The Kernel-Power Event Provider

Starting with Windows Vista, the Power Manager in the Windows kernel registers the following event provider and writes events to it:

Provider Name: Microsoft-Windows-Kernel-Power
Provider GUID: {331C3B3A-2005-44C2-AC5E-77220C37D6B4}
Symbolic Name: POP_ETW_PROVIDER

The kernel, of course, knows of the provider only by its GUID. The Provider Name is what’s stored in the registry for this GUID. It’s then the Name that the Event Viewer shows for the Provider in the Details tab for an event that actually has occurred. It’s also the name to use when referring to this provider in such tools as WEVTUTIL and the Performance Monitor. The Symbolic Name is what public symbol files for the kernel show as the programming label for the GUID as kernel data.

An instrumentation manifest for the Microsoft-Windows-Kernel-Power provider is compiled into Microsoft-Windows-Kernel-Power-Events.dll (but ADVAPI32.DLL in version 6.0) as a resource named WEVT_TEMPLATE. This location is known already in the registry when Windows is installed. It is the source of the plain-language names that the command wevtutil gp Microsoft-Windows-Kernel-Power extracts for channels, opcodes, levels, tasks and keywords.

Channels

Four channels are defined for the provider. Each takes a different selection of the many possible events.

Channel ID Channel Name Versions
8 System 6.0 and higher
16 Microsoft-Windows-Kernel-Power/Diagnostic 6.0 and higher
17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic 6.1 and higher
18 Microsoft-Windows-Kernel-Power/Thermal-Operational 6.1 and higher

The System log is familiar to all system administrators and many users. The Event Viewer shows it prominently among the Windows Logs. The others appear in the Event Viewer as “Applications and Services Logs”. The two diagnostic channels are not ordinarily enabled and are not even presented as logs that might be enabled except if the “Show Analytic and Debug Logs” option is checked. There is a good argument that the most important of the possible events are directed to the System log, but do not miss that by far the most go to the Diagnostic channel (16) and are thus not seen unless they are specially sought. To see more events than just the few that go to the System log, enable one or more of the other channels or create a custom log. The latter is anyway necessary for the more than two dozen events that begin at 300 and are not directed to any channel.

Events

Also in the registry is that plain-language descriptions of events, such as show in the Event Viewer, are resolved from the same DLL’s message-table resource (which is in practice in the language-specific MUI file). Note that Microsoft does not provide descriptions for the vast majority of the possible events.

The tables that presently follow are of all events for which the kernel is known to have code for writing the event—though presently only up to and including the original release of Windows 10. Names given for channels, levels, opcodes, tasks and keywords are from the compiled event template. Though conversion to friendly names is possible for all levels, no plain-language names are defined for some opcodes or for any tasks or keywords, and so the table uses the unfriendly names throughout. Some conventions are applied for brevity. The version, opcode and task are omitted unless they are non-zero, but beware that the name “win:Info” is formally defined for opcode zero. The high byte of the keyword is not rendered as text since it reliably corresponds to the channel. Alternatives for event data are sometimes, even often, not alternatives but are instead to be understood as additive, the event data having been extended from one version to the next.

Main Series

Events numbered sequentially from 1 have roughly doubled in a decade, reaching to:

Though many have fallen out of use in the sense that they are not known to the kernel in later versions, their IDs are not reused and information about them is retained in the compiled event template, presumably so that tools running on a new Windows logs can interpret logs collected from computers that run an old Windows.

POP_ETW_EVENT_POWERTRANSITION_START

Event ID: 1  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 1 win:Critical
Opcode: 1 win:Start
Task: 33 PowerTransition
Keyword: 0x40000000`00000009 po:Scenario
po:Performance
Event Data: Reason
Flags
Time
 

Event 1 is known to the kernel in version 6.0 and higher.

Quite what sense there is to ranking event 1 and 2 as Critical when they merely record even the ordinary start and end or an ordinary power transition is anyone’s guess.

POP_ETW_EVENT_POWERTRANSITION_END

Event ID: 2  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 1 win:Critical
Opcode: 2 win:Stop
Task: 33 PowerTransition
Keyword: 0x40000000`00000009 po:Scenario
po:Performance
Event Data: Status
Time
 

Event 2 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_QUERYAPPS

Event ID: 3  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 34 QueryApps
Keyword: 0x40000000`00000008 po:Performance

Event 3 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_QUERYAPPS_STATUS

Event ID: 4  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 34 QueryApps
Keyword: 0x40000000`00000008 po:Performance
Event Data: Status  

Event 4 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_QUERYSERVICES

Event ID: 5  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 35 QueryServices
Keyword: 0x40000000`00000008 po:Performance

Event 5 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_QUERYSERVICES_STATUS

Event ID: 6  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 35 QueryServices
Keyword: 0x40000000`00000008 po:Performance
Event Data: Status  

Event 6 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_IRPSTART

Event ID: 7    
Version: 0   6.0 only
1   6.1 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Opcode: 1 win:Start  
Task: 39 Irp  
Keyword: 0x40000000`00000008 po:Performance  
Event Data: Irp
PowerStateType
MinorFunction
TargetDevice
InstanceNameLength
InstanceName
  6.0 and higher
PowerState   6.1 and higher

Event 7 is known to the kernel in version 6.0 and higher.

It perhaps never can actually happen, but the kernel omits the InstanceName if the InstanceNameLength is zero.

POP_ETW_EVENT_IRPFINISH

Event ID: 8  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 39 Irp
Keyword: 0x40000000`00000008 po:Performance
Event Data: Irp
Status
FailedDriver
 

Event 8 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_APPVETO

Event ID: 9  
Channel: 8 System
Level: 4 win:Informational
Opcode: 35 Veto
Task: 34 QueryApps
Keyword: 0x80000000`00000004 po:Diagnostic
Event Data: Pid
Window
AppNameLength
AppName
 

Event 9 is known to the kernel in version 6.0 only. It has a plain-language description:

The application AppName stopped the power transition.

POP_ETW_EVENT_SERVICEVETO

Event ID: 10  
Channel: 8 System
Level: 4 win:Informational
Opcode: 35 Veto
Task: 35 QueryServices
Keyword: 0x80000000`00000004 po:Diagnostic
Event Data: Pid
ServiceNameLength
ServiceName
 

Event 10 is known to the kernel in version 6.0 only. It has a plain-language description:

The service ServiceName stopped the power transition.

POP_ETW_EVENT_IRPWAITING

Event ID: 11    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 58 IrpWaiting 6.1 only
Keyword: 0x40000000`00000000    
Event Data: Irp    

Event 11 is known to the kernel in versions 6.0 to 6.1.

POP_ETW_EVENT_QUERYAPP

Event ID: 12  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 34 QueryApps
Keyword: 0x40000000`00000008 po:Performance
Event Data: Pid
NameLength
Name
 

Event 12 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_QUERYAPP_END

Event ID: 13  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 34 QueryApps
Keyword: 0x40000000`00000008 po:Performance
Event Data: Pid  

Event 13 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_QUERYSERVICE

Event ID: 14  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 35 QueryServices
Keyword: 0x40000000`00000008 po:Performance
Event Data: NameLength
Name
 

Event 14 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_QUERYSERVICE_END

Event ID: 15  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 35 QueryServices
Keyword: 0x40000000`00000008 po:Performance
Event Data: NameLength
Name
 

Event 15 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_SUSPENDAPP

Event ID: 16  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 37 SuspendApps
Keyword: 0x40000000`00000008 po:Performance
Event Data: Pid
NameLength
Name
 

Event 16 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUSPENDAPP_END

Event ID: 17  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 37 SuspendApps
Keyword: 0x40000000`00000008 po:Performance
Event Data: Pid  

Event 17 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUSPENDSERVICE

Event ID: 18  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 38 SuspendServices
Keyword: 0x40000000`00000008 po:Performance
Event Data: NameLength
Name
 

Event 18 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUSPENDSERVICE_END

Event ID: 19  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 38 SuspendServices
Keyword: 0x40000000`00000008 po:Performance
Event Data: NameLength
Name
 

Event 19 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_IRP_DRIVERACQUIRE

Event ID: 20  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 40 Driver
Keyword: 0x40000000`00000008 po:Performance
Event Data: Irp
Device
DriverName
 

Event 20 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_IRP_DRIVERRELEASE

Event ID: 21  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 40 Driver
Keyword: 0x40000000`00000008 po:Performance
Event Data: Irp
Device
 

Event 21 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUSPENDAPPS

Event ID: 22  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 37 SuspendApps
Keyword: 0x40000000`00000008 po:Performance

Event 22 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUSPENDAPPS_END

Event ID: 23  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 37 SuspendApps
Keyword: 0x40000000`00000008 po:Performance

Event 23 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUSPENDSERVICES

Event ID: 24  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 38 SuspendServices
Keyword: 0x40000000`00000008 po:Performance

Event 24 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUSPENDSERVICES_END

Event ID: 25  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 38 SuspendServices
Keyword: 0x40000000`00000008 po:Performance

Event 25 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_RESUMEAPPS

Event ID: 26  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 44 ResumeApps
Keyword: 0x40000000`00000008 po:Performance

Event 26 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_RESUMESERVICES

Event ID: 27  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 43 ResumeServices
Keyword: 0x40000000`00000008 po:Performance

Event 27 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_RESUMEAPP

Event ID: 28  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 44 ResumeApps
Keyword: 0x40000000`00000008 po:Performance
Event Data: Pid
NameLength
Name
 

Event 28 is known to the kernel in version 6.0 only.

Though event 29 is defined in the compiled event templates for version 6.0 and higher, it is not known to the kernel in any version yet studied.

POP_ETW_EVENT_QUERYFAILEDAPPS

Event ID: 30  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Keyword: 0x40000000`00000000  

Event 30 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_QUERYFAILEDSERVICES

Event ID: 31  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Keyword: 0x40000000`00000000  

Event 31 is known to the kernel in version 6.0 only.  

POP_ETW_EVENT_QUERYFAILEDAPP

Event ID: 32  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Keyword: 0x40000000`00000000  
Event Data: Pid
NameLength
Name
 

Event 32 is known to the kernel in version 6.0 only.

