Microsoft-Windows-AppHost

111 events across 5 channels

Event	Title	Channel
101	The App Host failed to launch because a problem occurred while loading the app …	Admin
102	The App Host has encountered an unexpected error and will terminate.	Admin
112	WWAJSE report submitted with parameters 1: <param1> 2: <param2> 3: <param3> 4: …	Admin
121	The App Host failed to enumerate WinRT namespaces due to an issue with a winmd …	Admin
122	The App Host failed to enumerate WinRT namespaces due to unknown error.	Admin
126	App <.	Admin
127	App <.	Admin
128	This app was closed because of a critical infrastructure failure.	Admin
129	This app was closed because one or more packages were modified.	Admin
131	App <.	Admin
132	App <.	Admin
133	The App Host could not start because the host module Module::Function failed …	Admin
134	The App Host could not start because the web module …	Admin
135	The App Host could not start because the platform (WebInstance) failed with …	Admin
136	The App Host could not start because WinRT failed to initialize with HResult.	Admin
137	Pending resume event was signaled to the Host.	Admin
500	Infrastructure.LifecycleAppHostOperationSucceeded	Internal
502	Infrastructure.LifecycleAppHostOperationSucceeded502	Internal
504	Infrastructure.LifecycleAppHostOperationSucceeded504	Internal
506	SuspendingAppHostInformation	Internal
507	SuspendingAppHostInformation507	Internal
508	SuspendingAppHostInformation508	Internal
509	SuspendingAppHostInformation509	Internal
511	SuspendingAppHostInformation511	Internal
512	SuspendingAppHostInformation512	Internal
513	SuspendingAppHostInformation513	Internal
514	Activation.ModuleInitializationAppHostInformation	Internal
515	The App has subdownloads remaining to complete during suspension.	Internal
516	SuspendingInternalPlmTimeoutExprationAppHostInformation	Internal
517	SuspendingSubDownloadsAppHostInformation	Internal
518	SuspendingGarbageCollectionAppHostInformation	Internal
1001	Navigation.NavigationDomain.DecisionStart	Diagnostic
1002	Navigation.NavigationDomain.DecisionStop	Diagnostic
1003	MswwaProtocol.PackageToFileUriStart	Diagnostic
1004	MswwaProtocol.PackageToFileUriStop	Diagnostic
1007	Activation.ModuleInitializationStart	Diagnostic
1008	Activation.ModuleInitializationStop	Diagnostic
1009	Infrastructure.Host.SetupStart	Diagnostic
1010	Infrastructure.Host.SetupStop	Diagnostic
1011	NavigationStart	Diagnostic
1012	NavigationStop	Diagnostic
1015	Telemetry.WERReportingStart	Diagnostic
1016	Telemetry.WERReportingStop	Diagnostic
1017	Infrastructure.Host.UptimeStart	Diagnostic
1018	Infrastructure.Host.UptimeStop	Diagnostic
1019	ApplicationActivateEventStart	Diagnostic
1020	ApplicationActivateEventStop	Diagnostic
1021	ApplicationTerminationStart	Diagnostic
1022	ApplicationTerminationStop	Diagnostic
1023	SuspendingStart	Diagnostic
1024	SuspendingStop	Diagnostic
1025	ResumingStart	Diagnostic
1026	ResumingStop	Diagnostic
1027	Infrastructure.WebInstance.SetupStart	Diagnostic
1028	Infrastructure.WebInstance.SetupStop	Diagnostic
1029	InputPanelShowStart	Diagnostic
1030	InputPanelShowStop	Diagnostic
1031	InputPanelHideStart	Diagnostic
1032	InputPanelHideStop	Diagnostic
1033	SuspendingSubDownloadsStart	Diagnostic
1034	SuspendingSubDownloadsStop	Diagnostic
1035	TerminateAppStart	Diagnostic
1036	TerminateAppStop	Diagnostic
1037	MswwaProtocol.AppDataToFileUriStart	Diagnostic
1038	MswwaProtocol.AppDataToFileUriStop	Diagnostic
1039	EvaluatePackageStart	Diagnostic
1040	EvaluatePackageStop	Diagnostic
1041	ResizeStart	Diagnostic
1042	ResizeStop	Diagnostic
1043	ViewStateStart	Diagnostic
1044	ViewStateStop	Diagnostic
1045	InputPanelResizeViewportStart	Diagnostic
1046	InputPanelResizeViewportStop	Diagnostic
1047	SuspendingGarbageCollectionStart	Diagnostic
1048	SuspendingGarbageCollectionStop	Diagnostic
1049	ThreadMrtInitializationStart	Diagnostic
1050	ThreadMrtInitializationStop	Diagnostic
1051	Infrastructure.Host.HostModulesInitializationStart	Diagnostic
1052	Infrastructure.Host.HostModulesInitializationStop	Diagnostic
1053	Infrastructure.Host.HostRunStart	Diagnostic
1054	Infrastructure.Host.HostRunStop	Diagnostic
1055	Infrastructure.WebInstance.InitializeStart	Diagnostic
1056	Infrastructure.WebInstance.InitializeStop	Diagnostic
1057	Infrastructure.WebInstance.DispatchStart	Diagnostic
1058	Infrastructure.WebInstance.DispatchStop	Diagnostic
1059	Infrastructure.WebInstance.RunStart	Diagnostic
1060	Infrastructure.WebInstance.RunStop	Diagnostic
1061	WinRTAsyncCallStart	Diagnostic
1062	WinRTAsyncCallStop	Diagnostic
1063	MemoryStatsOnSuspend	Diagnostic
1064	LayoutChangedStart	Diagnostic
1065	LayoutChangedStop	Diagnostic
1066	ApplicationActivateEvent	Diagnostic
1067	ByteCodeSourceMapping	Diagnostic
1068	ByteCodeSourceMapping1068	Diagnostic
1069	LeavingBackgroundStart	Diagnostic
1070	LeavingBackgroundStop	Diagnostic
1071	EnteredBackgroundStart	Diagnostic
1072	EnteredBackgroundStop	Diagnostic
1073	BackgroundActivatedStart	Diagnostic
1074	BackgroundActivatedStop	Diagnostic
10000	SourceMessageId : Message.	ApplicationTracing
10001	SourceMessageId : Message.	ApplicationTracing
10002	SourceMessageId : Message.	ApplicationTracing
10003	Suspending Deferral Increment.	ApplicationTracing
10004	Suspending Deferral Decrement.	ApplicationTracing
10005	Activation.CompleteActivationStart	Diagnostic
10006	Activation.CompleteActivationStop	Diagnostic
10007	DrawingAppHostInformation	Internal
10009	NavigationStart10009	Diagnostic
10010	NavigationStop10010	Diagnostic

