Microsoft-Exchange-DxStoreHA

108 events across 5 channels

Event	Title	Channel
1	Performance stats for StoreKind (TotalProcessed: TotalCount).	Performance
2	Performance stats (cumulative) for StoreKind (TotalProcessed: TotalCount).	Performance
3	DxStore variant configuration (Reason: Reason).	Server
4	Terminating current process since Distributed store mode changed.	Server
201	'ApiName' succeeded (Latency: LatencyInMs μs).	Execution
202	'ApiName' failed (Latency: LatencyInMs μs).	Execution
203	Api 'ApiName' failed to proceed further since dag configuration was not …	Execution
401	Primary changed from InitialPrimary to NewPrimary detected by 'ProcessName'.	General
402	Shadow changed from InitialShadow to NewShadow detected by 'ProcessName'.	General
403	Failed to publish distributed store perf results.	General
1001	[Id] Message.	Server
1002	[Id] Message.	Server
1003	[Id] Message.	Server
2001	Failed to start dxstore instance for group GroupName.	Server
2002	Failed to trigger refresh to the dxstore manager.	Server
2003	Failed data store validation.	Validation
2004	Skipped data store validation.	Validation
2005	Completed validation.	Validation
2006	Successfuly updated DestinationStore with SourceStore snapshot (Duration: …	Validation
2007	Failed to update DestinationStore with SourceStore snapshot (Duration: …	Validation
2008	Data Store comparison stats (IsAllMatched: IsEverythingMatches, TotalKeys: …	Validation
2009	Data Store comparison verbose report (Part: PartNumber/TotalParts).	Validation
2010	Distributed store startup version check satisfied.	General
2011	Distributed store startup version check not satisfied.	General
2012	Distributed store startup failed with error: ErrorMessage.	Server
2013	Distributed store startup failed to register diagnostics handler (Group: …	Server
2015	Update to Source store failed.	Server
2016	Update to Source store succeeded.	Server
2017	Attempt to get database availability group for local server failed.	Server
2018	Initiating distributed store switch from 'CurrentConfig' => 'RequestedConfig'.	Server
2019	Distributed store switch attempt failed.	Server
2020	Distriuted store switch completed successfully.	Server
2021	Skipped checking prerequisites due to explicit flag in variant configuration.	Server
2022	Skipped distributed store switch processing since Active directory is not …	Server
2023	Skipped distributed store switch processing since some of the servers are not …	Server
2024	Skipped distributed store switch processing since DAG is not yet fully built or …	Server
2025	[Caller] Skipped checking config sync across dag due to explicit flag in variant …	Server
2026	[Caller] Dual distributed store AD/Variant configuration is not consistent …	Server
2027	Snapshot copy not applicable for the current store switch, hence not proceeding …	Server
2028	Copy snapshot from FromStore => ToStore failed.	Server
2029	Copy snapshot from FromStore => ToStore succeeded.	Server
2030	Attempting do perform full fledged distributed store switch - (Requested config: …	Server
2031	Attempting do configuration sync only - (Syncted to config: SyncedTo).	Server
2032	Attempt to check for distributed store change failed.	Server
2033	Started key swap for open keys in process:'ProcessName' - Initiator: Initiator …	Server
2034	Requested to block key operations for process:'ProcessName' - …	Server
2035	Finished key swap for open keys in process:'ProcessName' -.	Server
2036	Update local distributed store registry configuration initiated from Initiator …	Server
2037	Update local distributed store registry configuration failed.	Server
2038	Update local distributed store configuration succeeded.	Server
2039	Update local distributed store configuration skipped (Previous config: PrevCfg).	Server
2040	Skipped distributed store switch processing since a new request to switch is …	Server
2041	Process 'Operation' operation for key 'KeyName' cancelled due to dual store …	Server
2042	Skipped write test for dual store switch due to explicit flag in variant config …	Server
2043	Dual store switch blocked since last test write operation is not completed yet …	Server
2044	Dual store switch blocked since test write operation did not succeed.	Server
2050	Initiating HA Provider switch.	Server
2051	HA Provider switch succeeded.	Server
2052	HA Provider switch failed.	Server
2053	Attempting HA Provider switch.	Server
2054	Distributed store component startup failed to register DxStore manager …	Server
2100	Attempt to check for distributed store membership change failed.	Server
2101	Skipped distributed store membership check processing since Active directory is …	Server
2102	Skipped distributed store membership check processing since some of the servers …	Server
2103	Witness Server:WitnessServer reported that membership has not been configured.	Server
2104	Witness Server:WitnessServer reported a misconfigured membership.	Server
2105	Skipped distributed store membership check on witness WitnessServer due to …	Server
2106	Skipped distributed store membership update due to preconditions check failure.	Server
2107	Skipped distributed store membership update due to preconditions check failure.	Server
2108	Skipped best effort group creation on server Server due to exception : …	Server
2109	Failed to deserialize MembershipType membership from AD.	Server
2110	Successfully issued staging Paxos update.	Server
2111	Successfully stamped membership to AD.	Server
2112	Successfully issued the UpdateMembership Paxos command to current quorum.	Server
2113	Successfully issued the Create Group command to the DxStore Manager on node …	Server
2114	Successfully issued the Create Group command to the DxStore Manager on …	Server
2115	DxStore Membership - New Variant Config : NewVariantSettings, Existing Variant …	Server
2116	Membership Container Updated.	Server
2117	Straggler Connectivity Information updated: Message.	Server
2200	[GroupName] Local store integrity check failed as checksums did not match.	Server
2201	[GroupName] Local store integrity check skipped as the instance number when the …	Server
2202	[Identity] Local store integrity check published for …	Server
2203	[GroupName] Local store integrity check publish skipped as the leader doesn't …	Server
2204	[Identity] Local store integrity check failed as checksums did not match.	Server
2205	[Identity] Local store integrity check skipped as there is no locally recorded …	Server
2206	[Identity] Local store integrity check skipped as the requested instance number …	Server
3001	[GroupName] There has been no leader consensus since Timestamp.	Server
3002	[GroupName] There has been no log progress since Timestamp.	Server
3003	[GroupName] The DxStore Instance was restarted by the manager.	Server
3004	[GroupName] Group status - Leader: Leader InstanceState: InstanceState …	Server
3005	[GroupName] Group status - Leader: Leader InstanceState: InstanceState …	Server
3006	[GroupName] Group status - Leader: Leader InstanceState: InstanceState …	Server
3007	[GroupName] Node activity matrix.	Server
3008	Dual store configuration sync was able to successfuly read from AD first time …	Server
3009	[GroupName] There has been membership divergence detected since Timestamp.	Server
3010	[GroupName] Instance has requested for wipe edb on next instance start.	Server
3011	[GroupName] The DxStore Instance on NodeName has been seeing one way …	Server
3012	[GroupName] The following nodes are reporting one way communication failures: …	Server
3013	[Identity] Instance number out of sequence (IsRestarting: IsRestarting).	Server
3014	Identity: Blocked local node from participating in leader election (Reason: …	Server
3015	Identity: Allowed local node to participate in leader election.	Server
3016	Identity: Maintenance state check failed.	Server
3017	Identity: Percentage of servers in maintenance is PercentServersInMaintenance …	Server
3018	Identity: Maintenance state not available.	Server
3019	Identity: Blocked paxos message Message (Reason: Reason).	Server
3020	Heartbeat write failed with exception - Message.	Server
3021	[GroupName] There have been heartbeat write failures since LeaderName recorded a …	Server
3026	TypeName in TypeNameSpace are not allowed in DxStore.	Server