Though event 33 is defined in the compiled event templates for version 6.0 and higher, it is not known to the kernel in any version yet studied.

POP_ETW_EVENT_HIBERNATE_STATUS

Event ID: 34  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 45 Hibernate
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
Event Data: Status  

Event 34 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_DEVICESSUSPEND

Event ID: 35  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 41 SuspendDevices
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
Event Data: Query
TargetState
EffectiveState
 

Event 35 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_DEVICESSUSPEND_END

Event ID: 36  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 41 SuspendDevices
Keyword: 0x40000000`00000008 po:Performance

Event 36 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_DEVICESWAKE

Event ID: 37    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Opcode: 33 PhaseStart  
Task: 42 WakeDevices  
Keyword: 0x4000000`00000008 po:Performance 6.0 to 6.1
0x40000000`0000000C po:Diagnostic
po:Performance
6.2 and higher

Event 37 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_DEVICESWAKE_END

Event ID: 38    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Opcode: 34 PhaseStop  
Task: 42 WakeDevices  
Keyword: 0x40000000`00000008 po:Performance 6.0 to 6.1
0x40000000`0000000C po:Diagnostic
po:Performance
6.2 and higher

Event 38 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_TRANSITIONTIMES

Event ID: 39  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 33 PowerTransition
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
Event Data: SleepTime
ResumeTime
DriverWakeTime
HiberWriteTime
HiberReadTime
HiberPagesWritten
BiosInitTime
 

Event 39 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_DRIVERVETO

Event ID: 40  
Channel: 8 System
Level: 4 win:Informational
Opcode: 35 Veto
Task: 36 QueryDrivers
Keyword: 0x80000000`00000004 po:Diagnostic
Event Data: DriverNameLength
DriverName
InstanceNameLength
InstanceName
 

Event 40 is known to the kernel in version 6.0 and higher. It has a plain-language description:

The driver DriverName for device InstanceName stopped the power transition.

POP_ETW_EVENT_DIRTY_TRANSITION (but POP_ETW_EVENT_DIRTY_SLEEP in 6.0)

Event ID: 41    
Version: 0   6.0 only
2   6.1 only
3   6.2 and higher
Channel: 8 System  
Level: 1 win:Critical  
Task: 63 DirtyTransition 6.1 and higher
Keyword: 0x80000000`00000002 po:Simple 6.0 to 6.3
0x80002000`00000002 po:Simple
ms:Telemetry
10.0 and higher
Event Data: BugCheckCode
BugcheckParameter
  late 6.0 only
BugcheckCode
BugcheckParameter1
BugcheckParameter2
BugcheckParameter3
BugcheckParameter4
SleepInProgress
PowerButtonTimestamp
  6.1 and higher
BootAppStatus   6.2 and higher

Event 41 is known to the kernel in version 6.0 and higher. It nowadays has the plain-language description:

The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

The text for version 0 of the event differs a little, the first sentence instead being “The last sleep transition was unsuccessful.”

Much more important about version 6.0 is the confusion over the event version and the corresponding changes in event data. We have the luxury now of a historical perspective, such as if an ETL file from some release of Windows Vista is loaded into the Event Viewer (or similar application) on a new Windows. Such use is why the compiled event template even for Windows 10 has information about events that no recent version of the kernel can write. To go by these resources, event 41 exists in a version 0 that has no event data and a version 1 that has the two items as shown above for 6.0 SP1 and SP2. This history, however, is a fiction. The event templates from the time, compiled into ADVAPI32.DLL, have event 41 with no event data for the original release of Windows Vista, and with those two items of event data for Windows Vista SP1 and SP2, but they know nothing of a version 1 and neither does the kernel. Indeed, the Windows Vista kernel, in its original, SP1 and SP2 releases, writes all Microsoft-Windows-Kernel-Power events as version 0. As for the two arguments, these too are a fiction—at least for the formal releases that are studied here. In Windows Vista SP1 and SP2, the kernel writes event 41 with five arguments, being the ones that are known later as BugcheckCode through to BugcheckParameter4.

Though the compiled event template for Windows 7 knows, of course, that the Windows 7 kernel writes version 2 of the event and supplies seven items of event data, as shown above, the compiled event templates for Windows 8 and higher would have it that version 2 has BootAppStatus as an eighth argument.

POP_ETW_EVENT_PRESLEEP_NOTIFICATION2 (but plain POP_ETW_EVENT_PRESLEEP_NOTIFICATION in 6.0)

Event ID: 42    
Version: 0   6.0 only
2   6.1 and higher
Channel: 8 System  
Level: 4 win:Informational  
Task: 64 PreSleepNotification 6.1 and higher
Keyword: 0x80000000`00000004 po:Diagnostic  
Event Data: TargetState
EffectiveState
  6.0 and higher
Reason
Flags
  6.1 and higher

Event 42 is known to the kernel in version 6.0 and higher. It nowadays has the plain-language description:

The system is entering sleep.

Sleep Reason: Reason

The text for event version 0 has just the first sentence, there being no Reason in the event data.

POP_ETW_EVENT_ZEROHIBERFILE_START

Event ID: 43  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 46 ZeroHiberFile
Keyword: 0x40000000`00000008 po:Performance

Event 43 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_ZEROHIBERFILE_STOP

Event ID: 44  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 46 ZeroHiberFile
Keyword: 0x40000000`00000008 po:Performance

Event 44 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_FLUSHVOLUMES_START

Event ID: 45  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 47 FlushVolumes
Keyword: 0x40000000`00000008 po:Performance

Event 45 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_FLUSHVOLUMES_STOP

Event ID: 46  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 47 FlushVolumes
Keyword: 0x40000000`00000008 po:Performance

Event 46 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_GRACEFULSHUTDOWN_START

Event ID: 47  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 48 GracefulShutdown
Keyword: 0x40000000`00000008 po:Performance

Event 47 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_GRACEFULSHUTDOWN_STOP

Event ID: 48  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 48 GracefulShutdown
Keyword: 0x40000000`00000009 po:Scenario
po:Performance

Event 48 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_ZEROPAGEFILE_START

Event ID: 49  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 49 ZeroPageFile
Keyword: 0x40000000`00000008 po:Performance

Event 49 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_ZEROPAGEFILE_STOP

Event ID: 50  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 49 ZeroPageFile
Keyword: 0x40000000`00000008 po:Performance

Event 50 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_IOSHUTDOWNSYSTEM_START

Event ID: 51  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 50 IoShutdownSystem
Keyword: 0x40000000`00000008 po:Performance

Event 51 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_IOSHUTDOWNSYSTEM_STOP

Event ID: 52  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 50 IoShutdownSystem
Keyword: 0x40000000`00000008 po:Performance

Event 52 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_WAITFORPROCESSES_START

Event ID: 53  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 51 WaitForProcesses
Keyword: 0x40000000`00000008 po:Performance

Event 53 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_WAITFORPROCESSES_STOP

Event ID: 54  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 51 WaitForProcesses
Keyword: 0x40000000`00000008 po:Performance

Event 54 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_CMSHUTDOWNSYSTEM_START

Event ID: 55  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 52 CmShutdownSystem
Keyword: 0x40000000`00000008 po:Performance

Event 55 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_CMSHUTDOWNSYSTEM_STOP

Event ID: 56  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 52 CmShutdownSystem
Keyword: 0x40000000`00000008 po:Performance

Event 56 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SHOWUI_START

Event ID: 57  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 53 ShowUI
Keyword: 0x40000000`00000008 po:Performance

Event 57 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_SHOWUI_STOP

Event ID: 58  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 53 ShowUI
Keyword: 0x40000000`00000008 po:Performance

Event 58 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_AWAYMODE

Event ID: 59    
Channel: 8 System  
Level: 4 win:Informational  
Task: 65 AwayMode 6.1 and higher
Keyword: 0x80000000`00000004 po:Diagnostic  

Event 59 is known to the kernel in version 6.0 and higher. It has a plain-language description:

The system is entering Away Mode.

POP_ETW_EVENT_USER_QUERY_ALLOWED

Event ID: 60  
Channel: 8 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Value  

Event 60 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_KERNEL_QUERY_ALLOWED

Event ID: 61    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 67 KernelQueryAllowed 6.1 and higher
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: Value    

Event 61 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_STES

Event ID: 62    
Version: 0   6.0 only
1   6.1 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 68 SetExecutionState 6.1 and higher
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: ExecutionState
AppNameLength
AppName
  6.0 and higher
Pid
Tid
  late 6.0 and higher

Event 62 is known to the kernel in version 6.0 and higher. It has a plain-language description:

The application or service AppName has overridden user power management settings with a code of ExecutionState.

Again, version 6.0 has complications with the event version. The compiled event template for Windows 7 and higher has event 62 in a version 0 with three items of event data and a version 1 with five, but this is at best an idealised history. The extension to five items is known for version 0 in Windows Vista SP1 and SP2, both as written by the kernel and as interpreted through the compiled event template from the time.

POP_ETW_EVENT_STRS

Event ID: 63    
Version: 0   6.0 only
1   6.1 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 69 SystemTimeResolutionChange 6.1 and higher
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: ExecutionState
AppNameLength
AppName
  6.0 only
RequestedResolution
Pid
AppNameLength
AppName
SubProcessTag
  6.1 and higher

Event 63 is known in version 6.0 and higher. There seems to have been recurring trouble over the naming of event data and its use in the plain-language description. That version 6.0 mislabels the new value for the timer resolution as an ExecutionState is not a problem in practice:

The application or service AppName is attempting to update the system timer resolution to a value of ExecutionState.

The modern rendering, with more event data, selects incorrectly:

The application or service SubProcessTag is attempting to update the system timer resolution to a value of RequestedResolution.

To see the AppName, ignore the text and look at the event data. It is at least curious that for one of the few events that are directed to the Diagnostic channel yet also have a plain-language description, Microsoft has not noticed that the text presents a number where a name is plainly intended, or has not cared to fix the mismatch.