Event ID 101: The App Host failed to launch because a problem occurred while loading the app files and settings.

Provider: Microsoft-Windows-AppHost
Channel: Admin

Description

The App Host failed to launch because a problem occurred while loading the app files and settings. Ensure that the app is properly installed or try reinstalling the app.

Message #

The App Host failed to launch because a problem occurred while loading the app files and settings. Ensure that the app is properly installed or try reinstalling the app.

Event ID 102: The App Host has encountered an unexpected error and will terminate.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Initialize
Opcode: AppHostOperationFailed

Description

The App Host has encountered an unexpected error and will terminate. The error is HResult.

Message #

The App Host has encountered an unexpected error and will terminate. The error is  %1.

Fields #

Name	Description
`HResult` HexInt32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 112: WWAJSE report submitted with parameters 1: <param1> 2: <param2> 3: <param3> 4: <param4> 5: <param5> 6: <param6>.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Level: Informational
Task: Telemetry.WERReporting
Opcode: AppHostInformation

Description

WWAJSE report submitted with parameters 1: <param1> 2: <param2> 3: <param3> 4: <param4> 5: <param5> 6: <param6>. (PID: <PID>. Process Creation Time: <ProcessCreationTime>. App Binary Path: <ApplicationBinaryPath>.) Report Id: <ReportId>.

Message #

WWAJSE report submitted with parameters 1: <%1> 2: <%2> 3: <%3> 4: <%4> 5: <%5> 6: <%6>. (PID: <%7>. Process Creation Time: <%8>. App Binary Path: <%9>.) Report Id: <%10>

Fields #

Name	Description
`WWAJSERacReportEvent.param1` UnicodeString
`WWAJSERacReportEvent.param2` UnicodeString
`WWAJSERacReportEvent.param3` UnicodeString
`WWAJSERacReportEvent.param4` UnicodeString
`WWAJSERacReportEvent.param5` UnicodeString
`WWAJSERacReportEvent.param6` UnicodeString
`WWAJSERacReportEvent.PID` Int32
`WWAJSERacReportEvent.ProcessCreationTime` UnicodeString
`WWAJSERacReportEvent.ApplicationBinaryPath` UnicodeString
`WWAJSERacReportEvent.ReportId` UnicodeString
`param1` UnicodeString
`param2` UnicodeString
`param3` UnicodeString
`param4` UnicodeString
`param5` UnicodeString
`param6` UnicodeString
`PID` Int32
`ProcessCreationTime` UnicodeString
`ApplicationBinaryPath` UnicodeString
`ReportId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppHost",
    "guid": "{98E0765D-8C42-44A3-A57B-760D7F93225A}",
    "event_source_name": "",
    "event_id": 112,
    "version": 0,
    "level": 4,
    "task": 8,
    "opcode": 14,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-30T01:59:53.2155499+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 8300,
      "thread_id": 704
    },
    "channel": "Microsoft-Windows-AppHost/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "WWAJSERacReportEvent": {
      "param1": "Microsoft.Windows.CloudExperienceHost_10.0.20348.1_neutral_neutral_cw5n1h2txyewy",
      "param2": "App",
      "param3": "f675",
      "param4": "FFFFFFFD",
      "param5": "(null)",
      "param6": "0_0",
      "PID": "8300",
      "ProcessCreationTime": "1dcefd80069de95",
      "ApplicationBinaryPath": "C:\\Windows\\system32\\wwahost.exe",
      "ReportId": "5464222b-d126-4816-a885-60fc1cf0bf9e"
    }
  },
  "message": "WWAJSE report submitted with parameters 1: <Microsoft.Windows.CloudExperienceHost_10.0.20348.1_neutral_neutral_cw5n1h2txyewy> 2: <App> 3: <f675> 4: <FFFFFFFD> 5: <(null)> 6: <0_0>. (PID: <8300>. Process Creation Time: <1dcefd80069de95>. App Binary Path: <C:\\Windows\\system32\\wwahost.exe>.) Report Id: <5464222b-d126-4816-a885-60fc1cf0bf9e>"
}

