#kernel-events

Windows Event ID 4912 – Microsoft-Windows-Kernel-General: Object Manager Symbolic Link Creation

Event ID 4912 logs when the Windows Object Manager creates symbolic links in the kernel namespace, typically during system startup or driver initialization processes.

Windows Event ID 4 – Kernel-General: System Process Terminated Unexpectedly

Event ID 4 indicates a critical system process has terminated unexpectedly, often signaling kernel-level failures, driver issues, or system instability requiring immediate investigation.

Windows Event ID 2 – Kernel-General: System Boot Completion

Event ID 2 from Kernel-General indicates successful Windows system boot completion. This informational event logs when the kernel finishes loading and the system is ready for user logon.

Windows Event ID 12289 – Kernel-General: Memory Manager Performance Counter Update

Event ID 12289 indicates Windows Memory Manager has updated performance counters for memory allocation tracking. This informational event helps monitor system memory usage patterns and virtual memory operations.