POP_ETW_EVENT_SUPERFETCH_STARTRT

Event ID: 64  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 54 Superfetch
Keyword: 0x40000000`00000008 po:Performance

Event 64 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SUPERFETCH_STOP

Event ID: 65  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 54 Superfetch
Keyword: 0x40000000`00000008 po:Performance

Event 65 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_WINLOGON_START

Event ID: 66  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 55 Winlogon
Keyword: 0x40000000`00000008 po:Performance

Event 66 is known to the kernel in versions 6.0 to 6.1.

POP_ETW_EVENT_WINLOGON_STOP

Event ID: 67  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 55 Winlogon
Keyword: 0x40000000`00000008 po:Performance

Event 67 is known to the kernel in versions 6.0 to 6.1.

POP_ETW_EVENT_PRESLEEP_CALLBACKS_START

Event ID: 68  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 56 PreSleepCallbacks
Keyword: 0x40000000`00000008 po:Performance

Event 68 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_PRESLEEP_CALLBACKS_STOP

Event ID: 69  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 56 PreSleepCallbacks
Keyword: 0x40000000`00000008 po:Performance

Event 69 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_HIDEUI_START

Event ID: 70  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 57 HideUI
Keyword: 0x40000000`00000008 po:Performance

Event 70 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_HIDEUI_STOP

Event ID: 71  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 57 HideUI
Keyword: 0x40000000`00000008 po:Performance

Event 71 is known to the kernel in version 6.0 only.

POP_ETW_EVENT_IDLE_CHECK

Event ID: 72    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 70 IdleCheck 6.1 and higher
Keyword: 0x40000000`00000010 po:Idle  
Event Data: Threshold
LowestIdleness
AverageIdleness
AccruedIdleTime
NonIdleIgnored
IdleToSleep
NonIdleReferences
   

Event 72 is known to the kernel in version 6.0 and higher.

POP_ETW_EVENT_SETSYSTEMSTATE

Event ID: 73    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 5 win:Verbose  
Task: 71 SetSystemState 6.1 and higher
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: ExecutionState    

Event 73 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

POP_ETW_EVENT_REGISTERSYSTEMSTATE

Event ID: 74    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 72 RegisterSystemState 6.1 and higher
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: ExecutionState
StateHandle
   

Event 74 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

POP_ETW_EVENT_DEVICE_IDLE_START

Event ID: 75    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Opcode: 1 win:Start  
Task: 73 DeviceIdle 6.1 and higher
Keyword: 0x40000000`00000010 po:Idle  

Event 75 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

POP_ETW_EVENT_DEVICE_IDLE_END

Event ID: 76    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Opcode: 2 win:Stop  
Task: 73 DeviceIdle 6.1 and higher
Keyword: 0x40000000`00000010 po:Idle  

Event 76 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

POP_ETW_EVENT_DEVICE_IDLE_CHECK

Event ID: 77    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 74 DeviceIdleCheck 6.1 and higher
Keyword: 0x40000000`00000010 po:Idle  
Event Data: Device
Pdo
InstancePathLength
InstancePath
ConservativeTimeout
PerformanceTimeout
IdleTime
BusyCount
TotalBusyCount
IdlePowerState
CurrentPowerState
   

Event 77 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

POP_ETW_EVENT_DISK_IDLE_CHECK

Event ID: 78    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 75 DiskIdleCheck 6.1 and higher
Keyword: 0x40000000`00000010 po:Idle  
Event Data: Device
Timeout
IgnoreThreshold
IdleTime
NonIdleTime
   

Event 78 is known to the kernel in the version 6.0 from Windows Vista SP1, and higher.

POP_ETW_EVENT_SKIP_TICK

Event ID: 79  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 76 SkipTick
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
Event Data: Disabled
Overridden
 

Event 79 is known to the kernel in version 6.1 and higher. It has a plain-language description:

Timer tick distribution policy:            
            
Disabled: Disabled
            
Overridden: Overridden

POP_ETW_EVENT_COOLING_MODE

Event ID: 80  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 77 CoolingModeChange
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
CoolingModeLength
CoolingMode
 

Event 80 is known to the kernel in version 6.1 and higher. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance changed to CoolingMode cooling.

POP_ETW_EVENT_PASSIVE_COOLING_DIAGNOSTIC

Event ID: 81  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 78 PassiveCoolingDiagnostic
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
EventTime
PassiveCoolingStateLength
PassiveCoolingState
AffinityCount
_PSV
_TMP
_TC1
_TC2
_TSP
DeltaP
_PSL
Affinity
 

Event 81 is known to the kernel in version 6.1 only. Later versions write event 113 instead. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState cooling.
            
EventTime = EventTime
            
_PSV = _PSVK
            
_TMP = _TMPK
            
_TC1 = _TC1
            
_TC2 = _TC2
            
_TSP = _TSPms
            
Delta P = DeltaP
            
_PSL - see event data.

POP_ETW_EVENT_PASSIVE_COOLING_OPERATIONAL

Event ID: 82  
Channel: 18 Microsoft-Windows-Kernel-Power/Thermal-Operational
Level: 4 win:Informational
Task: 79 PassiveCoolingOperational
Keyword: 0x10000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
EventTime
PassiveCoolingStateLength
PassiveCoolingState
AffinityCount
_PSV
_TMP
_TC1
_TC2
_TSP
DeltaP
_PSL
Affinity
 

Event 82 is known to the kernel in version 6.1 only. Later versions write event 114 instead. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState cooling.
            
EventTime = EventTime
            
_PSV = _PSVK
            
_TMP = _TMPK
            
_TC1 = _TC1
            
_TC2 = _TC2
            
_TSP = _TSPms
            
Delta P = DeltaP
            
_PSL - see event data.

POP_ETW_EVENT_ACTIVE_COOLING_DIAGNOSTIC

Event ID: 83  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 80 ActiveCoolingDiagnostic
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
EventTime
ActiveCoolingStateLength
ActiveCoolingState
_AC0
_AC1
_AC2
_AC3
_AC4
_AC5
_AC6
_AC7
_AC8
_AC9
_TMP
 

Event 83 is known to the kernel in version 6.1 only. Later versions write event 115 instead. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.
            
EventTime = EventTime
            
_AC0 = _AC0K
            
_AC1 = _AC1K
            
_AC2 = _AC2K
            
_AC3 = _AC3K
            
_AC4 = _AC4K
            
_AC5 = _AC5K
            
_AC6 = _AC6K
            
_AC7 = _AC7K
            
_AC8 = _AC8K
            
_AC9 = _AC9K
            
_TMP = _TMPK

POP_ETW_EVENT_ACTIVE_COOLING_OPERATIONAL

Event ID: 84  
Channel: 18 Microsoft-Windows-Kernel-Power/Thermal-Operational
Level: 4 win:Informational
Task: 81 ActiveCoolingOperational
Keyword: 0x10000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
EventTime
ActiveCoolingStateLength
ActiveCoolingState
_AC0
_AC1
_AC2
_AC3
_AC4
_AC5
_AC6
_AC7
_AC8
_AC9
_TMP
 

Event 84 is known to the kernel in version 6.1 only. Later versions write event 116 instead. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.
            
EventTime = EventTime
            
_AC0 = _AC0K
            
_AC1 = _AC1K
            
_AC2 = _AC2K
            
_AC3 = _AC3K
            
_AC4 = _AC4K
            
_AC5 = _AC5K
            
_AC6 = _AC6K
            
_AC7 = _AC7K
            
_AC8 = _AC8K
            
_AC9 = _AC9K
            
_TMP = _TMPK

POP_ETW_EVENT_CRITICAL_TRIP_POINT_DIAGNOSTIC

Event ID: 85  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 2 win:Error
Task: 82 CriticalTripPointExceededDiagnostic
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
ShutdownTime
_CRT
 

Event 85 is known to the kernel in version 6.1 and higher. It has a plain-language description:

The system was shut down due to a critical thermal event.
            
Shutdown Time = ShutdownTime
            
ACPI Thermal Zone = ThermalZoneDeviceInstance
            
_CRT = _CRT

POP_ETW_EVENT_CRITICAL_TRIP_POINT_SYSTEM

Event ID: 86  
Channel: 8 System
Level: 2 win:Error
Task: 83 CriticalTripPointExceededSystem
Keyword: 0x80000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
ShutdownTime
_CRT
 

Event 86 is known to the kernel in version 6.1 and higher. It has a plain-language descrption:

The system was shut down due to a critical thermal event.
            
Shutdown Time = ShutdownTime
            
ACPI Thermal Zone = ThermalZoneDeviceInstance
            
_CRT = _CRT

POP_ETW_EVENT_S4_TRIP_POINT_DIAGNOSTIC

Event ID: 87  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 2 win:Error
Task: 84 S4TripPointExceededDiagnostic
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
HibernateTime
_HOT
 

Event 87 is known to the kernel in version 6.1 and higher. It has a plain-language description:

The system was hibernated due to a critical thermal event.
Hibernate Time = HibernateTime
            
ACPI Thermal Zone = ThermalZoneDeviceInstance
            
_HOT = _HOT

POP_ETW_EVENT_S4_TRIP_POINT_SYSTEM

Event ID: 88  
Channel: 8 System
Level: 2 win:Error
Task: 85 S4TripPointExceededSystem
Keyword: 0x80000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
HibernateTime
_HOT
 

Event 88 is known to the kernel in version 6.1 and higher. It has a plain-language descrption:

The system was hibernated due to a critical thermal event.
Hibernate Time = HibernateTime
            
ACPI Thermal Zone = ThermalZoneDeviceInstance
            
_HOT = _HOT

POP_ETW_EVENT_THERMAL_ZONE_ENUMERATED

Event ID: 89  
Channel: 8 System
Level: 4 win:Informational
Task: 86 ThermalZoneEnumerated
Keyword: 0x80000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
AffinityCount
_PSV
_TC1
_TC2
_TSP
_AC0
_AC1
_AC2
_AC3
_AC4
_AC5
_AC6
_AC7
_AC8
_AC9
_CRT
_HOT
_PSL
Affinity
 

Event 89 is known to the kernel in version 6.1 only. Later versions write event 125 instead. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has been enumerated.
            
