	22
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	37	SuspendApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_SUSPENDAPPS_END

Event 23 is known to the kernel in version 6.0 and higher.

Event ID:	23
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	37	SuspendApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_SUSPENDSERVICES

Event 24 is known to the kernel in version 6.0 and higher.

Event ID:	24
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	38	SuspendServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_SUSPENDSERVICES_END

Event 25 is known to the kernel in version 6.0 and higher.

Event ID:	25
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	38	SuspendServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_RESUMEAPPS

Event 26 is known to the kernel in version 6.0 and higher.

Event ID:	26
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	44	ResumeApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_RESUMESERVICES

Event 27 is known to the kernel in version 6.0 and higher.

Event ID:	27
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	43	ResumeServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_RESUMEAPP

Event 28 is known to the kernel in version 6.0 only.

Event ID:	28
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	44	ResumeApps
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	Pid NameLength Name

Event 29

Though event 29 is defined in the compiled event templates for version 6.0 and higher, it is not known to the kernel in any version yet studied.

Event ID:	29
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	43	ResumeServices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher
Event Data:	NameLength Name

POP_ETW_EVENT_QUERYFAILEDAPPS

Event 30 is known to the kernel in version 6.0 only.

Event ID:	30
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	59	QueryFailedApps	6.1 and higher
Keyword:	0x40000000`00000000

POP_ETW_EVENT_QUERYFAILEDSERVICES

Event 31 is known to the kernel in version 6.0 only.  

Event ID:	31
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	60	QueryFailedServices	6.1 and higher
Keyword:	0x40000000`00000000

POP_ETW_EVENT_QUERYFAILEDAPP

Event 32 is known to the kernel in version 6.0 only.

Event ID:	32
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	61	QueryFailedApp	6.1 and higher
Keyword:	0x40000000`00000000
Event Data:	Pid NameLength Name

Event 33

Though event 33 is defined in the compiled event templates for version 6.0 and higher, it is not known to the kernel in any version yet studied.

Event ID:	33
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	62	QueryFailedService	6.1 and higher
Keyword:	0x40000000`00000000
Event Data:	NameLength Name

POP_ETW_EVENT_HIBERNATE_STATUS

Event 34 is known to the kernel in version 6.0 and higher.

Event ID:	34
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	45	Hibernate
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	6.0 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 to 1809
	0x40000000`00002C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight po:WdiDiagnostic	1903 and higher
Event Data:	Status

POP_ETW_EVENT_DEVICESSUSPEND

Event 35 is known to the kernel in version 6.0 and higher.

Event ID:	35
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	41	SuspendDevices
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	6.0 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 to 1809
	0x40000000`00003C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight po:SleepDiagnostic po:WdiDiagnostic	1903 and higher
Event Data:	Query TargetState EffectiveState

POP_ETW_EVENT_DEVICESSUSPEND_END

Event 36 is known to the kernel in version 6.0 and higher.

Event ID:	36
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	41	SuspendDevices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_DEVICESWAKE

Event 37 is known to the kernel in version 6.0 and higher.

Event ID:	37
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	42	WakeDevices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 6.1
	0x40000000`0000000C	po:Diagnostic po:Performance	6.2 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 to 1809
	0x40000000`00001C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight po:SleepDiagnostic	1903 and higher

POP_ETW_EVENT_DEVICESWAKE_END

Event 38 is known to the kernel in version 6.0 and higher.

Event ID:	38
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	42	WakeDevices
Keyword:	0x40000000`00000008	po:Performance	6.0 to 6.1
	0x40000000`0000000C	po:Diagnostic po:Performance	6.2 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 and higher

POP_ETW_EVENT_TRANSITIONTIMES

Event 39 is known to the kernel in version 6.0 and higher. This event is another that exists in two versions. The second has one more parameter in the event data.

Event ID:	39
Version:	0		6.0 and higher
	1		1903 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	version 0 in 6.0 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	version 0 in 1607 to 1809
	0x40000000`00001C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight po:SleepDiagnostic	version 0 in 1903 and higher
	0x40000000`00003C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight po:SleepDiagnostic po:WdiDiagnostic	version 1
Event Data:	SleepTime ResumeTime DriverWakeTime HiberWriteTime HiberReadTime HiberPagesWritten BiosInitTime		versions 0 and 1
	CheckpointTime		version 1

POP_ETW_EVENT_DRIVERVETO

Event 40 is known to the kernel in version 6.0 and higher.

Event ID:	40
Channel:	8	System
Level:	4	win:Informational
Opcode:	35	Veto
Task:	36	QueryDrivers
Keyword:	0x80000000`00000004	po:Diagnostic	6.0 to 1511
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1607 to 1809
	0x80000000`00002404	po:Diagnostic po:DiagnosticLight po:WdiDiagnostic	1903 and higher
Event Data:	DriverNameLength DriverName InstanceNameLength InstanceName

This event has the plain-language description:

The driver DriverName for device InstanceName stopped the power transition.

POP_ETW_EVENT_DIRTY_TRANSITION

Event 41 is known to the kernel in version 6.0 and higher. Its original symbolic name, in version 6.0 only, was POP_ETW_EVENT_DIRTY_SLEEP. This is by far the Kernel-Power event that users will most be alarmed by and want most to understand. Microsoft also keeps attending to it, notably to add parameters to the event data. These have now gone through nine versions.

Event ID:	41
Version:	0		6.0 and higher
	1		6.1 and higher
	2		6.1 and higher
	3		6.2 and higher
	4		1607 and higher
	5		1703 and higher
	6		1709 and higher
	7		2004 and higher
	8		2004 and higher
Channel:	8	System
Level:	1	win:Critical
Task:	63	DirtyTransition	6.1 and higher
Keyword:	0x80000000`00000002	po:Simple	versions 0 to 2; version 3 in 6.0 to 6.3
	0x80002000`00000002	po:Simple ms:Telemetry	version 3 in 10.0 only
	0x80004000`00000002	po:Simple ms:Measures	version 3 in 1511 and higher; versions 4 to 8
Event Data:	BugCheckCode BugcheckParameter		version 0 in late 6.0 only; version 1
	BugcheckCode BugcheckParameter1 BugcheckParameter2 BugcheckParameter3 BugcheckParameter4 SleepInProgress PowerButtonTimestamp		versions 2 to 8
	BootAppStatus		version 2 in 6.2 and higher; versions 3 to 8
	Checkpoint ConnectedStandbyInProgress SystemSleepTransitionsToOn CsEntryScenarioInstanceId		versions 4 to 8
	BugCheckInfoFromEFI		versions 5 to 8
	CheckpointStatus		versions 6 to 8
	CsEntryScenarioInstanceIdV2		versions 7 to 8
	LongPowerButtonPressDetected		version 8

This event nowadays has the plain-language description:

The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

The text for versions 0 and 1 of the event differs a little, the first sentence instead being "The last sleep transition was unsuccessful."

Much more important about version 6.0 is the confusion over the event version and the corresponding changes in event data. We have the luxury now of a historical perspective. Because Microsoft (helpfully) wants that an ETL file from some release of Windows Vista can be loaded into the Event Viewer (or similar application) from a newer Windows, the the compiled event template even for Windows 10 has information about events that no recent version of the kernel can write. To go by these resources, event 41 exists in a version 0 that has no event data and a version 1 that has the two items as shown above for version 6.0 SP1 and SP2. This history, however, is a fiction. The event templates from the time, compiled into ADVAPI32.DLL, have event 41 with no event data for the original release of Windows Vista, and with those two items of event data for Windows Vista SP1 and SP2, but they know nothing of a version 1 and neither does the kernel. Indeed, the Windows Vista kernel, in its original, SP1 and SP2 releases, writes all Kernel-Power events as version 0. As for the two parameters, these too are a fiction-at least for the formal releases that are studied here. In Windows Vista SP1 and SP2, the kernel writes event 41 not with two parameters but with the five that are known later as BugcheckCode through to BugcheckParameter4.

Though the compiled event template for Windows 7 knows, of course, that the Windows 7 kernel writes version 2 of the event and supplies seven items of event data, the compiled event templates for Windows 8 and higher would have it that version 2 has BootAppStatus as an eighth parameter.

The event data that Microsoft labels Checkpoint marks what progress had been made for the power transition before its abrupt failure. It takes its values from the undocumented POP_SLEEP_CHECKPOINT enumeration.

POP_ETW_EVENT_PRESLEEP_NOTIFICATION3

Event 42 is known to the kernel in version 6.0 and higher. The symbolic name tracks the event's development through three versions. The original, in version 6.0 only, was simply POP_ETW_EVENT_PRESLEEP_NOTIFICATION. The event versions may have been numbered to suit the naming: no compiled event template knows of an event version 1 and neither does any kernel.

Event ID:	42
Version:	0		6.0 and higher
	2		6.1 and higher
	3		1607 and higher
Channel:	8	System
Level:	4	win:Informational
Task:	64	PreSleepNotification	6.1 and higher
Keyword:	0x80000000`00000004	po:Diagnostic	version 0 in 6.0 to 1511; version 2 in 6.0 to 10.0
	0x80004000`00000004	po:Diagnostic ms:Measures	version 2 in 1511 only
	0x80004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures	version 2 in 1607 only; version 3 in 1607 only
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	version 0 in 1607 and higher; version 2 in 1703 and higher; version 3 in 1703 and higher
Event Data:	TargetState EffectiveState		versions 0, 2 and 3
	Reason Flags		versions 2 and 3
	TransitionsToOn		version 3

This event nowadays has the plain-language description:

The system is entering sleep.

Sleep Reason: Reason

The text for event version 0 has just the first sentence, there being no Reason in the event data.

POP_ETW_EVENT_ZEROHIBERFILE_START

Event 43 is known to the kernel in version 6.0 and higher.

Event ID:	43
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	46	ZeroHiberFile
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_ZEROHIBERFILE_STOP

Event 44 is known to the kernel in version 6.0 and higher.

Event ID:	44
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	46	ZeroHiberFile
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_FLUSHVOLUMES_START

Event 45 is known to the kernel in version 6.0 and higher.

Event ID:	45
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	47	FlushVolumes
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_FLUSHVOLUMES_STOP

Event 46 is known to the kernel in version 6.0 and higher.

Event ID:	46
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	47	FlushVolumes
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_GRACEFULSHUTDOWN_START

Event 47 is known to the kernel in version 6.0 and higher.

Event ID:	47
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	48	GracefulShutdown
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_GRACEFULSHUTDOWN_STOP

Event 48 is known to the kernel in version 6.0 and higher.

Event ID:	48
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	48	GracefulShutdown
Keyword:	0x40000000`00000009	po:Scenario po:Performance

POP_ETW_EVENT_ZEROPAGEFILE_START

Event 49 is known to the kernel in version 6.0 and higher.

Event ID:	49
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	49	ZeroPageFile
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_ZEROPAGEFILE_STOP

Event 50 is known to the kernel in version 6.0 and higher.

Event ID:	50
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	49	ZeroPageFile
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_IOSHUTDOWNSYSTEM_START

Event 51 is known to the kernel in version 6.0 and higher.

Event ID:	51
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	50	IoShutdownSystem
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_IOSHUTDOWNSYSTEM_STOP

Event 52 is known to the kernel in version 6.0 and higher.

Event ID:	52
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	50	IoShutdownSystem
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_WAITFORPROCESSES_START

Event 53 is known to the kernel in version 6.0 and higher.

Event ID:	53
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	51	WaitForProcesses
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_WAITFORPROCESSES_STOP

Event 54 is known to the kernel in version 6.0 and higher.

Event ID:	54
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	51	WaitForProcesses
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_CMSHUTDOWNSYSTEM_START

Event 55 is known to the kernel in version 6.0 and higher.

Event ID:	55
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	52	CmShutdownSystem
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_CMSHUTDOWNSYSTEM_STOP

Event 56 is known to the kernel in version 6.0 and higher.

Event ID:	56
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	52	CmShutdownSystem
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_SHOWUI_START

Event 57 is known to the kernel in version 6.0 only.

Event ID:	57
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	53	ShowUI
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_SHOWUI_STOP

Event 58 is known to the kernel in version 6.0 only.

Event ID:	58
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	53	ShowUI
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_AWAYMODE

Event 59 is known to the kernel in version 6.0 and higher.

Event ID:	59
Channel:	8	System
Level:	4	win:Informational
Task:	65	AwayMode	6.1 and higher
Keyword:	0x80000000`00000004	po:Diagnostic	6.0 to 1511
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher

This event has the plain-language description:

The system is entering Away Mode.

POP_ETW_EVENT_USER_QUERY_ALLOWED

Event 60 is known to the kernel in version 6.0 only.

Event ID:	60
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	66	UserQueryAllowed	6.1 and higher
Keyword:	0x40000000`00000004	po:Diagnostic	6.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 to 1809
	0x40000000`00002404	po:Diagnostic po:DiagnosticLight po:WdiDiagnostic	1903 and higher
Event Data:	Value

POP_ETW_EVENT_KERNEL_QUERY_ALLOWED

Event 61 is known to the kernel in version 6.0 and higher.

Event ID:	61
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	67	KernelQueryAllowed	6.1 and higher
Keyword:	0x40000000`00000004	po:Diagnostic	6.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 to 1809
	0x40000000`00002404	po:Diagnostic po:DiagnosticLight po:WdiDiagnostic	1903 and higher
Event Data:	Value

POP_ETW_EVENT_STES

Event 62 is known to the kernel in version 6.0 and higher.

Event ID:	62
Version:	0		6.0 and higher
	1		6.1 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	68	SetExecutionState	6.1 and higher
Keyword:	0x40000000`00000004	po:Diagnostic	6.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	ExecutionState AppNameLength AppName		versions 0 and 1
	Pid Tid		version 0 in late 6.0 only; version 1

This event has the plain-language description:

The application or service AppName has overridden user power management settings with a code of ExecutionState.

Again, version 6.0 has complications with the event version. The compiled event template for Windows 7 and higher has event 62 in a version 0 with three items of event data and a version 1 with five, but this is at best an idealised history. The extension to five items is known for version 0 in Windows Vista SP1 and SP2, both as written by the kernel and as interpreted through the compiled event template from the time.

