Author Topic: updated pma.trid.xml for Windows Performance Monitor Alert  (Read 1017 times)

jenderek

  • Sr. Member
  • ****
  • Posts: 375
Hello trid users,

some days ago i want to get disc back space on my SSD occupied by Window. So
i run software bleacbit found on www.bleachbit.org.

One section with some hundreds MB to clean is called "Edge Browser Metrics".
There are listed file with names like BrowserMetrics-6226A05D-1FB4.pma.
Only a few are described by TrID as "Windows Performance Monitor Alert" by
pma.trid.xml (See appended output/trid-v-old.txt)

So i update definition by running tridscan. Later i found such examples with
names like 20220418142503428_24760.pma or 20220414152811.pma inside program
directory concerning Microsoft Edge. In third step of updating i also find
in another directory a file with name like CrashpadMetrics-active.pma.

Afterwards i look what have changed. At the beginning global strings section
contain 2 lines like:
   <String>METRICS.</String>
   <String>ETIME</String>
With more examples the second line shrink to word TIME and finally vanished.
Only the METRICS keyword survived. I find this as part in words like
BrowserMetrics, CrashpadMetrics or SetupMetrics at offset 80. So i mention
this fact in remark line.

The front block contains one XML construct describing the first bytes. This
looks like:
   <Bytes>DC0583400000</Bytes>
   <ASCII> . . . @</ASCII>
   <Pos>0</Pos>
With more examples the last byte here vanish and construct now becomes like:
   <Bytes>DC05834000</Bytes>
   <ASCII> . . . @</ASCII>
   <Pos>0</Pos>

The current definition contain nor reference URL. I at least found a page
about "Performance Monitor" on Wikipedia. So that information is now
expressed by line like:
 <RefURL>https://en.wikipedia.org/wiki/Performance_Monitor</RefURL>

Unfortunately few items about "alert" are listed and i also found no
information about file format or specification. A few web sites like
filext.com and www.thoughtco.com list a used defined mime type, which seem
for me to be plausible. That is now expressed by additional line like:
   <Mime>application/x-perfmon</Mime>

With the updated trid definition now all my Performance Monitor alerts PMA
examples are described ( see appended output/trid-v.txt). TrID definition,
some examples and output are stored in archive pma_.zip. I hope that my XML
files can be used in future version of triddefs.

With best wishes
Jörg Jenderek

Mark0

  • Administrator
  • Hero Member
  • *****
  • Posts: 2739
    • Mark0's Home Page
Re: updated pma.trid.xml for Windows Performance Monitor Alert
« Reply #1 on: July 14, 2022, 02:08:47 AM »
Thanks!