Event ID 1: Performance stats for StoreKind (TotalProcessed: TotalCount).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Performance

Description

Performance stats for StoreKind (TotalProcessed: TotalCount).

Fields #

Name	Description
`IsPrimary`
`StoreKind`
`TotalCount`
`TotalInProgress`
`TotalWriteRequestsSkipped`
`TotalReadRequestsSkipped`
`TotalFailedStale`
`TotalFailedNotReady`
`TotalFailedConstraint`
`TotalFailedServerTimeout`
`LatencyStats`
`ExceptionStats`
`ApiStats`
`ProcessName`

Event ID 2: Performance stats (cumulative) for StoreKind (TotalProcessed: TotalCount).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Performance

Description

Performance stats (cumulative) for StoreKind (TotalProcessed: TotalCount).

Fields #

Name	Description
`IsPrimary`
`StoreKind`
`TotalCount`
`TotalInProgress`
`TotalWriteRequestsSkipped`
`TotalReadRequestsSkipped`
`TotalFailedStale`
`TotalFailedNotReady`
`TotalFailedConstraint`
`TotalFailedServerTimeout`
`LatencyStats`
`ExceptionStats`
`ApiStats`
`ProcessName`

Event ID 3: DxStore variant configuration (Reason: Reason).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

DxStore variant configuration (Reason: Reason)

Fields #

Name	Description
`Reason`
`ObjectXml`
`Error`
`ProcessName`
`ProcessId`
`ProcessStartTime`

Event ID 4: Terminating current process since Distributed store mode changed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Terminating current process since Distributed store mode changed. (Previous: 'PreviousMode' New: 'NewMode')

