Use these Omnissa Workspace ONE Experience Management desktop telemetry data definitions and lists of available data fields to help you analyze Experience Management specific widgets in dashboards and in the Experience Management Solutions area in Omnissa Intelligence for your Windows and macOS devices that are managed by Omnissa Workspace ONE UEM.
Product information
Experience Management for macOS and Windows work on devices managed by the Omnissa Workspace ONE UEM product.
What category identifies Experience Management data?
When working in dashboard widgets in Intelligence, look for the Employee Experience category.
Update, sample, and transmission frequencies
- Updates: See How often does Experience Management data update?.
- Sample and transmission: See What are the sample and transmission frequencies?.
Common fields
The common fields table lists the data that is common to all the Experience Management event types.
| Friendly Name | Property | Definition | Type | Event Support | Examples |
|---|---|---|---|---|---|
| Device Make | Device_Make | Make of the device. | String | macOS and Windows | Lenovo |
| Device Model | Device_Model | Model of the device. | String | macOS and Windows | 20XXS1ER00 |
| Device Name | device_name | Name of the device. | String | macOS and Windows | PF2T16S2 |
| Device Serial Number | Device_Serial_Number | Serial number of the device. | String | macOS and Windows | VM8Kq4Oo513w |
| OS Major Version | OS_Major | The major version number. | Integer | macOS and Windows | 10 |
| OS Minor Version | OS_Minor | The minor version number. | Integer | macOS and Windows | 0 |
| OS Name Version | OS_Name_Version | The friendly name of the OS. | String | macOS and Windows | Microsoft Windows 11 Enterprise |
| OS Version | OS_Version | The operating system version. | String | macOS and Windows | 10.0.22631 |
| Platform | platform | The applicable platform. | String | macOS and Windows | Windows |
App network
The App Network table lists available data concerning application access to networks in your Experience Management deployment.
- Event category: App Network
- Entity: app_net_event
- New Connection - Identifies when an application initially connects to a network.
- Failed Connection - Identifies when an application failed to connect to a network.
- Closed Connection - Identifies when an application no longer remains connected to a network.
- Connection Statistics - Gives metrics on an application's network connection.
- Minimum agent version: Limited availability
| Friendly Name | Property | Definition | Type | New Connection | Failed Connection | Closed Connection | Connection Statistics | Examples |
|---|---|---|---|---|---|---|---|---|
| App Version | version | A number that identifies the application version. | String | Windows only | Windows only | Windows only | Windows only | 10.0.19041.4170 |
| Application Path | app_path | The path where the app is installed on a device. | String | Windows only | Windows only | Windows only | Windows only | C:\Windows\System32 |
| Average Connection Establishment Time | avg_conn_millis | Average Connection Establishment time in milliseconds. | Double | Windows only | NA | NA | NA | 260.5 milliseconds |
| Binary | application | The name of the process holding the connection. | String | Windows only | Windows only | Windows only | Windows only | ctfmon.exe |
| Connections Count | connections_count | The number of connections in the last interval | Integer | Windows only | NA | Windows only | Windows only | 100 |
| Domain | domain | An internet address. | String | Windows only | Windows only | Windows only | Windows only | DESKTOP-VAOF5MN |
| Event Name | event_name | The name of the event. | String | Windows only | Windows only | Windows only | Windows only | New Connection, Failed Connection, Closed Connection, Connection Statistics |
| Failure Description | failure_description | A verbose description of the failure reasons (can be platform dependent). | String | NA | Windows only | NA | NA | Connection failed due to no service running on the target. |
| Failure Reason | failure_reason | Reason for a connection failure. | String | NA | Windows only | NA | NA | Rejected Connection |
| File Description | name | Indicates the application product name. | String | Windows only | Windows only | Windows only | Windows only | Host Process for Windows Tasks |
| IP Protocol Version | ip_protocol_version | Identifies the IP protocol version as IPv4 or IPv6. | String | Windows only | Windows only | Windows only | Windows only | IPv4 |
| Is Loaded From App Volumes | is_loaded_from_av | Identifies if the app is from App Volumes | Boolean | Windows only | Windows only | Windows only | Windows only | True |
| Local IP Address | local_ip_address | The IP address of a local machine. | String | NA | Windows only | NA | NA | 44.230.85.241 |
| Local Port | local_port | The local port number. This attribute is not mandatory. | Integer | NA | Windows only | NA | NA | 8080 |
| Network Protocol Type | protocol_type | The type of protocol as tcp or udp. | String | Windows only | Windows only | Windows only | Windows only | TCP |
| Package Publisher | publisher | The publishing company of an app. | String | Windows only | Windows only | Windows only | Windows only | Intel Corporation |
| Process ID | process_id | A unique number to identify a process. | String | Windows only | Windows only | Windows only | Windows only | 1134 |
| Received Average Bytes Per Second | rx_avg_bps | The received average speed in bytes per second in an event time frame. | Double | NA | NA | NA | Windows only | 209,715,200 |
| Received Bytes | rx_bytes | The total data received from the socket connection in an event time frame (total data received in case of closed connection). | Double | NA | NA | Windows only | Windows only | 67995654 |
| Received Packet Count | rx_pkt_count | the number of packets received by the connection in an event time frame (total no of packets received in case of a closed connection). | Double | NA | NA | NA | Windows only | 6521 |
| Remote IP Address | remote_ip_address | The remote IP address. | String | Windows only | Windows only | Windows only | Windows only | 44.230.85.241 |
| Remote Port | remote_port | A remote port number. | Integer | Windows only | Windows only | Windows only | Windows only | 8800 |
| Sent Average Bytes Per Second | tx_avg_bps | The sent average speed in bytes per second in an event time frame. | Double | NA | NA | NA | Windows only | 108,715,400 |
| Sent Bytes | tx_bytes | The total data sent through the connection in an event time frame (total data sent in case of a closed connection). | Double | NA | NA | Windows only | Windows only | 987678543 |
| Sent Packet Count | tx_pkt_count | The number of packets sent through the connection in and event time frame (total number of packets sent in case of a closed connection). | Double | NA | NA | NA | Windows only | 5431 |
| Session Identifier | session | A Windows session ID. | String | Windows only | Windows only | Windows only | Windows only | 2 |
| User | user | The user of an application | String | Windows only | Windows only | Windows only | Windows only | TestUser |
| {.filterTable} |
App performance
The App Performance and App Performance (High Frequency, LA, Windows only) table lists available data concerning how well and efficiently apps are running in your Experience Management deployment.
- Event category: Performance
- Entity: resource_consumption
- app_resource_consumption - Identifies when an app is using too much CPU, memory, disk, and network.
- Minimum agent version: 24.12 for app performance
- Minimum agent version: 26.07 for app performance (high frequency), in limited availability, and for only Windows
Note: The schema for App Performance (High Frequency), currently in limited availability, is the same as App Performance except that it applies to Windows devices. The high frequency version collects raw application performance samples every 15 seconds and publishes aggregated events every 5 minutes, giving near-real-time visibility into resource consumption metrics including CPU, memory, disk, and GPU.
| Friendly Name | Property | Definition | Type | app_resource_consumption | Examples |
|---|---|---|---|---|---|
| App Version | version | The version of the Windows application. | String | Windows only | 10.0.19041.4170 |
| Application Name | application | The process binary name. | String | macOS and Windows | ctfmon.exe |
| Average Disk Transfer per Second | disk_io_bytes_sec | The rate at which bytes transfer to the disk during IO operations. | Double | macOS and Windows | 2057 bps |
| Average Network Transfer per Second | network_interface_bytes_sec | The rate at which bytes transfer through the network interface. | Double | Windows only | 301 bps |
| From App Volumes | is_loaded_from_av | Identifies whether an application was delivered by App Volumes or not. | Boolean | Windows only | TRUE |
| GPU 0 Usage | gpu_usage0 | The usage, as a percentage, of GPU #0 for an application. | Double | Windows only | 4.27% |
| GPU 1 Usage | gpu_usage1 | The usage, as a percentage, of GPU #1 for an application. | Double | Windows only | 0.04% |
| GPU 2 Usage | gpu_usage2 | The usage, as a percentage, of GPU #2 for an application. | Double | Windows only | 24.27% |
| Memory Usage | memory_usage_percentage | The memory usage, as a percentage, of an application. | Double | macOS and Windows | 6.24% |
| Package Name | name | The friendly name of an application. | String | macOS and Windows | Windows PowerShell |
| Private Memory | private_commit_byte | Total memory reserved by a process (RAM + pagefile), not shared with others. Leaks show up as a steady increase in committed memory that never stabilizes, since allocations aren’t freed. | Long | Windows only | 2.29 MB |
| Process Count | process_count | The process number that the application has consumed. | Integer | macOS and Windows | 5 |
| Processor Usage | processor_usage_percentage | The processor usage, as a percentage, of an application. | Double | macOS and Windows | 25.41% |
| User | user | The identified user of the session. | String | macOS and Windows | Administrator |
| {.filterTable} |
Apps
The Apps table lists data concerning characteristics and metadata for the apps in your Experience Management deployment.
- Event category: Application
- Entity: apps
- Application Start - Identifies when an application begins process whether it is a service, a user, or UI process.
- Application Exit - Identifies that an app has stopped running as expected because it was closed.
- Application Foreground - Identifies that an app is displaying in the UI when the UI is in the foreground, or is the main focus of the user session.
- Application Crash - Identifies that an app has stopped running, unexpectedly.
- Application Hang - Identifies that an app is stuck in a process.
- Application Unresponsive - Identifies that an app is not responding to user or resource inputs.
- Application Change - Tracks the app as it is installed, removed, reconfigured, when an update is installed, and when an update is uninstalled.
- Boot Degradation - Identifies that an application has reduced performance because of a restart. For example, the app took a long time to load during a system boot.