POP_ETW_EVENT_STRS

Event 63 is known in version 6.0 and higher.

Event ID:	63
Version:	0		6.0 and higher
	1		6.1 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	69	SystemTimeResolutionChange	6.1 and higher
Keyword:	0x40000000`00000004	po:Diagnostic	6.0 to 1903
	0x40000000`00004004	po:Diagnostic po:TimerResolution	2004 and higher
Event Data:	ExecutionState AppNameLength AppName		version 0 only
	RequestedResolution Pid AppNameLength AppName SubProcessTag		version 1 only

There seems to have been recurring trouble over the naming of event data and its use in the plain-language description. That the template for version 0 of the event mislabels the new value for the timer resolution as an ExecutionState is not a problem in practice, since the unhelpfully named parameter is given its intended meaning in the description:

The application or service AppName is attempting to update the system timer resolution to a value of ExecutionState.

The modern rendering, for event version 1 with its different parameters, incorrectly selects the fifth parameter where it presumably wants the AppName:

The application or service SubProcessTag is attempting to update the system timer resolution to a value of RequestedResolution.

To see the AppName, ignore the friendly description and look instead at the event data. Then perhaps wonder how it is that for one of the few events that are directed to the Diagnostic channel yet also have a plain-language description, Microsoft has either not noticed or has not cared to fix that the text presents a number where a name is plainly intended.

POP_ETW_EVENT_SUPERFETCH_START

Event 64 is known to the kernel in version 6.0 and higher.

Event ID:	64
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	54	Superfetch
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_SUPERFETCH_STOP

Event 65 is known to the kernel in version 6.0 and higher.

Event ID:	65
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	54	Superfetch
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_WINLOGON_START

Event 66 is known to the kernel in versions 6.0 to 6.1.

Event ID:	66
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	55	Winlogon
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_WINLOGON_STOP

Event 67 is known to the kernel in versions 6.0 to 6.1.

Event ID:	67
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	55	Winlogon
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_PRESLEEP_CALLBACKS_START

Event 68 is known to the kernel in version 6.0 and higher.

Event ID:	68
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	56	PreSleepCallbacks
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_PRESLEEP_CALLBACKS_STOP

Event 69 is known to the kernel in version 6.0 and higher.

Event ID:	69
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	56	PreSleepCallbacks
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_HIDEUI_START

Event 70 is known to the kernel in version 6.0 only.

Event ID:	70
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	57	HideUI
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_HIDEUI_STOP

Event 71 is known to the kernel in version 6.0 only.

Event ID:	71
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	57	HideUI
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_IDLE_CHECK

Event 72 is known to the kernel in version 6.0 and higher.

Event ID:	72
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	70	IdleCheck	6.1 and higher
Keyword:	0x40000000`00000010	po:Idle
Event Data:	Threshold LowestIdleness AverageIdleness AccruedIdleTime NonIdleIgnored IdleToSleep NonIdleReferences

POP_ETW_EVENT_SETSYSTEMSTATE

Event 73 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

Event ID:	73
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	5	win:Verbose	late 6.0 to 1607
	4	win:Informational	1703 and higher
Task:	71	SetSystemState	6.1 and higher
Keyword:	0x40000000`00000004	po:Diagnostic	late 6.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 to 1809
	0x40000000`00002404	po:Diagnostic po:DiagnosticLight po:WdiDiagnostic	1903 and higher
Event Data:	ExecutionState

POP_ETW_EVENT_REGISTERSYSTEMSTATE

Event 74 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

Event ID:	74
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	72	RegisterSystemState	6.1 and higher
Keyword:	0x40000000`00000004	po:Diagnostic	late 6.0 to
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	ExecutionState StateHandle

POP_ETW_EVENT_DEVICE_IDLE_START

Event 75 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

Event ID:	75
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start	6.1 and higher
Task:	73	DeviceIdle	6.1 and higher
Keyword:	0x40000000`00000010	po:Idle

POP_ETW_EVENT_DEVICE_IDLE_END

Event 76 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

Event ID:	76
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop	6.1 and higher
Task:	73	DeviceIdle	6.1 and higher
Keyword:	0x40000000`00000010	po:Idle

POP_ETW_EVENT_DEVICE_IDLE_CHECK

Event 77 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

Event ID:	77
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	74	DeviceIdleCheck	6.1 and higher
Keyword:	0x40000000`00000010	po:Idle
Event Data:	Device Pdo InstancePathLength InstancePath ConservativeTimeout PerformanceTimeout IdleTime BusyCount TotalBusyCount IdlePowerState CurrentPowerState

POP_ETW_EVENT_DISK_IDLE_CHECK

Event 78 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

Event ID:	78
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	75	DiskIdleCheck	6.1 and higher
Keyword:	0x40000000`00000010	po:Idle
Event Data:	Device Timeout IgnoreThreshold IdleTime NonIdleTime

POP_ETW_EVENT_SKIP_TICK

Event 79 is known to the kernel in version 6.1 and higher.

Event ID:	79
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	76	SkipTick
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance
Event Data:	Disabled Overridden

This event has the plain-language description:

Timer tick distribution policy:

Disabled: Disabled

Overridden: Overridden

POP_ETW_EVENT_COOLING_MODE

Event 80 is known to the kernel in version 6.1 and higher.

Event ID:	80
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	77	CoolingModeChange
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance CoolingModeLength CoolingMode

This event has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance changed to CoolingMode cooling.

POP_ETW_EVENT_PASSIVE_COOLING_DIAGNOSTIC

Event 81 is known to the kernel in version 6.1 only. Later versions write event 113 instead. It, along with event 82 (see next), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	81
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	78	PassiveCoolingDiagnostic
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance EventTime PassiveCoolingStateLength PassiveCoolingState AffinityCount _PSV _TMP _TC1 _TC2 _TSP DeltaP _PSL

The _PSL parameter is complex data.

This event has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState cooling.

EventTime = EventTime

_PSV = _PSVK

_TMP = _TMPK

_TC1 = _TC1

_TC2 = _TC2

_TSP = _TSPms

Delta P = DeltaP

_PSL - see event data.

POP_ETW_EVENT_PASSIVE_COOLING_OPERATIONAL

Event 82 is known to the kernel in version 6.1 only. Later versions write event 114 instead. It, along with event 81 (see preceding), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	82
Channel:	18	Microsoft-Windows-Kernel-Power/Thermal-Operational
Level:	4	win:Informational
Task:	79	PassiveCoolingOperational
Keyword:	0x10000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance EventTime PassiveCoolingStateLength PassiveCoolingState AffinityCount _PSV _TMP _TC1 _TC2 _TSP DeltaP _PSL

The _PSL parameter is complex data.

This event, 82, has the same plain-language description as event 81.

POP_ETW_EVENT_ACTIVE_COOLING_DIAGNOSTIC

Event 83 is known to the kernel in version 6.1 only. Later versions write event 115 instead. It, along with event 84 (see next), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	83
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	80	ActiveCoolingDiagnostic
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance EventTime ActiveCoolingStateLength ActiveCoolingState _AC0 _AC1 _AC2 _AC3 _AC4 _AC5 _AC6 _AC7 _AC8 _AC9 _TMP

This event has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.

EventTime = EventTime

_AC0 = _AC0K

_AC1 = _AC1K

_AC2 = _AC2K

_AC3 = _AC3K

_AC4 = _AC4K

_AC5 = _AC5K

_AC6 = _AC6K

_AC7 = _AC7K

_AC8 = _AC8K

_AC9 = _AC9K

_TMP = _TMPK

POP_ETW_EVENT_ACTIVE_COOLING_OPERATIONAL

Event 84 is known to the kernel in version 6.1 only. Later versions write event 116 instead. It, along with event 83 (see preceding), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	84
Channel:	18	Microsoft-Windows-Kernel-Power/Thermal-Operational
Level:	4	win:Informational
Task:	81	ActiveCoolingOperational
Keyword:	0x10000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance EventTime ActiveCoolingStateLength ActiveCoolingState _AC0 _AC1 _AC2 _AC3 _AC4 _AC5 _AC6 _AC7 _AC8 _AC9 _TMP

This event, 84, has the same plain-language description as event 83.

POP_ETW_EVENT_CRITICAL_TRIP_POINT_DIAGNOSTIC

Event 85 is known to the kernel in version 6.1 and higher. It, along with event 86 (see next), is one of a pair that are the same event directed to different channels.

Event ID:	85
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	2	win:Error
Task:	82	CriticalTripPointExceededDiagnostic
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance ShutdownTime _CRT

This event, 85, has the same plain-language description as event 86.

POP_ETW_EVENT_CRITICAL_TRIP_POINT_SYSTEM

Event 86 is known to the kernel in version 6.1 and higher. It, along with event 85 (see preceding), is one of a pair that are the same event directed to different channels.

Event ID:	86
Channel:	8	System
Level:	2	win:Error
Task:	83	CriticalTripPointExceededSystem
Keyword:	0x80000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance ShutdownTime _CRT

This event has the plain-language descrption:

The system was shut down due to a critical thermal event.

Shutdown Time = ShutdownTime

ACPI Thermal Zone = ThermalZoneDeviceInstance

_CRT = _CRT

POP_ETW_EVENT_S4_TRIP_POINT_DIAGNOSTIC

Event 87 is known to the kernel in version 6.1 and higher. It, along with event 88 (see next), is one of a pair that are the same event directed to different channels.

Event ID:	87
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	2	win:Error
Task:	84	S4TripPointExceededDiagnostic
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance HibernateTime _HOT

This event, 87, has the same plain-language description as event 88.

POP_ETW_EVENT_S4_TRIP_POINT_SYSTEM

Event 88 is known to the kernel in version 6.1 and higher. It, along with event 87 (see preceding), is one of a pair that are the same event directed to different channels.

Event ID:	88
Channel:	8	System
Level:	2	win:Error
Task:	85	S4TripPointExceededSystem
Keyword:	0x80000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance HibernateTime _HOT

This event has the plain-language descrption:

The system was hibernated due to a critical thermal event.
Hibernate Time = HibernateTime

ACPI Thermal Zone = ThermalZoneDeviceInstance

_HOT = _HOT

POP_ETW_EVENT_THERMAL_ZONE_ENUMERATED

Event 89 is known to the kernel in version 6.1 only. Later versions write event 125 instead.

Event ID:	89
Channel:	8	System
Level:	4	win:Informational
Task:	86	ThermalZoneEnumerated
Keyword:	0x80000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance AffinityCount _PSV _TC1 _TC2 _TSP _AC0 _AC1 _AC2 _AC3 _AC4 _AC5 _AC6 _AC7 _AC8 _AC9 _CRT _HOT _PSL

The _PSL parameter is complex data.

This event has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has been enumerated.

_PSV = _PSVK

_TC1 = _TC1

_TC2 = _TC2

_TSP = _TSPms

_AC0 = _AC0K

_AC1 = _AC1K

_AC2 = _AC2K

_AC3 = _AC3K

_AC4 = _AC4K

_AC5 = _AC5K

_AC6 = _AC6K

_AC7 = _AC7K

_AC8 = _AC8K

_AC9 = _AC9K

_CRT = _CRTK

_HOT = _HOTK

_PSL - see event data.

POP_ETW_EVENT_ILLEGAL_PROCESSOR_THROTTLE_DIAGNOSTIC

Event 90 is known to the kernel in version 6.1 and higher. It, along with event 91 (see next), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	90
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	3	win:Warning
Task:	87	IllegalProcessorThrottleDiagnostic
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ProcessorId ThrottleMSR ElapsedTime LogInterval

This event has the plain-language description:

Processor ProcessorId was throttled by an entity other than the kernel power manager. 
IA32_CLOCK_MODULATION_MSR = ThrottleMSR. 
Elapsed time since last event logged = ElapsedTimes. 
Log interval = LogInterval events.

POP_ETW_EVENT_ILLEGAL_PROCESSOR_THROTTLE_OPERATIONAL

Event 91 is known to the kernel in version 6.1 and higher. It, along with event 90 (see preceding), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	91
Channel:	18	Microsoft-Windows-Kernel-Power/Thermal-Operational
Level:	3	win:Warning
Task:	88	IllegalProcessorThrottleOperational
Keyword:	0x10000000`00000020	po:Thermal
Event Data:	ProcessorId ThrottleMSR ElapsedTime LogInterval

This event, 91, has the same plain-language description as event 90.

POP_ETW_EVENT_CREATE_POWER_REQUEST

Event 92 is known to the kernel in version 6.1 and higher.

Event ID:	92
Version:	0		6.1 and higher
	1		6.2 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	89	CreatePowerRequest
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Token Type ProcessID SessionID Legacy SystemAllowed DisplayAllowed AwayModeAllowed SystemCount DisplayCount AwayModeCount CallerLength ContextLength Caller Context		versions 0 and 1
	ExecutionRequiredAllowed PerformanceBoostAllowed FullScreenVideoAllowed ExecutionRequiredCount PerformanceBoostCount FullScreenVideoCount		version 1

POP_ETW_EVENT_CHANGE_POWER_REQUEST

Event 93 is known to the kernel in version 6.1 and higher.

Event ID:	93
Version:	0		6.1 and higher
	1		6.2 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	90	ChangePowerRequest
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Token SystemCount DisplayCount AwayModeCount		versions 0 and 1
	ExecutionRequiredCount PerformanceBoostCount FullScreenVideoCount		version 1

POP_ETW_EVENT_CLOSE_POWER_REQUEST

Event 94 is known to the kernel in version 6.1 and higher.

Event ID:	94
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	91	ClosePowerRequest
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Token

POP_ETW_EVENT_TIME_RESOLUTION_UPDATE

Event 95 is known to the kernel in version 6.1 and higher.

Event ID:	95
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	92	SystemTimeResolutionUpdate
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1903
	0x4000000`00004004	po:Diagnostic po:TimerResolution	2004 and higher
Event Data:	NewResolution

This event has the plain-language description:

The system timer resolution has changed to a value of NewResolution.

POP_ETW_EVENT_TIME_RESOLUTION_RUNDOWN

Event 96 is known to the kernel in version 6.1 and higher.