Fields #

Name	Description
`PreviousMode`
`NewMode`
`ProcessName`
`ProcessId`
`ProcessStartTime`

Event ID 201: 'ApiName' succeeded (Latency: LatencyInMs μs).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Execution

Description

'ApiName' succeeded (Latency: LatencyInMs μs)

Fields #

Name	Description
`ApiName`
`IsPrimary`
`StoreKind`
`IsSuccess`
`Key`
`OperationType`
`TimeInitiated`
`LatencyInMs`
`Exception`
`IsSkipped`
`Parameters`
`InstanceId`
`Callstack`
`ProcessName`

Event ID 202: 'ApiName' failed (Latency: LatencyInMs μs).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Execution

Description

'ApiName' failed (Latency: LatencyInMs μs)

Fields #

Name	Description
`ApiName`
`IsPrimary`
`StoreKind`
`IsSuccess`
`Key`
`OperationType`
`TimeInitiated`
`LatencyInMs`
`Exception`
`IsSkipped`
`Parameters`
`InstanceId`
`Callstack`
`ProcessName`

Event ID 203: Api 'ApiName' failed to proceed further since dag configuration was not accessbile even once after reboot.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Execution

Description

Api 'ApiName' failed to proceed further since dag configuration was not accessbile even once after reboot

Fields #

Name	Description
`ApiName`
`LastRecordedAccessTime`
`CurrentBootTime`
`CallStack`
`ProcessName`

Event ID 401: Primary changed from InitialPrimary to NewPrimary detected by 'ProcessName'.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Primary changed from InitialPrimary to NewPrimary detected by 'ProcessName'. Exiting process to run as a different primary data store

Fields #

Name	Description
`InitialPrimary`
`InitialShadow`
`NewPrimary`
`NewShadow`
`ProcessName`

Event ID 402: Shadow changed from InitialShadow to NewShadow detected by 'ProcessName'.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Shadow changed from InitialShadow to NewShadow detected by 'ProcessName'

Fields #

Name	Description
`InitialPrimary`
`InitialShadow`
`NewPrimary`
`NewShadow`
`ProcessName`

Event ID 403: Failed to publish distributed store perf results.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Failed to publish distributed store perf results. (Error: Error)

Fields #

Name	Description
`Error`

Event ID 1001: [Id] Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Id] Message

Fields #

Name	Description
`Id`
`Message`

Event ID 1002: [Id] Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Id] Message

Fields #

Name	Description
`Id`
`Message`

Event ID 1003: [Id] Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Id] Message

Fields #

Name	Description
`Id`
`Message`

Event ID 2001: Failed to start dxstore instance for group GroupName.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Failed to start dxstore instance for group GroupName. (Error: Error)

Fields #

Name	Description
`GroupName`
`Error`

Event ID 2002: Failed to trigger refresh to the dxstore manager.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Failed to trigger refresh to the dxstore manager. (Error: Error)

Fields #

Name	Description
`Error`

Event ID 2003: Failed data store validation.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Failed data store validation. (Reason: ReasonLabel)

Fields #

Name	Description
`ReasonLabel`
`ReasonContext`

Event ID 2004: Skipped data store validation.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Skipped data store validation. (Reason: ReasonLabel, Context: ReasonContext)

Fields #

Name	Description
`ReasonLabel`
`ReasonContext`

Event ID 2005: Completed validation.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Completed validation. (IsEverythingMatches: IsEverythingMatched)

Fields #

Name	Description
`IsEverythingMatched`
`TimingData`

Event ID 2006: Successfuly updated DestinationStore with SourceStore snapshot (Duration: Durationms).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Successfuly updated DestinationStore with SourceStore snapshot (Duration: Durationms)

Fields #

Name	Description
`Duration`
`Error`
`SourceStore`
`DestinationStore`

Event ID 2007: Failed to update DestinationStore with SourceStore snapshot (Duration: Durationms).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Failed to update DestinationStore with SourceStore snapshot (Duration: Durationms)

Fields #

Name	Description
`Duration`
`Error`
`SourceStore`
`DestinationStore`

Event ID 2008: Data Store comparison stats (IsAllMatched: IsEverythingMatches, TotalKeys: TotalKeysCount, TotalProperties: TotalPropertiesCount).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Data Store comparison stats (IsAllMatched: IsEverythingMatches, TotalKeys: TotalKeysCount, TotalProperties: TotalPropertiesCount)