- Shutdown Degradation- Identifies that an app has reduced performance while the system was shutting down.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | Application Start | Application Exit | Application Foreground | Application Crash | Application Hang | Application Unresponsive | Application Change | Boot Degradation | Shutdown Degradation | Examples |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Activation Time | activation_time | The activation time for application focus. | Date-Time | NA | NA | macOS and Windows | NA | NA | NA | NA | NA | NA | 2/13/2025 11:46:00 AM |
| Activity ID | activity_id | The activity id for a Windows event log. | String | NA | NA | NA | NA | NA | NA | NA | Windows only | Windows only | aaafff8b-ae3b-0001-6308-b1aa3baedb01 |
| App Volumes Package ID | av_package_id | Lists the ID of an App Volumes package. | UUID | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | NA | Windows only | Windows only | 08870c17-bca9-4558-9a4f-311f60e83439 |
| Application End Time | end_time | The time when the application stops. | Date-Time | NA | macOS and Windows | NA | NA | NA | NA | NA | NA | NA | 2/13/2025 11:46:00 AM |
| Application Install Path | app_path | The installation path of the application. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS only | Windows only | Windows only | C:\Windows\System32 |
| Application Name | application | Normalized app name or file description in Intelligence. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS only | Windows only | Windows only | Microsoft Windows Search Protocol Host |
| Create Time | create_time | Time when the app was created. | Date-Time | macOS and Windows | macOS and Windows | macOS and Windows | NA | NA | NA | NA | NA | NA | Feb 14, 2025 11:15 AM |
| Degradation in Milliseconds | load_degradation_time_millis | Reports the decrease of an app's performance. | Long | NA | NA | NA | NA | NA | NA | NA | Windows only | Windows only | 6744 |
| Domain | domain | Identifies the domain of the session's user. | String | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | NA | NA | NA | DESKTOP-VAOF5MN |
| Duration in Milliseconds | duration_millis | This field provides the total time an application was in the foreground in an application Foreground Event or an application remained unresponsive in an application Unresponsive Event. Use the Sum operator to know the total time of application usage. | Long | NA | NA | macOS and Windows | NA | macOS and Windows | macOS and Windows | Windows only | Windows only | Windows only | 13.6 s |
| Event Status | event_status | Identifies the status of the application. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | Windows only | Windows only | "complete" |
| Exception Code | exception_code | Exception code in an application crash event. | String | NA | NA | NA | Windows only | NA | NA | NA | NA | NA | 00000057 |
| Exception Offset | exception_offset | The offset of the crash module in the application. This field is applicable to Application Crash events. | String | NA | NA | NA | Windows only | NA | NA | NA | NA | NA | 00000000000c837a |
| From App Volumes | is_loaded_from_av | Identifies whether an application was delivered by App Volumes or not. | Boolean | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | NA | Windows only | Windows only | FALSE |
| GUID | guid | Lists the globally unique identifier for the app. | String | NA | NA | NA | NA | NA | NA | Windows only | NA | NA | 7642522831597947940 12269795336078027775 |
| MSI Path | msi_path | The file location of a MSI file. | String | NA | NA | NA | NA | NA | NA | Windows only | NA | NA | C:\ProgramData\AirWatchMDM\Apps\{5A821A77-BA32-4724-8BAB-2A83D3719FD4}\GlobalProtect64-6.1.4.msi |
| Method | method | Detailed install action, for example Installation, Uninstall, or Reconfig. | String | NA | NA | NA | NA | NA | NA | macOS and Windows | NA | NA | Reconfig |
| Module | module | The module name within an application. | String | NA | NA | NA | macOS and Windows | NA | NA | NA | NA | NA | libcoreclr.dylib |
| Module Path | module_path | The module installation path. | String | NA | NA | NA | macOS and Windows | NA | NA | NA | NA | NA | /Library/Application Support/Workflow/libcoreclr.dylib |
| Module Timestamp | module_timestamp | The time when the module was last modified. | Date-Time | NA | NA | NA | Windows only | NA | NA | NA | NA | NA | Jan 28, 2025 1:09 PM |
| Module Version | module_version | The module version. This version can be different than the application version. | String | NA | NA | NA | Windows only | NA | NA | NA | NA | NA | 1307.2407.15032.0 |
| Object Type | object_type | The type of the application. Values can be Application, Driver, and Service. | String | NA | NA | NA | NA | NA | NA | NA | Windows only | NA | Application |
| Package Full Name | pfn | Lists the application package family name. | String | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | NA | NA | NA | Microsoft.WindowsCalculator_8wekyb3d8bbwe |
| Package Language | locality | Lists the application language identifier. For example, English is 0x409 (dec.1033). | String | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | NA | NA | NA | 1033 |
| Package Name | name | The friendly name of the application. | String | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | Windows only | Console Window Host |
| Package Publisher | publisher | The application publisher name. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOs only | Windows only | Windows only | Microsoft Corporation |
| Package Version | version | The application version. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOs only | Windows only | Windows only | 7.0.22621.4746 |
| Process Identifier | process_id | Identifies a unique ID for a running application. | String | macOS and Windows | macOS and Windows | macOS and Windows | NA | NA | macOS and Windows | NA | NA | NA | 7456 |
| Return Code | return_code | The application's exit code, and it indicates the application's exit status or reason. | Integer | NA | Windows only | NA | NA | NA | NA | NA | NA | NA | 1168 |
| Session | session | Lists the Windows session ID. | String | Windows only | Windows only | Windows only | NA | NA | Windows only | NA | NA | NA | 2 |
| Timestamp | app_timestamp | Indicates when the app waslast modified. | Date-Time | NA | NA | NA | Windows only | NA | NA | NA | NA | NA | (Timestamp) seconds (INT64) = 3013880354 nanos (INT32) = 0 |
| Trigger Time | trigger_time | The time when an event triggered. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | Windows only | Windows only | (Timestamp) seconds (INT64) = 1645402934 nanos (INT32) = 340502704 |
| Transaction Identifier | transaction_id | Lists the unique ID assigned to a system transaction. | String | NA | NA | NA | NA | NA | NA | Windows only | NA | NA | 17360517195459799390 |
| Unresponsive Time | unresponsive_time | The time when an app began to be unresponsive. | Date-Time | NA | NA | NA | NA | NA | Windows only | NA | NA | NA | (Timestamp) seconds (INT64) = 1699985579 nanos (INT32) = 797934221 |
| Up Time in Milliseconds | up_time_millis | The time the application is active, from when it starts to stops. | Long | NA | macOS and Windows | NA | NA | NA | NA | NA | NA | NA | 92 ms |
| User | user | Identifies the user of the session. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | NA | NA | NA | TestUser |
| {.filterTable} |
Asset information
The asset information table lists data concerning physical resources in your Experience Management deployment.
- Event Category: Asset Info
- Entity: asset_info - Identifies the device asset information, for example, CPU, physical disk, or BIOS.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | asset_info | Examples |
|---|---|---|---|---|---|
| BIOS Timestamp | bios_timestamp | Indicates that the asset's BIOS updated data at a specific timestamp. | Date-Time | Windows only | May 21, 2023 3:00 PM |
| BIOS Version | bios_version | Indicates the version of the asset's BIOS. | String | macOS and Windows | 6.00 |
| Logical Disk Free Space In Megabytes | logicaldisk_free_space_mbytes | Indicates the Logical disk free space of the asset. | Double | macOS and Windows | 12877.000000 |
| Logical Disk Free Space (%) | logicaldisk_free_space_percentage | Indicates the Logical disk free space of the asset as a percentage. | Double | macOS and Windows | 21.353724 |
| Time Zone | time_zone | Indicates the time zone the asset is set to. | String | macOS and Windows | India Standard Time |
| {.filterTable} |
Battery information
The battery information table lists data concerning device batteries in your Experience Management deployment.
- Event category: Battery
- Entity: battery_info - Reports the battery information, for example, charge cycle count, serial number, Initial and actual capacity of the battery in milliwatt-hour (mWh).
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | battery_info | Examples |
|---|---|---|---|---|---|
| Actual Battery Capacity | actual_charge_capacity | Actual current capacity of the battery, in milliwatt-hours (mWh). | Long | Windows only | 48600 |
| Actual Battery Capacity Percentage | actual_charge_capacity_percent | Actual current capacity of the battery, in percentages (%). | Double | Windows only | 87.93598443505908 |
| Battery Cycle Count | charge_cycle_count | Count of battery fully charged and discharged. | Long | Windows only | 110 |
| Battery Manufacture Date | manufacture_date | Manufacture date of the battery. | Date-Time | Windows only | Feb 1, 2020 (YEAR, MONTH, DAY) |
| Battery Manufacturer Name | manufacture_name | Manufacturer name of the battery. | String | Windows only | SMP |
| Battery Serial Number | serial_number | Serial number of the battery. | String | Windows only | 7722 |
| Designed Battery Capacity | design_capacity | Initial capacity of the battery in milliwatt-hour (mWh) | Long | Windows only | 84292 |
| Is Battery Present | is_present | Identifies if the battery is present or not. | Boolean | Windows only | 1 |
| Is External Battery | is_external_battery | Identifies if the battery is external or not. | Boolean | Windows only | 0 |
| Last Removal Time | last_removal_time | The removal time of a battery that is no longer present in the system. | Date-Time | Windows only | 27-02-24 20:31 |
| {.filterTable} |
Device hardware
The device hardware table lists types, versions, manufacturers, identifying numbers, and other metadata for the hardware components in your Experience Management deployment.
- Event category: Device Hardware
- Entity: device_hardware - Identifies metrics concerning a device’s hardware, for example the driver version and the manufacturer.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | device_hardware | Examples |
|---|---|---|---|---|---|
| Bus Type | bus_type | Type of bus. | String | macOS and Windows | USB PCI |
| Device Has Problem | has_problem | Identifies that the device has problem. | Boolean | Windows only | 0 |
| Driver Published Date | driver_published_date | Build date of the driver. | Date-Time | Windows only | (Timestamp) seconds (INT64) = 1698883200 nanos (INT32) = 0 |
| Driver Version | driver_version | Version of the driver. | String | Windows only | 10.0.22621.3672 |
| Hardware Device ID | hardware_id | An identifier that uniquely identifies a device. | String | macOS and Windows | 10868025185241700000 |
| Hardware Device Manufacturer | hardware_manufacturer | Manufacturer of the device. | String | macOS and Windows | Realtek |
| Hardware Device Name | hardware_name | Name of the device. | String | macOS and Windows | Realtek USB GbE Family Controller |
| Hardware Device Type | hardware_type | Type of device. | String | macOs and Windows | Camera |
| Is Present | is_present | Identifies if the device is present or not. | Boolean | macOS and Windows | 0 |
| Last Removal Time | last_removal_time | The removal time of a device that is no longer present in the system. | Date-Time | macOS and Windows | (Timestamp) seconds (INT64) = 1702294317 nanos (INT32) = 0 |
| Platform Device ID | platform_device_id | Unique device identifier for Windows. | String | Windows only | PCI\VEN_8086&DEV_A353&SUBSYS_09061028&REV_10\3&11583659&0&B8 |
| Problem Code | problem_code | Code of an identified problem on a Windows device. This attribute is only applicable when a Windows device has a problem. | Integer | Windows only | 0 |
| Problem Description | problem_description | The description of the problem. | String | Windows only | |
| {.filterTable} |
Device performance
The device performance table lists available data concerning how well and efficiently devices are running in your Experience Management deployment.
- Event category: NA
- Entity: NA
- Performance Counters - Identifies performance metrics for a device, for example the dedicated memory capacity or the battery status charge rate.
- Power Consumption - Identifies performance metrics for a device’s power consumption, for example the display power consumption or the network power consumption.