Event ID 121: The App Host failed to enumerate WinRT namespaces due to an issue with a winmd file.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: WinRTIntegration
Opcode: AppHostOperationFailed

Description

The App Host failed to enumerate WinRT namespaces due to an issue with a winmd file. If you have third party winmd files ensure they are not corrupt and that their filenames match their corresponding namespace names.

Message #

The App Host failed to enumerate WinRT namespaces due to an issue with a winmd file. If you have third party winmd files ensure they are not corrupt and that their filenames match their corresponding namespace names.

Fields #

Name	Description
`HResultErrorCode` HexInt32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 122: The App Host failed to enumerate WinRT namespaces due to unknown error.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: WinRTIntegration
Opcode: AppHostOperationFailed

Description

The App Host failed to enumerate WinRT namespaces due to unknown error. (HResultErrorCode).

Message #

The App Host failed to enumerate WinRT namespaces due to unknown error. (%1)

Fields #

Name	Description
`HResultErrorCode` HexInt32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 126: App <.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Telemetry.WERReporting
Opcode: AppHostOperationFailed

Description

App <ApplicationName> crashed with an unhandled Javascript exception. App details are as follows: Display Name:<DisplayName>, AppUserModelId: <AppUserModelId> Package Identity:<PackageFullName> PID:<ProcessId>. The details of the JavaScript exception are as follows Exception Name:<ErrorType>, Description:<ErrorDescription>, HTML Document Path:<DocumentFile>, Source File Name:<SourceFile>, Source Line Number:<SourceLine>, Source Column Number:<SourceColumn>, and Stack Trace: StackTrace.

Message #

App <%2> crashed with an unhandled Javascript exception. App details are as follows: Display Name:<%1>, AppUserModelId: <%3> Package Identity:<%4> PID:<%5>. The details of the JavaScript exception are as follows Exception Name:<%6>, Description:<%7>, HTML Document Path:<%8>, Source File Name:<%9>, Source Line Number:<%10>, Source Column Number:<%11>, and Stack Trace: %12.

Fields #

Name	Description
`DisplayName` UnicodeString
`ApplicationName` UnicodeString
`AppUserModelId` UnicodeString
`PackageFullName` UnicodeString
`ProcessId` Int32
`ErrorType` UnicodeString
`ErrorDescription` UnicodeString
`DocumentFile` UnicodeString
`SourceFile` UnicodeString
`SourceLine` Int32
`SourceColumn` Int32
`StackTrace` UnicodeString

Event ID 127: App <.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Level: Error
Task: Telemetry.WERReporting
Opcode: AppHostOperationFailed

Description

App <WWATerminateApplication.ApplicationName> terminated itself by calling terminateApp API. App details are as follows: Display Name:<WWATerminateApplication.DisplayName>, AppUserModelId: <WWATerminateApplication.AppUserModelId> Package Identity:<WWATerminateApplication.PackageFullName> PID:<WWATerminateApplication.ProcessId>. The API was called from the context of the following HTML document: <WWATerminateApplication.DocumentFile>. Error object passed to terminateApp carried the following details Description:<WWATerminateApplication.ErrorDescription>, and Stack Trace:- WWATerminateApplication.StackTrace.

Message #

App <%2> terminated itself by calling terminateApp API. App details are as follows:  Display Name:<%1>, AppUserModelId: <%3> Package Identity:<%4> PID:<%5>. The API was called from the context of the following HTML document:  <%7>. Error object passed to terminateApp carried the following details Description:<%6>, and Stack Trace:- %8.