_PSV = _PSVK
            
_TC1 = _TC1
            
_TC2 = _TC2
            
_TSP = _TSPms
            
_AC0 = _AC0K
            
_AC1 = _AC1K
            
_AC2 = _AC2K
            
_AC3 = _AC3K
            
_AC4 = _AC4K
            
_AC5 = _AC5K
            
_AC6 = _AC6K
            
_AC7 = _AC7K
            
_AC8 = _AC8K
            
_AC9 = _AC9K
            
_CRT = _CRTK
            
_HOT = _HOTK
            
_PSL - see event data.

POP_ETW_EVENT_ILLEGAL_PROCESSOR_THROTTLE_DIAGNOSTIC

Event ID: 90  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 3 win:Warning
Task: 87 IllegalProcessorThrottleDiagnostic
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ProcessorId
ThrottleMSR
ElapsedTime
LogInterval
 

Event 90 is known to the kernel in version 6.1 and higher. It has a plain-language description:

Processor ProcessorId was throttled by an entity other than the kernel power manager. 
IA32_CLOCK_MODULATION_MSR = ThrottleMSR. 
Elapsed time since last event logged = ElapsedTimes. 
Log interval = LogInterval events.

POP_ETW_EVENT_ILLEGAL_PROCESSOR_THROTTLE_OPERATIONAL

Event ID: 91  
Channel: 18 Microsoft-Windows-Kernel-Power/Thermal-Operational
Level: 3 win:Warning
Task: 88 IllegalProcessorThrottleOperational
Keyword: 0x10000000`00000020 po:Thermal
Event Data: ProcessorId
ThrottleMSR
ElapsedTime
LogInterval
 

Event 91 is known to the kernel in version 6.1 and higher. It has a plain-language description: 

Processor ProcessorId was throttled by an entity other than the kernel power manager. 
IA32_CLOCK_MODULATION_MSR = ThrottleMSR. 
Elapsed time since last event logged = ElapsedTimes. 
Log interval = LogInterval events.

POP_ETW_EVENT_CREATE_POWER_REQUEST

Event ID: 92    
Version: 0   6.1 only
1   6.2 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 89 CreatePowerRequest  
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: Token
Type
ProcessID
SessionID
Legacy
SystemAllowed
DisplayAllowed
AwayModeAllowed
SystemCount
DisplayCount
AwayModeCount
CallerLength
ContextLength
Caller
Context
  6.1 and higher
ExecutionRequiredAllowed
PerformanceBoostAllowed
FullScreenVideoAllowed
ExecutionRequiredCount
PerformanceBoostCount
FullScreenVideoCount
  6.2 and higher

Event 92 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_CHANGE_POWER_REQUEST

Event ID: 93    
Version: 0   6.1 only
1   6.2 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 90 ChangePowerRequest  
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: Token
SystemCount
DisplayCount
AwayModeCount
  6.1 and higher
ExecutionRequiredCount
PerformanceBoostCount
FullScreenVideoCount
  6.2 and higher

Event 93 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_CLOSE_POWER_REQUEST

Event ID: 94  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 91 ClosePowerRequest
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Token  

Event 94 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_TIME_RESOLUTION_UPDATE

Event ID: 95  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 92 SystemTimeResolutionUpdate
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: NewResolution  

Event 95 is known to the kernel in version 6.1 and higher. It has a plain-language description:

The system timer resolution has changed to a value of NewResolution.

POP_ETW_EVENT_TIME_RESOLUTION_RUNDOWN

Event ID: 96  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 93 SystemTimeResolutionRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: CurrentPeriod
MinimumPeriod
MaximumPeriod
KernelRequestCount
KernelRequestedPeriod
 

Event 96 is known to the kernel in version 6.1 and higher. It has a plain-language description:

The system timer resolution currently has a value of CurrentPeriod.

POP_ETW_EVENT_TIME_RESOLUTION_REQUEST_RUNDOWN

Event ID: 97  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 94 SystemTimeResolutionRequestRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: RequestedPeriod
Pid
AppNameLength
AppName
 

Event 97 is known to the kernel in version 6.1 and higher. It has a plain-language description:

The system timer resolution currently has a value of RequestedPeriod.

POP_ETW_EVENT_KERNEL_STRS

Event ID: 98    
Version: 0   6.1 to 6.2
1   6.3 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 95 SystemTimeResolutionKernelChange  
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: RequestedResolution
  6.1 and higher
Tag   6.3 and higher

Event 98 is known in version 6.1 and higher. It has a plain-language description:

A driver is attempting to update the system timer resolution to a value of RequestedResolution.

POP_ETW_EVENT_POWER_REQUEST_RUNDOWN

Event ID: 99    
Version: 0   6.1 only
1   6.2 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 96 PowerRequestRundown  
Keyword: 0x40000000`00000004 po:Diagnostic  
Event Data: Token
Type
ProcessID
SessionID
Legacy
SystemAllowed
DisplayAllowed
AwayModeAllowed
SystemCount
DisplayCount
AwayModeCount
CallerLength
ContextLength
Caller
Context
  6.1 and higher
ExecutionRequiredAllowed
PerformanceBoostAllowed
FullScreenVideoAllowed
ExecutionRequiredCount
PerformanceBoostCount
FullScreenVideoCount
  6.2 and higher

Event 99 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_FLUSHALLPAGES

Event ID: 100  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 97 FlushAllPages
Keyword: 0x40000000`00000008 po:Performance

Event 100 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_FLUSHALLPAGES_END

Event ID: 101  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 97 FlushAllPages
Keyword: 0x40000000`00000008 po:Performance

Event 101 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_BUILDNOTIFYLIST

Event ID: 102  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 33 PhaseStart
Task: 98 BuildNotifyList
Keyword: 0x40000000`00000008 po:Performance

Event 102 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_BUILDNOTIFYLIST_END

Event ID: 103  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34 PhaseStop
Task: 98 BuildNotifyList
Keyword: 0x40000000`00000008 po:Performance

Event 103 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_SLEEP_DISABLE_REASON_RUNDOWN

Event ID: 104  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 99 SleepDisableReasonRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: AffectedState
PowerReasonCode
PowerReasonLength
PowerReasonInfo
 

Event 104 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_ACDC_STATE_CHANGE

Event ID: 105    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 100 AcDcStateChange  
Keyword: 0x40000000`00000004 po:Diagnostic 6.1 to 6.3
0x40002000`00000004 po:Diagnostic
ms:Telemetry
10.0 and higher
Event Data: AcOnline    

Event 105 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_ACDC_STATE_RUNDOWN

Event ID: 106  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 101 AcDcStateRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: AcOnline  

Event 106 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_POSTSLEEP_NOTIFICATION

Event ID: 107  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 102 PostSleepNotification
Keyword: 0x40000000`00000044 po:Diagnostic
po:PerfTrackContext
Event Data: TargetState
EffectiveState
WakeFromState
 

Event 107 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_HIBER_STATS

Event ID: 108  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 33 PowerTransition
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
Event Data: CopyBytes
ElapsedTime
IoTime
InitTime
CopyTime
PagesWritten
PagesProcessed
DumpCount
FileRuns
ReadTime
ResumeAppTime
CompressTime
 

Event 108 is known to the kernel in version 6.1 only. Later versions write event 117 instead.

POP_ETW_EVENT_SHUTDOWN_ACTION

Event ID: 109    
Channel: 8 System  
Level: 4 win:Informational  
Task: 103 ShutdownAction  
Keyword: 0x80000000`00000004 po:Diagnostic 6.1 to 6.3
0x80002000`00000004 po:Diagnostic
ms:Telemetry
10.0 and higher
Event Data: ShutdownActionType
ShutdownEventCode
ShutdownReason
   

Event 109 is known to the kernel in version 6.1 and higher. It nowadays has the plain-language description:

The kernel power manager has initiated a shutdown transition.

Shutdown Reason: ShutdownReason

Before Windows 10, however, you get just the first sentence and must look in the event data if you want the ShutdownReason.

POP_ETW_EVENT_TIME_RESOLUTION_STACK_RUNDOWN

Event ID: 110  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 104 SystemTimerResolutionStackRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: RequestedPeriod
Pid
AppNameLength
AppName
StackSize
Stack
 

Event 110 is known to the kernel in version 6.1 and higher.

POP_ETW_EVENT_POWER_SETTING_RUNDOWN

Event ID: 111    
Version: 0   6.2 only
1   6.3 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 105 PowerSettingRundown  
Keyword: 0x40000000`00000080 po:PowerSetting  
Event Data: SettingGuid
DataSize
Data
  6.2 and higher
Override   6.3 and higher

Event 111 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_POWER_SETTING_CHANGE

Event ID: 112    
Version: 0   6.2 only
1   6.3 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 106 PowerSettingChange  
Keyword: 0x40000000`00000080 po:PowerSetting  
Event Data: SettingGuid
DataSize
Data
  6.2 and higher
Override   6.3 and higher

Event 112 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_PASSIVE_COOLING_DIAGNOSTIC

Event ID: 113    
Version: 0   6.2 only
1   6.3 and higher
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic  
Level: 4 win:Informational  
Task: 78 PassiveCoolingDiagnostic  
Keyword: 0x20000000`00000020 po:Thermal  
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
EventTime
PassiveCoolingState
_PSV
_TMP
_TC1
_TC2
_TSP
DeltaP
  6.2 and higher
MinimumThrottle   6.3 and higher

Event 113 is known to the kernel in version 6.2 and higher, apparently having replaced event 81. It nowadays has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive cooling.
            
EventTime = EventTime
            
_PSV = _PSVK
            
_TMP = _TMPK
            
_TC1 = _TC1
            
_TC2 = _TC2
            
_TSP = _TSPms
            
Delta P = DeltaP
            
Minimum Throttle = MinimumThrottle

The rendering for earlier versions of the event continues only as far as do the items of event data.

POP_ETW_EVENT_PASSIVE_COOLING_OPERATIONAL

Event ID: 114    
Version:  0   6.2 only
1   6.3 and higher
Channel: 18 Microsoft-Windows-Kernel-Power/Thermal-Operational  
Level: 4 win:Informational  
Task: 79 PassiveCoolingOperational  
Keyword: 0x10000000`00000020 po:Thermal  
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
EventTime
PassiveCoolingState
_PSV
_TMP
_TC1
_TC2
_TSP
DeltaP
  6.2 and higher
MinimumThrottle   6.3 and higher

Event 114 is known to the kernel in version 6.2 and higher, apparently having replaced event 82. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive cooling.
            