- Minimum agent version: 24.12
| Friendly Name | Definition | Performance Counters | Power Consumption | Examples | Units |
|---|---|---|---|---|---|
| Average Total Power Consumption | Average total power in the duration time period. avg_total_power = total_energy (converted to unit in Wh) / duration time (converted to unit in hour) | Windows only | Windows only | 45.05 | Watts |
| Battery Status Charge Rate | The rate at which the battery is charging. | macOS and Windows | macOS and Windows | 0 | Milliwatts |
| Battery Status Discharge Rate | The rate at which the battery is discharging. | macOS and Windows | macOS and Windows | 0. | Milliwatts |
| Battery Status Remaining Capacity | The amount of remaining battery capacity. | macOS and Windows | macOS and Windows | 75764 | Milliwatt-hours |
| CPU Power Consumption | The sum of the power consumed (in milliwatt-hours) by the CPU. Transmitted based on the device performance transmit frequency for power data of 1 hour. Use in dashboards to aggregate power consumed over any admin defined time range. | Windows only | Windows only | 15470.04 mWh | Milliwatt-hours |
| Disk Power Consumption | The sum of the power consumed (in milliwatt-hours) by the physical disk. Transmitted based on the device performance transmit frequency for power data of 1 hour. Use in dashboards to aggregate power consumed over any admin defined time range. | Windows only | Windows only | 37.04 mWh | Milliwatt-hours |
| Display Power Consumption | The sum of the power consumed (in milliwatt-hours) by the integrated display. Transmitted based on the device performance transmit frequency for power data of 1 hour. Use in dashboards to aggregate power consumed over any admin defined time range. | Windows only | Windows only | 1707.04 mWh | Milliwatt-hours |
| Display Power Consumption | The sum of the power consumed (in milliwatt-hours) by the integrated display. Transmitted based on the device performance transmit frequency for power data of 1 hour. Use in dashboards to aggregate power consumed over any admin defined time range. | Windows only | Windows only | 1707.04 mWh | Milliwatt-hours |
| Energy Consumption Duration | The period of time during which the energy consumption occurred (reported in milli seconds). | macOS and Windows | macOS and Windows | 1 min | ms/s/min |
| GPU 0 Dedicated Memory Capacity | The maximum RAM allocated for the graphics processing unit (GPU) #0. | Windows only | Windows only | 128 MB | Bytes |
| GPU 0 Dedicated Memory Usage | The maximum RAM that GPU #0 can use. | Windows only | Windows only | 0 bytes | Bytes |
| GPU 0 Manufacturer | The name of the company that manufactured GPU #0. | Windows only | Windows only | Intel Corporation | NA |
| GPU 0 Name | The name of GPU #0. | macOS and Windows | macOS and Windows | Intel(R) UHD Graphics 630 | NA |
| GPU 0 Shared Memory Usage | The shared RAM used by GPU #0. | Windows only | Windows only | 6494 MB | Bytes |
| GPU 0 Usage | The usage as a percentage of GPU #0. | macOS and Windows | macOS and Windows | 0.12% | Percentage |
| GPU 1 Dedicated Memory Capacity | The maximum RAM allocated for GPU #1. | Windows only | Windows only | 3.87 GB | Bytes |
| GPU 1 Dedicated Memory Usage | The maximum RAM that GPU #1 can use. | Windows only | Windows only | 0 bytes | Bytes |
| GPU 1 Manufacturer | The name of the company that manufactured GPU #1. | Windows only | Windows only | Intel Corporation | NA |
| GPU 1 Name | The name of GPU #1. | macOS and Windows | macOS and Windows | NVIDIA Quadro T1000 | NA |
| GPU 1 Shared Memory Usage | The shared RAM used by GPU #1. | Windows only | Windows only | 256 KB | Bytes |
| GPU 1 Usage | The usage as a percentage of GPU #1. | macOS and Windows | macOS and Windows | 0% | Percentage |
| GPU 2 Dedicated Memory Capacity | The maximum RAM allocated for GPU #2. | Windows only | Windows only | 3.87 GB | Bytes |
| GPU 2 Dedicated Memory Usage | The maximum RAM that GPU #2 can use. | Windows only | Windows only | 0 bytes | Bytes |
| GPU 2 Manufacturer | The name of the company that manufactured GPU #2. | Windows only | Windows only | Intel Corporation | NA |
| GPU 2 Name | The name of GPU #2. | macOS and Windows | macOS and Windows | Intel(R) UHD Graphics 630 | NA |
| GPU 2 Shared Memory Usage | The shared RAM used by GPU #2. | Windows only | Windows only | 256 KB | Bytes |
| GPU 2 Usage | The usage as a percentage of GPU #2. | macOS and Windows | macOS and Windows | 0% | Percentage |
| GPU Shared Memory Capacity | The maximum RAM allocated for GPUs to share with other components. | Windows only | Windows only | 15.84GB | Bytes |
| Logicaldisk Free Space (Megabytes) | The hard disk free space in megabytes. | macOS and Windows | macOS and Windows | 11421 | MB |
| Memory Cache Faults per sec | The memory cache faults per seconds. Cache Faults is a type of Page Fault. | Windows only | Windows only | 68.287961 | Cache faults/sec |
| Memory Committed Bytes in use | The ratio of Memory\\Committed Bytes to the Memory\\Commit Limit. | macOS and Windows | macOS and Windows | 26.38% | Percentage |
| Memory Page Faults per sec | The total page faults including soft and hard. Average number of pages faulted per second. | Windows only | Windows only | 9651.298229 | Page faults/sec |
| Memory Page Reads per sec | The rate at which the disk was read to resolve hard page faults. | Windows only | Windows only | 435.24747 | Page reads/sec |
| Memory Page Writes per sec | The rate at which page data is written to the disk. | Windows only | Windows only | 0.02 | Page reads/sec |
| Memory Pages per sec | The rate at which pages are read or written to the disk to resolve hard faults. | Windows only | Windows only | 23.54 | Number of pages per second |
| Memory Transition Faults per sec | This field provides the rate at which page faults are resolved by recovering the pages shared by other processes. | Windows only | Windows only | 1570.952333 | Transition faults/sec |
| Memory Usage Percentage | The overall memory usage as a percentage of the device. | macOS and Windows | macOS and Windows | 34.0944% | Percentage |
| Network Interface Packets Outbound Errors | The number of outbound packets that did not transmit because of errors. | macOS and Windows | macOS and Windows | 0 | NA |
| Network Interface Packets Received Errors | The number of inbound packets that contained errors. | macOS and Windows | macOS and Windows | 7 | NA |
| Network Power Consumption | The sum of the power consumed (in milliwatt-hours) by the network adapters. Transmitted based on the device performance transmit frequency for power data of 1 hour. Use in dashboards to aggregate power consumed over any admin defined time range. | Windows only | Windows only | 490.04 mWh | Milliwatt-hours |
| Paging File Usage | The percentage value of page file usages. | macOS and Windows | macOS and Windows | 6.1822% | Percentage |
| Physical Disk Avg Disk Bytes Queue Length | The average number of IO requests in the queue waiting to be sent to the storage system. | Windows only | Windows only | 903 bytes | Bytes |
| Physical Disk Avg Disk Bytes Read | The average number of bytes transferred to the disk during read operations. | macOS and Windows | macOS and Windows | 146.84 KB | KB |
| Physical Disk Avg Disk Bytes Transfer | Average number of bytes transferred to the disk during read/write operations. | Windows only | Windows only | 74.93 KB | KB |
| Physical Disk Avg Disk Bytes Write | The average number of bytes transferred to the disk during write operations. | Windows only | Windows only | 67.42 KB | KB |
| Physical Disk Avg Disk Read per sec | The rate at which bytes are read to the disk during read operations. | macOS and Windows | macOS and Windows | 0.000494 | Second |
| Physical Disk Avg Disk Read Queue Length | The average number of read IO requests in the queue waiting to be sent to the storage system. | Windows only | Windows only | 9.09 | Average number of read requests in the queue |
| Physical Disk Avg Disk Read Time | It is a performance metric that measures the average time, in milliseconds, that it takes to read data from a physical disk. This metric provides insight into the responsiveness of the disk when performing read operations. | Windows only | Windows only | 0.03 | Percentage |
| Physical Disk Avg Disk Transfer per sec | The rate at which of bytes transferred to the disk during IO operations. | Windows only | Windows only | 0.00049 | Second |
| Physical Disk Avg Disk Write per sec | The rate at which bytes are written to the disk during write operations. | macOS and Windows | macOS and Windows | 0.000494 | Second |
| Physical Disk Avg Disk Write Queue Length | The average number of write IO requests in the queue waiting to be sent to the storage system. | Windows only | Windows only | 2.91 | Average number of write requests in the queue |
| Physical Disk Avg Disk Write Time | It is a performance metric that measures the average time, in milliseconds, that it takes to write data to a physical disk. This metric is crucial for understanding the responsiveness and efficiency of the disk when handling write operations. | Windows only | Windows only | 0.04 | Percentage |
| Physical Disk Idle Time | It is a performance metric that measures the percentage of time during which the physical disk is not processing any read or write requests. It essentially indicates how much of the time the disk is idle, meaning it is not being used actively by any applications or processes. | macOS and Windows | macOS and Windows | 99.72 | Percentage |
| Physical Memory in Bytes | The physical memory of the device. | macOS and Windows | macOS and Windows | 16.00 GB | GB |
| Processor Total C1 Time | Refers to the time a CPU core spends in the C1 state, which is one of the "C-states" or "power states" in modern processors C1 (Halt). The first idle state where the CPU is still active but not executing instructions. It can quickly return to C0 (active state - The CPU is fully operational, executing instructions). It's the lightest sleep state with minimal power saving. | Windows only | Windows only | 6.87% | Percentage |
| Processor Total C2 Time | Refers to the time a CPU core spends in the C2 state. C2 - Stop-Clock: A deeper idle state than C1, which reduces power consumption further, but takes a bit longer to return to C0 (active state - The CPU is fully operational, executing instructions). In scenarios where power saving is critical, higher total times in C2 or C3 might be desired, as they indicate the processor is spending more time in low-power states. | Windows only | Windows only | 4.99% | Percentage |
| Processor Total C3 Time | Refers to the time a CPU core spends in the C3 state. C3 - Sleep: A deeper sleep state where more of the CPU's functions are powered down. This state saves more power but takes even longer to wake up and return to C0 (active state - The CPU is fully operational, executing instructions). | Windows only | Windows only | 61.57% | Percentage |
| Processor Total DPC Time | This is the cumulative amount of time the CPU spends in an idle state. Monitoring idle time is important for understanding system utilization. A high idle time generally indicates that the CPU is not heavily loaded and has sufficient capacity to handle more tasks. | Windows only | Windows only | 0.08% | Percentage |
| Processor Total Idle Time | This is the cumulative amount of time the CPU spends in an idle state. Monitoring idle time is important for understanding system utilization. A high idle time generally indicates that the CPU is not heavily loaded and has sufficient capacity to handle more tasks. | macOS and Windows | macOS and Windows | 73.41% | Percentage |
| Processor Total Interrupt Time | The percentage time the processor spends in receiving and servicing hardware interruptions during sample intervals. A high percentage of interruptions can indicate a problem with a hardware device. | Windows only | Windows only | 0.21% | Percentage |
| Processor Total Interrupts per sec | The total interruptions per second. | Windows only | Windows only | 6712.42 | NA |
| Processor Total Privileged Time | The percentage of time that the processor is spent executing in Kernel (or Privileged) mode. | macOS and Windows | macOS and Windows | 5.4% | Percentage |
| Processor Total Processor Time | The percentage of elapsed time that the processor spends executing non-idle threads. | macOS and Windows | macOS and Windows | 10.58% | Percentage |
| Processor Total User Time | The percentage of time that the processor spends executing in User mode. | macOS and Windows | macOS and Windows | 3.45% | Percentage |
| System On Chip Power Consumption | The sum of the power consumed (in milliwatt-hours) by the integrated circuit. Transmitted based on the device performance transmit frequency for power data of 1 hour. Use in dashboards to aggregate power consumed over any admin defined time range. | Windows only | Windows only | 0 | Milliwatt-hours |
| Thermal Zone Information Throttle Reason | The reasons why the thermal zone is limiting. | Windows only | Windows only | 0 | NA |
| Thermal Zone Information Zone Temperature | The CPU core temperature. | macOS and Windows | macOS and Windows | 24.85 | Celsius |
| Total Power Consumption | The sum of the power consumed (in milliwatt-hours) by all hardware components. Transmitted based on the device performance transmit frequency for power data of 1 hour. Use in dashboards to aggregate power consumed over any admin defined time range. | Windows only | Windows only | 58391.17 mWh | Milliwatt-hours |
| {.filterTable} |
Devices
The devices table lists data concerning systems, components, and metadata for the devices in your Experience Management deployment.