Fields #

Name	Description
`WWATerminateApplication.DisplayName` UnicodeString
`WWATerminateApplication.ApplicationName` UnicodeString
`WWATerminateApplication.AppUserModelId` UnicodeString
`WWATerminateApplication.PackageFullName` UnicodeString
`WWATerminateApplication.ProcessId` Int32
`WWATerminateApplication.ErrorDescription` UnicodeString
`WWATerminateApplication.DocumentFile` UnicodeString
`WWATerminateApplication.StackTrace` UnicodeString
`DisplayName` UnicodeString
`ApplicationName` UnicodeString
`AppUserModelId` UnicodeString
`PackageFullName` UnicodeString
`ProcessId` Int32
`ErrorDescription` UnicodeString
`DocumentFile` UnicodeString
`StackTrace` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppHost",
    "guid": "{98E0765D-8C42-44A3-A57B-760D7F93225A}",
    "event_source_name": "",
    "event_id": 127,
    "version": 0,
    "level": 2,
    "task": 8,
    "opcode": 12,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-30T01:59:53.1373982+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 8300,
      "thread_id": 12668
    },
    "channel": "Microsoft-Windows-AppHost/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "WWATerminateApplication": {
      "DisplayName": "Microsoft account",
      "ApplicationName": "App",
      "AppUserModelId": "Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App",
      "PackageFullName": "Microsoft.Windows.CloudExperienceHost_10.0.20348.1_neutral_neutral_cw5n1h2txyewy",
      "ProcessId": "8300",
      "ErrorDescription": "{\"setPromise\":\"[function]\"}",
      "DocumentFile": "/default.html",
      "StackTrace": "Error: Scenario not set. If you are in debug mode, please launch with a URI.\n   at AppManager.prototype._crashCxh (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:203:13)\n   at AppManager.prototype._setScenario (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:369:17)\n   at AppManager.prototype.initialize (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:75:13)\n   at Anonymous function (ms-appx://microsoft.windows.cloudexperiencehost/js/default.js:46:13)\n   at p (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:37380)\n   at M.enter (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:40967)\n   at _run (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:42792)\n   at _completed (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:42233)\n   at Anonymous function (ms-appx://microsoft.windows.cloudexperiencehost/core/js/require-helpers.js:12:13)\n   at l.execCb (ms-appx://microsoft.windows.cloudexperiencehost/lib/require.js:26:290)\n"
    }
  },
  "message": "App <App> terminated itself by calling terminateApp API. App details are as follows:  Display Name:<Microsoft account>, AppUserModelId: <Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App> Package Identity:<Microsoft.Windows.CloudExperienceHost_10.0.20348.1_neutral_neutral_cw5n1h2txyewy> PID:<8300>. The API was called from the context of the following HTML document:  </default.html>. Error object passed to terminateApp carried the following details Description:<{\"setPromise\":\"[function]\"}>, and Stack Trace:- Error: Scenario not set. If you are in debug mode, please launch with a URI.\n   at AppManager.prototype._crashCxh (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:203:13)\n   at AppManager.prototype._setScenario (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:369:17)\n   at AppManager.prototype.initialize (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:75:13)\n   at Anonymous function (ms-appx://microsoft.windows.cloudexperiencehost/js/default.js:46:13)\n   at p (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:37380)\n   at M.enter (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:40967)\n   at _run (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:42792)\n   at _completed (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:42233)\n   at Anonymous function (ms-appx://microsoft.windows.cloudexperiencehost/core/js/require-helpers.js:12:13)\n   at l.execCb (ms-appx://microsoft.windows.cloudexperiencehost/lib/require.js:26:290)\r\n."
}

Event ID 128: This app was closed because of a critical infrastructure failure.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Telemetry.WERReporting
Opcode: AppHostInformation

Description

This app was closed because of a critical infrastructure failure.

Message #

This app was closed because of a critical infrastructure failure.

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 129: This app was closed because one or more packages were modified.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Telemetry.WERReporting
Opcode: AppHostInformation

Description

This app was closed because one or more packages were modified. Please reinstall the app.

Message #

This app was closed because one or more packages were modified. Please reinstall the app.

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 131: App <.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Telemetry.WERReporting
Opcode: AppHostOperationFailed

Description

App <ApplicationName> terminated itself by window.close() API, which is not recommended. App details are as follows: Display Name:<DisplayName>, AppUserModelId: <AppUserModelId> Package Identity:<PackageFullName> PID:<ProcessId>. The API was called from the context of the following HTML document: <DocumentFile>

Message #

App <%2> terminated itself by window.close() API, which is not recommended. App details are as follows:  Display Name:<%1>, AppUserModelId: <%3> Package Identity:<%4> PID:<%5>. The API was called from the context of the following HTML document:  <%6>