Event ID:	96
Version:	0		6.1 and higher
	1		1803 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	93	SystemTimeResolutionRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1903
	0x40000000`00004004	po:Diagnostic po:TimerResolution	2004 and higher
Event Data:	CurrentPeriod MinimumPeriod MaximumPeriod KernelRequestCount KernelRequestedPeriod		versions 0 and 1
	InternalSetPeriod		version 1

This event has the plain-language description:

The system timer resolution currently has a value of CurrentPeriod.

POP_ETW_EVENT_TIME_RESOLUTION_REQUEST_RUNDOWN

Event 97 is known to the kernel in version 6.1 and higher.

Event ID:	97
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	94	SystemTimeResolutionRequestRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1903
	0x40000000`00004004	po:Diagnostic po:TimerResolution	2004 and higher
Event Data:	RequestedPeriod Pid AppNameLength AppName

This event has the plain-language description:

The system timer resolution currently has a value of RequestedPeriod.

The text is shared with that of event 96, both taking their one placeholder from the first parameter but differing in how this parameter is labelled.

POP_ETW_EVENT_KERNEL_STRS

Event 98 is known in version 6.1 and higher.

Event ID:	98
Version:	0		6.1 and higher
	1		6.3 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	95	SystemTimeResolutionKernelChange
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1903
	0x40000000`00004004	po:Diagnostic po:TimerResolution	2004 and higher
Event Data:	RequestedResolution		versions 0 and 1
	Tag		version 1

This event has the plain-language description:

A driver is attempting to update the system timer resolution to a value of RequestedResolution.

POP_ETW_EVENT_POWER_REQUEST_RUNDOWN

Event 99 is known to the kernel in version 6.1 and higher.

Event ID:	99
Version:	0		6.1 and higher
	1		6.2 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	96	PowerRequestRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Token Type ProcessID SessionID Legacy SystemAllowed DisplayAllowed AwayModeAllowed SystemCount DisplayCount AwayModeCount CallerLength ContextLength Caller Context		versions 0 and 1
	ExecutionRequiredAllowed PerformanceBoostAllowed FullScreenVideoAllowed ExecutionRequiredCount PerformanceBoostCount FullScreenVideoCount		version 1

POP_ETW_EVENT_FLUSHALLPAGES

Event 100 is known to the kernel in version 6.1 and higher.

Event ID:	100
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	97	FlushAllPages
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_FLUSHALLPAGES_END

Event 101 is known to the kernel in version 6.1 and higher.

Event ID:	101
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	97	FlushAllPages
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_BUILDNOTIFYLIST

Event 102 is known to the kernel in version 6.1 and higher.

Event ID:	102
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	33	PhaseStart
Task:	98	BuildNotifyList
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_BUILDNOTIFYLIST_END

Event 103 is known to the kernel in version 6.1 and higher.

Event ID:	103
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	98	BuildNotifyList
Keyword:	0x40000000`00000008	po:Performance	6.0 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_SLEEP_DISABLE_REASON_RUNDOWN

Event 104 is known to the kernel in version 6.1 and higher.

Event ID:	104
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	99	SleepDisableReasonRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	AffectedState PowerReasonCode PowerReasonLength PowerReasonInfo

POP_ETW_EVENT_ACDC_STATE_CHANGE

Event 105 is known to the kernel in version 6.1 and higher. It is remarkable for having started as diagnostic but then regarded as important enough to report in the System log.

Event ID:	105
Version:	0		6.1 and higher
	1		1709 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic	6.1 to 1607
	8	System	1703 and higher
Level:	4	win:Informational
Task:	100	AcDcStateChange
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 6.3
	0x40002000`00000004	po:Diagnostic ms:Telemetry	10.0 only
	0x40004000`00000004	po:Diagnostic ms:Measures	1511 only
	0x40004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures	1607 only
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1703 and higher
Event Data:	AcOnline		versions 0 and 1
	RemainingCapacity FullChargeCapacity		version 1

Redirecting event 105 to the System log brought with it a plain-language description:

Power source change.

POP_ETW_EVENT_ACDC_STATE_RUNDOWN

Event 106 is known to the kernel in version 6.1 and higher.

Event ID:	106
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	101	AcDcStateRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.1 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	AcOnline

POP_ETW_EVENT_POSTSLEEP_NOTIFICATION

Event 107 is known to the kernel in version 6.1 and higher. This event is another that started as diagnostic but was promoted to the System log. Unlike for event 105 (see above), this change was concurrent with adding parameters to the event data and so the first event version is left as diagnostic.

Event ID:	107
Version:	0		6.1 and higher
	1		1511 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic	version 0
	8	System	version 1
Level:	4	win:Informational
Task:	102	PostSleepNotification
Keyword:	0x40000000`00000044	po:Diagnostic po:PerfTrackContext	version 0 in 6.1 to 1511
	0x40000000`00000444	po:Diagnostic po:PerfTrackContext po:DiagnosticLight	version 0 in 1607 and higher
	0x80004000`00000044	po:Diagnostic po:PerfTrackContext ms:Measures	version 1 in 1511 only
	0x80004000`00000444	po:Diagnostic po:PerfTrackContext po:DiagnosticLight ms:Measures	version 1 in 1607 only
	0x80000000`00000444	po:Diagnostic po:PerfTrackContext po:DiagnosticLight	version 1 in 1703 and higher
Event Data:	TargetState EffectiveState WakeFromState		versions 0 and 1
	ProgrammedWakeTimeAc ProgrammedWakeTimeDc WakeRequesterTypeAc WakeRequesterTypeDc		version 1

Version 1 of this event has the plain-language description:

The system has resumed from sleep.

POP_ETW_EVENT_HIBER_STATS

Event 108 is known to the kernel in version 6.1 only. Later versions write event 117 instead.

Event ID:	108
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	6.1 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 and higher
Event Data:	CopyBytes ElapsedTime IoTime InitTime CopyTime PagesWritten PagesProcessed DumpCount FileRuns ReadTime ResumeAppTime CompressTime

POP_ETW_EVENT_SHUTDOWN_ACTION

Event 109 is known to the kernel in version 6.1 and higher.

Event ID:	109
Channel:	8	System
Level:	4	win:Informational
Task:	103	ShutdownAction
Keyword:	0x80000000`00000004	po:Diagnostic	6.1 to 6.3
	0x80002000`00000004	po:Diagnostic ms:Telemetry	10.0 only
	0x80004000`00000004	po:Diagnostic ms:Measures	1511 only
	0x80004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures	1607 and hig
Event Data:	ShutdownActionType ShutdownEventCode ShutdownReason

This event nowadays has the plain-language description:

The kernel power manager has initiated a shutdown transition.

Shutdown Reason: ShutdownReason

Before Windows 10, however, you get just the first sentence and must look in the event data if you want the ShutdownReason.

POP_ETW_EVENT_TIME_RESOLUTION_STACK_RUNDOWN

Event 110 is known to the kernel in version 6.1 and higher.

Event ID:	110
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	104	SystemTimerResolutionStackRundown
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	RequestedPeriod Pid AppNameLength AppName StackSize Stack

POP_ETW_EVENT_POWER_SETTING_RUNDOWN

Event 111 is known to the kernel in version 6.2 and higher.

Event ID:	111
Version:	0		6.2 and higher
	1		6.3 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	105	PowerSettingRundown
Keyword:	0x40000000`00000080	po:PowerSetting
Event Data:	SettingGuid DataSize Data		versions 0 and 1
	Override		version

POP_ETW_EVENT_POWER_SETTING_CHANGE

Event 112 is known to the kernel in version 6.2 and higher.

Event ID:	112
Version:	0		6.2 and higher
	1		6.3 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	106	PowerSettingChange
Keyword:	0x40000000`00000080	po:PowerSetting
Event Data:	SettingGuid DataSize Data		versions 0 and 1
	Override		version 1

POP_ETW_EVENT_PASSIVE_COOLING_DIAGNOSTIC

Event 113 is known to the kernel in version 6.2 and higher, apparently having replaced event 81. It, along with event 114 (see next), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	113
Version:	0		6.2 and higher
	1		6.3 and higher
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	78	PassiveCoolingDiagnostic
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance EventTime PassiveCoolingState _PSV _TMP _TC1 _TC2 _TSP DeltaP		versions 0 and 1
	MinimumThrottle		version 1

This event nowadays has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive cooling.

EventTime = EventTime

_PSV = _PSVK

_TMP = _TMPK

_TC1 = _TC1

_TC2 = _TC2

_TSP = _TSPms

Delta P = DeltaP

Minimum Throttle = MinimumThrottle

The rendering for earlier versions of the event continues only as far as do the items of event data. It, along with event 113 (see preceding), is one of a pair that are the same event directed to different diagnostic channels.

POP_ETW_EVENT_PASSIVE_COOLING_OPERATIONAL

Event 114 is known to the kernel in version 6.2 and higher, apparently having replaced event 82.

Event ID:	114
Version:	0		6.2 and higher
	1		6.3 and higher
Channel:	18	Microsoft-Windows-Kernel-Power/Thermal-Operational
Level:	4	win:Informational
Task:	79	PassiveCoolingOperational
Keyword:	0x10000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance EventTime PassiveCoolingState _PSV _TMP _TC1 _TC2 _TSP DeltaP		versions 0 and 1
	MinimumThrottle		version 1

This event, 114, has the same plain-language descriptions as event 113.

POP_ETW_EVENT_ACTIVE_COOLING_DIAGNOSTIC

Event 115 is known to the kernel in version 6.2 and higher, apparently having replaced event 83. It, along with event 116 (see next), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	115
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	80	ActiveCoolingDiagnostic
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance EventTime ActiveCoolingState _AC0 _AC1 _AC2 _AC3 _AC4 _AC5 _AC6 _AC7 _AC8 _AC9 _TMP

This event has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.

EventTime = EventTime

_AC0 = _AC0K

_AC1 = _AC1K

_AC2 = _AC2K

_AC3 = _AC3K

_AC4 = _AC4K

_AC5 = _AC5K

_AC6 = _AC6K

_AC7 = _AC7K

_AC8 = _AC8K

_AC9 = _AC9K

_TMP = _TMPK

POP_ETW_EVENT_ACTIVE_COOLING_OPERATIONAL

Event 116 is known to the kernel in version 6.2 and higher, apparently having replaced event 84. It, along with event 115 (see preceding), is one of a pair that are the same event directed to different diagnostic channels.

Event ID:	116
Channel:	18	Microsoft-Windows-Kernel-Power/Thermal-Operational
Level:	4	win:Informational
Task:	81	ActiveCoolingOperational
Keyword:	0x10000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance EventTime ActiveCoolingState _AC0 _AC1 _AC2 _AC3 _AC4 _AC5 _AC6 _AC7 _AC8 _AC9 _TMP

This event, 116, has the same plain-language description as event 115.

POP_ETW_EVENT_HIBER_STATS

Event 117 is known to the kernel in version 6.2 and higher, apparently having replaced event 108.

Event ID:	117
Version:	0		6.2 and higher
	1		10.0 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	6.2 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	version 0 in 1607 and higher; version 1 in 1607 to 1809
	0x40000000`00002C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight po:WdiDiagnostic	version 1 in 1903 and higher
Event Data:	TotalResumeTime POSTTime ResumeBootMgrTime ResumeAppTime ResumeAppStartTime ResumeLibraryInitTime ResumeInitTime ResumeHiberFileTime ResumeRestoreImageStartTimestamp ResumeIoTime ResumeDecompressTime ResumeMapTime ResumeUnmapTime ResumeUserInOutTime ResumeAllocateTime ResumeKernelSwitchTimestamp KernelReturnFromHandlerTimestamp SleeperThreadEndTimestamp TimeStampCounterAtSwitchTime KernelReturnSystemPowerStateTimestamp HiberHiberFileTime InitTime HiberSharedBufferTime TotalHibernateTime KernelResumeHiberFileTime KernelResumeInitTime KernelResumeSharedBufferTime DeviceResumeTime KernelAnimationTime KernelPagesProcessed KernelPagesWritten BootPagesProcessed BootPagesWritten HiberWriteRate HiberCompressRate ResumeReadRate ResumeDecompressRate FileRuns NoMultiStageResumeReason MaxHuffRatio		versions 0 and 1
	SecurePagesProcessed HiberChecksumTime HiberChecksumIoTime ResumeChecksumTime ResumeChecksumIoTime KernelChecksumTime KernelChecksumIoTime		version 1

Note the very many statistics that come with this event, with even more added for Windows 10.

POP_ETW_IDLE_RESILIENCY_START

Event 118 is known to the kernel in version 6.2 and higher.

Event ID:	118
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	107	IdleResiliencyStart
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	RequestedResolution Flags Ticks

This event has the plain-language description:

Idle resiliency activiated with requested clock period: RequestedResolution(Internal flags:Flags, Ticks:Ticks).

POP_ETW_IDLE_RESILIENCY_END

Event 119 is known to the kernel in version 6.2 and higher.

Event ID:	119
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	108	IdleResiliencyEnd
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	RequestedResolution Flags Ticks

This event has the plain-language description:

Idle resiliency deactivated (Internal flags:Flags).

POP_ETW_EVENT_PERFTRACK_HIBERNATE

Event 120 is known to the kernel in version 6.2 and higher.

Event ID:	120
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x40010000`00000009	po:Scenario po:Performance win:ResponseTime	6.2 to 1511
	0x40010000`00000809	po:Scenario po:Performance po:PerformanceLight win:ResponseTime	1607 and higher
Event Data:	HiberfileSizeKB TotalHibernateTime HiberHiberFileTime

POP_ETW_EVENT_PERFTRACK_STANDBY

Event 121 is known to the kernel in version 6.2 and higher.

Event ID:	121
Version:	0		6.2 and higher
	1		6.2 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x40010000`00000009	po:Scenario po:Performance win:ResponseTime	6.2 to 1511
	0x40010000`00000809	po:Scenario po:Performance po:PerformanceLight win:ResponseTime	1607 and higher
Event Data:	DriverWakeTime TotalResumeTime BiosInitTime		versions 0 and 1
	ResumeAppsTime ResumeServicesTime		version 1

For the event as written by the Windows 8 kernel, the event version is already 1. Which kernel ever could write version 0 is not known.