- Event category: Device
- Entity: devices
- Boot - Identifies metrics concerning a device’s boot functions, for example boot end time or boot drive load time.
- Shutdown - Identifies metrics for a device’s shutdown functions like duration time or preshutdown time.
- System Crash - Identifies metrics concerning a device system’s unexpected and complete stoppage, for example an error code or a crash path.
- Unexpected Shutdown - Identifies metrics concerning a device’s unexpected shutdown, for example performance degradation or kernel load in time.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | Boot | Shutdown | System Crash | Unexpected Shutdown | Examples |
|---|---|---|---|---|---|---|---|---|
| Activity ID | activity_id | The unique ID for a windows event log. You can use this to correlate Boot and Shutdown events with Employee Experience > Apps where the event name = Boot Degradation events. | String | Windows only | Windows only | NA | NA | aaafff8b-ae3b-0001-6308-b1aa3baedb01 |
| Autochk Duration in Milliseconds | autochk_millis | The process involves the autochk.exe utility running at startup to check the logical integrity of NTFS file systems, typically on volumes flagged as "dirty" after an improper shutdown. | Long | Windows only | NA | NA | NA | |
| Boot Device Duration in Milliseconds | device_init_millis | The boot device, such as a hard drive or USB, contains the bootloader which in turn loads the operating system's kernel (ntoskrnl.exe), essential drivers, and the Windows kernel (ntoskrnl.exe) into RAM. This initializes the system and prepares it for user login. | Long | Windows only | NA | NA | NA | |
| Boot Driver Load Duration in Milliseconds | boot_driverload_duration_millis | Loads the Windows kernel (ntoskrnl.exe) and essential drivers into memory. This kernal and drivers are necessary to start the operating system and interact with hardware. These drivers, known as boot-start drivers, are automatically installed by Windows during the initial setup to ensure fundamental hardware functionality. | Long | Windows only | NA | NA | NA | 298 |
| Boot End Time | boot_end_time | Boot end time. | File Date-Time | Windows only | NA | NA | NA | Jan 26, 2025 10:18 PM |
| Boot PNP Duration in Milliseconds | pnp_init_millis | The process is the phase of the Windows startup sequence where the PnP manager, a key component of the operating system, identifies and configures hardware devices by loading their drivers and allocating system resources like memory and interrupts. | Long | Windows only | NA | NA | NA | |
| Boot Prefetch Service Duration | boot_prefetchinit_duration_millis | Officially known as SuperFetch (now part of SysMain in modern Windows versions), this property improves the Windows boot process by pre-loading frequently used application files and data into RAM during startup to make subsequent boots and application launches faster. | Long | Windows only | NA | NA | NA | 85 |
| Crash Address | crash_address | Memory address of the system crash. | String | NA | NA | Windows only | NA | 0xfffff80377614f10 |
| Crash Parameters List | parameters | BugCheck description of parameters. | File Date-Time | NA | NA | Windows only | Windows only | 0x00000000c0000005,0xfffff8037b9c5050,0xffffdd8369b2daa0,0x0000000000000000 |
| Crash Path | crash_path | Windows dump file location. | String | NA | NA | macOS and Windows | NA | C:\Windows\Minidump\012725-20890-01.dmp |
| Crashdump Type | crashdump_type | Windows crash dump type. | String | NA | NA | NA | Windows only | 7 |
| Critical Services Initialization Duration in Milliseconds | critical_services_init_millis | A key phase of the Windows boot process where the operating system loads and starts essential system services and drivers. | Long | Windows only | NA | NA | NA | |
| Duration in Milliseconds | duration_millis | Boot and Shutdown duration. | Long | Windows only | Windows only | NA | NA | 43783 |
| End Time | end_time | The time boot ends. | File Date-Time | macOS and Windows | macOS and Windows | NA | NA | (Timestamp) seconds (INT64) = 1710936457 nanos (INT32) = 572000000 |
| Error | error | The BugCheck code. | String | NA | NA | Windows only | Windows only | 0x000000d1 |
| Event Status | event_status | Identifies the status of a process. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | Complete |
| Exception Code | error_code | A string that represents an error. | String | NA | NA | Windows only | NA | 0x80000003 |
| Explorer Initialization Duration in Milliseconds | explorer_init_millis | The stage of the Windows boot sequence after user login but before the desktop is fully responsive. | Long | Windows only | NA | NA | NA | |
| Kernel Initialization Duration in Milliseconds | kernel_init_millis | The process involves the OS loader loading the core Windows kernel (ntoskrnl.exe) into memory, followed by the initialization of the Hardware Abstraction Layer (HAL) and essential "boot critical" device drivers. | Long | Windows only | NA | NA | NA | 2.803 |
| Kernel Load Duration in Milliseconds | kernel_millis | Part of the Shutdown event. | Long | NA | Windows only | NA | NA | 1126 |
| Machine Profile Processing Duration in Milliseconds | machine_profile_processing_millis | Refers to the operating system initializing and loading user-specific settings and profiles after the core system has started and the user has logged in. | Long | Windows only | NA | NA | NA | |
| Main Path Load Duration in Milliseconds | main_pathload_duration_millis | The main path for the Windows boot process depends on the system's firmware; either the traditional BIOS or the newer UEFI. Both paths involve firmware initializing hardware, a boot manager, and a bootloader that loads the Windows kernel and essential drivers. | Long | Windows only | NA | NA | NA | 10483 |
| Module | module | Crashed module in a system crash event. | String | NA | NA | Windows only | NA | win32kbase |
| Numbers of Startup Apps | num_startup_apps | The number of startup programs for each computer and user, depending on the installed software and user preferences. You can view and manage these apps through the Task Manager's Startup tab or the Settings app under Apps > Startup to control which applications launch automatically when you sign in. This property impacts boot time and system performance. | Long | Windows only | NA | NA | NA | 12 |
| OS Loader Duration in Milliseconds | os_loader_millis | Also called the Boot Manager (bootmgr.exe), it is a critical part of the Windows boot process that takes over after the UEFI/BIOS performs its Power-On Self-Test (POST) and firmware checks. | Long | Windows only | NA | NA | NA | |
| Other Kernel Initialization Duration in Milliseconds | other_kernel_init_millis | The process involves the operating system kernel (ntoskrnl.exe) taking full control after the bootloader loads it into memory, establishing the essential hardware abstraction layer (HAL) for hardware communication, loading the Windows Registry and essential drivers, setting up core services like the system pagefile, and then launching the first user-mode processes, such as the Session Manager (smss.exe). This process prepares the system for user interaction. | Long | Windows only | NA | NA | NA | |
| Other Logon Initial Activity Duration in Milliseconds | other_logon_init_activity_millis | Part of Logon and is a Windows boot performance metric that measures the total time spent on logon-related tasks not covered by other specific metrics, such as profile or Group Policy loading. The property accounts for a collection of background processes and scripts that run during a user's sign-in to the desktop. | Long | Windows only | NA | NA | NA | |
| Performance Degradation | perf_degradation | Indicates that boot or shutdown was degraded. | Boolean | Windows only | Windows only | NA | NA | TRUE |
| Post Boot Duration in Milliseconds | post_boot_millis | The POST (Power-On Self-Test) is a hardware diagnostic routine that runs immediately after a computer is powered on, before the Windows operating system loads. It verifies the functionality of crucial hardware components like the CPU, RAM, hard drive, and other peripherals. If POST detects a hardware error, it typically halts the boot process and may signal the problem with a specific beep pattern or error message. | Long | Windows only | NA | NA | NA | |
| Preshutdown Duration in Milliseconds | preshutdown_millis | A timeout period during the Windows shutdown process that gives critical services an initial opportunity to stop gracefully. By default, this period is 3 minutes (180 seconds), but services can request an extension or developers can adjust it to a maximum of 3600 seconds. | Long | NA | Windows only | NA | NA | 572 |
| Process | process | Crashed process in a system crash. | Integer | NA | NA | macOS and Windows | NA | ntkrnlmp.exe |
| Reason | reason | The reason for unexpected shutdown, for example ColdReboot or SystemCrash. | String | NA | NA | NA | macOS and Windows | SystemCrash |
| Reboot After Install | reboot_after_install | The reboot after install flag in a Windows boot event indicates that the system has restarted to complete the installation of an application, a driver, or a Windows update. | Boolean | Windows only | NA | NA | NA | False |
| Result | result | The result of a process. | String | macOS and Windows | macOS and Windows | NA | NA | Success |
| SMSS Initialization Duration in Milliseconds | smss_init_millis | The crucial first step where Windows' smss.exe starts after the kernel loads, creating and managing user and system sessions. | Long | Windows only | NA | NA | NA | |
| Services Duration in Milliseconds | services_millis | Involves the Service Control Manager (SCM) sending a shutdown signal to all running services, which have a default time limit to respond and shut down gracefully. | Long | NA | Windows only | NA | NA | 85 |
| Session 0 Initialization Duration in Milliseconds | session0_init_millis | A critical stage in the Windows boot process where the foundational, non-interactive system services are started before any user logs on. | Long | Windows only | NA | NA | NA | |
| Session 1 Initialization Duration in Milliseconds | session1_init_millis | It is a phrase often seen in a "SESSION1_INITIALIZATION_FAILED" BSOD (Blue Screen of Death) error message<0xC2><0xA0> that indicates a critical error preventing Windows from starting. | Long | Windows only | NA | NA | NA | |
