該ETW提供商"Microsoft-Windows-Kernel-Memory"
有一個關鍵字"KERNEL_MEM_KEYWORD_WS_SWAP"
("0x80"
)。這裏有當數據被調出所發生的某些事件/分頁中:
<event value="4" symbol="WorkingSetOutSwapStart" version="0" task="WorkingSetOutSwap" opcode="win:Start" level="win:Informational" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" template="WorkingSetOutSwapStartArgs"/>
<event value="4" symbol="WorkingSetOutSwapStart_V1" version="1" task="WorkingSetOutSwap" opcode="win:Start" level="win:Informational" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" template="WorkingSetOutSwapStartArgs_V1"/>
<event value="5" symbol="WorkingSetOutSwapStop" version="0" task="WorkingSetOutSwap" opcode="win:Stop" level="win:Informational" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" template="WorkingSetOutSwapStopArgs"/>
<event value="5" symbol="WorkingSetOutSwapStop_V1" version="1" task="WorkingSetOutSwap" opcode="win:Stop" level="win:Informational" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" template="WorkingSetOutSwapStopArgs_V1"/>
<event value="6" symbol="WorkingSetInSwapStart" version="0" task="WorkingSetInSwap" opcode="win:Start" level="win:Informational" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" template="WorkingSetOutSwapStartArgs"/>
<event value="6" symbol="WorkingSetInSwapStart_V1" version="1" task="WorkingSetInSwap" opcode="win:Start" level="win:Informational" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" template="WorkingSetOutSwapStartArgs_V1"/>
<event value="7" symbol="WorkingSetInSwapStop" version="0" task="WorkingSetInSwap" opcode="win:Stop" level="win:Informational" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" template="WorkingSetInSwapStopArgs"/>
在這裏,你得到像訪問頁數一些數據(PagesProcessed):
<template tid="WorkingSetOutSwapStartArgs">
<data name="ProcessId" inType="win:UInt32"/>
</template>
<template tid="WorkingSetOutSwapStopArgs">
<data name="ProcessId" inType="win:UInt32"/>
<data name="Status" inType="win:HexInt32"/>
<data name="PagesProcessed" inType="win:UInt32"/>
</template>
<template tid="WorkingSetInSwapStopArgs">
<data name="ProcessId" inType="win:UInt32"/>
<data name="Status" inType="win:HexInt32"/>
</template>
<template tid="WorkingSetOutSwapStartArgs_V1">
<data name="ProcessId" inType="win:UInt32"/>
<data name="Flags" inType="win:HexInt32"/>
</template>
<template tid="WorkingSetOutSwapStopArgs_V1">
<data name="ProcessId" inType="win:UInt32"/>
<data name="Status" inType="win:HexInt32"/>
<data name="PagesProcessed" inType="win:Pointer"/>
<data name="WriteCombinePagesProcessed" inType="win:Pointer"/>
<data name="UncachedPagesProcessed" inType="win:Pointer"/>
<data name="CleanPagesProcessed" inType="win:Pointer"/>
</template>
玩它,如果它包括您需要的所有數據。
我相信這是一個意外,但你忘了提及操作系統。不是我知道通過回答:) – Makketronix