POP_ETW_EVENT_PERFTRACE_RESUME_FROM_HIBERNATE

Event 122 is known to the kernel in version 6.2 and higher.

Event ID:	122
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x40010000`00000009	po:Scenario po:Performance win:ResponseTime	6.2 to 1511
	0x40010000`00000809	po:Scenario po:Performance po:PerformanceLight win:ResponseTime	1607 and higher
Event Data:	TotalResumeTime PhasePagesWrittenMB ResumeAppAndKernelResumeHiberFileTime POSTAndDeviceResumeTime RatesAndResumeAppsServicesTime PhasePagesProcessedMB

POP_ETW_EVENT_PERFTACK_HYBRID_SHUTDOWN

Event 123 is known to the kernel in version 6.2 and higher.

Event ID:	123
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x40010000`00000009	po:Scenario po:Performance win:ResponseTime	6.2 to 1511
	0x40010000`00000809	po:Scenario po:Performance po:PerformanceLight win:ResponseTime	1607 and higher
Event Data:	HiberfileSize TotalHybridShutdownTime HiberfileCreateTime

POP_ETW_EVENT_PERFTRACK_HYBRID_RESUME

Event 124 is known to the kernel in version 6.2 and higher.

Event ID:	124
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x40010000`00000009	po:Scenario po:Performance win:ResponseTime	6.2 to 1511
	0x40010000`00000809	po:Scenario po:Performance po:PerformanceLight win:ResponseTime	1607 and higher
Event Data:	TotalResumeTime PhasePagesWrittenMB ResumeAppAndKernelResumeHiberFileTime POSTAndDeviceResumeTime RatesAndResumeAppsServicesTime PhasePagesProcessedMB

POP_ETW_EVENT_THERMAL_ZONE_ENUMERATED

Event 125 is known to the kernel in version 6.2 and higher, apparently having replaced event 89.

Event ID:	125
Version:	0		6.2 and higher
	1		6.3 and higher
	2		10.0 and higher
	3		1511 and higher
	4		1703 and higher
Channel:	8	System
Level:	4	win:Informational
Task:	86	ThernalZoneEnumerated
Keyword:	0x80000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance _PSV _TC1 _TC2 _TSP _AC0 _AC1 _AC2 _AC3 _AC4 _AC5 _AC6 _AC7 _AC8 _AC9 _CRT _HOT		versions 0 to 4
	MinimumThrottle		versions 1 to 4
	_CR3 OverThrottleThreshold		versions 2 to 4
	DescriptionLength Description		versions 3 and 4
	_TZP		version 4

This event nowadays has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has been enumerated.

_PSV = _PSVK

_TC1 = _TC1

_TC2 = _TC2

_TSP = _TSPms

_AC0 = _AC0K

_AC1 = _AC1K

_AC2 = _AC2K

_AC3 = _AC3K

_AC4 = _AC4K

_AC5 = _AC5K

_AC6 = _AC6K

_AC7 = _AC7K

_AC8 = _AC8K

_AC9 = _AC9K

_CRT = _CRTK

_HOT = _HOTK

minimum throttle = MinimumThrottle

_CR3 = _CR3K

This is for event versions 2 and higher. The rendering for earlier versions of the event (naturally) extends only as far as do the items of event data.

POP_ETW_EVENT_DEVICESSUSPENDLEVEL

Event 126 is known to the kernel in version 6.2 and higher.

Event ID:	126
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	6.2 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 and higher
Event Data:	Level MinorFunction

POP_ETW_EVENT_DEVICESSUSPENDLEVEL_END

Event 127 is known to the kernel in version 6.2 and higher.

Event ID:	127
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	6.2 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 and higher
Event Data:	Level MinorFunction

POP_ETW_EVENT_DEVICESWAKELEVEL

Event 128 is known to the kernel in version 6.2 and higher.

Event ID:	128
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	6.2 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 and higher
Event Data:	Level MinorFunction

POP_ETW_EVENT_DEVICESWAKELEVEL_END

Event 129 is known to the kernel in version 6.2 and higher.

Event ID:	129
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4
Keyword:	0x40000000`0000000C	po:Diagnostic po:Performance	6.2 to 1511
	0x40000000`00000C0C	po:Diagnostic po:Performance po:DiagnosticLight po:PerformanceLight	1607 and higher
Event Data:	Level MinorFunction

POP_ETW_EVENT_S3FWSTATS_SUSPEND

Event 130 is known to the kernel in version 6.2 and higher.

Event ID:	130
Channel:	8	System
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x80000000`00000004	po:Diagnostic	6.2 to 1511
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SuspendStart SuspendEnd

This event has the plain-language description:

Firmware S3 times. SuspendStart: SuspendStart, SuspendEnd: SuspendEnd

POP_ETW_EVENT_S3FWSTATS_RESUME

Event 131 is known to the kernel in version 6.2 and higher.

Event ID:	131
Channel:	8	System
Level:	4	win:Informational
Task:	33	PowerTransition
Keyword:	0x80000000`00000004	po:Diagnostic	6.2 to
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	ResumeCount FullResume AverageResume

This event has the plain-language description:

Firmware S3 times. ResumeCount: ResumeCount, FullResume: FullResume, AverageResume: AverageResume

POP_ETW_EVENT_PLATFORMROLE_RUNDOWN

Event 132 is known to the kernel in version 6.2 and higher.

Event ID:	132
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	150	FirmwarePlatformRoleRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	PlatformRole

POP_ETW_EVENT_RESUMEAPPS_END

Event 133 is known to the kernel in version 6.2 and higher.

Event ID:	133
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	44	ResumeApps
Keyword:	0x40000000`00000008	po:Performance	6.2 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_RESUMESERVCIES_END

Event 134 is known to the kernel in version 6.2 and higher.

Event ID:	134
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	34	PhaseStop
Task:	43	ResumeServices
Keyword:	0x40000000`00000008	po:Performance	6.2 to 1511
	0x40000000`00000808	po:Performance po:PerformanceLight	1607 and higher

POP_ETW_EVENT_CONSOLE_DISPLAY_STATE

Event 135 is known to the kernel in version 6.2 and higher.

Event ID:	135
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 6.3
	0x40002000`00000004	po:Diagnostic ms:Telemetry	10.0 to 1511
	0x40002000`00000404	po:Diagnostic po:DiagnosticLight ms:Telemetry	1607 and higher
Event Data:	DisplayState

POP_ETW_EVENT_DEVICE_RUNDOWN

Event 136 is known to the kernel in version 6.2 and higher.

Event ID:	136
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	151	DeviceRundown
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	DeviceNode PowerState InstancePathLength InstancePath FriendlyNameLength FriendlyName

POP_ETW_EVENT_MTRR_CHANGED

Event 137 is known to the kernel in version 6.2 and higher.

Event ID:	137
Channel:	8	System
Level:	2	win:Error
Keyword:	0x80000000`00000004	po:Diagnostic	6.2 to 1511
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SleepState

This event has the plain-language description:

The system firmware has changed the processor's memory type range registers (MTRRs) across a sleep state transition (SSleepState). This can result in reduced resume performance.

POP_ETW_EVENT_THERMAL_PERFTRACK

Event 138 is known to the kernel in version 6.2 and higher.

Event ID:	138
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	154	ThermalPerfTrack
Keyword:	0x40010000`00000000	win:ResponseTime
Event Data:	Throttle Temperature ZoneLength Zone

POP_ETW_EVENT_THERMAL_DURATION_PERFTRACK

Event 139 is known to the kernel in version 6.2 and higher.

Event ID:	139
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	155	ThermalDurationPerfTrack
Keyword:	0x40010000`00000000	win:ResponseTime
Event Data:	ThrottleDuration ZoneLength Zone

POP_ETW_EVENT_CS_CONSUMPTION_PERFTRACK

Event 140 is known to the kernel in version 6.2 and higher.

Event ID:	140
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	156	CsConsumptionPerfTrack
Keyword:	0x40010000`00000000	win:ResponseTime
Event Data:	EnergyDrain Duration DripsTransitions Flags

POP_ETW_EVENT_CS_FAN_PERFTRACK

Event 141 is known to the kernel in version 6.3 and higher.

Event ID:	141
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	172	CsFanPerfTrack
Keyword:	0x40010000`00000000	win:ResponseTime
Event Data:	FanDuration ActivationDelay

POP_ETW_EVENT_ABNORMAL_RESET

Event 142 is known to the kernel in version 6.3 and higher.

Event ID:	142
Channel:	8	System
Level:	1	win:Critical
Task:	173	AbnormalReset
Keyword:	0x80000000`00000002	po:Simple	6.3 only
	0x80002000`00000002	po:Simple ms:Telemetry	10.0 only
	0x80004000`00000002	po:Simple ms:Measures	1511 to 1607
	0x80000000`00000002	po:Simple	1703 and higher
Event Data:	ResetReasonMask

This event has the plain-language description:

The system has rebooted without cleanly shutting down first. This error is caused because the system stopped responding and the hardware watchdog tiggered a system reset.

POP_ETW_EVENT_CS_DRIPS_WATCHDOG_PERFTRACK

Event 143 is known to the kernel in version 6.3 and higher.

Event ID:	143
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	174	CsDripsWatchdogPerfTrack
Keyword:	0x40010000`00000000	win:ResponseTime
Event Data:	ResiliencyPhaseNonActivatedNoDripsMs NonActivatedCpuTimeMs DurationThisPeriodMs ActionsTakenAndOnAc

POP_ETW_EVENT_THERMAL_EVENT

Event 144 is known to the kernel in version 6.3 and higher.

Event ID:	144
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	175	ThermalEvent
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	InitiatorLength Initiator Type Temperature TripPointTemperature

POP_ETW_EVENT_THERMAL_ZONE_RUNDOWN

Event 145 is known to the kernel in version 6.3 and higher.

Event ID:	145
Version:	0		6.3 and higher
	1		10.0 and higher
	2		1511 and higher
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	176	ThermalZoneRundown
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance ActiveCoolingState ActivePoint PassiveCoolingState ThrottleLimit		versions 0 to 2
	ThermalStandby OverThrottled		versions 1 and 2
	DescriptionLength Description		version 2

POP_ETW_EVENT_POWER_SETTING_CALLBACK_START

Event 146 is known to the kernel in version 10.0 and higher.

Event ID:	146
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	177	PowerSettingCallback
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Callback SettingGuid DataSize Data

POP_ETW_EVENT_POWER_SETTING_CALLBACK_STOP

Event 147 is known to the kernel in version 10.0 and higher.

Event ID:	147
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	177	PowerSettingCallback
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Callback SettingGuid

POP_ETW_EVENT_ENERGY_SAVER_STATE

Event 148 is known to the kernel in version 10.0 and higher.

Event ID:	148
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	178	EnergySaverState
Keyword:	0x40000000`00000009	po:Scenario po:Performance	10.0 to 1511
	0x40000000`00000809	po:Scenario po:Performance po:PerformanceLight	1607 and higher
Event Data:	State Reason

POP_ETW_EVENT_SESSION_DISPLAY_OFF

Event 149 is known to the kernel in version 10.0 and higher.

Event ID:	149
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	185	SessionDisplayOff
Keyword:	0x40002000`00000004	po:Diagnostic ms:Telemetry	10.0 only
	0x40004000`00000004	po:Diagnostic ms:Measures	1511 only
	0x40004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures	1607 and high
Event Data:	Session Console Reason

POP_ETW_EVENT_SESSION_DISPLAY_ON

Event 150 is known to the kernel in version 10.0 and higher.

Event ID:	150
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	186	SessionDisplayOn
Keyword:	0x40002000`00000004	po:Diagnostic ms:Telemetry	10.0 only
	0x40004000`00000004	po:Diagnostic ms:Measures	1511 only
	0x40004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures	1607 and higher
Event Data:	Session Console Reason

POP_ETW_EVENT_COOLING_EXTENSION_ADD

Event 151 is known to the kernel in version 10.0 and higher.

Event ID:	151
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	187	CoolingExtensionAdd
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	PassiveSupported ActiveSupported Throttle ActiveEngaged Token DeviceIdLength DeviceId

POP_ETW_EVENT_COOLING_EXTENSION_RUNDOWN

Event 152 is known to the kernel in version 10.0 and higher.

Event ID:	152
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	188	CoolingExtensionRundown
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	PassiveSupported ActiveSupported Throttle ActiveEngaged Token DeviceIdLength DeviceId

POP_ETW_EVENT_COOLING_EXTENSION_REMOVE

Event 153 is known to the kernel in version 10.0 and higher.

Event ID:	153
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	189	CoolingExtensionRemove
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	PassiveSupported ActiveSupported Throttle ActiveEngaged Token DeviceIdLength DeviceId

POP_ETW_EVENT_COOLING_EXTENSION_PASSIVE_UPDATE

Event 154 is known to the kernel in version 10.0 and higher.

Event ID:	154
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	190	CoolingExtensionPassiveUpdate
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	Throttle Token

POP_ETW_EVENT_COOLING_EXTENSION_ACTIVE_UPDATE

Event 155 is known to the kernel in version 10.0 and higher.

Event ID:	155
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	191	CoolingExtensionActiveUpdate
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ActiveEngaged Token

POP_ETW_EVENT_THERMAL_REQUEST_ADD

Event 156 is known to the kernel in version 10.0 and higher.

Event ID:	156
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	192	ThermalRequestAdd
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	Throttle ActiveEngaged Token DeviceIdLength CallerLength ContextLength PolicyLength DeviceId Caller Context Policy

POP_ETW_EVENT_THERMAL_REQUEST_RUNDOWN

Event 157 is known to the kernel in version 10.0 and higher.

Event ID:	157
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	193	ThermalRequestRundown
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	Throttle ActiveEngaged Token DeviceIdLength CallerLength ContextLength PolicyLength DeviceId Caller Context Policy

POP_ETW_EVENT_THERMAL_REQUEST_REMOVE

Event 158 is known to the kernel in version 10.0 and higher.

Event ID:	158
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	194	ThermalRequestRemove
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	Throttle ActiveEngaged Token DeviceIdLength CallerLength ContextLength PolicyLength DeviceId Caller Context Policy

POP_ETW_EVENT_THERMAL_REQUEST_PASSIVE_UPDATE

Event 159 is known to the kernel in version 10.0 and higher.