| Session Initialization Other Duration in Milliseconds | session_init_other_millis | Part of the Boot Event. | Long | Windows only | NA | NA | NA | |
| Stack Trace | stack_trace | List of the method calls that the resource was in the middle of when an Exception was thrown. | String | NA | NA | macOS and Windows | NA | nt!KeBugCheckEx+0x0(0xfffff802033fd890),(0xfffff80203411e29),(0xfffff8020340d8a3),(0xfffff8021bcf1981),(0xfffff8021bcf1d3d),(0xfffff8021bcf1ea1),(0xfffff80203235cf5),(0xfffff8020364599c),(0xfffff802036455f3),(0xfffff802036448c6)' |
| System PNP Duration in Milliseconds | pnp_load_duration_millis | A critical part of Windows startup where the PnP manager identifies and configures hardware devices by loading the correct device drivers. | Long | Windows only | NA | NA | NA | 263 |
| System Session Duration in Milliseconds | system_session_millis | A coordinated series of steps that ends this session and powers down the computer. The duration of this process can vary based on several factors, with the most significant one being the "Fast Startup" feature | Long | NA | Windows only | NA | NA | 10483 |
| Time Change in Milliseconds | timechange_millis | The shutdown time change. | Long | NA | Windows only | NA | NA | 448 |
| Total Boot Duration in Milliseconds | total_boot_millis | The total time it takes for a computer to go from being powered off to being fully functional and ready for user interaction. In this case, from the power button press until the Windows logon screen. | Long | Windows only | NA | NA | NA | |
| Trigger Time | trigger_time | Reports the boot start time. | File Date-Time | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | (Timestamp) seconds (INT64) = 1645402934 nanos (INT32) = 340502704 |
| User Logon Wait Duration in Milliseconds | user_logon_wait_millis | Refers to the time it takes for a user's profile and desktop environment to fully load and become responsive after the user enters their credentials. This duration is influenced by factors like startup applications, disk activity, and Group Policy processing. | Long | Windows only | NA | NA | NA | |
| User Policy Duration in Milliseconds | user_policy_millis | Refers to the maximum amount of time the system will wait for Group Policy scripts to finish executing before forcing a shutdown. | Long | NA | Windows only | NA | NA | 298 |
| User Profiles Duration in Milliseconds | user_profiles_millis | The time it takes to properly unload a user's session and all related processes. While there is no single "duration," a normal shutdown involving user profiles should be very fast. Delays indicate a problem with a specific application or process that is preventing the session from closing. | Long | NA | Windows only | NA | NA | 10483 |
| User Profile Processing Duration in Milliseconds | user_profile_processing_millis | Loads the settings, preferences, and data for a specific user after they have entered their credentials. This critical phase is managed by the User Profile Service (ProfSvc), and delays or errors during this process can prevent a user from signing in. | Long | Windows only | NA | NA | NA | |
| User Session Duration in Milliseconds | user_session_millis | Refers to the time it takes to properly close all user-related applications and services before the system shuts down. During this period, Windows sends specific messages to processes to trigger an orderly exit, allowing applications to save data and terminate gracefully. | Long | NA | Windows only | NA | NA | 298 |
| Version | version | OS version. | String | NA | NA | macOS and Windows | NA | 10.0.19041 |
| {.filterTable} |
Display
The display table lists data concerning the resource screens showing electronic media in your Experience Management deployment.
- Event category: Display
- Entity: display
- Screen Saver Off - Identifies that a resource stopped using or does not use a screen saver.
- Screen Saver On - Identifies that a resource used a screen saver.
- Sleep - Identifies metrics concerning a resource in the sleep state.
- Wake - Identifies metrics concerning a resource in the wake state.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | Screen Saver Off | Screen Saver On | Sleep | Wake | Examples |
|---|---|---|---|---|---|---|---|---|
| Domain | domain | Domain of the display. | String | Windows only | Windows only | NA | NA | DTEST-WIN10-1 |
| Duration in Milliseconds | duration_millis | Wake or sleep duration. | Long | NA | NA | Windows only | Windows only | 641 |
| Event Status | event_status | For an OS start trigger, the status is Request. For an OS start complete, the status is Complete. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | Complete |
| Trigger Time | trigger_time | Identifies the boot start time. | File Date-Time | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | (Timestamp) seconds (INT64) = 1645402934 nanos (INT32) = 340502704 |
| User | user | The user of the display. | String | macOS and Windows | macOS and Windows | NA | NA | Administrator |
| {.filterTable} |
Network
The network table lists data concerning components in the system that connects and facilitates communication between the devices and resources in your Experience Management deployment.
-
Event category: Network
-
Entity: net_event
- net_event_l2_connected - Identifies that the resource is connected to the network.
- net_event_l2_disconnected - Identifies that the resource is not connected to the network.
- net_event_l2_reconfigured - Identifies that the network on the resource has been reconfigured.
- net_event_l2_statistic - Identifies metrics pertaining to the network.
- lan_gw_latency - Identifies that the network has a LAN latency issue.
- wan_dns_latency - Identifies that the network has a WAN latency issue.
- Public IP - Identifies location data such as address, city, country, region, longitude, latitude, and geolocation ID of a public IP. This event requires the device to have network access to the following domains:
ts.awmdm.com,ts4.awmdm.com, andts6.awmdm.com.
-
Minimum agent version: Use 25.09 to use the Public IP event and 24.12 for all other events.
| Friendly Name | Property | Definition | Type | net_event_l2_connected | net_event_l2_disconnected | net_event_l2_reconfigured | net_event_l2_statistic | lan_gw_latency | wan_dns_latency | Public IP | Examples |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Dot11 Auth Type | dot11_auth_type | Lists the authentication type used to establish a connection. | String | Windows only | NA | Windows only | NA | NA | NA | NA | WPA2 RSNA |
| Dot11 Available Modes | dot11_available_modes | Lists modes supported by an adapter. What displays in this list depends on the adapter’s configuration settings. Possible values are 802.11, +, and a/b/g/n/ac/ad/ax. | String List | Windows only | NA | Windows only | NA | NA | NA | NA | 802.11b 802.11g 802.11n 802.11a 802.11ac 802.11ax |
| Dot11 BSS Available Modes | dot11_bss_available_modes | Lists the available 802.11 modes on the access point that the adapter is connected to. | String List | Windows only | NA | Windows only | NA | NA | NA | NA | 802.11ax |
| Dot11 BSS IPv4address | dot11_bss_ipv4address | Lists the IPv4 address of the access point that the adapter is connected to. | String | Windows only | NA | Windows only | NA | NA | NA | NA | 0.0.0.0 |
| Dot11 BSS WiFi Generation | dot11_bss_wifi_generation | Lists the latest WiFi generation supported by the access point that the adapter is connected to. | String | Windows only | NA | Windows only | NA | NA | NA | NA | Wi-Fi 6 |
| Dot11 BSS WPS Enabled | dot11_bss_wps_enabled | Lists the WiFi protected setup (WPS) activated on an access point that the adapter is connected to. | Boolean | Windows only | NA | Windows only | NA | NA | NA | NA | TRUE |
| Dot11 BSS WPS Modes | dot11_bss_wps_modes | Lists the WiFi protected setup modes activated on the access point that the adapter is connected to. | String List | Windows only | NA | Windows only | NA | NA | NA | NA | Privacy WPS Push Button Pin |
| Dot11 BSSID | dot11_bssid | Lists the MAC address of an access point. | String | Windows only | NA | Windows only | NA | NA | NA | NA | a8:5b:f7:fc:6e:11 |
| Dot11 Channel | dot11_channel | Lists the WiFi channel used by a connection. | Integer | macOS and Windows | NA | macOS and Windows | NA | NA | NA | NA | 64 |
| Dot11 Encryption | dot11_encryption | Lists the encryption algorithm used by this connection. Possible values: None WEP-RC4-40 WEP-RC4-104 WEP-RC4-ANY TKIP-RC4 WPA-USE-GROUP CCMP-AES-128 CCMP-AES-256 BIP-CMAC-128 BIP-CMAC-256 BIP-GMAC-128 BIP-GMAC-256 GCMP-AES-128 GCMP-AES-256 IHV | String | Windows only | NA | Windows only | NA | NA | NA | NA | CCMP-AES-128 |
| Dot11 Frequency | dot11_frequency | Lists the values as 2.4 or 5 GHz. | Float | macOS and Windows | NA | macOS and Windows | NA | NA | NA | NA | 5.320000172 |
| Dot11 Mode | dot11_mode | Lists the 802.11 mode. Possible values are 802.11, +, and a/b/g/n/ac/ad/ax. | String | macOS and Windows | NA | macOS and Windows | NA | NA | NA | NA | 802.11ax |
| Dot11 RSSI | dot11_rssi | Lists the signal strength in decibels-milliwatts (dBm). | Integer | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | NA | NA | NA | -39 |
| Dot11 Security Standard | dot11_security_standard | Indicates the security standard used to establish a connection. Possible values are: Unknown Open WP WPA Personal WPA Enterprise WPA2 Personal WPA2 Enterprise WPA3 Personal WPA3 Enterpriser IHV | String | macOS and Windows | NA | macOS and Windows | NA | NA | NA | NA | WPA2 Enterprise |
| Dot11 Signal Quality | dot11_signal_quality | Indicates the signal quality, as a percentage, provided by Microsoft Windows. | Integer | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | NA | NA | NA | 85 |
| Dot11 SSID | dot11_ssid | Lists the wireless network name. | String | macOS and Windows | NA | macOS and Windows | macOS and Windows | NA | NA | NA | Acme |
| Dot11 WiFi Generation | dot11_wifi_generation | Lists the latest WiFi generation supported by the adapter. Possible values are Wifi-1..6 and 6E. | String | Windows only | NA | Windows only | NA | NA | NA | NA | Wi-Fi 6 |
| Event Friendly Name | event_friendly_name | A human readable name of the event. | String | NA | NA | NA | NA | NA | NA | Windows only | Public IP |