Fields #

Name	Description
`IsEverythingMatches`
`TotalKeysCount`
`TotalPropertiesCount`
`TotalClusdbKeysCount`
`TotalClusdbPropertiesCount`
`TotalDxStoreKeysCount`
`TotalDxStorePropertiesCount`
`CountKeysOnlyInClusdb`
`CountKeysOnlyInDxStore`
`CountKeysInClusdbAndDxStoreAndPropertiesMatch`
`CountKeysInClusdbAndDxStoreButPropertiesDifferent`
`CountPropertiesOnlyInClusdb`
`CountPropertiesOnlyInDxStore`
`CountPropertiesSameInClusdbAndDxStore`
`CountPropertiesDifferentInClusdbAndDxStore`

Event ID 2009: Data Store comparison verbose report (Part: PartNumber/TotalParts).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Data Store comparison verbose report (Part: PartNumber/TotalParts)

Fields #

Name	Description
`PartNumber`
`TotalParts`
`Report`

Event ID 2010: Distributed store startup version check satisfied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Distributed store startup version check satisfied

Fields #

Name	Description
`PersistedVersion`
`LowestVersionInDagServer`
`LowestVersionInDag`
`MinimumRequired`
`Error`

Event ID 2011: Distributed store startup version check not satisfied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Distributed store startup version check not satisfied

Fields #

Name	Description
`PersistedVersion`
`LowestVersionInDagServer`
`LowestVersionInDag`
`MinimumRequired`
`Error`

Event ID 2012: Distributed store startup failed with error: ErrorMessage.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distributed store startup failed with error: ErrorMessage

Fields #

Name	Description
`ErrorMessage`
`Exception`

Event ID 2013: Distributed store startup failed to register diagnostics handler (Group: GroupName).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distributed store startup failed to register diagnostics handler (Group: GroupName)

Fields #

Name	Description
`GroupName`
`Error`

Event ID 2015: Update to Source store failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update to Source store failed. Duration: Elapsed, (Error: ErrorMessage)

Fields #

Name	Description
`Source`
`Elapsed`
`ErrorMessage`

Event ID 2016: Update to Source store succeeded.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update to Source store succeeded. Duration: Elapsed

Fields #

Name	Description
`Source`
`Elapsed`

Event ID 2017: Attempt to get database availability group for local server failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempt to get database availability group for local server failed. (Check for possible exception in event data)

Fields #

Name	Description
`Message`
`StackTrace`

Event ID 2018: Initiating distributed store switch from 'CurrentConfig' => 'RequestedConfig'.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Initiating distributed store switch from 'CurrentConfig' => 'RequestedConfig'

Fields #

Name	Description
`CurrentConfig`
`RequestedConfig`

Event ID 2019: Distributed store switch attempt failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distributed store switch attempt failed. Duration (Elapsed), Error: ErrorMessage

Fields #

Name	Description
`Elapsed`
`ErrorMessage`

Event ID 2020: Distriuted store switch completed successfully.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distriuted store switch completed successfully. Duration: Elapsed

Fields #

Name	Description
`Elapsed`

Event ID 2021: Skipped checking prerequisites due to explicit flag in variant configuration.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped checking prerequisites due to explicit flag in variant configuration

Event ID 2022: Skipped distributed store switch processing since Active directory is not accessible.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store switch processing since Active directory is not accessible

Event ID 2023: Skipped distributed store switch processing since some of the servers are not yet upgraded to the required version.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store switch processing since some of the servers are not yet upgraded to the required version. (Required: 'RequiredVersion')

Fields #

Name	Description
`RequiredVersion`
`FailedServerAndVersions`

Event ID 2024: Skipped distributed store switch processing since DAG is not yet fully built or ready to provision.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store switch processing since DAG is not yet fully built or ready to provision

Event ID 2025: [Caller] Skipped checking config sync across dag due to explicit flag in variant configuration.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Caller] Skipped checking config sync across dag due to explicit flag in variant configuration

Fields #

Name	Description
`Caller`

Event ID 2026: [Caller] Dual distributed store AD/Variant configuration is not consistent across the dag (Possibly due to AD replication delays).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Caller] Dual distributed store AD/Variant configuration is not consistent across the dag (Possibly due to AD replication delays). Operation can not continue until AD/VariantConfig is in sync across the dag and majority servers are reachable to determine that. (Result: ResultXml)

Fields #

Name	Description
`Caller`
`ResultXml`

Event ID 2027: Snapshot copy not applicable for the current store switch, hence not proceeding with copy snapshot.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Snapshot copy not applicable for the current store switch, hence not proceeding with copy snapshot

Event ID 2028: Copy snapshot from FromStore => ToStore failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Copy snapshot from FromStore => ToStore failed. Duration: Elapsed, IsAborting: IsAborting, (Error: ErrorMessage)