Fields #

Name	Description
`DisplayName` UnicodeString
`ApplicationName` UnicodeString
`AppUserModelId` UnicodeString
`PackageFullName` UnicodeString
`ProcessId` Int32
`DocumentFile` UnicodeString

Event ID 132: App <.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Telemetry.WERReporting
Opcode: AppHostOperationFailed

Description

App <ApplicationName> was terminated due to a navigation error with target url <TargetUrl> and error code <ErrorCode>. App details are as follows: Display Name:<DisplayName>, AppUserModelId: <AppUserModelId> Package Identity:<PackageFullName> PID:<ProcessId>. The Navigation was initiated from the context of the following HTML document: <DocumentFile>

Message #

App <%2> was terminated due to a navigation error with target url <%7> and error code <%8>. App details are as follows: Display Name:<%1>, AppUserModelId: <%3> Package Identity:<%4> PID:<%5>. The Navigation was initiated from the context of the following HTML document:  <%6>

Fields #

Name	Description
`DisplayName` UnicodeString
`ApplicationName` UnicodeString
`AppUserModelId` UnicodeString
`PackageFullName` UnicodeString
`ProcessId` Int32
`DocumentFile` UnicodeString
`TargetUrl` UnicodeString
`ErrorCode` UnicodeString

Event ID 133: The App Host could not start because the host module Module::Function failed with HResult.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Infrastructure.Lifecycle
Opcode: AppHostOperationFailed

Description

The App Host could not start because the host module Module::Function failed with HResult.

Message #

The App Host could not start because the host module %2::%1 failed with %3.

Fields #

Name	Description
`Function` UnicodeString
`Module` UnicodeString
`HResult` HexInt32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 134: The App Host could not start because the web module WebInstance::Module::Function failed with HResult.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Infrastructure.Lifecycle
Opcode: AppHostOperationFailed

Description

The App Host could not start because the web module WebInstance::Module::Function failed with HResult.

Message #

The App Host could not start because the web module %3::%2::%1 failed with %4.

Fields #

Name	Description
`Function` UnicodeString
`Module` UnicodeString
`WebInstance` Int32
`HResult` HexInt32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 135: The App Host could not start because the platform (WebInstance) failed with HResult.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Infrastructure.Lifecycle
Opcode: AppHostOperationFailed

Description

The App Host could not start because the platform (WebInstance) failed with HResult.

Message #

The App Host could not start because the platform (%1) failed with %2.

Fields #

Name	Description
`WebInstance` Int32
`HResult` HexInt32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 136: The App Host could not start because WinRT failed to initialize with HResult.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Infrastructure.Lifecycle
Opcode: AppHostOperationFailed

Description

The App Host could not start because WinRT failed to initialize with HResult.

Message #

The App Host could not start because WinRT failed to initialize with %1.

Fields #

Name	Description
`HResult` HexInt32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 137: Pending resume event was signaled to the Host.

Provider: Microsoft-Windows-AppHost
Channel: Admin
Task: Infrastructure.Lifecycle
Opcode: AppHostInformation

Description

Pending resume event was signaled to the Host.

Message #

Pending resume event was signaled to the Host.

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 500: Infrastructure.LifecycleAppHostOperationSucceeded

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Infrastructure.Lifecycle
Opcode: AppHostOperationSucceeded

Fields #

Name	Description
`Function` UnicodeString
`Module` UnicodeString
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 502: Infrastructure.LifecycleAppHostOperationSucceeded502

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Infrastructure.Lifecycle
Opcode: AppHostOperationSucceeded

Fields #

Name	Description
`Function` UnicodeString
`Module` UnicodeString
`WebInstance` Int32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 504: Infrastructure.LifecycleAppHostOperationSucceeded504

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Infrastructure.Lifecycle
Opcode: AppHostOperationSucceeded

Fields #

Name	Description
`Action` UnicodeString
`WebInstance` Int32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 506: SuspendingAppHostInformation

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Suspending
Opcode: AppHostInformation

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 507: SuspendingAppHostInformation507

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Suspending
Opcode: AppHostInformation

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 508: SuspendingAppHostInformation508

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Suspending
Opcode: AppHostInformation

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 509: SuspendingAppHostInformation509

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Suspending
Opcode: AppHostInformation

Fields #

Name	Description
`WindowType` Int32
`WebPlatformSuspendDownloadPending` Boolean
`WebPlatformCleanupPending` Boolean
`WerReportDuringSuspend` Boolean
`suspendSubdownloadsCount` Int32
`NewTimeout` Int32
`CurrentTimeout` Int32
`PID` Int32
`TID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 511: SuspendingAppHostInformation511

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Suspending
Opcode: AppHostInformation

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 512: SuspendingAppHostInformation512

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Suspending
Opcode: AppHostInformation

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 513: SuspendingAppHostInformation513

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Suspending
Opcode: AppHostInformation

Fields #

Name	Description
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 514: Activation.ModuleInitializationAppHostInformation

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Activation.ModuleInitialization
Opcode: AppHostInformation

Fields #

Name	Description
`PackageFullName` UnicodeString
`OSVersion` HexInt64
`WebPlatformVersion` HexInt64
`ScriptProjectionVersion` HexInt32

Event ID 515: The App has subdownloads remaining to complete during suspension.