| Geolocation IPv4 Address | geolocation_ipv4_address | Identifies an IPv4 address mapped to a location. | String | NA | NA | NA | NA | NA | NA | Windows only | 192.30.67.11 |
| Geolocation IPv6 Address | geolocation_ipv6_address | Identifies an IPv6 address mapped to a location | String | NA | NA | NA | NA | NA | NA | Windows only | 2600:1700:1dd0:1b90:80bf:fab:78e0:4029%0 |
| IPv4 Addresses | ipv4_addresses | Lists the IPv4 addresses and subnet lengths. For example, 10.20.30.40/22. | String List | macOS and Windows | NA | macOS and Windows | NA | NA | NA | Windows only | 10.4.137.89/21 |
| IPv4 City | ipv4_city | Identifies the city to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | Atlanta |
| IPv4 Country | ipv4_country | Identifies the country to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | United States (US) |
| IPv4 DHCP Enabled | ipv4_dhcp_enabled | Indicates that IPv4 DHCP is activated for a connection. | Boolean | Windows only | NA | Windows only | NA | NA | NA | NA | TRUE |
| IPv4 DHCP Server | ipv4_dhcp_server | Lists the IP address of the IPv4 DHCP server that issued the connection’s IP address. | String | Windows only | NA | Windows only | NA | NA | NA | NA | 192.168.133.254 |
| IPv4 DNS Servers | ipv4_dns_servers | Lists the IPv4 DNS servers. | String List | Windows only | NA | Windows only | NA | NA | NA | NA | 10.117.0.1 10.111.0.1 10.112.16.131 |
| IPv4 Enabled | ipv4_enabled | Indicates that IPv4 is activated for a connection. | Boolean | macOS and Windows | NA | macOS and Windows | NA | NA | NA | NA | TRUE |
| IPv4 Gateways | ipv4_gateways | Lists the IPv4 gateways. | String List | Windows only | NA | Windows only | NA | NA | NA | NA | 10.4.143.253 |
| IPv4 Geolocation ID | ipv4_geolocation_id | A value that represents the geographic data assigned to a public IP. | String | NA | NA | NA | NA | NA | NA | Windows only | 192.30.67.11 |
| IPv4 LAN Average Latency | ipv4_gw_avg_resp | Indicates the average latency for IPv4 gateway in milliseconds. | Double | NA | NA | NA | NA | macOS and Windows | NA | NA | 564.0000000 |
| IPv4 LAN Gateway Address | ipv4_gw_addr | Lists the IP address of the IPv4 gateway. | String | NA | NA | NA | NA | macOS and Windows | NA | NA | 10.185.111.254 |
| IPv4 LAN Packet Loss Rate | ipv4_gw_packet_loss_rate | Indicates the percentage of packet loss rate for IPv4 gateway. | Double | NA | NA | NA | NA | macOS and Windows | NA | NA | 0.0000000 |
| IPv4 Latitude | ipv4_latitude | Lists the latitudinal quardinates to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | 33.74 |
| IPv4 Longitude | ipv4_longitude | Lists the longitudinal quardinates to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | -84.38798 |
| IPv4 Region | ipv4_region | Identifies the region to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | Georgia |
| IPv4 WAN Average Latency | ipv4_wan_dns_avg_resp | Indicates the average latency for IPv4 WAN DNS in milliseconds. | Double | NA | NA | NA | NA | NA | macOS and Windows | NA | 814.000000 |
| IPv4 WAN DNS Target Address | ipv4_wan_dns_target_addr | Lists the IP address of the IPv4 WAN DNS address. | String | NA | NA | NA | NA | NA | macOS and Windows | NA | 8.8.8.8 |
| IPv4 WAN Packet Loss Rate | ipv4_wan_dns_packet_loss_rate | Indicates the percentage of packet loss rate for IPv4 WAN DNS. | Double | NA | NA | NA | NA | NA | macOS and Windows | NA | 0 |
| IPv6 Addresses | ipv6_addresses | Lists the IPv6 addresses and subnet lengths. | String List | macOS and Windows | NA | macOS and Windows | NA | NA | NA | Windows only | fe80::50:56ff:fe56:4453 |
| IPv6 City | ipv6_city | Identifies the city to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | Atlanta |
| IPv6 Country | ipv6_country | Identifies the country to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | United States (US) |
| IPv6 DNS Servers | ipv6_dns_servers | List the IPv6 DNS servers. | String List | Windows only | NA | Windows only | NA | NA | NA | NA | fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1 |
| IPv6 Enabled | ipv6_enabled | Indicates that IPv6 is activated for a connection. | Boolean | macOS and Windows | NA | macOS and Windows | NA | NA | NA | NA | TRUE |
| IPv6 Gateways | ipv6_gateways | Lists the IPv6 gateways. | String List | Windows only | NA | Windows only | NA | NA | NA | NA | |
| IPv6 Geolocation ID | ipv6_geolocation_id | A value that represents the geographic data assigned to a public IP. | String | NA | NA | NA | NA | NA | NA | Windows only | 2600:1700:1dd0:1b90:80bf:fab:78e0:4029%0 |
| IPv6 LAN Average Latency | ipv6_gw_avg_resp | Indicates the average latency for IPv6 gateway in milliseconds. | Double | NA | NA | NA | NA | macOS and Windows | NA | NA | 814.00000000 |
| IPv6 LAN Gateway Address | ipv6_gw_addr | Lists the IP address of the IPv6 gateway. | String | NA | NA | NA | NA | macOS and Windows | NA | NA | fe80::50:56ff:fe56:4453 |
| IPv6 LAN Packet Loss Rate | ipv6_gw_packet_loss_rate | Indicates the percentage of packet loss rate for IPv6 gateway. | Double | NA | NA | NA | NA | macOS and Windows | NA | NA | 0.0000000 |
| IPv6 Latitude | ipv6_latitude | Lists the latitudinal quardinates to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | 33.74 |
| IPv6 Longitude | ipv6_longitude | Lists the longitudinal quardinates to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | -84.38798 |
| IPv6 Region | ipv6_region | Identifies the region to which a public IP is mapped. | String | NA | NA | NA | NA | NA | NA | Windows only | Georgia |
| IPv6 WAN Average Latency | ipv6_wan_dns_avg_resp | Indicates the average latency for IPv6 WAN DNS in milliseconds. | Double | NA | NA | NA | NA | NA | macoS and Windows | NA | 29.000000 |
| IPv6 WAN DNS Target Address | ipv6_wan_dns_target_addr | Lists the IP address of the IPv6 WAN DNS address. | String | NA | NA | NA | NA | NA | macOS and Windows | NA | fe80::50:56ff:fe56:4453 |
| IPv6 WAN Packet Loss Rate | ipv6_wan_dns_packet_loss_rate | Indicates the percentage of packet loss rate for IPv6 WAN DNS. | Double | NA | NA | NA | NA | NA | macOS and Windows | NA | 0.0000000 |
| L2 Avg Recv Bps | l2_rx_avg_bps | Indicates the average received bytes per second over a sample period. | Long | NA | NA | NA | macOS and Windows | NA | NA | NA | 4738.00 |
| L2 Avg Tx Bps | l2_tx_avg_bps | Indicates the average transmitted bytes per second over sample period. | Long | NA | NA | NA | macOS and Windows | NA | NA | NA | 4785.00 |
| L2 Connection Breadcrumb | l2_connection_breadcrumb | To link events together, the system generates a unique connection GUID for each connection event as indicated by the event net_event_l2_connected. The system uses the generated GUID in subsequent events ( lan_gw_latency and wan_dns_latency,net_event_l2_disconnected, net_event_l2_reconfigured, and net_event_l2_statistics) that are associated with a connection. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | NA | d6e7de41-49f2-4995-aeef-021290d1ad67 |
| L2 Recv Bps | l2_rx_link_speed_bits_ps | Lists the current received link speed in bits per second. | Long | NA | NA | NA | macOS and Windows | NA | NA | NA | 310000000.00 |
| L2 Tx Bps | l2_tx_link_speed_bits_ps | Lists the current transmitted link speed in bits per second. | Long | NA | NA | NA | macOS and Windows | NA | NA | NA | 542000000.00 |
| NIC Description | nic_description | Identifies the network interface card. lan_gw_latencynet_event_l2_connected net_event_l2_disconnected net_event_l2_reconfigured net_event_l2_statisticswan_dns_latency | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | NA | Intel(R) 82574L Gigabit Network Connection |
| NIC Type | nic_type | Indicates that the network is a wired Ethernet 802.1 or a wireless 802.1. Possible values are Ethernet and Wireless. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | NA | Wireless |
| Physical Address | physical_address | Lists the MAC address. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | NA | 02:00:72:24:e4:b2 |
| {.filterTable} |
Network adapters
The network adapter table lists data concerning the cards in devices and resources that facilitate connection to the network and that allow communication with the network and the internet in your Experience Management deployment.
- Event category: Network
- Entity: device_network_adapter - Lists the device network adapter information, for example, NIC type and description, MAC address, or driver name.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | device_network_adapter | Examples |
|---|---|---|---|---|---|
| Driver Install Date | driver_install_date | Indicates the date a driver was installed or updated. | Date-Time | Windows only | Friday, October 4, 2024 |
| Driver Name | driver_name | Lists the installed driver name. | String | Windows only | Intel(R) Wireless-AC 9560 160MHz |
| Driver Problem | driver_problem | A flag that indicates that the system found an issue with a driver. | Boolean | Windows only | FALSE |
| Driver Problem Description | driver_problem_description | Lists the problem with a driver. | String | Windows only | A description of the driver problem. |
| Driver Provider | driver_provider | Lists the author of an installed driver. | String | Windows only | Intel |
| Driver Published Date | driver_published_date | Indicates the date a driver was published. On Windows, this value is the DriverVer from the INF file. | Date-Time | Windows only | Tuesday, April 30, 2024 |
| Driver Version | driver_version | Lists the installed driver version. | String | Windows only | 23.60.1.2 |
| NIC Description | nic_description | Describes the unique adapter. | String | macOS and Windows | Intel(R) Wireless-AC 9560 160MHz |
| NIC Manufacturer | nic_manufacturer | Indicates the manufacturer. An example is Intel. | String | macOS and Windows | Intel Corporation |
| NIC Model | nic_model | Lists the model name of an adapter. | String | macOS and Windows | Intel(R) Wireless-AC 9560 160MHz |
| NIC Type | nic_type | Indicates that the adapter is a wired Ethernet 802.1 or a wireless 802.11. Possible values are Ethernet and Wireless. | String | macOS and Windows | Wireless |
| Physical Address | physical_address | List the MAC address of an adapter. | String | macOS and Windows | 04:ed:33:79:3c:c2 |
| {.filterTable} |
OS Updates
The OS updates table lists data concerning the updates, which can include new features, security enhancements, and performance improvements, pushed to resource operating systems in your Experience Management deployment.
