Microsoft-Windows-Crashdump

9 events across 2 channels

Event ID	Title	Channel
1	Resume capable	Analytic
1	Resume capable	Operational
2	Transfer sizes	Analytic
2	Transfer sizes	Operational
3	Create dump file	Operational
4	Soft restart prepare for early crash dump failed with status Status, failure …	Operational
5	Early crash dump support failed to initialize with status Status.	Operational
6	Early crash dump support succesfully initialized	Analytic
7	Early crash dump is supported by the operating system	Analytic

Event ID 1 — Resume capable

Provider: Microsoft-Windows-Crashdump
Channel: Analytic
Task: Resumecapablesettings
Opcode: OpCodeResumeCapable

Description

Resume capable.

Message #

Resume capable

Fields #

Name	Description
`ResumeCapable` Boolean	—
`ReasonCodes` UInt32	—

Event ID 1 — Resume capable

Provider: Microsoft-Windows-Crashdump
Channel: Operational
Task: Resumecapablesettings
Opcode: OpCodeResumeCapable

Description

Resume capable.

Fields #

Name	Description
`ResumeCapable` Boolean	—
`ReasonCodes` UInt32	—

Event ID 2 — Transfer sizes

Provider: Microsoft-Windows-Crashdump
Channel: Analytic
Task: Transfersizesettings
Opcode: OpCodeTransferSizes

Description

Transfer sizes.

Message #

Transfer sizes

Fields #

Name	Description
`Minimum` UInt32	—
`Maximum` UInt32	—

Event ID 2 — Transfer sizes

Provider: Microsoft-Windows-Crashdump
Channel: Operational
Task: Transfersizesettings
Opcode: OpCodeTransferSizes

Description

Transfer sizes.

Fields #

Name	Description
`Minimum` UInt32	—
`Maximum` UInt32	—

Event ID 3 — Create dump file

Provider: Microsoft-Windows-Crashdump
Channel: Operational
Task: Createdumpfilesettings
Opcode: OpCodeCreateDumpFile

Description

Create dump file.

Message #

Create dump file

Fields #

Name	Description
`IoSpaceEnabled` Boolean	—
`PhysicalMemorySizeInBytes` UInt64	—
`DumpFileSizeInBytes` UInt64	—
`CreateDumpFileDurationInMs` UInt64	—
`LargeDumpThresholdGB` UInt32	—

Event ID 4 — Soft restart prepare for early crash dump failed with status Status, failure point FailurePoint.

Provider: Microsoft-Windows-Crashdump
Channel: Operational
Task: EarlyCrashDump
Opcode: PrepareFailure

Description

Soft restart prepare for early crash dump failed with status Status, failure point FailurePoint.

Message #

Soft restart prepare for early crash dump failed with status %1, failure point %2

Fields #

Name	Description
`Status` UInt32	— NTSTATUS reference
`FailurePoint` UInt32	—

Event ID 5 — Early crash dump support failed to initialize with status Status.

Provider: Microsoft-Windows-Crashdump
Channel: Operational
Task: EarlyCrashDump
Opcode: InitializationFailure

Description

Early crash dump support failed to initialize with status Status.

Message #

Early crash dump support failed to initialize with status %1

Fields #

Name	Description
`Status` UInt32	— NTSTATUS reference

Event ID 6 — Early crash dump support succesfully initialized

Provider: Microsoft-Windows-Crashdump
Channel: Analytic
Task: EarlyCrashDump
Opcode: Initialized

Description

Early crash dump support succesfully initialized.

Message #

Early crash dump support succesfully initialized

Event ID 7 — Early crash dump is supported by the operating system

Provider: Microsoft-Windows-Crashdump
Channel: Analytic
Task: EarlyCrashDump
Opcode: Supported

Description

Early crash dump is supported by the operating system.

Message #

Early crash dump is supported by the operating system