View Windows Boot Data Collected by Aternity

Aternity monitors several parallel boot times for Windows devices, some from the Windows Event Log (ID 100), while others are Aternity's proprietary calculations. Event ID 100 lists the main path boot duration, the post boot duration and their sum: the total boot time.

Note

The Event Log does not log all boots. For example, boots from virtual consoles are not logged.

Therefore, Aternity's proprietary boot measurements are more robust, as they log the boot times regardless of speed or virtual consoles. They include the machine boot time and the user logon time.

Your can view these measurements in the Troubleshoot Boot dashboard.

Aternity does not collect boot times of virtual desktops (VDIs).

Various boot times on Windows devices
Field Description Source
Degraded Boot Components

The list of degraded boot components is a collection of processes launched during boot (drivers, applications, optimizations) which took more than five seconds to load.

For example, Event ID 100 shows if a Windows built-in application or service caused a slowdown; event 101 reveals if an application caused the slowdown; event ID 102 details any drivers causing a delay; event 106 means that background optimization took longer than usual, and so on.

Aternity collects this information from the Windows Event Log (event IDs 100-199) in the Application and Services Logs > Microsoft > Windows > Diagnostics-Performance > Boot Performance Monitoring section.

Machine Boot

Machine boot is part of a device's boot time, starting a fraction of a second after the Windows logo appears, and ending with the Windows sign in screen.

The Windows Event Log does not list every single boot (for example boots from virtual console sessions or boots which complete very quickly), hence the need to track boot times in a more robust way.

Agent queries Windows Kernel-PnP (NOT the Event Log) for the BootStart > Start event to mark the start of this time, and ends when the Windows sign in screen appears (or the automatic sign in process starts).

User Logon

User logon measures a part of the boot time, starting when you press OK at the Windows sign in screen and ending when the Windows desktop Start button appears.

The Windows Event Log does not list every single boot (for example boots from virtual console sessions or boots which complete very quickly), hence the need to track boot times in a more robust way.

The Agent queries Windows Shell-Core (NOT the Event Log) for the Explorer_StartMenu_Ready event to mark the end of this time.

Main Path Boot Duration

The main path boot duration is the time elapsed from the appearance of the animated Windows logo until the appearance of the desktop.

Agent queries Windows Event Log in the Diagnostics > Performance > Windows section, ID 100 for the MainPathBootTime parameter.

Post Boot Duration

The post boot duration is the time elapsed from the appearance of the desktop until the CPU reaches 80% idle for 10 consecutive seconds.

The Agent queries Windows Event ID 100, located in the Diagnostics > Performance > Windows section of the log, and reports the measurement stored as BootPostBootTime.

Total Boot

The total boot time on a Windows device starts from the time the Windows logo appears until the desktop appears and all components are loaded.

Agent queries Windows Event Log (ID 100) for the BootTime parameter, calculated as the sum of main path boot and post boot times, located in the Diagnostics > Performance > Windows section of the log.

The Boot Time, the MainPathBootTime, and the BootPostBootTime are Microsoft measurements, derived from the Windows Event logs.

Finding MainPathBootTime and BootPostBootTime in the Windows Event Viewer