- Event category: OS Updates
- Entity: os_updates
- Patch Install - Identifies metrics pertaining to a resources’s patch installation, for example the duration and the patch title.
- Patch Uninstall - Identifies metrics pertaining to a resources’s patch uninstallation, for example the GUID and the error code.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | Patch Install | Patch Uninstall | Examples |
|---|---|---|---|---|---|---|
| Duration in Milliseconds | duration_millis | The OS updated installation duration. | Long | Windows only | Windows only | 593 |
| Error | error | An error code in the event log. | String | NA | Windows only | 0x80070013 |
| Event Status | event_status | Reports the status of the event as complete, request, and failed. | String | macOS and Windows | macOS and Windows | Complete |
| GUID | guid | The globally unique identifier of the OS update. | UUID | Windows only | Windows only | 32505c-a41c-aff0-babe-01963daa4da0 |
| Revision Number | revision_number | A unique ID that indicates a change or a revision of an OS update. | String | macOS and Windows | macOS and Windows | 2949172 |
| Title | title | The title of the OS update. | String | macOS and Windows | macOS and Windows | Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.361.786.0) |
| Transaction Identifier | transaction_id | A unique ID that identifies the OS update transaction. | String | Windows only | Windows only | 10975597789300736267 |
| Trigger Time | trigger_time | The time an event triggered | File Date-Time | macOS and Windows | macOS and Windows | (Timestamp) seconds (INT64) = 1645402934 nanos (INT32) = 340502704 |
| {.filterTable} |
Service inventory
The Service Inventory table lists data about Windows services running on endpoint devices in your Experience Management deployment.
- Event category: Service inventory
- Entity: service_inventory
- Minimum agent version: 26.07
| Friendly Name | Property | Definition | Type | Examples |
|---|---|---|---|---|
| App Volumes Package ID | av_package_id | The App Volumes package identifier associated with the service. | Uuid | 08870c17-bca9-4558-9a4f-311f60e83439 |
| From App Volumes | is_loaded_from_av | Indicates whether the service is delivered from App Volumes. | Boolean | true |
| Process Name | image_name | The name of the process hosting the service. | String | svchost.exe |
| Process Version | image_version | The version of the process hosting the service. | String | 10.0.26100.5074 |
| Service Auto Recovery | auto_recovery | Indicates whether auto recovery is configured for the service. | Boolean | true |
| Service Description | description | The description of the service. | String | Omnissa Experience Management Service collects telemetry for use with the Omnissa Digital Employee Experience Management Solution |
| Service Display Name | display_name | The display name of the service. | String | Omnissa Experience Management Service |
| Service Dll Name | dll_name | The name of the DLL associated with the service. On Windows, many services run inside a shared host process; this attribute captures the service DLL name. | String | ztdhelper.dll |
| Service Dll Version | dll_version | The version of the DLL associated with the service. | String | 10.0.26100.6725 |
| Service Id | service_id | The unique identifier of the service. On Windows, this is a hash of the service name. | String | 5086996434635914803 |
| Service Logon Account Domain | account_domain | The domain of the user account under which the service runs. Affects service permissions and access. | String | Testdomain |
| Service Logon Account User | account_user | The user account under which the service runs. Affects service permissions and access. Allowed values: Local System, Local Service, Network Service. | String | Local System |
| Service Name | name | The name of the service. | String | ws1etlm |
| Service Startup Type | startup_type | The startup type of the service, which defines how and when the service starts. Allowed values: Automatic, Manual, Disabled. | String | Automatic |
| Service Status | status | The current status of the service. Allowed values: Running, Stopped. | String | Running |
| Service Type | type | The type of service. Allowed values: System, User, User_Instance. | String | System |
| Session Domain | session_domain | The session domain for a User service instance. | String | testdomain |
| Session Id | session_id | The session identifier for a User service instance. | String | 2 |
| Session User | session_user_name | The session user name for a User service instance. | String | testuser |
| {.filterTable} |
Service inventory change event
In addition to the Service Inventory snapshot entity, Omnissa Intelligence creates two derived timeseries entities that track historical changes to service inventory data over time.
- Service Inventory Change Event that tracks changes to
service_inventorydata for UEM-managed Windows devices. - Service Inventory Change Event (Horizon) that tracks changes to
horizon_service_inventorydata for Horizon-managed devices.
The Service Inventory snapshot entity captures a point-in-time inventory of all services on a device at each reporting cycle. However, snapshot data alone doesn't tell you what changed and when it changed. The Inventory Change Event entity does tell you what changed and when it changed.
Each time a new snapshot arrives for a specific service on a given device, Intelligence compares the current and previous attribute values for each service. If any attribute changes - service status, startup type, account user, display name, or any other tracked field - Intelligence automatically creates a timeseries entry recording that change. You now have a queryable history of changes.
Example use case
An IT admin wants to know when a specific service stops running across their fleet, and wants to be alerted to it - not just see the current state.
- The snapshot entity shows the current inventory.
- The change event entity activates automations and alerts that are triggered when a service transitions from Running to Stopped (or any other state change).
Allowed values
Service Status values
| Value | Description |
|---|---|
| Running | The service is currently active and running. |
| Stopped | The service is not running. |
Service Startup Type values
| Value | Description |
|---|---|
| Automatic | The service starts automatically when the system starts. |
| Manual | The service starts only when explicitly started by a user or application. |
| Disabled | The service is disabled and cannot be started. |
| System | The service is loaded during kernel initialization, early in system startup. |
Service Type values
| Value | Description |
|---|---|
| System | A service that runs in a shared host process (e.g. svchost.exe). |
| User | A per-user service instance. |
| User Instance | A specific instance of a per-user service. |
Service Logon Account User values
| Value | Description |
|---|---|
| Local System | A highly privileged built-in account used by the operating system. |
| Loacl Service | A built-in account with reduced privileges for services that do not need network access. |
| Network Service | A built-in account that has network access but reduced local privileges. |
| User Account | A specific user or domain account under which the service runs, using that account's credentials and permissions. For services running under a specific user account (for example domain\user), the system splits the value and populates either the Service Logon Account User and the Service Logon Account Domain attribute accordingly. |
Services
The services table lists data concerning the Omnissa App Volumes service and other services in your Experience Management deployment.
- Event category: Services
- Entity: services
- Service Installed - Identifies metrics pertaining to the installation of a service.
- Service Removed - Identifies metrics pertaining to the removal of a service.
- Service Start - Identifies metrics pertaining to the start of a service on a Windows resource, for example the App Volumes package ID.
- Service Stop - Identifies metrics pertaining to the stoppage of a service on a Windows resource, for example the process ID.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | Service Installed | Service Removed | Service Start | Service Stop | Examples |
|---|---|---|---|---|---|---|---|---|
| App Volumes Package ID | av_package_id | Lists the ID of an App Volumes package. | UUID | NA | NA | Windows only | Windows only | 08870c17-bca9-4558-9a4f-311f60e83439 |
| Duration in Milliseconds | duration_millis | Indicates how long it takes to start or stop the service successfully. | Long | NA | NA | Windows only | Windows only | 72 |
| Event Status | event_status | The status of the service event. | String | macOS only | macOS only | Windows only | Windows only | Complete |
| From App Volumes | is_loaded_from_av | Identifies whether an application was delivered by App Volumes or not. | Boolean | NA | NA | Windows only | Windows only | FALSE |
| Image Name | image_name | Lists the executable of the service. | String | macOS only | macOS only | Windows only | Windows only | sppsvc.exe |
| Process ID | process_id | Lists the process ID of the service. | String | NA | NA | Windows only | Windows only | 11516 |
| Service Display Name | service_display_name | Lists the service long name. | String | macOS only | macOS only | Windows only | Windows only | Software Protection |
| Service Name | service_name | macOS: This data field lists the identifier of the service. Windows: This data field lists the service short name. | String | macOS only | macOS only | Windows only | Windows only | TrustedInstaller |
| Trigger Time | trigger_time | The time a service event triggered. | File Date-Time | macOS only | macOS only | Windows only | Windows only | (Timestamp) seconds (INT64) = 1645402934 nanos (INT32) = 340502704 |
| User | user | Lists the service owner. | String | macOS only | macOS only | NA | NA | admin |
| {.filterTable} |
Software metering
The software metering table lists data concerning the software metering solution, which monitors desktops, measures usage, and works with workflows to automate actions for productivity and security applications, in your Experience Management deployment.
- Event category: NA
- Entity: NA
- Minimum agent version: 24.12
| Friendly Name | Definition | Source | Supported on Windows | Supported on macOS |
|---|---|---|---|---|
| Active Applications | Count of device with last application foreground time within 14, 30, 45, 60, 90, or 120 days (count of devices). Active Apps = Total Device Count with app installed - Inactive Device Count | App Activity | Yes | Yes |
| App Create Date | Date the application was initially installed in your environment on a device, ignoring versioning. | Software Metering UEM | Yes | Yes |
| App Status | Identifies if the app is managed or unmanaged. | UEM | Yes | Yes |
| Application Name | Parent name for all applications mapped to single identifier. | Software Application Catalog | Yes | Yes |
| Average Foreground Time | Calculated based on Total Foreground Time during set time period / Count of Foreground Launch events during set time period. | Employee Experience | Yes | Yes |
| Category | Category allows the grouping of similar software applications for easy comparison. | Software Application Catalog | Yes | Yes |
| Device Model | The model of the device. | UEM | Yes | Yes |
| Device Name | The friendly name of the device. | UEM | Yes | Yes |
| Foreground Activity | The user selected foreground activity for calculating metrics on the dashboard. | Software Metering | Yes | Yes |
| Inactive Applications | Count of devices with last application foreground time not within 14, 30, 45, 60, 90, or 120 days. Inactive Apps = Total devices with app installed - Active Device Count | App Activity Employee Experience | Yes | Yes |
| Last Seen | The last date the device had an event with the applications. | UEM | Yes | Yes |
| OS Version | Current version of the operating system. | UEM | Yes | Yes |
| Platform | Specific platform. | UEM | Yes | Yes |
| Platforms | List of all platforms associated with the software applications. | App Activity Employee Experience | Yes | Yes |
| Product Last Foreground XX days | The last time the product was interacted with within a selected time range (14, 30, 45, 60, 90, or 120 days). | Software Metering | Yes | Yes |
| Product URL | The URL to the publisher product page. | Software Application Catalog | Yes | Yes |
| Publisher | The parent company that owns the application. | Software Application Catalog | Yes | Yes |
| Status | Manage and unmanaged status imported from UEM. | UEM | Yes | Yes |
| Total Applications | The total count of devices with the application currently installed. | App Activity | Yes | Yes |
| Total Foreground Time | Sum of foreground time across all applications within a set time period. | Employee Experience | Yes | Yes |
| {.filterTable} |
Storage information
The storage information table lists data concerning the components that store information and house saved data for resources to access in your Experience Management deployment.