Fields #

Name	Description
`FromStore`
`ToStore`
`Elapsed`
`IsAborting`
`ErrorMessage`

Event ID 2029: Copy snapshot from FromStore => ToStore succeeded.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Copy snapshot from FromStore => ToStore succeeded. Duration: Elapsed

Fields #

Name	Description
`FromStore`
`ToStore`
`Elapsed`

Event ID 2030: Attempting do perform full fledged distributed store switch - (Requested config: NewCfg).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempting do perform full fledged distributed store switch - (Requested config: NewCfg)

Fields #

Name	Description
`CfgPack`
`NewCfg`
`PrevCfg`

Event ID 2031: Attempting do configuration sync only - (Syncted to config: SyncedTo).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempting do configuration sync only - (Syncted to config: SyncedTo)

Fields #

Name	Description
`CfgPack`
`SyncedTo`

Event ID 2032: Attempt to check for distributed store change failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempt to check for distributed store change failed. Error: ErrorMessage

Fields #

Name	Description
`ErrorMessage`

Event ID 2033: Started key swap for open keys in process:'ProcessName' - Initiator: Initiator (PrevConfig: PreviousConfig, NewConfig: NewConfig).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Started key swap for open keys in process:'ProcessName' - Initiator: Initiator (PrevConfig: PreviousConfig, NewConfig: NewConfig)

Fields #

Name	Description
`ProcessName`
`Initiator`
`PreviousConfig`
`NewConfig`
`IsCancelPendingWrites`
`IsWritesAlreadyBlocked`

Event ID 2034: Requested to block key operations for process:'ProcessName' - ReadsInProgress:ReadsInProgress, WritesInProgress:WritesInProgress, ShadowInProgress:ShadowInProgress.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Requested to block key operations for process:'ProcessName' - ReadsInProgress:ReadsInProgress, WritesInProgress:WritesInProgress, ShadowInProgress:ShadowInProgress

Fields #

Name	Description
`ProcessName`
`ReadsInProgress`
`WritesInProgress`
`ShadowInProgress`

Event ID 2035: Finished key swap for open keys in process:'ProcessName' -.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Finished key swap for open keys in process:'ProcessName' - (Keys updated: TotalKeysUpdated, ReadsInProgress:ReadsInProgress, WritesInProgress:WritesInProgress, ShadowInProgress:ShadowInProgress

Fields #

Name	Description
`ProcessName`
`TotalKeysUpdated`
`ReadsInProgress`
`WritesInProgress`
`ShadowInProgress`

Event ID 2036: Update local distributed store registry configuration initiated from Initiator (IsForce:IsForce Config:Config).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update local distributed store registry configuration initiated from Initiator (IsForce:IsForce Config:Config)

Fields #

Name	Description
`Initiator`
`IsForce`
`Config`

Event ID 2037: Update local distributed store registry configuration failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update local distributed store registry configuration failed. (IsAttempted:IsAttempted, PrevCfg:PreviousConfig, Error:ErrorMessage)

Fields #

Name	Description
`IsAttempted`
`PreviousConfig`
`ErrorMessage`

Event ID 2038: Update local distributed store configuration succeeded.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update local distributed store configuration succeeded. (Previous config: PrevCfg)

Fields #

Name	Description
`PrevCfg`

Event ID 2039: Update local distributed store configuration skipped (Previous config: PrevCfg).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update local distributed store configuration skipped (Previous config: PrevCfg)

Fields #

Name	Description
`PrevCfg`

Event ID 2040: Skipped distributed store switch processing since a new request to switch is issued before minimum time passed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store switch processing since a new request to switch is issued before minimum time passed. (LastSuccessfulSwitchTime: LastSuccessfulSwitchTime, Elasped: Elasped, MinimumRequired: MinimumRequired)

Fields #

Name	Description
`LastSuccessfulSwitchTime`
`Elasped`
`MinimumRequired`

Event ID 2041: Process 'Operation' operation for key 'KeyName' cancelled due to dual store switch.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Process 'Operation' operation for key 'KeyName' cancelled due to dual store switch. (Hung duration: HungDuration)

Fields #

Name	Description
`Process`
`Operation`
`KeyName`
`HungDuration`
`InitiatedTime`
`CutoffTime`

Event ID 2042: Skipped write test for dual store switch due to explicit flag in variant config (NewStore: NewStore, PendingDuration: PendingDuration).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped write test for dual store switch due to explicit flag in variant config (NewStore: NewStore, PendingDuration: PendingDuration)

Fields #

Name	Description
`NewStore`
`PendingDuration`

Event ID 2043: Dual store switch blocked since last test write operation is not completed yet (NewStore: NewStore, PendingDuration: PendingDuration).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Dual store switch blocked since last test write operation is not completed yet (NewStore: NewStore, PendingDuration: PendingDuration)

