• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1111
  • Last Modified:

DCStart and DCEnd in trace performance monitor

Does anybody know what this word mean (DCStart and DCEnd)?  I use trace logs in performance monitor (Windows XP).  When I create trace, I check "Process creations/deletions".  When the trace is started, it get all event about process creation in Windows.  This produce a .etl file.  When I convert this etl file in csv file, I see every process started on the computer where trace as been activated.  In the trace, I see a lot of starting type method, both of them are DCStart and DCEnd.   Does anybody know what DC mean ?
Thank you.

This is an exemple of log in the file...
     Process          DCStart       0x02F8      1.28577E+17      2008-06-11 18:05      1190      700       0x00014A71      756      668      0      0       "\\NT AUTHORITY\SYSTEM"       "winlogon.exe"
     Process          DCStart       0x0338      1.28577E+17      2008-06-11 18:05      0      0       0x00015673      800      756      0      0       "\\NT AUTHORITY\SYSTEM"       "services.exe"
0
swatuser
Asked:
swatuser
  • 2
1 Solution
 
squillmanCommented:
DCStart is the event that lists running processes at the start of a kernel session.  DCEnd is the event that lists them at the end of the kernel session.
0
 
swatuserAuthor Commented:
Thanks for your post, can you just say to me what is a "Kernel session" ?  When it finish ?  If I start a trace logs in moment x, all running process will be logged as "DCStart" ? (In other word, all new process will be logged as "Start" ?)  This part is not clear for me.  Thanks for your help.
0
 
squillmanCommented:
Sorry, I should have said kernel logging session.  There will be a process with DCStart for each process running at the time the logging session starts and one with DCEnd for each process that was running at the time the logging session ends.  And yes, for a process that starts during your logging session you'll see a Process entry with a Type of Start.  If a process ends during your logging session you'll get an entry with Type of End.

This is also true for threads.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now