- Event category: Storage information
- Entity: NA
- disk_info - Lists the disk information, for example, disk name, media type, protocol type, or bus type.
- volume_info - Lists the volume information, for example, mount path, drive letter, or capacity.
- Minimum agent version: 24.12
| Friendly Name | Definition | disk_info | volume_info | Examples |
|---|---|---|---|---|
| Disk Name | The disk name that was returned by the Windows OS. | Windows only | Windows only | Micron 2300 NVMe 1024GB |
| Disk Size | Total space of the disk, and it includes reserved space and available space. Reserved space is the space reserved by the operating system or hardware that can not be assigned to volumes. Available space is the space that can be assigned to volumes. | Windows only | Windows only | 5000.0 (Megabytes) |
| Drive Letter | Letter of the drive, which can be C, D, E, or F. | Windows only | Windows only | C |
| Failed | Indicates a failure during the collection of disk information, like an inaccessible USB disk. | Windows only | Windows only | True False |
| Free Space | The free space of the volume as reported by the filesystem. | Windows only | Windows only | 1000.0 (Megabytes) |
| Health Status | The disk’s health status, which is based on S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology), Hardware Error, and Transient Error. | Windows only | Windows only | Unknown Unhealthy Warning Healthy |
| Information Type | The type of information. | Windows only | Windows only | Disk Volume |
| Is Active System Drive | Indicates whether the volume contains the running operating system. | Windows only | Windows only | True False |
| Is Present | Indicates that the disk is present, if the disk is unplugged, or if it is set to false. By default, the system reports disk removal for up to seven days. | Windows only | Windows only | True False |
| Is Removable | Indicates that the disk is removable, like a USB drive. | Windows only | Windows only | True False |
| Last Removal Time | When combined with Is Present, displays the last removal time. By default, the system reports disk removal for up to seven days. | Windows only | Windows only | 2/27/2024 20:31 |
| Manufacturer Name | The name of the storage manufacturer. | Windows only | Windows only | Micron |
| Media Type | Identifies the solid state drives (SSDs). Provided as an ENUM (enumerated type). | Windows only | Windows only | SSD HDD Other |
| Unallocated Space | The unallocated disk space not assigned to volumes. | Windows only | Windows only | 1000.0 (Megabytes) |
| Unique Identifier | An identifier that is locally generated to uniquely identify the device. | Windows only | Windows only | 18026096556741400000 |
| Used Space Percentage | The used volume space percentage that is reported by the filesystem. | Windows only | Windows only | 40.0% |
| Volume Size | The size of the volume. | Windows only | Windows only | 5000.0 (Megabytes) |
| Volume Type | Indicates the volume type as data, recovery, or other. Data: Indicates that the volume is used to save files. Recovery: Indicates that the recovery volume is used for system recovery and troubleshooting. Other: Indicates other types of volumes besides data and recovery. | Windows only | Windows only | Data Recovery Other |
| {.filterTable} |
Synthetic URL monitoring
The synthetic URL monitoring table lists data concerning the synthetic URL monitoring solution, which monitors specific web applications and URLs to identify network performance issues and availability, in your Experience Management deployment.
- Event category:
- Entity: synthetic_url_monitoring
- http_https_url_test - Identifies metrics for or a web application or a URL experiencing network performance issues, for example a reason for failure or a protocol version.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | http_https_url_test | Examples |
|---|---|---|---|---|---|
| Certification Valid From | cert_valid_from_time | The secure connection certificate start date. | Date-Time | Windows only | (Timestamp) seconds (INT64) = 1701293404 nanos (INT32) = 0 |
| Certification Valid To | cert_valid_to_time | The secure connection certificate end date. | Date-Time | Windows only | (Timestamp) seconds (INT64) = 1709069403 nanos (INT32) = 0 |
| Configured IP Protocol | configured_ip_protocol | Administrator configured IP (Internet Protocol) to run tests. The possible IP protocols are IPv4, IPv6, and Auto. | String | Windows only | IPv4 |
| Fail Reason | fail_reason | The reason a connection failed. | String | Windows only | Resolving timed out after 1006 milliseconds/ Could not resolve host: bad_host/ Request failed with status code: 404 |
| HTTP Response Time in Milliseconds | http_resp_millis | The time it takes for the data transfer to complete. | Double | Windows only | 270.770000 |
| HTTP Status Code | http_status_code | HTTP/S code connection. Empty status indicates failure. | Integer | Windows only | 404 |
| IP Protocol Version | ip_protocol_version | IP protocol used in testing. | String | Windows only | IPv4 |
| Is Secure Protocol | is_secure_protocol | True if there is a secure TLS/SSL connection, and False otherwise. | Boolen | Windows only | 1 |
| Is Success | is_success | Indicates whether the connection is a success. | Boolean | Windows only | 1 |
| Name Response Time in Milliseconds | name_res_millis | The time it takes for the name to resolve. | Double | Windows only | 26.856000 |
| Socket Connection Time in Milliseconds | socket_conn_millis | The time it takes to connect to the remote host (or proxy). | Double | Windows only | 374.133000 |
| TLS Setup Time in Milliseconds | tls_setup_millis | The time it takes for the SSL connect or handshake with the remote host. | Double | Windows only | 24.610000 |
| Target Address | target_address | The target URL to test. | String | Windows only | https://example-102303.com |
| Target IP Address | target_ip_address | Resolved IP address of the target address. | String | Windows only | 44.230.85.241 |
| Test ID | test_id | A UUID for each synthetic test. | String | Windows only | 156d003e-fe38-4640-a56e-dbcd0bd5df99 |
| Test Type | test_type | Synthetic test type. | String | Windows only | Http/s |
| Total Response Time in Milliseconds | total_resp_millis | Total HTTP/S connection time. | Double | Windows only | 129.750000 |
| {.filterTable} |
User actions
The user actions table lists data concerning who interacts with your resources and from where in your Experience Management deployment.
- Event category: User Actions
- Entity: user_actions
- Logon - Identifies metrics concerning user actions while logging on to a resource, for example logon type or the user name.
- Logout - Identifies metrics concerning user actions while logging out of a resource, for example if the logging out failed.
- Lock - Identifies metrics concerning user actions while locking a resource, for example the computer domain name.
- Unlock - Identifies metrics concerning user actions while unlocking a resource, for example if the unlock was successful.
- Minimum agent version: 24.12
| Friendly Name | Property | Definition | Type | Logon | Logout | Lock | Unlock | Examples |
|---|---|---|---|---|---|---|---|---|
| Domain | domain | The computer domain name. | String | Windows only | Windows only | Windows only | Windows only | DTEST-WIN10-1 |
| Event Status | event_status | The status of the user action. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | Complete |
| Logon Type | logon_type | The type of log on. For example, Interactive. | String | Windows only | NA | Windows only | Windows only | Interactive |
| Result | result | The result of a user action. | String | macOS and Windows | Windows only | Windows only | Windows only | Success |
| Session | session | The user session ID. | Integer | NA | Windows only | Windows only | Windows only | 2 |
| Trigger Time | trigger_time | The time a user action event triggered. | File Date-Time | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | (Timestamp) seconds (INT64) = 1645402934 nanos (INT32) = 340502704 |
| User | user | The logon user name. | String | macOS and Windows | macOS and Windows | macOS and Windows | macOS and Windows | Administrator |
| {.filterTable} |
Web apps
The web apps table lists data concerning the web app monitoring solution, which collects data on web apps using the Omnissa Experience Management browser extension, in your Experience Management deployment.
- Event category: Web App Metrics
- Entity: web_app_metrics
- web_app_speed - Identifies metrics for an internet session.
- web_app_error - The error when a page load failed and it includes two types of errors: HTTP error and Browser error.
- Minimum agent version: 25.03
| Friendly Name | Property | Definition | Type | web_app_speed | web_app_error | Examples |
|---|---|---|---|---|---|---|
| Browser | browser_name | The name of the browser. | String | macOS and Windows | macOS and Windows | Microsoft Edge, Google Chrome |
| Browser Version | browser_version | The version of the browser. | String | macOS and Windows | macOS and Windows | 122.0.6261.129 |
| Connection Setup Duration in Milliseconds | connect_duration | The time to establish socket connection between browser and web server. | Double | macOS and Windows | NA | 100 |
| DNS Lookup Duration in Milliseconds | dns_duration | The time to resolve domain names. | Double | macOS and Windows | NA | 100 |
| DOM Content Load Duration | dom_content_load_duration | The time when the HTML structure of a page is fully parsed, allowing JavaScript to execute and other elements to load. This is a metric for understanding how quickly a webpage becomes interactive. | Double | macOS and Windows | NA | 100 |
| DOM Processing Duration | dom_processing_duration | The time for the browser to understand and build the structure of the page. This duration is a key factor in overall page load time and user experience. | Double | macOS and Windows | NA | 100 |
| Error | error | The error when a page load failed. Errors include HTTP error and Browser error. | String | NA | macOS and Windows | HTTP ERROR 404 net::ERR_FAILED |
| Extension Version | extension_version | The version of the browser extension | String | macOS and Windows | macOS and Windows | 24.10.0.278 |
| Host of Target URL | target_url_host | The host of the target URL. | String | macOS and Windows | macOS and Windows | https://example.com |
| HTTP Protocol | protocol | The protocol version of HTTP. | String | macOS and Windows | NA | http1.1/h2/h3 |
| HTTP Request Duration in Milliseconds | request_duration | The time until first byte of document response is received. | Double | macOS and Windows | NA | 100 |
| HTTP Response Duration in Milliseconds | response_duration | The time to download the document response. | Double | macOs and Windows | NA | 100 |
| Load Duration in Milliseconds | load_duration | The time to load the web app. | Double | macOS and Windows | NA | 100 |
| Redirect Duration in Milliseconds | redirect_duration | The time for the HTTP redirect if there is one . | Double | macOS and Windows | NA | 100 |
| Relative Reference of Target URL | target_url_relative | The other part of the target URL. | String | macOS and Windows | macOS and Windows | /path?query#anchor |
| TLS Negotiation Duration in Milliseconds | tls_duration | The time to establish a secure socket connection between browser and web server. | Double | macOS and Windows | NA | 100 |
| Total Load Duration in Milliseconds | total_load_duration | The time for a web page to fully load and become interactive, from the initial user request to the final rendering of all its content in the browser. | Double | macOS and Windows | NA | 1000 |
| Unload Duration | unload_duration | The time when a document or a child resource is being unloaded, such as when a user navigates away from a page, closes a tab, or refreshes the page. | Double | macOS and Windows | NA | 100 |
| {.filterTable} |
Was this page helpful?