<?xml version="1.0" encoding="UTF-8"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0" copyright="Copyright (c) Microsoft Corporation. All Rights Reserved.">
  <assemblyIdentity name="Microsoft-Windows-Subsys" version="6.1.7601.17514" processorArchitecture="x86" language="neutral" buildType="release" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" />
  <dependency discoverable="no" resourceType="Resources">
    <dependentAssembly>
      <assemblyIdentity name="Microsoft-Windows-Csrsrv.Resources" version="6.1.7601.17514" processorArchitecture="x86" language="*" buildType="release" publicKeyToken="31bf3856ad364e35" />
    </dependentAssembly>
  </dependency>
  <localization>
    <resources culture="en-US">
      <stringTable>
        <string id="description" value="Subsystem support components" />
        <string id="displayName" value="Subsystem" />
        <string id="EventMessage.CrashDumpCopyError" value="The crash dump file could not be created due to a lack of free space on the destination drive. Increasing the amount of free space on the destination drive may help prevent this error." />
      </stringTable>
    </resources>
  </localization>
  <instrumentation>
    <events xmlns="http://schemas.microsoft.com/win/2004/08/events">
      <provider guid="{e8316a2d-0d94-4f52-85dd-1e15b66c5891}" messageFileName="%windir%\system32\csrsrv.dll" name="Microsoft-Windows-Subsys-Csr" resourceFileName="%windir%\system32\csrsrv.dll" symbol="CsrEventProvider">
        <channels>
          <channel chid="defch" name="Microsoft-Windows-Subsys-Csr/Operational" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x010000" name="csr:Diagnostics" />
        </keywords>
        <templates>
          <template tid="ShutdownProcess">
            <data inType="win:UInt32" name="ProcessId" outType="win:PID" />
            <data inType="win:UInt32" name="Level" />
            <data inType="win:UInt32" name="Flags" />
          </template>
          <template tid="Status">
            <data inType="win:UInt32" name="Status" />
          </template>
        </templates>
        <tasks>
          <task name="csr:ShutdownProcesses" value="1" />
          <task name="csr:ShutdownProcess" value="3" />
        </tasks>
        <events>
          <event channel="defch" keywords="csr:Diagnostics" level="win:Informational" opcode="win:Start" symbol="CsrEvt_ShutdownProcesses_Start" task="csr:ShutdownProcesses" value="1" />
          <event channel="defch" keywords="csr:Diagnostics" level="win:Informational" opcode="win:Stop" symbol="CsrEvt_ShutdownProcesses_Stop" task="csr:ShutdownProcesses" value="2" />
          <event channel="defch" keywords="csr:Diagnostics" level="win:Informational" opcode="win:Start" symbol="CsrEvt_ShutdownProcess_Start" task="csr:ShutdownProcess" template="ShutdownProcess" value="3" />
          <event channel="defch" keywords="csr:Diagnostics" level="win:Informational" opcode="win:Stop" symbol="CsrEvt_ShutdownProcess_Stop" task="csr:ShutdownProcess" template="Status" value="4" />
        </events>
      </provider>
      <provider guid="{43e63da5-41d1-4fbf-aded-1bbed98fdd1d}" messageFileName="%windir%\system32\csrsrv.dll" name="Microsoft-Windows-Subsys-SMSS" resourceFileName="%windir%\system32\csrsrv.dll" symbol="SmssEventProvider">
        <channels>
          <channel chid="defch" name="Microsoft-Windows-Subsys-SMSS/Operational" type="Analytic" />
          <importChannel chid="chidSystem" name="System" />
        </channels>
        <keywords>
          <keyword mask="0x010000" name="smss:Diagnostics" />
        </keywords>
        <templates>
          <template tid="ExecuteImageStart">
            <data inType="win:UInt32" name="Flags" />
            <data inType="win:UInt16" name="ImageNameLength" />
            <data inType="win:UnicodeString" length="ImageNameLength" name="ImageName" />
          </template>
          <template tid="ExecuteImageStop">
            <data inType="win:UInt32" name="ProcessId" outType="win:PID" />
          </template>
          <template tid="FileRename">
            <data inType="win:UInt16" name="FromNameLength" />
            <data inType="win:UInt16" name="ToNameLength" />
            <data inType="win:UnicodeString" length="FromNameLength" name="FromName" />
            <data inType="win:UnicodeString" length="ToNameLength" name="ToName" />
          </template>
          <template tid="FileName">
            <data inType="win:UInt16" name="FileNameLength" />
            <data inType="win:UnicodeString" length="FileNameLength" name="FileName" />
          </template>
        </templates>
        <tasks>
          <task name="smss:ExecuteImage" value="1" />
          <task name="smss:InitializeRegistry" value="3" />
          <task name="smss:SetupExecuteList" value="5" />
          <task name="smss:BootExecuteList" value="7" />
          <task name="smss:ProcessFileRenames" value="9" />
          <task name="smss:FileRename" value="11" />
        </tasks>
        <events>
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Start" symbol="SmssEvt_ExecuteImage_Start" task="smss:ExecuteImage" template="ExecuteImageStart" value="1" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Stop" symbol="SmssEvt_ExecuteImage_Stop" task="smss:ExecuteImage" template="ExecuteImageStop" value="2" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Start" symbol="SmssEvt_InitializeRegistry_Start" task="smss:InitializeRegistry" value="3" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Stop" symbol="SmssEvt_InitializeRegistry_Stop" task="smss:InitializeRegistry" value="4" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Start" symbol="SmssEvt_SetupExecuteList_Start" task="smss:SetupExecuteList" value="5" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Stop" symbol="SmssEvt_SetupExecuteList_Stop" task="smss:SetupExecuteList" value="6" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Start" symbol="SmssEvt_BootExecuteList_Start" task="smss:BootExecuteList" value="7" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Stop" symbol="SmssEvt_BootExecuteList_Stop" task="smss:BootExecuteList" value="8" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Start" symbol="SmssEvt_ProcessFileRenames_Start" task="smss:ProcessFileRenames" value="9" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Informational" opcode="win:Stop" symbol="SmssEvt_ProcessFileRenames_Stop" task="smss:ProcessFileRenames" value="10" />
          <event channel="defch" keywords="smss:Diagnostics" level="win:Verbose" opcode="win:Info" symbol="SmssEvt_FileRename_Info" task="smss:FileRename" template="FileRename" value="11" />
          <event channel="chidSystem" level="win:Error" message="$(string.EventMessage.CrashDumpCopyError)" opcode="win:Info" symbol="SmssEvt_CrashDumpCopy_Error" template="FileName" value="12" />
        </events>
      </provider>
    </events>
  </instrumentation>
</assembly>