EventTime = EventTime
            
_PSV = _PSVK
            
_TMP = _TMPK
            
_TC1 = _TC1
            
_TC2 = _TC2
            
_TSP = _TSPms
            
Delta P = DeltaP
            
Minimum Throttle = MinimumThrottle

The rendering for earlier versions of the event continues only as far as do the items of event data.

POP_ETW_EVENT_ACTIVE_COOLING_DIAGNOSTIC

Event ID: 115  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 80 ActiveCoolingDiagnostic
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
EventTime
ActiveCoolingState
_AC0
_AC1
_AC2
_AC3
_AC4
_AC5
_AC6
_AC7
_AC8
_AC9
_TMP
 

Event 115 is known to the kernel in version 6.2 and higher, apparently having replaced event 83. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.
            
EventTime = EventTime
            
_AC0 = _AC0K
            
_AC1 = _AC1K
            
_AC2 = _AC2K
            
_AC3 = _AC3K
            
_AC4 = _AC4K
            
_AC5 = _AC5K
            
_AC6 = _AC6K
            
_AC7 = _AC7K
            
_AC8 = _AC8K
            
_AC9 = _AC9K
            
_TMP = _TMPK

POP_ETW_EVENT_ACTIVE_COOLING_OPERATIONAL

Event ID: 116  
Channel: 18 Microsoft-Windows-Kernel-Power/Thermal-Operational
Level: 4 win:Informational
Task: 81 ActiveCoolingOperational
Keyword: 0x10000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
EventTime
ActiveCoolingState
_AC0
_AC1
_AC2
_AC3
_AC4
_AC5
_AC6
_AC7
_AC8
_AC9
_TMP
 

Event 116 is known to the kernel in version 6.2 and higher, apparently having replaced event 84. It has a plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.
            
EventTime = EventTime
            
_AC0 = _AC0K
            
_AC1 = _AC1K
            
_AC2 = _AC2K
            
_AC3 = _AC3K
            
_AC4 = _AC4K
            
_AC5 = _AC5K
            
_AC6 = _AC6K
            
_AC7 = _AC7K
            
_AC8 = _AC8K
            
_AC9 = _AC9K
            
_TMP = _TMPK

POP_ETW_EVENT_HIBER_STATS

Event ID: 117    
Version: 0   6.2 to 6.3
1   10.0 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 33 PowerTransition  
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
 
Event Data: TotalResumeTime
POSTTime
ResumeBootMgrTime
ResumeAppTime
ResumeAppStartTime
ResumeLibraryInitTime
ResumeInitTime
ResumeHiberFileTime
ResumeRestoreImageStartTimestamp
ResumeIoTime
ResumeDecompressTime
ResumeMapTime
ResumeUnmapTime
ResumeUserInOutTime
ResumeAllocateTime
ResumeKernelSwitchTimestamp
KernelReturnFromHandlerTimestamp
SleeperThreadEndTimestamp
TimeStampCounterAtSwitchTime
KernelReturnSystemPowerStateTimestamp
HiberHiberFileTime
InitTime
HiberSharedBufferTime
TotalHibernateTime
KernelResumeHiberFileTime
KernelResumeInitTime
KernelResumeSharedBufferTime
DeviceResumeTime
KernelAnimationTime
KernelPagesProcessed
KernelPagesWritten
BootPagesProcessed
BootPagesWritten
HiberWriteRate
HiberCompressRate
ResumeReadRate
ResumeDecompressRate
FileRuns
NoMultiStageResumeReason
MaxHuffRatio
  6.2 and higher
SecurePagesProcessed
HiberChecksumTime
HiberChecksumIoTime
ResumeChecksumTime
ResumeChecksumIoTime
KernelChecksumTime
KernelChecksumIoTime
  10.0 and higher

Event 117 is known to the kernel in version 6.2 and higher, apparently having replaced event 108. Note the very many statistics that come with this event, with even more added for Windows 10.

POP_ETW_IDLE_RESILIENCY_START

Event ID: 118  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 107 IdleResiliencyStart
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: RequestedResolution
Flags
Ticks
 

Event 118 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Idle resiliency activiated with requested clock period: RequestedResolution(Internal flags:Flags, Ticks:Ticks).

POP_ETW_IDLE_RESILIENCY_END

Event ID: 119  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 108 IdleResiliencyEnd
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: RequestedResolution
Flags
Ticks
 

Event 119 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Idle resiliency deactivated (Internal flags:Flags).

POP_ETW_EVENT_PERFTRACK_HIBERNATE

Event ID: 120  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 33 PowerTransition
Keyword: 0x40010000`00000009 po:Scenario
po:Performance
win:ResponseTime
Event Data: HiberfileSizeKB
TotalHibernateTime
HiberHiberFileTime
 

Event 120 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_PERFTRACK_STANDBY

Event ID: 121  
Version: 1  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 33 PowerTransition
Keyword: 0x40010000`00000009 po:Scenario
po:Performance
win:ResponseTime
Event Data: DriverWakeTime
TotalResumeTime
BiosInitTime
ResumeAppsTime
ResumeServicesTime
 

Event 121 is known to the kernel in version 6.2 and higher. For the event as written by the Windows 8 kernel, the event version is already 1. Which kernel ever could write version 0 is not known.

POP_ETW_EVENT_PERFTRACE_RESUME_FROM_HIBERNATE

Event ID: 122  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 33 PowerTransition
Keyword: 0x40010000`00000009 po:Scenario
po:Performance
win:ResponseTime
Event Data: TotalResumeTime
PhasePagesWrittenMB
ResumeAppAndKernelResumeHiberFileTime
POSTAndDeviceResumeTime
RatesAndResumeAppsServicesTime
PhasePagesProcessedMB
 

Event 122 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_PERFTACK_HYBRID_SHUTDOWN

Event ID: 123  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 33 PowerTransition
Keyword: 0x40010000`00000009 po:Scenario
po:Performance
win:ResponseTime
Event Data: HiberfileSize
TotalHybridShutdownTime
HiberfileCreateTime
 

Event 123 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_PERFTRACK_HYBRID_RESUME

Event ID: 124  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 33 PowerTransition
Keyword: 0x40010000`00000009 po:Scenario
po:Performance
win:ResponseTime
Event Data: TotalResumeTime
PhasePagesWrittenMB
ResumeAppAndKernelResumeHiberFileTime
POSTAndDeviceResumeTime
RatesAndResumeAppsServicesTime
PhasePagesProcessedMB
 

Event 124 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_THERMAL_ZONE_ENUMERATED

Event ID: 125    
Version: 0   6.2 only
1   6.3 only
2   10.0 and higher
Channel: 8 System  
Level: 4 win:Informational  
Task: 86 ThernalZoneEnumerated  
Keyword: 0x80000000`00000020 po:Thermal  
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
_PSV
_TC1
_TC2
_TSP
_AC0
_AC1
_AC2
_AC3
_AC4
_AC5
_AC6
_AC7
_AC8
_AC9
_CRT
_HOT
  6.2 and higher
MinimumThrottle   6.3 and higher
_CR3
OverThrottleThreshold
  10.0 and higher

Event 125 is known to the kernel in version 6.2 and higher, apparently having replaced event 89. It nowadays has the plain-language description:

ACPI thermal zone ThermalZoneDeviceInstance has been enumerated.
            
_PSV = _PSVK
            
_TC1 = _TC1
            
_TC2 = _TC2
            
_TSP = _TSPms
            
_AC0 = _AC0K
            
_AC1 = _AC1K
            
_AC2 = _AC2K
            
_AC3 = _AC3K
            
_AC4 = _AC4K
            
_AC5 = _AC5K
            
_AC6 = _AC6K
            
_AC7 = _AC7K
            
_AC8 = _AC8K
            
_AC9 = _AC9K
            
_CRT = _CRTK
            
_HOT = _HOTK
            
minimum throttle = MinimumThrottle
            
_CR3 = _CR3K

The rendering for earlier versions of the event continues only as far as do the items of event data.

POP_ETW_EVENT_DEVICESSUSPENDLEVEL

Event ID: 126  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
Event Data: Level
MinorFunction
 

Event 126 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICESSUSPENDLEVEL_END

Event ID: 127  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Keyword: 0x40000000`0000000C  
Event Data: Level
MinorFunction
 

Event 127 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICESWAKELEVEL

Event ID: 128  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
Event Data: Level
MinorFunction
 

Event 128 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICESWAKELEVEL_END

Event ID: 129  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4  
Keyword: 0x40000000`0000000C po:Diagnostic
po:Performance
Event Data: Level
MinorFunction
 

Event 129 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_S3FWSTATS_SUSPEND

Event ID: 130  
Channel: 8 System
Level: 4 win:Informational
Task: 33  
Keyword: 0x80000000`00000004 po:Diagnostic
Event Data: SuspendStart
SuspendEnd
 

Event 130 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Firmware S3 times. SuspendStart: SuspendStart, SuspendEnd: SuspendEnd

POP_ETW_EVENT_S3FWSTATS_RESUME

Event ID: 131  
Channel: 8 System
Level: 4 win:Informational
Task: 33 PowerTransition
Keyword: 0x80000000`00000004 po:Diagnostic
Event Data: ResumeCount
FullResume
AverageResume
 

Event 131 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Firmware S3 times. ResumeCount: ResumeCount, FullResume: FullResume, AverageResume: AverageResume

POP_ETW_EVENT_PLATFORMROLE_RUNDOWN

Event ID: 132  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 150 FirmwarePlatformRoleRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: PlatformRole  

Event 132 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_RESUMEAPPS_END

Event ID: 133  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34  
Task: 44 ResumeApps
Keyword: 0x40000000`00000008 po:Performance

Event 133 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_RESUMESERVCIES_END

Event ID: 134  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 34  
Task: 43 ResumeServices
Keyword: 0x40000000`00000008 po:Performance

Event 134 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_CONSOLE_DISPLAY_STATE

Event ID: 135    
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Keyword: 0x40000000`00000004 po:Diagnostic 6.2 to 6.3
0x40002000`00000004 po:Diagnostic
ms:Telemetry
10 and higher
Event Data: DisplayState    

Event 135 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_RUNDOWN

Event ID: 136  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 151 DeviceRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: DeviceNode
PowerState
InstancePathLength
InstancePath
FriendlyNameLength
FriendlyName
 

Event 136 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_MTRR_CHANGED

Event ID: 137  
Channel: 8 System
Level: 2 win:Error
Keyword: 0x80000000`00000004 po:Diagnostic
Event Data: SleepState  

Event 137 is known to the kernel in version 6.2 and higher. It has a plain-language description:

The system firmware has changed the processor's memory type range registers (MTRRs) across a sleep state transition (SSleepState). This can result in reduced resume performance.