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Infrastructure.Lifecycle
Opcode: AppHostInformation

Description

The App has subdownloads remaining to complete during suspension. Host has requested the system for more time.

Message #

The App has subdownloads remaining to complete during suspension. Host has requested the system for more time.

Fields #

Name	Description
`MainWebInstanceInitializeTime` UInt64
`AppSuspendHandlerInvoked` UInt64
`AppSuspendHandlerCompleted` UInt64
`WebPlatformSuspendDownloadPending` Boolean
`WebPlatformSuspendDownloadCount` Int32
`WebPlatformSuspendDownloadWaitStart` UInt64
`WebPlatformCleanupPending` Boolean
`WebPlatformCleanupStart` UInt64
`CurrentSuspendingTimeout` Int32
`NewSuspendingTimeout` Int32
`PID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 516: SuspendingInternalPlmTimeoutExprationAppHostInformation

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: SuspendingInternalPlmTimeoutExpration
Opcode: AppHostInformation

Fields #

Name	Description
`WindowType` Int32
`WebPlatformSuspendDownloadPending` Boolean
`WebPlatformCleanupPending` Boolean
`suspendSubdownloadsCount` Int32
`PID` Int32
`TID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 517: SuspendingSubDownloadsAppHostInformation

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: SuspendingSubDownloads
Opcode: AppHostInformation

Fields #

Name	Description
`WindowType` Int32
`WebPlatformSuspendDownloadPending` Boolean
`WebPlatformCleanupPending` Boolean
`PID` Int32
`TID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 518: SuspendingGarbageCollectionAppHostInformation

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: SuspendingGarbageCollection
Opcode: AppHostInformation

Fields #

Name	Description
`WindowType` Int32
`WebPlatformSuspendDownloadPending` Boolean
`WebPlatformCleanupPending` Boolean
`PID` Int32
`TID` Int32
`PackageFullName` UnicodeString
`AppUserModelId` UnicodeString

Event ID 1001: Navigation.NavigationDomain.DecisionStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Navigation.NavigationDomain.Decision
Opcode: Start

Event ID 1002: Navigation.NavigationDomain.DecisionStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Navigation.NavigationDomain.Decision
Opcode: Stop

Event ID 1003: MswwaProtocol.PackageToFileUriStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: MswwaProtocol.PackageToFileUri
Opcode: Start

Event ID 1004: MswwaProtocol.PackageToFileUriStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: MswwaProtocol.PackageToFileUri
Opcode: Stop

Event ID 1007: Activation.ModuleInitializationStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Activation.ModuleInitialization
Opcode: Start

Event ID 1008: Activation.ModuleInitializationStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Activation.ModuleInitialization
Opcode: Stop

Event ID 1009: Infrastructure.Host.SetupStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.Host.Setup
Opcode: Start

Event ID 1010: Infrastructure.Host.SetupStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.Host.Setup
Opcode: Stop

Event ID 1011: NavigationStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Navigation
Opcode: Start

Fields #

Name	Description
`ObjectWWA` UInt64
`Counter` UInt32
`PackageFullName` UnicodeString
`AppID` UnicodeString
`NavigationInfo` HexInt32

Event ID 1012: NavigationStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Navigation
Opcode: Stop

Fields #

Name	Description
`ObjectWWA` UInt64
`Counter` UInt32
`PackageFullName` UnicodeString
`AppID` UnicodeString
`NavigationInfo` HexInt32

Event ID 1015: Telemetry.WERReportingStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Telemetry.WERReporting
Opcode: Start

Event ID 1016: Telemetry.WERReportingStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Telemetry.WERReporting
Opcode: Stop

Event ID 1017: Infrastructure.Host.UptimeStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.Host.Uptime
Opcode: Start

Event ID 1018: Infrastructure.Host.UptimeStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.Host.Uptime
Opcode: Stop

Event ID 1019: ApplicationActivateEventStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ApplicationActivateEvent
Opcode: Start

Fields #

Name	Description
`PackageFullName` UnicodeString
`AppID` UnicodeString
`ContractID` UnicodeString
`IsReactivation` UInt32

Event ID 1020: ApplicationActivateEventStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ApplicationActivateEvent
Opcode: Stop

Fields #

Name	Description
`PackageFullName` UnicodeString
`AppID` UnicodeString
`ContractID` UnicodeString
`IsReactivation` UInt32