Event ID:	159
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	195	ThermalRequestPassiveUpdate
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	Throttle Token

POP_ETW_EVENT_THERMAL_REQUEST_ACTIVE_UPDATE

Event 160 is known to the kernel in version 10.0 and higher.

Event ID:	160
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	196	ThermalRequestActiveUpdate
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ActiveEngaged Token

POP_ETW_EVENT_CS_DRIPS_WATCHDOG

Event 161 is known to the kernel in version 10.0 and higher.

Event ID:	161
Version:	0		10.0 and higher
	1		1511 and higher
	2		1703 and higher
	3		1803 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	197	CsDripsWatchdog
Keyword:	0x40000000`00000004	po:Diagnostic	10.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	versions 0 and 1 in 1607 and higher
	0x40004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures	versions 2 and 3
Event Data:	ResiliencyPhaseNonActivatedNoDripsMs NonActivatedCpuTimeMs DurationThisPeriodMs OnAc EnergyDrainMw DeviceConstraint ActionsTaken DeviceServiceNameLength DeviceServiceName ChildServiceNameLength ChildServiceName		versions 0 to 3
	PepPreVeto		versions 1 to 3
	InvocationCount		versions 2 and 3

POP_ETW_EVENT_THERMAL_ZONE_THERMAL_STANDBY_UPDATE

Event 162 is known to the kernel in version 10.0 and higher.

Event ID:	162
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	198	ThermalZoneThermalStandbyUpdate
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance Engaged

POP_ETW_EVENT_THERMAL_ZONE_OVERTHROTTLED_UPDATE

Event 163 is known to the kernel in version 10.0 and higher.

Event ID:	163
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	199	ThermalZoneOverthrottledUpdate
Keyword:	0x20000000`00000020	po:Thermal
Event Data:	ThermalZoneDeviceInstanceLength ThermalZoneDeviceInstance Engaged

POP_ETW_EVENT_THERMAL_STANDBY_NOTIFICATION

Event 164 is known to the kernel in version 10.0 and higher.

Event ID:	164
Channel:	17	Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level:	4	win:Informational
Task:	200	ThermalStandbyNotification
Keyword:	0x20000000`00000020	po:Thermal

POP_ETW_EVENT_SYSTEM_IDLE_TIMEOUT_INITIALIZED

Event 165 is known to the kernel in version 10.0 and higher.

Event ID:	165
Version:	0		10.0 and higher
	1		1709 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	201	SystemIdle
Keyword:	0x40000000`00000004	po:Diagnostic	10.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	IdleInformationUpdated TimeoutSource Action MinState Timeout Flags		versions 0 and 1
	Reason		version 1

POP_ETW_EVENT_SYSTEM_IDLE_UPDATE

Event 166 is known to the kernel in version 10.0 and higher.

Event ID:	166
Version:	0		10.0 and higher
	1		1511 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	201	SystemIdle
Keyword:	0x40000000`00000004	po:Diagnostic	10.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	AccumulatedIdleTime SystemIdle Flags Action MinState DozeS4Timeout		versions 0 and 1
	PredictedUserReturnTime		version 1

POP_ETW_EVENT_SYSTEM_IDLE_TIME_RESET

Event 167 is known to the kernel in version 10.0 and higher.

Event ID:	167
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	201	SystemIdle
Keyword:	0x40000000`00000004	po:Diagnostic	10.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Reason S0LowPowerDozeTimerCancelled

POP_ETW_EVENT_SYSTEM_IDLE_S0_LOW_POWER_DOZE

Event 168 is known to the kernel in version 10.0 and higher.

Event ID:	168
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	201	SystemIdle
Keyword:	0x40000000`00000004	po:Diagnostic	10.0 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	CancelledDueToUserInput

POP_ETW_EVENT_SYSTEM_IDLE_S0_LOW_POWER_DOZE_TIMER_ARMED

Event 169 is known to the kernel in Version 1511 and higher.

Event ID:	169
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	201	SystemIdle
Keyword:	0x40000000`00000004	po:Diagnostic	1511 only
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Source Time

POP_ETW_EVENT_SYSTEM_IDLE_S0_LOW_POWER_DOZE_TIMER_CANCELLED

Event 170 is known to the kernel in Version 1511 and higher.

Event ID:	170
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	201	SystemIdle
Keyword:	0x40000000`00000004	po:Diagnostic	1511 only
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Reason

POP_ETW_EVENT_CS_DEEP_SLEEP_WATCHDOG

Event 171 is known to the kernel in Version 1511 and higher.

Event ID:	171
Version:	0		1511 and higher
	1		1803 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	202	CsDeepSleepWatchdog
Keyword:	0x40000000`00000004	po:Diagnostic	1511 only
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	ResiliencyPhaseNonActivatedNoDeepSleepMs NonActivatedCpuTimeMs DurationThisPeriodMs OnAc ActionsTaken PowerSettingPending		versions 0 and 1

POP_ETW_EVENT_STANDBY_CONNECTIVITY_UPDATE

Event 172 is known to the kernel in Version 1607 and higher.

Event ID:	172
Channel:	8	System
Level:	4	win:Informational
Task:	203	StandbyConnectivityUpdate
Keyword:	0x80000000`00000404	po:Diagnostic po:DiagnosticLight
Event Data:	State Reason

This event has the plain-language description:

Connectivity state in standby: State, Reason: Reason

POP_ETW_EVENT_FLUSHSLEEPSTUDYLOGGER_START

Event 173 is known to the kernel in Version 1607 and higher.

Event ID:	173
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	204	FlushSleepStudyLogger
Keyword:	0x40000000`00000808	po:Performance po:PerformanceLight

POP_ETW_EVENT_FLUSHSLEEPSTUDYLOGGER_STOP

Event 174 is known to the kernel in Version 1607 and higher.

Event ID:	174
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	204	FlushSleepStudyLogger
Keyword:	0x40000000`00000802	po:Simple po:PerformanceLight

POP_ETW_EVENT_STANDBY_CONNECTIVITY_RUNDOWN

Event 175 is known to the kernel in Version 1607 and higher.

Event ID:	175
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	205	StandbyConnectivityRundown
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	State Reason

POP_ETW_EVENT_CS_COMPLIANCE_RUNDOWN

Event 176 is known to the kernel in Version 1607 and higher.

Event ID:	176
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	206	CsComplianceRundown
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Type State

POP_ETW_EVENT_CS_COMPLIANCE_UPDATE

Event 177 is known to the kernel in Version 1607 and higher.

Event ID:	177
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	207	CsComplianceUpdate
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Type State

POP_ETW_EVENT_BACKGROUND_ACTIVITY_POLICY_UPDATE

Event 178 is known to the kernel in Version 1607 and higher.

Event ID:	178
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	208	BackgroundActivityPolicyUpdate
Keyword:	0x40000000`00000404	po:Diagnostic po:DiagnosticLight
Event Data:	PreviousPolicy NewPolicy

This event has the plain-language description:

Background Activity Policy updated from PreviousPolicy to NewPolicy.

POP_ETW_FORCEIDLE_STATE_CHANGE

Event 179 is known to the kernel in Version 1703 and higher.

Event ID:	179
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	213	ForceIdleStateChange
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	PrevState NewState

POP_ETW_FORCEIDLE_RESET

Event 180 is known to the kernel in Version 1703 and higher.

Event ID:	180
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	214	ForceIdleReset
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Reason

POP_ETW_DEEP_SLEEP_SET_CONSTRAINT

Event 181 is known to the kernel in Version 1703 and higher.

Event ID:	181
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	215	DeepSleepSetConstraint
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Constraint

POP_ETW_DEEP_SLEEP_CLEAR_CONSTRAINT

Event 182 is known to the kernel in Version 1703 and higher.

Event ID:	182
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	216	DeepSleepClearConstraint
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Constraint

POP_ETW_DEEP_SLEEP_CONSTRAINT_RUNDOWN

Event 183 is known to the kernel in Version 1703 and higher.

Event ID:	183
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	217	DeepSleepConstraintRundown
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	ConstraintCount Constraints Constraint

POP_ETW_DEEP_SLEEP_IR_TIMER_DATA

Event 184 is known to the kernel in Version 1703 and higher.

Event ID:	184
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	219	IRTimerExpiries
Keyword:	0x40000000`00000200	po:SleepStudy
Event Data:	ExpiryCount RelativeId ComponentName

POP_ETW_EVENT_RTC_WAKE_INFO

Event 185 is known to the kernel in Version 1703 and higher.

Event ID:	185
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	221	RtcWakeInfo
Keyword:	0x40000000`00000404	po:Diagnostic po:DiagnosticLight
Event Data:	WokeSystem RejectReason Uncertain Spurious FixedWakeSourceMask AcAlarmSignaled DcAlarmSignaled RtcSignaled AcProgrammedTime DcProgrammedTime UsingAcTime WakeTime AdjustedWakeTime FullWake

POP_ETW_EVENT_IRPPENDED

Event 186 is known to the kernel in Version 1709 and higher.

Event ID:	186
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	36	Pended
Task:	39	Irp
Keyword:	0x40000000`00000008	po:Performance
Event Data:	Irp

POP_ETW_EVENT_NTINITIATEPOWERACTION_API_CALL

Event 187 is known to the kernel in Version 1809 and higher.

Event ID:	187
Channel:	8	System
Level:	4	win:Informational
Task:	NtInitiatePowerActionApiCall
Keyword:	0x80004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures
Event Data:	ApiCallerNameLength ApiCallerName SystemAction LightestSystemState

This event has the plain-language description:

User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs.

See that although the attempt is thought by Microsoft to be important enough to report in the System log, you’re left to look at the event data to find which user-mode process to worry about.

POP_ETW_EVENT_PREPARESLEEP

Event 188 is known to the kernel in Version 1903 and higher.

Event ID:	188
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	PrepareSleep
Keyword:	0x40000000`00000808	po:Performance po:PerformanceLight

POP_ETW_EVENT_PREPARESLEEP_END

Event 189 is known to the kernel in Version 1903 and higher.

Event ID:	189
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	249	PrepareSleep
Keyword:	0x40000000`00000808	po:Performance po:PerformanceLight

SQM Series

Windows 7 started numbering a new series of events at 200, apparently all to support what Microsoft has variously-and some might say fancifully-termed Software Quality Monitoring, Software Quality Metrics and Software Quality Management, all as part of a more or less voluntary Customer Experience Improvement Program. There is surely some merit to an argument that the computer-using world cannot reasonably complain these days about telemetry in Windows 10, given that it did so little to understand what Microsoft had been doing with telemetry for years before.

The compiled event templates for Windows 7 and higher define events 200 through 208 inclusive, but only 203 and 208 are known to be written by the kernel in any version.

Event 200

Event ID:	200
Level:	4
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid SqmSid SqmWindowsSessionId SqmSessionFlags

Event 201

Event ID:	201
Level:	4
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid

Event 202

Event ID:	202
Level:	4
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid SqmID SqmDWORDDatapointValue

PopSqm_Increment_Dword

Event 203 is known to the kernel in version 6.3 only.

Event ID:	203
Level:	4
Opcode:	2	win:Stop
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid SqmID SqmDWORDDatapointValue

Event 204

Event ID:	204
Level:	4
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid SqmID SqmDWORDDatapointValue

Event 205

Event ID:	205
Level:	4
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid SqmID SqmDWORDDatapointValue

Event 206

Event ID:	206
Level:	4
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid SqmID SqmDWORDDatapointValue

Event 207

Event ID:	207
Level:	4
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid SqmID SqmStringDatapointValue

PopSqm_Add_StreamRow

Event 208 is known to the kernel in version 6.1 and higher.

Event ID:	208
Level:	4
Keyword:	0x00080000`00000000	win:SQM
Event Data:	SqmType SqmSessionGuid SqmID SqmStreamRowLength SqmStreamRow

The SqmStreamRow parameter is complex data.

The 300 Series

Windows 8 started a series of Microsoft-Windows-Kernel-Power events that is notable because none are directed to any channel that is defined in the registry as if set up already for use in the Event Viewer. To see these events you must enable them to a custom event tracing session such as the Performance Monitor presents as a Data Collector Set.

This series also grows, though slowly, reaching to:

• 317 in 6.2;
• 319 in 6.3;
• 329 in 10.0 and 1511;
• 333 in 1607 to 2004.

Every one of the events in this series has event data. None have plain-language descriptions.

POP_ETW_EVENT_PLUGIN_REGISTRATION

Event 300 is known to the kernel in version 6.2 and higher.

Event ID:	300
Level:	4	win:Informational
Task:	132	PluginRegistration
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Plugin Attributes

POP_ETW_EVENT_PLUGIN_REGISTRATION_RUNDOWN

Event 301 is known to the kernel in version 6.2 and higher.

Event ID:	301
Level:	4	win:Informational
Task:	133	PluginRegistrationRundown
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Plugin Attributes

POP_ETW_EVENT_DEVICE_PREPARATION

Event 302 is known to the kernel in version 6.2 and higher.

Event ID:	302
Level:	4	win:Informational
Task:	134	DevicePreparation
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Plugin IdLength Id Prepared

POP_ETW_EVENT_DEVICE_REGISTRATION

Event 303 is known to the kernel in version 6.2 and higher.

Event ID:	303
Version:	0		6.2 and higher
	1		6.3 and higher
Level:	4	win:Informational
Task:	135	DeviceRegistration
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Plugin PowerState Status IdLength Id ComponentCount		versions 0 and 1
	VetoMasks		version 1

POP_ETW_EVENT_DEVICE_REGISTRATION_RUNDOWN

Event 304 is known to the kernel in version 6.2 and higher.

Event ID:	304
Version:	0		6.2 and higher
	1		6.3 and higher
Level:	4	win:Informational
Task:	136	DeviceRegistrationRundown
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Plugin PowerState Status IdLength Id ComponentCount		versions 0 and 1
	VetoMasks		version 1

POP_ETW_EVENT_DEVICE_UNREGISTRATION

Event 305 is known to the kernel in version 6.2 and higher.

Event ID:	305
Level:	4	win:Informational
Task:	137	DeviceUnregistration
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token

POP_ETW_EVENT_DEVICE_START_POWER_MANAGEMENT

Event 306 is known to the kernel in version 6.2 and higher.

