shutdown and boot monitoring performance together in even viewer

[ray smith]

hi all,

i happened to notice that whenever start my computer and check my boot performance in

event viewer->Application and Services log->Microsoft->Windows->Diagnostics Performance->Operational,

there are two events that are logged. First is Boot Performance Monitoring (Event 100) and below it at is Shutdown Monitoring Performance (Event 200). Whenever i start my comp. these two events are logged together at the same time.

why shutdown performance monitoring is logged when i start the comp? is it normal for both the events (100, 200) to occur together? shouldn't the shutdown performance event be logged when i shut down my comp?

kindly help,
regards,

 

[F5ing]

Yeah, I think I remember noticing that before. But if you look at the incident time contained within the event it should correspond to the correct time. I guess what it does is, on the way down it stores the value somewhere, then actually retrieves that stored value and writes the event after it's up and running again.

On top of that, the startup event time doesn't match actual startup time either, but the incident time does.

Just a guess...

 

[ray smith]

so u mean its actually the reference of the previous shutdown, but displaying it on the next start up, right?

 

[F5ing]

That's what I'm guessing. Even the startup entry occurs much later than the actual startup time. It can't post the events until the event monitoring service gets up and running.

So the actual event time simply indicates the time the event was posted in the log rather than the time the event actually occured. To find when it actually happened you have to check the incident time.