POP_ETW_EVENT_THERMAL_PERFTRACK

Event ID: 138  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 154 ThermalPerfTrack
Keyword: 0x40010000`00000000 win:ResponseTime
Event Data: Throttle
Temperature
ZoneLength
Zone
 

Event 138 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_THERMAL_DURATION_PERFTRACK

Event ID: 139  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 155 ThermalDurationPerfTrack
Keyword: 0x40010000`00000000 win:ResponseTime
Event Data: ThrottleDuration
ZoneLength
Zone
 

Event 139 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_CS_CONSUMPTION_PERFTRACK

Event ID: 140  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 156 CsConsumptionPerfTrack
Keyword: 0x40010000`00000000 win:ResponseTime
Event Data: EnergyDrain
Duration
DripsTransitions
Flags
 

Event 140 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_CS_FAN_PERFTRACK

Event ID: 141  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 172 CsFanPerfTrack
Keyword: 0x40010000`00000000 win:ResponseTime
Event Data: FanDuration
ActivationDelay
 

Event 141 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_ABNORMAL_RESET

Event ID: 142    
Channel: 8 System  
Level: 1 win:Critical  
Task: 173 AbnormalReset  
Keyword: 0x80000000`00000002 po:Simple 6.3 only
0x80002000`00000002 po:Simple
ms:Telemetry
10.0 and higher
Event Data: ResetReasonMask    

Event 142 is known to the kernel in version 6.3 and higher. It has a plain-language description:

The system has rebooted without cleanly shutting down first. This error is caused because the system stopped responding and the hardware watchdog tiggered a system reset.

POP_ETW_EVENT_CS_DRIPS_WATCHDOG_PERFTRACK

Event ID: 143  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 174 CsDripWatchdogPerfTrack
Keyword: 0x40010000`00000000 win:ResponseTime
Event Data: ResiliencyPhaseNonActivatedNoDripsMs
NonActivatedCpuTimeMs
DurationThisPeriodMs
ActionsTakenAndOnAc
 

Event 143 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_THERMAL_EVENT

Event ID: 144  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 175 ThermalEvent
Keyword: 0x20000000`00000020 po:Thermal
Event Data: InitiatorLength
Initiator
Type
Temperature
TripPointTemperature
 

Event 144 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_THERMAL_ZONE_RUNDOWN

Event ID: 145    
Version: 0   6.3 and higher
1   10.0 and higher
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic  
Level: 4 win:Informational  
Task: 176 ThermalZoneRundown  
Keyword: 0x20000000`00000020 po:Thermal  
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
ActiveCoolingState
ActivePoint
PassiveCoolingState
ThrottleLimit
  6.3 and higher
ThermalStandby
OverThrottled
  10.0 and higher

Event 145 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_POWER_SETTING_CALLBACK_START

Event ID: 146  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 1 win:Start
Task: 177 PowerSettingCallback
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Callback
SettingGuid
DataSize
Data
 

Event 146 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_POWER_SETTING_CALLBACK_STOP

Event ID: 147  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Opcode: 2 win:Stop
Task: 177 PowerSettingCallback
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Callback
SettingGuid
 

Event 147 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_ENERGY_SAVER_STATE

Event ID: 148  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 178 EnergySaverState
Keyword: 0x40000000`00000009 po:Scenario
po:Performance
Event Data: State
Reason
 

Event 148 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_SESSION_DISPLAY_OFF

Event ID: 149  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 185 SessionDisplayOff
Keyword: 0x40002000`00000004 po:Diagnostic
ms:Telemetry
Event Data: Session
Console
Reason
 

Event 149 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_SESSION_DISPLAY_ON

Event ID: 150  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 186 SessionDisplayOn
Keyword: 0x40002000`00000004 po:Diagnostic
ms:Telemetry
Event Data: Session
Console
Reason
 

Event 150 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COOLING_EXTENSION_ADD

Event ID: 151  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 187 CoolingExtensionAdd
Keyword: 0x20000000`00000020 po:Thermal
Event Data: PassiveSupported
ActiveSupported
Throttle
ActiveEngaged
Token
DeviceIdLength
DeviceId
 

Event 151 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COOLING_EXTENSION_RUNDOWN

Event ID: 152  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 188 CoolingExtensionRundown
Keyword: 0x20000000`00000020 po:Thermal
Event Data: PassiveSupported
ActiveSupported
Throttle
ActiveEngaged
Token
DeviceIdLength
DeviceId
 

Event 152 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COOLING_EXTENSION_REMOVE

Event ID: 153  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 189 CoolingExtensionRemove
Keyword: 0x20000000`00000020 po:Thermal
Event Data: PassiveSupported
ActiveSupported
Throttle
ActiveEngaged
Token
DeviceIdLength
DeviceId
 

Event 153 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COOLING_EXTENSION_PASSIVE_UPDATE

Event ID: 154  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 190 CoolingExtensionPassiveUpdate
Keyword: 0x20000000`00000020 po:Thermal
Event Data: Throttle
Token
 

Event 154 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COOLING_EXTENSION_ACTIVE_UPDATE

Event ID: 155  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 191 CoolingExtensionActiveUpdate
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ActiveEngaged
Token
 

Event 155 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_THERMAL_REQUEST_ADD

Event ID: 156  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 192 ThermalRequestAdd
Keyword: 0x20000000`00000020 po:Thermal
Event Data: Throttle
ActiveEngaged
Token
DeviceIdLength
CallerLength
ContextLength
PolicyLength
DeviceId
Caller
Context
Policy
 

Event 156 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_THERMAL_REQUEST_RUNDOWN

Event ID: 157  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 193 ThermalRequestRundown
Keyword: 0x20000000`00000020 po:Thermal
Event Data: Throttle
ActiveEngaged
Token
DeviceIdLength
CallerLength
ContextLength
PolicyLength
DeviceId
Caller
Context
Policy
 

Event 157 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_THERMAL_REQUEST_REMOVE

Event ID: 158  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 194 ThermalRequestRemove
Keyword: 0x20000000`00000020 po:Thermal
Event Data: Throttle
ActiveEngaged
Token
DeviceIdLength
CallerLength
ContextLength
PolicyLength
DeviceId
Caller
Context
Policy
 

Event 158 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_THERMAL_REQUEST_PASSIVE_UPDATE

Event ID: 159  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 195 ThermalRequestPassiveUpdate
Keyword: 0x20000000`00000020 po:Thermal
Event Data: Throttle
Token
 

Event 159 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_THERMAL_REQUEST_ACTIVE_UPDATE

Event ID: 160  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 196 ThermalRequestActiveUpdate
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ActiveEngaged
Token
 

Event 160 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_CS_DRIPS_WATCHDOG

Event ID: 161  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 197 CsDripsWatchdog
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: ResiliencyPhaseNonActivatedNoDripsMs
NonActivatedCpuTimeMs
DurationThisPeriodMs
OnAc
EnergyDrainMw
DeviceConstraint
ActionsTaken
DeviceServiceNameLength
DeviceServiceName
ChildServiceNameLength
ChildServiceName
 

Event 161 is known to the kernel in version 10.0 and higher.

OP_ETW_EVENT_THERMAL_ZONE_THERMAL_STANDBY_UPDATE

Event ID: 162  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 198 ThermalZoneThermalStandbyUpdate
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
Engaged
 

Event 162 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_THERMAL_ZONE_OVERTHROTTLED_UPDATE

Event ID: 163  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 199 ThermalZoneOverthrottledUpdate
Keyword: 0x20000000`00000020 po:Thermal
Event Data: ThermalZoneDeviceInstanceLength
ThermalZoneDeviceInstance
Engaged
 

Event 163 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_THERMAL_STANDBY_NOTIFICATION

Event ID: 164  
Channel: 17 Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Level: 4 win:Informational
Task: 200 ThermalStandbyNotification
Keyword: 0x20000000`00000020 po:Thermal

Event 164 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_SYSTEM_IDLE_TIMEOUT_INITIALIZED

Event ID: 165  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 201 SystemIdle
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: IdleInformationUpdated
TimeoutSource
Action
MinState
Timeout
Flags
 

Event 165 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_SYSTEM_IDLE_UPDATE

Event ID: 166  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 201 SystemIdle
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: AccumulatedIdleTime
SystemIdle
Flags
Action
MinState
DozeS4Timeout
 

Event 166 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_SYSTEM_IDLE_TIME_RESET

Event ID: 167  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 201 SystemIdle
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Reason
S0LowPowerDozeTimerCancelled
 

Event 167 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_SYSTEM_IDLE_S0_LOW_POWER_DOZE

Event ID: 168  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 201 SystemIdle
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: CancelledDueToUserInput  

Event 168 is known to the kernel in version 10.0 and higher.

SQM Series

Version 6.1 started numbering events at 200, apparently all to support what Microsoft has variously termed Software Quality Monitoring, Software Quality Metrics and Software Quality Management, all as part of a more or less (but mostly less) voluntary Customer Experience Improvement Program. There is surely some merit to an argument that the computer-using world cannot reasonably complain these days about telemetry in Windows 10, given that it did so little to understand what Microsoft was doing with telemetry in the early days.

The compiled event templates for Windows 7 and higher define events 200 through 208 inclusive, but only two are known to be written by the kernel in any version.