Event ID:	306
Level:	4	win:Informational
Task:	138	StartDevicePowerManagement
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token

POP_ETW_EVENT_DEVICE_POWER_REQUIREMENT_TO_DEVICE

Event 307 is known to the kernel in version 6.2 and higher.

Event ID:	307
Level:	4	win:Informational
Task:	139	DevicePowerRequirementToDevice
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token PowerRequired

POP_ETW_EVENT_DEVICE_POWER_STATE

Event 308 is known to the kernel in version 6.2 and higher.

Event ID:	308
Level:	4	win:Informational
Task:	140	DevicePowerState
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token PowerState

POP_ETW_EVENT_DEVICE_POWERED

Event 309 is known to the kernel in version 6.2 and higher.

Event ID:	309
Level:	4	win:Informational
Task:	141	DevicePowered
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token

POP_ETW_EVENT_COMPONENT_REGISTRATION

Event 310 is known to the kernel in version 6.2 and higher.

Event ID:	310
Version:	0		6.2 and higher
	1		6.3 and higher
Level:	4	win:Informational
Task:	142	ComponentRegistration
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Active IdleState IdleStateCount IdleStates

The IdleStates parameter is complex data. Event versions 0 and 1 differ in its deeper interpretation.

POP_ETW_EVENT_COMPONENT_REGISTRATION_RUNDOWN

Event 311 is known to the kernel in version 6.2 and higher.

Event ID:	311
Version:	0		6.2 and higher
	1		6.3 and higher
Level:	4	win:Informational
Task:	143	ComponentRegistrationRundown
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Active IdleState IdleStateCount IdleStates

The IdleStates parameter is complex data. Event versions 0 and 1 differ in its deeper interpretation.

POP_ETW_EVENT_COMPONENT_CONDITION

Event 312 is known to the kernel in version 6.2 and higher.

Event ID:	312
Level:	4	win:Informational
Task:	144	ComponentCondition
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Active

POP_ETW_EVENT_COMPONENT_IDLE_STATE

Event 313 is known to the kernel in version 6.2 and higher.

Event ID:	313
Level:	4	win:Informational
Task:	145	ComponentIdleState
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component IdleState

POP_ETW_EVENT_COMPONENT_LATENCY

Event 314 is known to the kernel in version 6.2 and higher.

Event ID:	314
Level:	4	win:Informational
Task:	146	ComponentLatency
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Latency

POP_ETW_EVENT_COMPONENT_RESIDENCY

Event 315 is known to the kernel in version 6.2 and higher.

Event ID:	315
Level:	4	win:Informational
Task:	147	ComponentResidency
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Residency

POP_ETW_EVENT_COMPONENT_WAKE

Event 316 is known to the kernel in version 6.2 and higher.

Event ID:	316
Level:	4	win:Informational
Task:	148	ComponentWake
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component ArmedForWake

POP_ETW_EVENT_DEVICE_POWER_REQUIREMENT_FROM_PEP

Event 317 is known to the kernel in version 6.2 and higher.

Event ID:	317
Level:	4	win:Informational
Task:	149	DevicePowerRequirementFromPep
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token PowerRequired

POP_ETW_EVENT_DEVICE_IDLE_CONSTRAINTS

Event 318 is known to the kernel in version 6.3 and higher.

Event ID:	318
Level:	4	win:Informational
Task:	168	DeviceIdleConstraints
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token StateCount MinimumDStates

POP_ETW_EVENT_COMPONENT_IDLE_CONSTRAINTS

Event 319 is known to the kernel in version 6.3 and higher.

Event ID:	319
Level:	4	win:Informational
Task:	169	ComponentIdleConstraints
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component StateCount MinimumFStates

POP_ETW_EVENT_DEVICE_VERBOSE_RUNDOWN

Event 320 is known to the kernel in version 6.3 and higher.

Event ID:	320
Version:	0		6.3 and higher
	1		10.0 and higher
	2		1809 and higher
	3		1903 and higher
Level:	4	win:Informational
Task:	170	DeviceVerboseRundown
Keyword:	0x00000000`00000200	po:SleepStudy
Event Data:	DeviceNode DeviceIdLength DeviceId InstancePathLength InstancePath ServiceNameLength ServiceName PlatformStateDependents		versions 0 to 3
	Pdo ParentDeviceNode		versions 1 to 3
	Flags		versions 2 and 3
	FriendlyNameLength FriendlyName DripsRequiredState		version 3

POP_ETW_EVENT_PERFORMANCE_STATE_REGISTRATION

Event 321 is known to the kernel in version 10.0 and higher.

Event ID:	321
Level:	4	win:Informational
Task:	179	PerformanceStateRegistration
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component SetCount

POP_ETW_EVENT_PERFORMANCE_STATE_REGISTRATION_RUNDOWN

Event 322 is known to the kernel in version 10.0 and higher.

Event ID:	322
Level:	4	win:Informational
Task:	180	PerformanceStateRegistrationRundown
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component SetCount

POP_ETW_EVENT_PERFORMANCE_STATE_SET_REGISTRATION

Event 323 is known to the kernel in version 10.0 and higher.

Event ID:	323
Level:	4	win:Informational
Task:	181	PerformanceStateSetRegistration
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Set NameLength Name Type Unit Minimum Maximum StateCount StateValues CurrentState

POP_ETW_EVENT_PERFORMANCE_STATE_SET_REGISTRATION_RUNDOWN

Event 324 is known to the kernel in version 10.0 and higher.

Event ID:	324
Level:	4	win:Informational
Task:	182	PerformanceStateSetRegistrationRundown
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Set NameLength Name Type Unit Minimum Maximum StateCount StateValues CurrentState

POP_ETW_EVENT_COMPONENT_PERFORMANCE_STATE_INITIATING

Event 325 is known to the kernel in version 10.0 and higher.

Event ID:	325
Level:	4	win:Informational
Task:	183	ComponentPerformanceState
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component PerformanceStateSetCount PerformanceStateSets

The PerformanceStateSets parameter is complex data.

POP_ETW_EVENT_COMPONENT_PERFORMANCE_STATE_PROCESSING

Event 326 is known to the kernel in version 10.0 and higher.

Event ID:	326
Level:	4	win:Informational
Task:	183	ComponentPerformanceState
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Progress

POP_ETW_EVENT_COMPONENT_PERFORMANCE_STATE_COMPLETED

Event 327 is known to the kernel in version 10.0 and higher.

Event ID:	327
Level:	4	win:Informational
Task:	183	ComponentPerformanceState
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component Succeeded

POP_ETW_EVENT_COMPONENT_PERFORMANCE_STATE_NOMINAL_CHANGE

Event 328 is known to the kernel in version 10.0 and higher.

Event ID:	328
Level:	4	win:Informational
Task:	183	ComponentPerformanceState
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token Component DeviceTransition PowerState PerformanceStateSetCount PerformanceStateSets

The PerformanceStateSets parameter is complex data.

POP_ETW_EVENT_DEBUGGER_TRANSITION_REQUIREMENTS

Event 329 is known to the kernel in version 10.0 and higher.

Event ID:	329
Level:	4	win:Informational
Task:	184	DebuggerTransitionRequirements
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	Token StateCount TransitionRequired

POP_ETW_EVENT_DEFAULT_PEP_WORKER_START

Event 330 is known to the kernel in version 1607 and higher.

Event ID:	330
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	210	DefaultPepWorker
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	StartDevice

POP_ETW_EVENT_DEFAULT_PEP_WORKER_END

Event 331 is known to the kernel in version 1607 and higher.

Event ID:	331
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	210	DefaultPepWorker
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	EndDevice WorkType Phase NumberExtraDevices

POP_ETW_EVENT_DEFAULT_PEP_WORKER_DEVICE_RECOVERED

Event 332 is known to the kernel in version 1607 and higher.

Event ID:	332
Level:	1	win:Critical
Task:	211	DefaultPepWorkerDeviceRecovered
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	EndDevice WorkType Phase NumberExtraDevices

POP_ETW_EVENT_DEFAULT_PEP_WORKER_DEVICE_ORPHANED

Event 333 is known to the kernel in version 1607 and higher.

Event ID:	333
Level:	1	win:Critical
Task:	212	DefaultPepWorkerDeviceOrphaned
Keyword:	0x00000000`00000100	po:RuntimeFx
Event Data:	EndDevice WorkType Phase NumberExtraDevices

The Adaptive Display Series

Events numbered from 400 are also new for Windows 8. They are all directed to the Diagnostic channel, but unlike all but a handful of other events that go to the Diagnostic channel, these all have plain-language descriptions. That these descriptions merely list the event data parameters without even attempting to put them in any sort of context suggests that their existence is just from some programmer's taste for completeness or neatness.

Later versions have not extended this series, though a release of Windows 10 did define a new version for one event. Conspicuously, the plain-language description was not updated to report the added parameter of event data.

POP_ETW_ADPM_SESSION_CREATED

Event 400 is known to the kernel in version 6.2 and higher. It begins a set of eight events whose reports are similar enough to share their event data and plain-language description.

Event ID:	400
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	109	SessionCreated
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId Console

This event has the plain-language description:

SessionId: SessionId, Console:Console

POP_ETW_ADPM_SESSION_CLOSED

Event 401 is known to the kernel in version 6.2 and higher.

Event ID:	401
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	110	SessionClosed
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId Console

This event, 401, has the same plain-language description as event 400.

POP_ETW_ADPM_SESSION_CONNECTED

Event 402 is known to the kernel in version 6.2 and higher.

Event ID:	402
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	111	SessionConnected
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId Console

This event, 402, has the same plain-language description as event 400.

POP_ETW_ADPM_SESSION_DISCONNECTED

Event 403 is known to the kernel in version 6.2 and higher.

Event ID:	403
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	112	SessionDisconnected
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId Console

This event, 403, has the same plain-language description as event 400.

POP_ETW_ADPM_ACTIVE_INPUT

Event 404 is known to the kernel in version 6.2 and higher.

Event ID:	404
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	113	ActiveInput
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId Console

This event, 404, has the same plain-language description as event 400.

POP_ETW_ADPM_PASSIVE_INPUT

Event 405 is known to the kernel in version 6.2 and higher.

Event ID:	405
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	114	PassiveInput
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId Console

This event, 405, has the same plain-language description as event 400.

POP_ETW_ADPM_SESSION_LOCKED

Event 406 is known to the kernel in version 6.2 and higher.

Event ID:	406
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	115	SessionLocked
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId Console

This event, 406, has the same plain-language description as event 400.

POP_ETW_ADPM_SESSION_UNLOCKED

Event 407 is known to the kernel in version 6.2 and higher.

Event ID:	407
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	116	SessionUnlocked
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId Console

This event, 407, has the same plain-language description as event 400.

Event 408

Though event 408 is defined in the compiled event templates for Windows 8 and higher, it is not known to the kernel in any version yet studied.

Event ID:	408
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	117	SensorInput
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	UserPresence

This event has the plain-language description:

User presence:UserPresence

POP_ETW_ADPM_SENSOR_INVALID

Event 409 is known to the kernel in version 6.2 only.

Event ID:	409
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	118	SensorInvalid
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Code

This event has the plain-language description:

Reason code:Code

Event 410

Though event 410 is defined in the compiled event templates for Windows 8 and higher, it is not known to the kernel in any version yet studied.

Event ID:	410
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	119	SensorSmoothing
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Engaged

This event has the plain-language decription:

Engaged:Engaged

Event 411

Though event 411 is defined in the compiled event templates for Windows 8 and higher, it is not known to the kernel in any version yet studied.

Event ID:	411
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	120	SensorWatchdog
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Engaged

This event, 411, has the same plain-language decription as event 410.

POP_ETW_ADPM_SESSION_DISPLAY_STATE

Event 412 is known to the kernel in version 6.2 and higher. It begins a set of three events whose reports are similar enough to share their event data and plain-language description.

Event ID:	412
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	121	DisplaySessionStatus
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId State

This event has the plain-language description:

Session Id:SessionId, Value: State

POP_ETW_ADPM_SESSION_INPUT_STATE

Event 413 is known to the kernel in version 6.2 and higher.

Event ID:	413
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	122	UserSessionStatus
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId State

This event, 413, has the same plain-language description as event 412.

POP_ETW_ADPM_GLOBAL_INPUT_STATE

Event 414 is known to the kernel in version 6.2 and higher.

Event ID:	414
Version:	0		6.2 to 1511
	1		1607 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	123	UserGlobalStatus
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SessionId State		versions 0 and 1
	TransitionCount		version 1

This event, 414, has the same plain-language description as event 412.

POP_ETW_ADPM_SENSOR_INPUT_CHANGED

Event 415 is known to the kernel in version 6.2 only.

Event ID:	415
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	124	SensorInputChanged
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Old New

This event has the plain-language description:

Old value:Old, New value: New

POP_ETW_ADPM_INPUT_TIMEOUT

Event 416 is known to the kernel in version 6.2 and higher. It begins a pair whose reports are similar enough to share their event data and plain-language description.

Event ID:	416
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	125	InputState
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Value Zeroed Computed

This event has the plain-language description:

Value:Value, Zeroed: Zeroed, Computed: Computed

POP_ETW_ADPM_DISPLAY_TIMEOUT

Event 417 is known to the kernel in version 6.2 and higher.

Event ID:	417
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	126	DisplayState
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Value Zeroed Computed

This event, 417, has the same plain-language description as event 416.

POP_ETW_ADPM_POLICY_CHANGE

Event 418 is known to the kernel in version 6.2 and higher.

Event ID:	418
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	127	PolicyChange
Keyword:	0x40000000`00000004	po:Diagnostic	6.2 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SensorDisplayTimeout DisplayTimeout SensorInputTimeout InputTimeout SessionLockedTimeout SensorEnabled

This event, 418, has the same plain-language description as event 416. This surely is mismatched:

Value:SensorDisplayTimeout, Zeroed: DisplayTimeout, Computed: SensorInputTimeout

More investigation is required, but it looks like a copy-and-paste error that nobody at Microsoft has noticed (or has troubled to fix). Amid the plain indications that Microsoft regards the diagnostic logs as being not for users (however advanced or engaged in system administration), a general lack of care might well prompt some question of how much the diagnostic logs matter even to Microsoft.

