Trace Windows 7 boot/shutdown/hibernate/standby/resume issues
sessionShutdown sessionID="0" duration="1513">
The value sessionShutdown sessionID="0" shows the servicesShutdownDuration. So you can see which service takes too long to stop.
What Happens in SystemSession
This phase includes two subphases:
• Preshutdown notification. Windows serially shuts down all services that registered to receive preshutdown notifications. Ordered services—services that have set up the shutdown order of dependent services—are shut down before non-ordered services.
• Shutdown notification. All services that registered to receive shutdown notifications are shut down in parallel.
If all services have not exited after 20 seconds (in Windows Vista) or 12 seconds (in Windows 7), the system continues the shutdown. Processes and services that do not shut down in a timely manner are left running as the system shuts down.
SystemSession Performance Vulnerabilities
In the preshutdown notification subphase, the SCM serializes the waits. Therefore, these services block system shutdown until they exit or until the wait hint time-out expires.
Services are not guaranteed to have enough time to finish all their work in the shutdown notification subphase before the system shuts down.
In both cases expand the node and look at the shutdownDuration value.
It helps you to identify a hanging application are service.
What Happens in KernelShutdown
In the KernelShutdown phase, the rest of the system, including all devices and drivers, is shut down.
To calculate the time spent in KernelShutdown, subtract the time that is required to shut down the system and user sessions from shutdownTime.
In my example:
KernelShutdown = 23184 - 3321 - 1513 = 18350
In this case the 18.35 seconds are very slow. In the
That is all you need to analyze slow shutdown issues.
Page 1 of 1
Page 1 of 1