Event ID 1021: ApplicationTerminationStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ApplicationTermination
Opcode: Start

Fields #

Name	Description
`PackageFullName` UnicodeString
`AppID` UnicodeString

Event ID 1022: ApplicationTerminationStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ApplicationTermination
Opcode: Stop

Fields #

Name	Description
`PackageFullName` UnicodeString
`AppID` UnicodeString

Event ID 1023: SuspendingStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Suspending
Opcode: Start

Event ID 1024: SuspendingStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Suspending
Opcode: Stop

Event ID 1025: ResumingStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Resuming
Opcode: Start

Event ID 1026: ResumingStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Resuming
Opcode: Stop

Event ID 1027: Infrastructure.WebInstance.SetupStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.WebInstance.Setup
Opcode: Start

Event ID 1028: Infrastructure.WebInstance.SetupStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.WebInstance.Setup
Opcode: Stop

Event ID 1029: InputPanelShowStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: InputPanelShow
Opcode: Start

Event ID 1030: InputPanelShowStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: InputPanelShow
Opcode: Stop

Event ID 1031: InputPanelHideStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: InputPanelHide
Opcode: Start

Event ID 1032: InputPanelHideStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: InputPanelHide
Opcode: Stop

Event ID 1033: SuspendingSubDownloadsStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: SuspendingSubDownloads
Opcode: Start

Event ID 1034: SuspendingSubDownloadsStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: SuspendingSubDownloads
Opcode: Stop

Event ID 1035: TerminateAppStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: TerminateApp
Opcode: Start

Event ID 1036: TerminateAppStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: TerminateApp
Opcode: Stop

Event ID 1037: MswwaProtocol.AppDataToFileUriStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: MswwaProtocol.AppDataToFileUri
Opcode: Start

Event ID 1038: MswwaProtocol.AppDataToFileUriStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: MswwaProtocol.AppDataToFileUri
Opcode: Stop

Event ID 1039: EvaluatePackageStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: EvaluatePackage
Opcode: Start

Event ID 1040: EvaluatePackageStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: EvaluatePackage
Opcode: Stop

Event ID 1041: ResizeStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Resize
Opcode: Start

Event ID 1042: ResizeStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Resize
Opcode: Stop

Event ID 1043: ViewStateStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ViewState
Opcode: Start

Event ID 1044: ViewStateStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ViewState
Opcode: Stop

Event ID 1045: InputPanelResizeViewportStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: InputPanelResizeViewport
Opcode: Start

Event ID 1046: InputPanelResizeViewportStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: InputPanelResizeViewport
Opcode: Stop

Event ID 1047: SuspendingGarbageCollectionStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: SuspendingGarbageCollection
Opcode: Start

Event ID 1048: SuspendingGarbageCollectionStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: SuspendingGarbageCollection
Opcode: Stop

Event ID 1049: ThreadMrtInitializationStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ThreadMrtInitialization
Opcode: Start

Event ID 1050: ThreadMrtInitializationStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ThreadMrtInitialization
Opcode: Stop

Event ID 1051: Infrastructure.Host.HostModulesInitializationStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.Host.HostModulesInitialization
Opcode: Start

Event ID 1052: Infrastructure.Host.HostModulesInitializationStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.Host.HostModulesInitialization
Opcode: Stop

Event ID 1053: Infrastructure.Host.HostRunStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.Host.HostRun
Opcode: Start

Event ID 1054: Infrastructure.Host.HostRunStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.Host.HostRun
Opcode: Stop

Event ID 1055: Infrastructure.WebInstance.InitializeStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.WebInstance.Initialize
Opcode: Start

Event ID 1056: Infrastructure.WebInstance.InitializeStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.WebInstance.Initialize
Opcode: Stop

Event ID 1057: Infrastructure.WebInstance.DispatchStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.WebInstance.Dispatch
Opcode: Start

Event ID 1058: Infrastructure.WebInstance.DispatchStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.WebInstance.Dispatch
Opcode: Stop

Event ID 1059: Infrastructure.WebInstance.RunStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.WebInstance.Run
Opcode: Start

Event ID 1060: Infrastructure.WebInstance.RunStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Infrastructure.WebInstance.Run
Opcode: Stop

Event ID 1061: WinRTAsyncCallStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: WinRTAsyncCall
Opcode: Start

Fields #

Name	Description
`Priority` Int32
`Id` Pointer

Event ID 1062: WinRTAsyncCallStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: WinRTAsyncCall
Opcode: Stop

Fields #

Name	Description
`Priority` Int32
`Id` Pointer

Event ID 1063: MemoryStatsOnSuspend

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: MemoryStatsOnSuspend

Fields #

Name	Description
`JSHeapSizeMB` HexInt32
`TotalWorkingSetMBandPrivateCommitMB` HexInt32
`PackageAgeS` UInt32
`AppID` UnicodeString
`PackageFullName` UnicodeString