PopSqm_Increment_Dword

Event ID: 203  
Level: 4  
Opcode: 2 win:Stop
Keyword: 0x00080000`00000000 win:SQM
Event Data: SqmType
SqmSessionGuid
SqmID
SqmDWORDDatapointValue
 

Event 203 is known to the kernel in version 6.3 only.

PopSqm_Add_StreamRow

Event ID: 208  
Level: 4  
Keyword: 0x00080000`00000000 win:SQM
Event Data: SqmType
SqmSessionGuid
SqmID
SqmStreamRowLength
SqmStreamRow
SqmTypeEntry
SqmDWORDEntry
SqmStringEntry
 

Event 208 is known to the kernel in version 6.1 and higher.

The 300 Series

Version 6.0 started a series of Microsoft-Windows-Kernel-Power events that is notable because none are directed to any channel that is defined in the registry as if set up already for use in the Event Viewer. To see these events you must enable them to a custom event tracing session such as the Performance Monitor starts as a Data Collector Set.

This series also grows, reaching to:

Every one of the events in this series has event data. None yet have plain-language descriptions.

POP_ETW_EVENT_PLUGIN_REGISTRATION

Event ID: 300  
Level: 4 win:Informational
Task: 132 PluginRegistration
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Plugin
Attributes
 

Event 300 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_PLUGIN_REGISTRATION_RUNDOWN

Event ID: 301  
Level: 4 win:Informational
Task: 133 PluginRegistrationRundown
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Plugin
Attributes
 

Event 301 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_PREPARATION

Event ID: 302  
Level: 4 win:Informational
Task: 134 DevicePreparation
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Plugin
IdLength
Id
Prepared
 

Event 302 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_REGISTRATION

Event ID: 303    
Version: 0   6.2 only
1   6.3 and higher
Level: 4 win:Informational  
Task: 135 DeviceRegistration  
Keyword: 0x00000000`00000100 po:RuntimeFx  
Event Data: Token
Plugin
PowerState
Status
IdLength
Id
ComponentCount
  6.2 and higher
VetoMasks   6.3 and higher

Event 303 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_REGISTRATION_RUNDOWN

Event ID: 304    
Version: 0   6.2 only
1   6.3 and higher
Level: 4 win:Informational  
Task: 136 DeviceRegistrationRundown  
Keyword: 0x00000000`00000100 po:RuntimeFx  
Event Data: Token
Plugin
PowerState
Status
IdLength
Id
ComponentCount
  6.2 and higher
VetoMasks   6.3 and higher

Event 304 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_UNREGISTRATION

Event ID: 305  
Level: 4 win:Informational
Task: 137 DeviceUnregistration
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token  

Event 305 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_START_POWER_MANAGEMENT

Event ID: 306  
Level: 4 win:Informational
Task: 138 StartDevicePowerManagement
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token  

Event 306 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_POWER_REQUIREMENT_TO_DEVICE

Event ID: 307  
Level: 4 win:Informational
Task: 139 DevicePowerRequirementToDevice
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
PowerRequired
 

Event 307 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_POWER_STATE

Event ID: 308  
Level: 4 win:Informational
Task: 140 DevicePowerState
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
PowerState
 

Event 308 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_POWERED

Event ID: 309  
Level: 4 win:Informational
Task: 141 DevicePowered
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token  

Event 309 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_COMPONENT_REGISTRATION

Event ID: 310    
Version: 0   6.2 only
1   6.3 and higher
Level: 4 win:Informational  
Task: 142 ComponentRegistration  
Keyword: 0x00000000`00000100 po:RuntimeFx  
Event Data: Token
Component
Active
IdleState
IdleStateCount
IdleStates
Latency
Residency
NominalPower
  6.2 and higher
VetoMask   6.3 and higher

Event 310 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_COMPONENT_REGISTRATION_RUNDOWN

Event ID: 311    
Version: 0   6.2 only
1   6.3 and higher
Level: 4 win:Informational  
Task: 143 ComponentRegistrationRundown  
Keyword: 0x00000000`00000100 po:RuntimeFx  
Event Data: Token
Component
Active
IdleState
IdleStateCount
IdleStates
Latency
Residency
NominalPower
  6.2 and higher
VetoMask   6.3 and higher

Event 311 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_COMPONENT_CONDITION

Event ID: 312  
Level: 4 win:Informational
Task: 144 ComponentCondition
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
Active
 

Event 312 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_COMPONENT_IDLE_STATE

Event ID: 313  
Level: 4 win:Informational
Task: 145 ComponentIdleState
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
IdleState
 

Event 313 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_COMPONENT_LATENCY

Event ID: 314  
Level: 4 win:Informational
Task: 146 ComponentLatency
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
Latency
 

Event 314 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_COMPONENT_RESIDENCY

Event ID: 315  
Level: 4 win:Informational
Task: 147 ComponentResidency
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
Residency
 

Event 315 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_COMPONENT_WAKE

Event ID: 316  
Level: 4 win:Informational
Task: 148 ComponentWake
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
ArmedForWake
 

Event 316 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_POWER_REQUIREMENT_FROM_PEP

Event ID: 317  
Level: 4 win:Informational
Task: 149 DevicePowerRequirementFromPep
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
PowerRequired
 

Event 317 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_DEVICE_IDLE_CONSTRAINTS

Event ID: 318  
Level: 4 win:Informational
Task: 168 DeviceIdleConstraints
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
StateCount
MinimumDStates
 

Event 318 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_COMPONENT_IDLE_CONSTRAINTS

Event ID: 319  
Level: 4 win:Informational
Task: 169 ComponentIdleConstraints
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
StateCount
MinimumFStates
 

Event 319 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_DEVICE_VERBOSE_RUNDOWN

Event ID: 320    
Version: 0   6.3 only
1   10.0 and higher
Level: 4 win:Informational  
Task: 170 DeviceVerboseRundown  
Keyword: 0x00000000`00000200 po:SleepStudy  
Event Data: DeviceNode
DeviceIdLength
DeviceId
InstancePathLength
InstancePath
ServiceNameLength
ServiceName
PlatformStateDependents
  6.3 and higher
Pdo
ParentDeviceNode
  10.0 and higher

Event 320 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_PERFORMANCE_STATE_REGISTRATION

Event ID: 321  
Level: 4 win:Informational
Task: 179 PerformanceStateRegistration
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
SetCount
 

Event 321 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_PERFORMANCE_STATE_REGISTRATION_RUNDOWN

Event ID: 322  
Level: 4 win:Informational
Task: 180 PerformanceStateRegistrationRundown
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
SetCount
 

Event 322 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_PERFORMANCE_STATE_SET_REGISTRATION

Event ID: 323  
Level: 4 win:Informational
Task: 181 PerformanceStateSetRegistration
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
Set
NameLength
Name
Type
Unit
Minimum
Maximum
StateCount
StateValues
CurrentState
 

Event 323 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_PERFORMANCE_STATE_SET_REGISTRATION_RUNDOWN

Event ID: 324  
Level: 4 win:Informational
Task: 182 PerformanceStateSetRegistrationRundown
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
Set
NameLength
Name
Type
Unit
Minimum
Maximum
StateCount
StateValues
CurrentState
 

Event 324 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COMPONENT_PERFORMANCE_STATE_INITIATING

Event ID: 325  
Level: 4 win:Informational
Task: 183 ComponentPerformanceState
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
PerformanceStateSetCount
PerformanceStateSets
Set
Reserved
RequestedState
 

Event 325 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COMPONENT_PERFORMANCE_STATE_PROCESSING

Event ID: 326  
Level: 4 win:Informational
Task: 183 ComponentPerformanceState
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
Progress
 

Event 326 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COMPONENT_PERFORMANCE_STATE_COMPLETED

Event ID: 327  
Level: 4 win:Informational
Task: 183 ComponentPerformanceState
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
Succeeded
 

Event 327 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_COMPONENT_PERFORMANCE_STATE_NOMINAL_CHANGE

Event ID: 328  
Level: 4 win:Informational
Task: 183 ComponentPerformanceState
Keyword: 0x00000000`00000100 po:RuntimeFx
Event Data: Token
Component
DeviceTransition
PowerState
PerformanceStateSetCount
PerformanceStateSets
Set
Reserved
NewState
 

Event 328 is known to the kernel in version 10.0 and higher.

POP_ETW_EVENT_DEBUGGER_TRANSITION_REQUIREMENTS

Event ID: 329  
Level: 4 win:Informational
Task: 184 DebuggerTransitionRequirements
Keyword: 0x00000000`00000100  
Event Data: Token
StateCount
TransitionRequired
 

Event 329 is known to the kernel in version 10.0 and higher.

The Adaptive Display Series

Events numbered from 400 also are new for Windows 8. Unlike all but a handful of other events that are directed to the Diagnostic channel, these all have plain-language descriptions. 

Later versions have not extended this series.

POP_ETW_ADPM_SESSION_CREATED

Event ID: 400  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 109 SessionCreated
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
Console
 

Event 400 is known to the kernel in version 6.2 and higher. It has a plain-language description:

SessionId: SessionId, Console:Console

POP_ETW_ADPM_SESSION_CLOSED

Event ID: 401  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 110 SessionClosed
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
Console
 

Event 401 is known to the kernel in version 6.2 and higher. It has a plain-language description:

SessionId: SessionId, Console:Console

POP_ETW_ADPM_SESSION_CONNECTED

Event ID: 402  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 111 SessionConnected
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
Console
 

Event 402 is known to the kernel in version 6.2 and higher. It has a plain-language description:

SessionId: SessionId, Console:Console

POP_ETW_ADPM_SESSION_DISCONNECTED

Event ID: 403  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 112 SessionDisconnected
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
Console
 

Event 403 is known to the kernel in version 6.2 and higher. It has a plain-language description:

SessionId: SessionId, Console:Console

POP_ETW_ADPM_ACTIVE_INPUT

Event ID: 404  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 113 ActiveInput
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
Console
 

Event 404 is known to the kernel in version 6.2 and higher. It has a plain-language description:

SessionId: SessionId, Console:Console

POP_ETW_ADPM_PASSIVE_INPUT

Event ID: 405  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 114 PassiveInput
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
Console
 

Event 405 is known to the kernel in version 6.2 and higher. It has a plain-language description:

SessionId: SessionId, Console:Console

POP_ETW_ADPM_SESSION_LOCKED

Event ID: 406  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 115 SessionLocked
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
Console
 

Event 406 is known to the kernel in version 6.2 and higher. It has a plain-language description:

SessionId: SessionId, Console:Console

POP_ETW_ADPM_SESSION_UNLOCKED

Event ID: 407  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 116 SessionUnlocked
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
Console
 

Event 407 is known to the kernel in version 6.2 and higher. It has a plain-language description:

SessionId: SessionId, Console:Console

Though event 408 is defined in the compiled event templates for Windows 8 and higher, it is not known to the kernel in any version yet studied.