Fields #

Name	Description
`NewStore`
`PendingDuration`

Event ID 2044: Dual store switch blocked since test write operation did not succeed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Dual store switch blocked since test write operation did not succeed. (IsTimedOut:IsTimedOut, IsVerificationSucceeded:IsVerificationSucceeded, ErrorMessage:ErrorMessage)

Fields #

Name	Description
`IsTimedOut`
`IsVerificationSucceeded`
`ErrorMessage`

Event ID 2050: Initiating HA Provider switch.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Initiating HA Provider switch

Fields #

Name	Description
`CurrentConfig`
`RequestedConfig`

Event ID 2051: HA Provider switch succeeded.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

HA Provider switch succeeded

Fields #

Name	Description
`Duration`

Event ID 2052: HA Provider switch failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

HA Provider switch failed

Fields #

Name	Description
`Duration`
`ErrorMessage`

Event ID 2053: Attempting HA Provider switch.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempting HA Provider switch

Fields #

Name	Description
`CfgPack`
`NewCfg`
`PrevCfg`

Event ID 2054: Distributed store component startup failed to register DxStore manager diagnostics handler.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distributed store component startup failed to register DxStore manager diagnostics handler

Fields #

Name	Description
`Error`

Event ID 2100: Attempt to check for distributed store membership change failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempt to check for distributed store membership change failed. Error: ErrorMessage

Fields #

Name	Description
`ErrorMessage`
`StackTrace`

Event ID 2101: Skipped distributed store membership check processing since Active directory is not accessible.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership check processing since Active directory is not accessible

Event ID 2102: Skipped distributed store membership check processing since some of the servers are not yet upgraded to the required version.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership check processing since some of the servers are not yet upgraded to the required version. (Required: 'RequiredVersion')

Fields #

Name	Description
`RequiredVersion`
`FailedServerAndVersions`

Event ID 2103: Witness Server:WitnessServer reported that membership has not been configured.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Witness Server:WitnessServer reported that membership has not been configured. Attempt to fix configured to AttemptToFix

Fields #

Name	Description
`WitnessServer`
`AttemptToFix`

Event ID 2104: Witness Server:WitnessServer reported a misconfigured membership.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Witness Server:WitnessServer reported a misconfigured membership. Look at event XML for expected and reported servers list.

Fields #

Name	Description
`WitnessServer`
`ExpectedServers`
`ReportedServers`

Event ID 2105: Skipped distributed store membership check on witness WitnessServer due to exception : ExceptionMessage.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership check on witness WitnessServer due to exception : ExceptionMessage

Fields #

Name	Description
`WitnessServer`
`ExceptionMessage`
`ExceptionStackTrace`

Event ID 2106: Skipped distributed store membership update due to preconditions check failure.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership update due to preconditions check failure. Exception : ExceptionMessage

Fields #

Name	Description
`ExceptionMessage`
`ExceptionStackTrace`

Event ID 2107: Skipped distributed store membership update due to preconditions check failure.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership update due to preconditions check failure. Failure Message : FailureMessage

Fields #

Name	Description
`FailureMessage`

Event ID 2108: Skipped best effort group creation on server Server due to exception : ExceptionMessage.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped best effort group creation on server Server due to exception : ExceptionMessage

Fields #

Name	Description
`Server`
`ExceptionMessage`
`ExceptionStackTrace`

Event ID 2109: Failed to deserialize MembershipType membership from AD.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Failed to deserialize MembershipType membership from AD.

Fields #

Name	Description
`MembershipType`
`SerializedMembershipFromAD`

Event ID 2110: Successfully issued staging Paxos update.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully issued staging Paxos update. Update's Paxos Sequence Number estimate - PaxosSequenceNumber.

Fields #

Name	Description
`PaxosSequenceNumber`

Event ID 2111: Successfully stamped membership to AD.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully stamped membership to AD.

Fields #

Name	Description
`GenerationTimestamp`
`InstanceNumber`
`Members`

Event ID 2112: Successfully issued the UpdateMembership Paxos command to current quorum.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully issued the UpdateMembership Paxos command to current quorum.

Fields #

Name	Description
`GenerationTimestamp`
`InstanceNumber`
`Members`

Event ID 2113: Successfully issued the Create Group command to the DxStore Manager on node NewServer.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully issued the Create Group command to the DxStore Manager on node NewServer.

Fields #

Name	Description
`NewServer`
`GenerationTimestamp`
`InstanceNumber`
`Members`

Event ID 2114: Successfully issued the Create Group command to the DxStore Manager on unconfigured witness server NewServer.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully issued the Create Group command to the DxStore Manager on unconfigured witness server NewServer.