Event ID 1064: LayoutChangedStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: LayoutChanged
Opcode: Start

Event ID 1065: LayoutChangedStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: LayoutChanged
Opcode: Stop

Event ID 1066: ApplicationActivateEvent

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ApplicationActivateEvent

Fields #

Name	Description
`ToggleCount` UInt32
`ToggleDetail` UInt32
`PackageFullName` UnicodeString
`AppID` UnicodeString

Event ID 1067: ByteCodeSourceMapping

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ByteCodeSourceMapping

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 1068: ByteCodeSourceMapping1068

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: ByteCodeSourceMapping

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 1069: LeavingBackgroundStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: LeavingBackground
Opcode: Start

Event ID 1070: LeavingBackgroundStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: LeavingBackground
Opcode: Stop

Event ID 1071: EnteredBackgroundStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: EnteredBackground
Opcode: Start

Event ID 1072: EnteredBackgroundStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: EnteredBackground
Opcode: Stop

Event ID 1073: BackgroundActivatedStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: BackgroundActivated
Opcode: Start

Event ID 1074: BackgroundActivatedStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: BackgroundActivated
Opcode: Stop

Event ID 10000: SourceMessageId : Message.

Provider: Microsoft-Windows-AppHost
Channel: ApplicationTracing
Task: ApplicationTracing.Error
Opcode: AppHostApplicationError

Description

SourceMessageId : Message

Message #

%6%10 : %11

Fields #

Name	Description
`DisplayName` UnicodeString
`ApplicationName` UnicodeString
`AppUserModelId` UnicodeString
`PackageFullName` UnicodeString
`ProcessId` Int32
`Source` UnicodeString
`DocumentFile` UnicodeString
`Line` Int32
`Column` Int32
`MessageId` Int32
`Message` UnicodeString

Event ID 10001: SourceMessageId : Message.

Provider: Microsoft-Windows-AppHost
Channel: ApplicationTracing
Task: ApplicationTracing.Warning
Opcode: AppHostApplicationWarning

Description

SourceMessageId : Message

Message #

%6%10 : %11

Fields #

Name	Description
`DisplayName` UnicodeString
`ApplicationName` UnicodeString
`AppUserModelId` UnicodeString
`PackageFullName` UnicodeString
`ProcessId` Int32
`Source` UnicodeString
`DocumentFile` UnicodeString
`Line` Int32
`Column` Int32
`MessageId` Int32
`Message` UnicodeString

Event ID 10002: SourceMessageId : Message.

Provider: Microsoft-Windows-AppHost
Channel: ApplicationTracing
Task: ApplicationTracing.Informational
Opcode: AppHostApplicationInformation

Description

SourceMessageId : Message

Message #

%6%10 : %11

Fields #

Name	Description
`DisplayName` UnicodeString
`ApplicationName` UnicodeString
`AppUserModelId` UnicodeString
`PackageFullName` UnicodeString
`ProcessId` Int32
`Source` UnicodeString
`DocumentFile` UnicodeString
`Line` Int32
`Column` Int32
`MessageId` Int32
`Message` UnicodeString

Event ID 10003: Suspending Deferral Increment.

Provider: Microsoft-Windows-AppHost
Channel: ApplicationTracing
Task: ApplicationTracing.Informational
Opcode: AppHostApplicationInformation

Description

Suspending Deferral Increment.

Message #

Suspending Deferral Increment.

Fields #

Name	Description
`DeferralCount` Int32

Event ID 10004: Suspending Deferral Decrement.

Provider: Microsoft-Windows-AppHost
Channel: ApplicationTracing
Task: ApplicationTracing.Informational
Opcode: AppHostApplicationInformation

Description

Suspending Deferral Decrement.

Message #

Suspending Deferral Decrement.

Fields #

Name	Description
`DeferralCount` Int32

Event ID 10005: Activation.CompleteActivationStart

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Activation.CompleteActivation
Opcode: Start

Event ID 10006: Activation.CompleteActivationStop

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Activation.CompleteActivation
Opcode: Stop

Event ID 10007: DrawingAppHostInformation

Provider: Microsoft-Windows-AppHost
Channel: Internal
Task: Drawing
Opcode: AppHostInformation

Fields #

Name	Description
`Value` UnicodeString

Event ID 10009: NavigationStart10009

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Navigation
Opcode: Start

Event ID 10010: NavigationStop10010

Provider: Microsoft-Windows-AppHost
Channel: Diagnostic
Task: Navigation
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 98e0765d-8c42-44a3-a57b-760d7f93225a

Defined in wwahost.exe, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-AppHost registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-AppHost registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)