The New Main Series

Yet another series begins at 500, again dating from Windows 8. It is not yet clear what organising principle assigns events to this series. After a small extension for Windows 8.1, this series was left alone for a while but additions since Version 1709 are numerous enough to suggest that this is now the main series (the original series that begins at 1 being near to full).

• 507 in 6.2;
• 517 in 6.3 to 1511;
• 519 in 1607;
• 521 in 1703;
• 526 in 1709;
• 543 in 1803;
• 548 in 1809;
• 555 in 1903;
• 565 in 2004.

POP_ETW_IO_COALESCING_ON

Event 500 is known to the kernel in version 6.2 and higher.

Event ID:	500
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	128	IoCoalescingOn
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SpindownTimeout TimerInterval FlushInterval Flags

This event has the plain-language description:

IO coalescing activated with spindown period: SpindownTimeout, Timer:TimerInterval, Flush:FlushInterval, Flags:Flags.

POP_ETW_IO_COALESCING_OFF

Event 501 is known to the kernel in version 6.2 and higher.

Event ID:	501
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	129	IoCoalescingOff
Keyword:	0x40000000`00000004	po:Diagnostic

This event has the plain-language description:

IO coalescing deactivated.

POP_ETW_IO_COALESCING_FLUSH

Event 502 is known to the kernel in version 6.2 and higher.

Event ID:	502
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	130	IoCoalescingFlush
Keyword:	0x40000000`00000004	po:Diagnostic

This event has the plain-language description:

IO coalescing flush command generated.

POP_ETW_IO_COALESCING_DSK_IDLE

Event 503 is known to the kernel in version 6.2 and higher.

Event ID:	503
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	131	IoCoalescingDiskIdle
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	DiskDeviceObject

This event has the plain-language description:

IO coalescing disk device DiskDeviceObject is about to be spun down.

POP_ETW_EVENT_SYSTEM_LATENCY_UPDATE

Event 504 is known to the kernel in version 6.2 and higher.

Event ID:	504
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	152	SystemLatencyUpdate
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SystemLatency

POP_ETW_EVENT_SYSTEM_LATENCY_RUNDOWN

Event 505 is known to the kernel in version 6.2 and higher.

Event ID:	505
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	153	SystemLatencyRundown
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SystemLatency

POP_ETW_EVENT_CS_ENTER_REASON

Event 506 is known to the kernel in version 6.2 and higher.

Event ID:	506
Version:	0		6.2 and higher
	1		1703 and higher
	2		1709 and higher
	3		1809 and higher
Channel:	8	System
Level:	4	win:Informational
Task:	157	CsEnterReason
Keyword:	0x80000000`00000004	po:Diagnostic	6.2 to 6.3
	0x80002000`00000004	po:Diagnostic ms:Telemetry	10.0 only
	0x80004000`00000004	po:Diagnostic ms:Measures	1511 only
	0x80004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures	1607 only
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1703 and higher
Event Data:	Reason		versions 0 to 3
	LidOpenState ExternalMonitorConnectedState ScenarioInstanceId		versions 1 to 3
	BatteryRemainingCapacityOnEnter BatteryFullChargeCapacityOnEnter		versions 2 and 3
	ScenarioInstanceIdV2 BootId		version 3

This event has the plain-language description:

The system is entering connected standby 

Reason: Reason.

Microsoft promoted Connected Standby as an important development. It surely is, if only for angering a substantial minority of users who prefer to think of their computers as their own, not Microsoft’s. Both entering and leaving Connected Standby are thought by Microsoft to be sufficiently important to record in the System log. But see that for the increasingly many parameters that add to the explanation, Microsoft leaves you to look in the event data.

POP_ETW_EVENT_CS_EXIT_REASON

Event 507 is known to the kernel in version 6.2 and higher.

Event ID:	507
Version:	0		6.2 and higher
	1		6.3 and higher
	2		10.0 and higher
	3		10.0 and higher
	4		1511 and higher
	5		1703 and higher
	6		1709 and higher
	7		1809 and higher
	8		1903 and higher
	9		2004 and higher
Channel:	8	System
Level:	4	win:Informational
Task:	158	CsExitReason
Keyword:	0x80000000`00000004	po:Diagnostic	version 0 in 6.2 to 1511; version 1 in 6.3
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	version 0 in 1607 and higher
	0x80002000`00000204	po:Diagnostic po:SleepStudy ms:Telemetry	versions 1 to 3 in 10.0 only
	0x80000000`00000204	po:Diagnostic po:SleepStudy	version 1 in 1511
	0x80000000`00000604	po:Diagnostic po:SleepStudy po:DiagnosticLight	version 1 in 1607 and higher; versions 2 to 9 in 1703 and higher
	0x80004000`00000204	po:Diagnostic po:SleepStudy ms:Measures	versions 2 to 4 in 1511 only
	0x80004000`00000604	po:Diagnostic po:SleepStudy po:DiagnosticLight ms:Measures	versions 2 to 4 in 1607 only
Event Data:	EnergyDrain ActiveResidencyInUs NonDripsTimeActivatedInUs FirstDripsEntryInUs DripsResidencyInUs DurationInUs DripsTransitions FullChargeCapacityRatio AudioPlaying Reason		versions 0 to 9 in 6.2 and higher
	AudioPlaybackInUs NonActivatedCpuInUs PowerStateAc		versions 0 to 9 in 6.3 and higher
	HwDripsResidencyInUs		versions 1 to 9
	ExitLatencyInUs		versions 2 to 9
	DisconnectedStandby AoAcCompliantNic		versions 3 to 9
	NonAttributedCpuInUs		versions 4 to 9
	ModernSleepEnabledActionsBitmask ModernSleepAppliedActionsBitmask LidOpenState ExternalMonitorConnectedState ScenarioInstanceId IsCsSessionInProgressOnExit		versions 5 to 9
	BatteryRemainingCapacityOnExit BatteryFullCharageCapacityOnExit		versions 6 to 9
	ScenarioInstanceIdV2 BootId InputSuppressionActionCount NonResiliencyTimeInUs ResiliencyDripsTimeInUs ResiliencyHwDripsTimeInUs GdiOnTime DwmSyncFlushTime MonitorPowerOnTime		versions 8 and 9
	SleepEntered ScreenOffEnergyCapacityAtStart ScreenOffEnergyCapacityAtEnd ScreenOffDurationInUs SleepEnergyCapacityAtStart SleepEnergyCapacityAtEnd SleepDurationInUs ScreenOffFullEnergyCapacityAtStart ScreenOffFullEnergyCapacityAtEnd SleepFullEnergyCapacityAtStart SleepFullEnergyCapacityAtEnd		version 9

This event's plain-language description is specially remarkable for how little it presents of the very many parameters in the event data:

The system is exiting connected standby 

Reason: Reason.

A version 2 of this event is defined by the compiled event manifest for Windows 10, with event data stopping at ExitLatencyInUs, but it is not written by any version of the kernel yet studied.

POP_ETW_EVENT_DYNAMIC_TICK_DISABLED

Event 508 is known to the kernel in version 6.3 and higher.

Event ID:	508
Channel:	8	System
Level:	4	win:Informational
Task:	159	DynamicTickDisabled
Keyword:	0x80000000`00000004	po:Diagnostic	6.3 to 1511
	0x80000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Reason

This event has the plain-language description:

The system has been constrained to a periodic tick 

Reason: Reason.

POP_ETW_EVENT_DYNAMIC_TICK_STATUS_RUNDOWN

Event 509 is known to the kernel in version 6.3 and higher.

Event ID:	509
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	160	DynamicTickStatusRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.3 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	Flags

POP_ETW_EVENT_SPM_POLICY_STATUS_UPDATE

Event 510 is known to the kernel in version 6.3 only.

Event ID:	510
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	161	SpmStatusUpdate
Keyword:	0x40000000`00000004	po:Diagnostic	6.3 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SpmStatus

This event has the plain-language description:

Scenario Power Manager (SPM) policy framework has current status: SpmStatus.

POP_ETW_EVENT_SPM_POLICY_STATUS_RUNDOWN

Event 511 is known to the kernel in version 6.3 only.

Event ID:	511
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	162	SpmStatusRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.3 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	SpmStatus

POP_ETW_EVENT_SPM_POLICY_ALIAS_RUNDOWN

Event 512 is known to the kernel in version 6.3 only.

Event ID:	512
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	163	SpmPolicyAliasRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.3 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	PolicyGuid PolicyAliasLength PolicyAlias

POP_ETW_EVENT_SPM_SCENARIO_POLICY_RUNDOWN

Event 513 is known to the kernel in version 6.3 only.

Event ID:	513
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	164	SpmScenarioPolicyRundown
Keyword:	0x40000000`00000004	po:Diagnostic	6.3 to 1511
	0x40000000`00000404	po:Diagnostic po:DiagnosticLight	1607 and higher
Event Data:	ScenarioGuid ScenarioNameLength ScenarioName Flags DefaultSettingsScenarioGuid PolicyCount PolicySettings

The PolicySettings parameter is complex data.

POP_ETW_EVENT_COMPONENT_ACCOUNTING

Event 514 is known to the kernel in version 6.3 and higher.

Event ID:	514
Version:	0		6.3 and higher
	1		2004 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	165	ComponentAccounting
Keyword:	0x40000000`00000200	po:SleepStudy
Event Data:	ScenarioInstanceId DeviceNode Component ActiveTime		versions 0 and 1
	ScenarioInstanceIdV2		version1

POP_ETW_EVENT_SPM_SCENARIO_START

Event 515 is known to the kernel in version 6.3 and higher.

Event ID:	515
Version:	0		6.3 and higher
	1		1511 and higher
	2		1709 and higher
	3		1809 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	166	SpmScenarioStart
Keyword:	0x40000000`00000200	po:SleepStudy Microsoft-Windows-Kernel-Power/Diagnostic
Event Data:	ScenarioGuid ScenarioInstanceId		versions 0 to 3
	CsEnterReason		versions 1 to 3
	BatteryRemainingCapacityOnEnter BatteryFullChargeCapacityOnEnter		versions 2 and 3
	ScenarioInstanceIdV2 BootId CurrentSystemTime		version 3

POP_ETW_EVENT_SPM_SCENARIO_STOP

Event 516 is known to the kernel in version 6.3 and higher.

Event ID:	516
Version:	0		6.3 and higher
	1		10.0 and higher
	2		10.0 and higher
	3		10.0 and higher
	4		1511 and higher
	5		1703 and higher
	6		1709 and higher
	7		1803 and higher
	8		1809 and higher
	9		1903 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	167	SpmScenarioStop
Keyword:	0x40000000`00000200	po:SleepStudy
Event Data:	EnergyDrain DripsResidencyInUs OnAc HwDripsResidencyInUs PreVetoCount VetoCount DurationInUs FullChargeCapacity NonActivatedCpuInUs IRTruncatePercentage DesignCapacity		versions 0 to 9
	AudioDurationInUs Reason		versions 1 to 9
	DisconnectedStandby		versions 2 to 9
	AoAcCompliantNic		versions 3 to 9
	NonAttributedCpuInUs EnergySaverPolicy VideoTimeoutInSec LockConsoleTimeoutInSec StandbyTimeoutInSec		versions 4 to 9
	ModernSleepEnabledActionsBitmask ModernSleepAppliedActionsBitmask		versions 5 to 9
	EnergyDrainV2Flags EnergyDrainV2		versions 6 to 9
	DirectedDripsTransitionCount IsHibernateEnabled HibernateTimeoutInSec HibernateBudgetPercentage		versions 7 to 9
	IsLockConsoleTimeoutActive		versions 8 and 9
	IsDebuggerEnabled		version 9

Versions 1 and 2 of this event are defined by the compiled event manifest for Windows 10, but are not written by any version of the kernel yet studied.

POP_ETW_EVENT_DEVICE_ACCOUNTING

Event 517 is known to the kernel in version 6.3 and higher.

Event ID:	517
Version:	0		6.3 and higher
	1		2004 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	171	DeviceAccounting
Keyword:	0x40000000`00000200	po:SleepStudy
Event Data:	ScenarioInstanceId DeviceNode ActiveTime		versions 0 and 1
	ScenarioInstanceIdV2		version 1

POP_ETW_EVENT_IOSHUTDOWN_FILE_SYSTEMS_START

Event 518 is known to the kernel in Version 1607 and higher.

Event ID:	518
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	1	win:Start
Task:	209	IoShutdownFileSystems
Keyword:	0x40000000`00000808	po:Performance po:PerformanceLight

POP_ETW_EVENT_IOSHUTDOWN_FILE_SYSTEMS_STOP

Event 519 is known to the kernel in Version 1607 and higher.

Event ID:	519
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Opcode:	2	win:Stop
Task:	209	IoShutdownFileSystems
Keyword:	0x40000000`00000808	po:Performance po:PerformanceLight

POP_ETW_EVENT_BASIC_BRIGHTNESS_ENGINE_OFF

Event 520 is known to the kernel in Version 1703 and higher.

Event ID:	520
Channel:	8	System
Level:	4	win:Informational
Task:	218	BrightnessEngineSwap
Keyword:	0x80004000`00000404	po:Diagnostic po:DiagnosticLight ms:Measures

This event has the plain-language description:

The brightness on this system is managed by high-precision brightness aware service.

POP_ETW_EVENT_BATTERY_COUNT_CHANGE

Event 521 is known to the kernel in Version 1703 and higher.

Event ID:	521
Channel:	8	System
Level:	4	win:Informational
Task:	220	BatteryCountChange
Keyword:	0x80000000`00000404	po:Diagnostic po:DiagnosticLight
Event Data:	ValidBatteryCount ErrorBatteryCount AbandonedBatteryCount

This event has the plain-language description:

Active battery count change.

POP_ETW_EVENT_CS_DRIPS_DIVERGENCE

Event 522 is known to the kernel in Version 1709 and higher.

Event ID:	522
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	222	CsDripsDivergence
Keyword:	0x40000000`00000404	po:Diagnostic po:DiagnosticLight
Event Data:	HwDripsTotalTimeValid DripsTotalTimeThisPeriodUs HwDripsTotalTimeThisPeriodUs PopDripsSwHwDivergenceThreshold

Event 523

Though event 523 is defined in the compiled event templates for Version 1709 and higher, it is not known to the kernel in any version yet studied.