POP_ETW_ADPM_SENSOR_INVALID

Event ID: 409  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 118 SensorInvalid
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Code  

Event 409 is known to the kernel in version 6.2 only. It has a plain-language description:

Reason code:Code

Though events 410 and 411 are defined in the compiled event templates for Windows 8 and higher, they are not known to the kernel in any version yet studied.

POP_ETW_ADPM_SESSION_DISPLAY_STATE

Event ID: 412  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 121 DisplaySessionStatus
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
State
 

Event 412 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Session Id:SessionId, Value: State

POP_ETW_ADPM_SESSION_INPUT_STATE

Event ID: 413  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 122 UserSessionStatus
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
State
 

Event 413 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Session Id:SessionId, Value: State

POP_ETW_ADPM_GLOBAL_INPUT_STATE

Event ID: 414  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 123 UserGlobalStatus
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SessionId
State
 

Event 414 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Session Id:SessionId, Value: State

POP_ETW_ADPM_SENSOR_INPUT_CHANGED

Event ID: 415  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 124 SensorInputChanged
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Old
New
 

Event 415 is known to the kernel in version 6.2 only. It has a plain-language description:

Old value:Old, New value: New

POP_ETW_ADPM_INPUT_TIMEOUT

Event ID: 416  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 125 InputState
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Value
Zeroed
Computed
 

Event 416 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Value:Value, Zeroed: Zeroed, Computed: Computed

POP_ETW_ADPM_DISPLAY_TIMEOUT

Event ID: 417  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 126 DisplayState
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Value
Zeroed
Computed
 

Event 417 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Value:Value, Zeroed: Zeroed, Computed: Computed

POP_ETW_ADPM_POLICY_CHANGE

Event ID: 418  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 127 PolicyChange
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SensorDisplayTimeout
DisplayTimeout
SensorInputTimeout
InputTimeout
SessionLockedTimeout
SensorEnabled
 

Event 418 is known to the kernel in version 6.2 and higher. It has a plain-language description:

Value:SensorDisplayTimeout, Zeroed: DisplayTimeout, Computed: SensorInputTimeout

This surely is mismatched. More investigation is required.

The 500 Series

Yet another series begins at 500. It is not yet clear what organising principle assigns events to this series, which was extended from 507 to 517 in version 6.3.

POP_ETW_IO_COALESCING_ON

Event ID: 500  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 128 IoCoalescingOn
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SpindownTimeout
TimerInterval
FlushInterval
Flags
 

Event 500 is known to the kernel in version 6.2 and higher. It has a plain-language description:

IO coalescing activated with spindown period: SpindownTimeout, Timer:TimerInterval, Flush:FlushInterval, Flags:Flags.

POP_ETW_IO_COALESCING_OFF

Event ID: 501  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 129 IoCoalescingOff
Keyword: 0x40000000`00000004 po:Diagnostic

Event 501 is known to the kernel in version 6.2 and higher. It has a plain-language description:

IO coalescing deactivated.

POP_ETW_IO_COALESCING_FLUSH

Event ID: 502  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 130 IoCoalescingFlush
Keyword: 0x40000000`00000004 po:Diagnostic

Event 502 is known to the kernel in version 6.2 and higher. It has a plain-language description:

IO coalescing flush command generated.

POP_ETW_IO_COALESCING_DSK_IDLE

Event ID: 503  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 131 IoCoalescingDiskIdle
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: DiskDeviceObject  

Event 503 is known to the kernel in version 6.2 and higher. It has a plain-language description:

IO coalescing disk device DiskDeviceObject is about to be spun down.

POP_ETW_EVENT_SYSTEM_LATENCY_UPDATE

Event ID: 504  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 152 SystemLatencyUpdate
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SystemLatency  

Event 504 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_SYSTEM_LATENCY_RUNDOWN

Event ID: 505  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 153 SystemLatencyRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SystemLatency  

Event 505 is known to the kernel in version 6.2 and higher.

POP_ETW_EVENT_CS_ENTER_REASON

Event ID: 506    
Channel: 8 System  
Level: 4 win:Informational  
Task: 157 CsEnterReason  
Keyword: 0x80000000`00000004 po:Diagnostic 6.2 to 6.3
0x80002000`00000004 po:Diagnostic
ms:Telemetry
10.0 and higher
Event Data: Reason    

Event 506 is known to the kernel in version 6.2 and higher. It has a plain-language description:

The system is entering connected standby 

Reason: Reason.

POP_ETW_EVENT_CS_EXIT_REASON

Event ID: 507    
Version: 0   6.2 only
1   6.3 only
3   10.0 and higher
Channel: 8 System  
Level: 4 win:Informational  
Task: 158 CsExitReason  
Keyword: 0x80000000`00000004 po:Diagnostic 6.2 to 6.3
0x80002000`00000204 po:Diagnostic
po:SleepStudy
ms:Telemetry
10.0 and higher
Event Data: EnergyDrain
ActiveResidencyInUs
NonDripsTimeActivatedInUs
FirstDripsEntryInUs
DripsResidencyInUs
DurationInUs
DripsTransitions
FullChargeCapacityRatio
AudioPlaying
Reason
  6.2 and higher
AudioPlaybackInUs
NonActivatedCpuInUs
PowerStateAc
HwDripsResidencyInUs
  6.3 and higher
ExitLatencyInUs
DisconnectedStandby
AoAcCompliantNic
  10.0 and higher

Event 507 is known to the kernel in version 6.2 and higher. It has a plain-language description that is specially remarkable for how little it presents of the event data:

The system is exiting connected standby 

Reason: Reason.

A version 2 of this event is defined by the compiled event manifest for Windows 10, with event data stopping at ExitLatencyInUs, but it is not written by any version of the kernel yet studied.

POP_ETW_EVENT_DYNAMIC_TICK_DISABLED

Event ID: 508  
Channel: 8 System
Level: 4 win:Informational
Task: 159 DynamicTickDisabled
Keyword: 0x80000000`00000004 po:Diagnostic
Event Data: Reason  

Event 508 is known to the kernel in version 6.3 and higher. It has a plain-language description:

The system has been constrained to a periodic tick 

Reason: Reason.

POP_ETW_EVENT_DYNAMIC_TICK_STATUS_RUNDOWN

Event ID: 509  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 160 DynamicTickStatusRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: Flags  

Event 509 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_SPM_POLICY_STATUS_UPDATE

Event ID: 510  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 161 SpmStatusUpdate
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SpmStatus  

Event 510 is known to the kernel in version 6.3 only. It has a plain-language description:

Scenario Power Manager (SPM) policy framework has current status: SpmStatus.

POP_ETW_EVENT_SPM_POLICY_STATUS_RUNDOWN

Event ID: 511  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 162 SpmStatusRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: SpmStatus  

Event 511 is known to the kernel in version 6.3 only.

POP_ETW_EVENT_SPM_POLICY_ALIAS_RUNDOWN

Event ID: 512  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 163 SpmPolicyAliasRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: PolicyGuid
PolicyAliasLength
PolicyAlias
 

Event 512 is known to the kernel in version 6.3 only.

POP_ETW_EVENT_SPM_SCENARIO_POLICY_RUNDOWN

Event ID: 513  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 164 SpmScenarioPolicyRundown
Keyword: 0x40000000`00000004 po:Diagnostic
Event Data: ScenarioGuid
ScenarioNameLength
ScenarioName
Flags
DefaultSettingsScenarioGuid
PolicyCount
PolicySettings
PolicyGuid
Flags
PolicyValue
 

Event 513 is known to the kernel in version 6.3 only.

POP_ETW_EVENT_COMPONENT_ACCOUNTING

Event ID: 514  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 165 ComponentAccounting
Keyword: 0x40000000`00000200 po:SleepStudy
Event Data: ScenarioInstanceId
DeviceNode
Component
ActiveTime
 

Event 514 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_SPM_SCENARIO_START

Event ID: 515  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 166 SpmScenarioStart
Keyword: 0x40000000`00000200 po:SleepStudy
Microsoft-Windows-Kernel-Power/Diagnostic
Event Data: ScenarioGuid
ScenarioInstanceId
 

Event 515 is known to the kernel in version 6.3 and higher.

POP_ETW_EVENT_SPM_SCENARIO_STOP

Event ID: 516    
Version: 0   6.3 only
3   10.0 and higher
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic  
Level: 4 win:Informational  
Task: 167 SpmScenarioStop  
Keyword: 0x40000000`00000200 po:SleepStudy  
Event Data: EnergyDrain
DripsResidencyInUs
OnAc
HwDripsResidencyInUs
PreVetoCount
VetoCount
DurationInUs
FullChargeCapacity
NonActivatedCpuInUs
IRTruncatePercentage
DesignCapacity
  6.3 and higher
AudioDurationInUs
Reason
DisconnectedStandby
AoAcCompliantNic
   

Event 516 is known to the kernel in version 6.3 and higher.

Versions 1 and 2 of this event are defined by the compiled event manifest for Windows 10, but are not written by any version of the kernel yet studied.

POP_ETW_EVENT_DEVICE_ACCOUNTING

Event ID: 517  
Channel: 16 Microsoft-Windows-Kernel-Power/Diagnostic
Level: 4 win:Informational
Task: 171 DeviceAccounting
Keyword: 0x40000000`00000200 po:SleepStudy
Event Data: ScenarioInstanceId
DeviceNode
ActiveTime
 

Event 517 is known to the kernel in version 6.3 and higher.