Fields #

Name	Description
`NewServer`
`GenerationTimestamp`
`InstanceNumber`
`Members`

Event ID 2115: DxStore Membership - New Variant Config : NewVariantSettings, Existing Variant Config : ExistingVariantSettings.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

DxStore Membership - New Variant Config : NewVariantSettings, Existing Variant Config : ExistingVariantSettings.

Fields #

Name	Description
`NewVariantSettings`
`ExistingVariantSettings`

Event ID 2116: Membership Container Updated.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Membership Container Updated. IntendedMembership:IntendedMembership; FinalVettedMembership:FinalVettedMembership; CurrentDxStoreMembership:CurrentMembership; StragglerServers:StragglerServers; ReturningStragglerServers:ReturningStragglerServers; FieldsChanged:FieldsChanged

Fields #

Name	Description
`IntendedMembership`
`FinalVettedMembership`
`CurrentMembership`
`StragglerServers`
`ReturningStragglerServers`
`FieldsChanged`

Event ID 2117: Straggler Connectivity Information updated: Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Straggler Connectivity Information updated: Message

Fields #

Name	Description
`Message`

Event ID 2200: [GroupName] Local store integrity check failed as checksums did not match.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Local store integrity check failed as checksums did not match

Fields #

Name	Description
`GroupName`

Event ID 2201: [GroupName] Local store integrity check skipped as the instance number when the checksum was computed and when this check is being run don't match.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Local store integrity check skipped as the instance number when the checksum was computed and when this check is being run don't match

Fields #

Name	Description
`GroupName`

Event ID 2202: [Identity] Local store integrity check published for InstanceNumber:RequestedInstanceNumber.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Local store integrity check published for InstanceNumber:RequestedInstanceNumber

Fields #

Name	Description
`Identity`
`InitiatingServer`
`RequestedInstanceNumber`

Event ID 2203: [GroupName] Local store integrity check publish skipped as the leader doesn't have a recorded checksum.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Local store integrity check publish skipped as the leader doesn't have a recorded checksum.

Fields #

Name	Description
`GroupName`

Event ID 2204: [Identity] Local store integrity check failed as checksums did not match.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Local store integrity check failed as checksums did not match. Initator:InitiatingServer. InstanceNumber:RequestedInstanceNumber

Fields #

Name	Description
`Identity`
`InitiatingServer`
`RequestedInstanceNumber`

Event ID 2205: [Identity] Local store integrity check skipped as there is no locally recorded checksum.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Local store integrity check skipped as there is no locally recorded checksum. Initator:InitiatingServer. InstanceNumber:RequestedInstanceNumber

Fields #

Name	Description
`Identity`
`InitiatingServer`
`RequestedInstanceNumber`

Event ID 2206: [Identity] Local store integrity check skipped as the requested instance number (RequestedInstanceNumber) did not match the recorded instance number (RecordedInstanceNumber).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Local store integrity check skipped as the requested instance number (RequestedInstanceNumber) did not match the recorded instance number (RecordedInstanceNumber). Initiator:InitiatingServer

Fields #

Name	Description
`Identity`
`InitiatingServer`
`RequestedInstanceNumber`
`RecordedInstanceNumber`

Event ID 3001: [GroupName] There has been no leader consensus since Timestamp.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] There has been no leader consensus since Timestamp

Fields #

Name	Description
`Timestamp`
`GroupName`

Event ID 3002: [GroupName] There has been no log progress since Timestamp.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] There has been no log progress since Timestamp. Last recorded heartbeat write content : LastHeartbeatWriteContent

Fields #

Name	Description
`Timestamp`
`LastHeartbeatWriteContent`
`GroupName`

Event ID 3003: [GroupName] The DxStore Instance was restarted by the manager.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] The DxStore Instance was restarted by the manager. Reason: Message

Fields #

Name	Description
`Message`
`GroupName`

Event ID 3004: [GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied

Fields #

Name	Description
`IsLeader`
`Leader`
`Lag`
`InstanceState`
`StoreState`
`IsMajoritySuccessfulyReplied`
`IsMajorityPaxosInitialized`
`IsMajorityAgreeWithLeader`
`TotalRequested`
`TotalSuccessful`
`TotalFailed`
`TotalNoReplies`
`FailedServerInfo`
`LastFailedServerInfo`
`ServersNotReplied`
`Reason`
`GroupName`
`SequencePositions`