Event ID:	523
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	41	SuspendDevices
Keyword:	0x40002000`00000008	po:Performance ms:Telemetry
Event Data:	Irp Status FailedDriver ElapsedTime

POP_ETW_EVENT_BATTERY_TRIGGER_MET

Event 524 is known to the kernel in Version 1709 and higher.

Event ID:	524
Channel:	8	System
Level:	4	win:Informational
Task:	223	BatteryTriggerMet
Keyword:	0x80000000`00000404	po:Diagnostic po:DiagnosticLight
Event Data:	Index ActiveBatteryCount Remainingpercentage IsAcOnline BatteryActionInternalFlags IsPowerActionCallIgnored IsPowerPolicyEnabled PowerPolicyAction PowerPolicyBatteryLevel PowerPolicyEventCode PowerPolicyMinState

This event has the plain-language description:

Index Battery Trigger Met

POP_ETW_EVENT_NET_REFRESH_TIMER_ARMED

Event 525 is known to the kernel in Version 1709 and higher.

Event ID:	525
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	224	NetRefreshTimerArmed
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	DurationInUs

POP_ETW_EVENT_NET_REFRESH_TIMER_DISARMED

Event 526 is known to the kernel in Version 1709 and higher.

Event ID:	526
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	225	NetRefreshTimerDisarmed
Keyword:	0x40000000`00000004	po:Diagnostic

POP_ETW_EVENT_POWER_STATE_RUNDOWN

Event 527 is known to the kernel in Version 1803 and higher.

Event ID:	527
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	226	PowerStateEventRundown
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Event Class Count

POP_ETW_EVENT_POWER_STATE

Event 528 is known to the kernel in Version 1803 and higher.

Event ID:	528
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	227	PowerStateEvent
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Event Intent

POP_ETW_EVENT_POWER_AGGREGATOR_QUEUE_OVERFLOW

Event 529 is known to the kernel in Version 1803 and Version 1809.

Event ID:	529
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	228	PowerAggregatorQueueOverflow
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Intent Class PowerEvent

POP_ETW_EVENT_POWER_AGGREGATOR_REQUEST

Event 530 is known to the kernel in Version 1803 and Version 1809.

Event ID:	530
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	229	PowerAggregatorRequest
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SessionId RequestQueueId Intent Class PowerEvent VetoReason

POP_ETW_EVENT_POWER_AGGREGATOR_VALIDATION_EVENT

Event 531 is known to the kernel in Version 1803 and Version 1809.

Event ID:	531
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	230	PowerAggregatorValidationEvent
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SessionId Action Result

POP_ETW_EVENT_POWER_AGGREGATOR_COMPLETION_EVENT

Event 532 is known to the kernel in Version 1803 to Version 1903.

Event ID:	532
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	231	PowerAggregatorCompletionEvent
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SessionId Result

POP_ETW_EVENT_POWER_AGGREGATOR_SESSION_BEGIN

Event 533 is known to the kernel in Version 1803 to Version 1903.

Event ID:	533
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	232	PowerAggregatorSessionBegin
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SessionId PowerEvent Action AudioActivity DisconnectedStandbyMode DsEnabled

POP_ETW_EVENT_POWER_AGGREGATOR_SESSION_END

Event 534 is known to the kernel in Version 1803 to Version 1903.

Event ID:	534
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	233	PowerAggregatorSessionEnd
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SessionId Result

POP_ETW_EVENT_DIRECTED_DRIPS_ENGAGED

Event 535 is known to the kernel in Version 1803 and higher.

Event ID:	535
Version:	0	1803 and higher
	1	2004 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	234	DirectedDripsEngaged
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	CsSessionId Engaged	versions 0 and 1
	CsSessionIdV2	version 1

POP_ETW_EVENT_DIRECTED_DRIPS_WORKER

Event 536 is known to the kernel in Version 1803 and higher.

Event ID:	536
Version:	0	1803 and higher
	1	2004 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	235	DirectedDripsWorker
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	CsSessionId WorkFlags	versions 0 and 1
	CsSessionIdV2	version 1

POP_ETW_EVENT_DIRECTED_DRIPS_MARK_DEVICE

Event 537 is known to the kernel in Version 1803 and higher.

Event ID:	537
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	236	DirectedDripsMarkDevice
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	CsSessionId DeviceObject

POP_ETW_EVENT_DIRECTED_DRIPS_NOTIFY_APPS_SERVICES

Event 538 is known to the kernel in Version 1803 and higher.

Event ID:	538
Version:	0	1803 and higher
	1	2004 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	237	DirectedDripsNotifyAppsAndServices
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	CsSessionId Suspended Result DurationMs	versions 0 and 1
	CsSessionIdV2	version 1

POP_ETW_EVENT_DIRECTED_DRIPS_NOTIFY_DEVICES

Event 539 is known to the kernel in Version 1803 and higher.

Event ID:	539
Version:	0	1803 and higher
	1	2004 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	238	DirectedDripsNotifyDevices
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	CsSessionId Suspended Result DurationMs	versions 0 and 1
	CsSessionIdV2	version 1

POP_ETW_EVENT_DIRECTED_DRIPS_INITIALIZATION

Event 540 is known to the kernel in Version 1803 and higher.

Event ID:	540
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	239	DirectedDripsInitialization
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	EnableResult InitializationResult

POP_ETW_EVENT_SIDLE_UPDATE_NOTIFICATION_WORKER

Event 541 is known to the kernel in Version 1803 and higher.

Event ID:	541
Version:	0	1803 and higher
	1	1903 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	240	SIdleUpdateNotificationWorker
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SystemIdle	versions 0 and 1
	Status TimeoutSource	version 1

POP_ETW_EVENT_POWER_AGGREGATOR_INVALID_REQUEST_INDEX

Event 542 is known to the kernel in Version 1803 and Version 1809.

Event ID:	542
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	241	PowerAggregatorInvalidRequestIndex
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	RequestedIndex NumberOfRequests QueueSize

POP_ETW_EVENT_DRIPS_WAKE_ACCOUNTING_SUMMARY

Event 543 is known to the kernel in Version 1803 and higher.

Event ID:	543
Version:	0	1803 and higher
	1	2004 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	242	DripsWakeAccountingSummary
Keyword:	0x40000000`00000204	po:Diagnostic po:SleepStudy
Event Data:	CsSessionId Count IdleMinDurationInUs IdleMaxDurationInUs IdleTotalDurationInUs ReasonDescriptionLength ReasonDescription GroupCount Group Number Affinity	version 0 only
	CsSessionId Count IdleMinDurationInUs IdleMaxDurationInUs IdleTotalDurationInUs ReasonDescriptionLength ReasonDescription GroupCount Group CsSessionIdV2 Number Affinity	version 1 only

POP_ETW_EVENT_DIRECTED_DRIPS_DISENGAGE_MASK_CHANGED

Event 544 is known to the kernel in Version 1809 and higher.

Event ID:	544
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	244	DirectedDripsDisengageMaskChange
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	OldMask NewMask SetFlags ClearedFlags

POP_ETW_EVENT_DIRECTED_DRIPS_DEVICE_VISIT

Event 545 is known to the kernel in Version 1809 and higher.

Event ID:	545
Version:	0	1809 and higher
	1	1903 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	245	DirectedDripsDeviceVisit
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	BraodcastTreeId IsRootDevice DeviceNode InstancePathLength InstancePath	versions 0 and 1
	VisitType	version 1

POP_ETW_EVENT_DIRECTED_DRIPS_PROBLEM_DEVICE

Event 546 is known to the kernel in Version 1809 and higher.

Event ID:	546
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	246	DirectedDripsProblemDevice
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	BroadcastTreeId DeviceNode Reason

POP_ETW_EVENT_DIRECTED_POWER_TRANSITION_START

Event 547 is known to the kernel in Version 1809 and higher.

Event ID:	547
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	247	DirectedPowerTransitionStart
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	DeviceNode PowerDown

POP_ETW_EVENT_DIRECTED_POWER_TRANSITION_END

Event 548 is known to the kernel in Version 1809 and higher.

Event ID:	548
Version:	0	1809 and higher
	1	1903 and higher
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	248	DirectedPowerTransitionEnd
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	DeviceNode PowerDown	versions 0 and 1
	DevicePowerState	version 1

POP_ETW_EVENT_SYSTEM_IDLE_ASSESSMENT

Event 549 is known to the kernel in Version 1903 and higher.

Event ID:	549
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	251	SystemIdleAssessment
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	IdleTimeout NotIdleEvents IsSystemIdle

POP_ETW_EVENT_SYSTEM_IDLE_EVENT_ASSESSMENT

Event 550 is known to the kernel in Version 1903 and higher.

Event ID:	550
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	252	SystemIdleEventAssessment
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	EventType TimeSinceEvent IdleTimeout WasIgnored BusyReason

POP_ETW_EVENT_SYSTEM_IDLE_RUNDOWN

Event 551 is known to the kernel in Version 1903 and higher.

Event ID:	551
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	253	SystemIdleRundown
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	ScanInterval

POP_ETW_EVENT_SYSTEM_IDLE_CONTEXT_UPDATE

Event 552 is known to the kernel in Version 1903 and higher.

Event ID:	552
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	254	SystemIdleContextUpdate
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Reason PreviousTimeoutSource PreviousTimeout NewTimeoutSource NewTimeout

POP_ETW_EVENT_DIRECTED_FX_POWER_STATE_FAILURE

Event 553 is known to the kernel in Version 1903 and higher.

Event ID:	553
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	255	DirectedFxPowerStateFailure
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	FxDevice DeviceNode InstancePathLength InstancePath

POP_ETW_EVENT_DIRECTED_DRIPS_DEVICE_STATS

Event 554 is known to the kernel in Version 1903 and higher.

Event ID:	554
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	256	DirectedDripsDeviceStats
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	CsSessionId DeviceNode FriendlyNameLength FriendlyName HardwareIdLength HardwareId DeviceClassNameLength DeviceClassName DeviceClassGuidLength DeviceClassGuid BroadcastTreeId DfxTransitionCount Ps4TransitionCount Flags

POP_ETW_EVENT_EXECUTE_POWER_ACTION

Event 555 is known to the kernel in Version 1903 and higher.

Event ID:	555
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	257	ExecutePowerAction
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	Reason TriggerFlags UserNotify PowerAction PowerActionFlags PowerActionEventCode MinState SubstitutionPolicy

POP_ETW_EVENT_DIRECTED_DRIPS_ERROR_RECORD

Event 556 is known to the kernel in Version 2004 and higher.

Event ID:	556
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	258	DirectedDripsErrorRecord
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	SessionId RootDeviceNode ErrorDeviceNode ReasonCode Count

POP_ETW_EVENT_KERNEL_STRS_INTERNAL

Event 557 is known to the kernel in Version 2004 and higher. It is an alternative to event 98.

Event ID:	557
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	259	SystemTimeResolutionKernelChangeInternal
Keyword:	0x40000000`00000004	po:Diagnostic
Event Data:	RequestedResolution Tag

This event, 557, has the same plain-language description as event 98:

POP_ETW_EVENT_POWER_AGGREGATOR_HANDLE_INTENT

Event 558 is known to the kernel in Version 2004 and higher.

Event ID:	558
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	260	PowerAggregatorHandleIntent
Keyword:	0x40000000`00008004	po:Diagnostic po:PowerAggregator
Event Data:	Intent Class Cause Status CurrentTargetState NextTargetState

POP_ETW_EVENT_POWER_AGGREGATOR_WORKER_START

Event 559 is known to the kernel in Version 2004 and higher.

Event ID:	559
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	261	PowerAggregatorWorkerStart
Keyword:	0x40000000`00008004	po:Diagnostic po:PowerAggregator ;

A template for the event data is specified for this event but is empty.

POP_ETW_EVENT_POWER_AGGREGATOR_WORKER_END

Event 560 is known to the kernel in Version 2004 and higher.

Event ID:	560
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	262	PowerAggregatorWorkerEnd
Keyword:	0x40000000`00008004	po:Diagnostic po:PowerAggregator ;

A template for the event data is specified for this event but is empty.

POP_ETW_EVENT_POWER_AGGREGATOR_INTERNAL_STATE_CHANGE

Event 561 is known to the kernel in Version 2004 and higher.

Event ID:	561
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	263	PowerAggregatorInternalStateChange
Keyword:	0x40000000`00008004	po:Diagnostic po:PowerAggregator ;
Event Data:	CurrentInternalState NextInternalState

POP_ETW_EVENT_POWER_AGGREGATOR_HANDLER_INVOKE

Event 562 is known to the kernel in Version 2004 and higher.

Event ID:	562
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	264	PowerAggregatorHandlerInvoke
Keyword:	0x40000000`00008004	po:Diagnostic po:PowerAggregator ;
Event Data:	CurrentTargetState CurrentInternalState

POP_ETW_EVENT_POWER_AGGREGATOR_PDC_PHASES_EXITED

Event 563 is known to the kernel in Version 2004 and higher.

Event ID:	563
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	265	PowerAggregatorPdcPhasesExited
Keyword:	0x40000000`00008004	po:Diagnostic po:PowerAggregator ;

A template for the event data is specified for this event but is empty.

POP_ETW_EVENT_POWER_AGGREGATOR_PDC_SLEEP_TRANSITION

Event 564 is known to the kernel in Version 2004 and higher.

Event ID:	564
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	266	PowerAggregatorPdcSleepTransition
Keyword:	0x40000000`00008004	po:Diagnostic po:PowerAggregator ;
Event Data:	IsSleepEnter Token CurrentTargetState CurrentInternalState Status

POP_ETW_EVENT_POWER_AGGREGATOR_SUSPEND_RESUME

Event 565 is known to the kernel in Version 2004 and higher.

Event ID:	565
Channel:	16	Microsoft-Windows-Kernel-Power/Diagnostic
Level:	4	win:Informational
Task:	267	PowerAggregatorSuspendResume
Keyword:	0x40000000`00008004	po:Diagnostic po:PowerAggregator ;
Event Data:	Suspended SuspendCount