Event ID 3005: [GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied

Fields #

Name	Description
`IsLeader`
`Leader`
`Lag`
`InstanceState`
`StoreState`
`IsMajoritySuccessfulyReplied`
`IsMajorityPaxosInitialized`
`IsMajorityAgreeWithLeader`
`TotalRequested`
`TotalSuccessful`
`TotalFailed`
`TotalNoReplies`
`FailedServerInfo`
`LastFailedServerInfo`
`ServersNotReplied`
`Reason`
`GroupName`
`SequencePositions`

Event ID 3006: [GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied

Fields #

Name	Description
`IsLeader`
`Leader`
`Lag`
`InstanceState`
`StoreState`
`IsMajoritySuccessfulyReplied`
`IsMajorityPaxosInitialized`
`IsMajorityAgreeWithLeader`
`TotalRequested`
`TotalSuccessful`
`TotalFailed`
`TotalNoReplies`
`FailedServerInfo`
`LastFailedServerInfo`
`ServersNotReplied`
`Reason`
`GroupName`
`SequencePositions`

Event ID 3007: [GroupName] Node activity matrix.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Node activity matrix

Fields #

Name	Description
`NodeActivity`
`GroupName`

Event ID 3008: Dual store configuration sync was able to successfuly read from AD first time after reboot.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Dual store configuration sync was able to successfuly read from AD first time after reboot

Fields #

Name	Description
`LastRecordedAccessTime`
`CurrentBootTime`

Event ID 3009: [GroupName] There has been membership divergence detected since Timestamp.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] There has been membership divergence detected since Timestamp. Diagnostics:Message

Fields #

Name	Description
`Timestamp`
`GroupName`
`Message`

Event ID 3010: [GroupName] Instance has requested for wipe edb on next instance start.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Instance has requested for wipe edb on next instance start. Process will exit now. (Reason: Reason, EseExceptionType: ExceptionType)

Fields #

Name	Description
`GroupName`
`Reason`
`ExceptionType`
`Exception`

Event ID 3011: [GroupName] The DxStore Instance on NodeName has been seeing one way communication issues.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] The DxStore Instance on NodeName has been seeing one way communication issues. FailureDirection: FailureMode

Fields #

Name	Description
`GroupName`
`NodeName`
`FailureMode`

Event ID 3012: [GroupName] The following nodes are reporting one way communication failures: FailureReport.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] The following nodes are reporting one way communication failures: FailureReport

Fields #

Name	Description
`GroupName`
`FailureReport`

Event ID 3013: [Identity] Instance number out of sequence (IsRestarting: IsRestarting).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Instance number out of sequence (IsRestarting: IsRestarting)

Fields #

Name	Description
`Identity`
`IsRestarting`
`LastSequenceNumberExecuted`
`CurrentSequenceNumberExecuted`

Event ID 3014: Identity: Blocked local node from participating in leader election (Reason: Reason).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Blocked local node from participating in leader election (Reason: Reason)

Fields #

Name	Description
`Identity`
`Reason`
`PrevIsAllowed`
`PrevReason`

Event ID 3015: Identity: Allowed local node to participate in leader election.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Allowed local node to participate in leader election

Fields #

Name	Description
`Identity`
`PrevIsAllowed`
`PrevReason`

Event ID 3016: Identity: Maintenance state check failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Maintenance state check failed

Fields #

Name	Description
`Identity`
`Error`

Event ID 3017: Identity: Percentage of servers in maintenance is PercentServersInMaintenance which exceeded limit.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Percentage of servers in maintenance is PercentServersInMaintenance which exceeded limit. Allowing local node to participate in leader elections to be safe

Fields #

Name	Description
`Identity`
`ServersInGroupCount`
`ServersInMaintenanceCount`
`PercentServersInMaintenance`
`LeaderBlockSafetyPercentage`

Event ID 3018: Identity: Maintenance state not available.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Maintenance state not available

Fields #

Name	Description
`Identity`
`Reason`

Event ID 3019: Identity: Blocked paxos message Message (Reason: Reason).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Blocked paxos message Message (Reason: Reason)

Fields #

Name	Description
`Identity`
`Message`
`Reason`

Event ID 3020: Heartbeat write failed with exception - Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Heartbeat write failed with exception - Message

Fields #

Name	Description
`Message`
`StackTrace`

Event ID 3021: [GroupName] There have been heartbeat write failures since LeaderName recorded a heartbeat write at Timestamp.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] There have been heartbeat write failures since LeaderName recorded a heartbeat write at Timestamp.

Fields #

Name	Description
`Timestamp`
`LeaderName`
`GroupName`

Event ID 3026: TypeName in TypeNameSpace are not allowed in DxStore.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

TypeName in TypeNameSpace are not allowed in DxStore. Current unknown type list:UnknowTypeList

Fields #

Name	Description
`TypeName`
`TypeNameSpace`
`UnknowTypeList`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)