detection.wiki

Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic

46 events across 2 channels

Event IDTitleChannel
256Operational
256Driver load result Status.Diagnostic
512Operational
512Driver unloaded.Diagnostic
768Operational
768Instance setup on the volume VolumeName has completed with status Status.Diagnostic
1024Operational
1024Query teardown for VolumeName has completed with status Status.Diagnostic
1280Operational
1280Teardown has started for VolumeName.Diagnostic
1536Operational
1536Teardown has completed.Diagnostic
1792Operational
1792File pre-create File, FileName.Diagnostic
2048Operational
2048File post-create File.Diagnostic
2304Operational
2304Stream Handle Context is deleted.Diagnostic
4096Operational
4096Stream Context is deleted.Diagnostic
4352Operational
4352Tunneled operation Operation.Diagnostic
4608Operational
4608Channel connect Type.Diagnostic
4864Operational
4864Channel disconnect Type.Diagnostic
5120Operational
5120Message Type.Diagnostic
5376Operational
5376Single Client Notification is enqueued.Diagnostic
5632Operational
5632Single Client Notification is canceled.Diagnostic
5888Operational
5888Single Client Notification is Completed.Diagnostic
6144Operational
6144Received Byte Range Lock Request MinorFunction.Diagnostic
6400Operational
6400Received Byte Range Lock Request MinorFunction.Diagnostic
8448Operational
8448Oplock request.Diagnostic
8704Operational
8704Oplock status.Diagnostic
8960Operational
8960Oplock break.Diagnostic
9216Operational
9216Filter at altitude VetoFromAltitudeIntegral.Diagnostic

Event ID 256 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
DriverLoad

Description

Driver load result .

Fields #

NameDescription
Status HexInt32— NTSTATUS reference

Event ID 256 — Driver load result Status.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
DriverLoad

Description

Driver load result Status.

Message #

Driver load result %1.

Fields #

NameDescription
Status HexInt32— NTSTATUS reference

Event ID 512 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
DriverLoad

Description

Driver unloaded.

Event ID 512 — Driver unloaded.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
DriverLoad

Description

Driver unloaded.

Message #

Driver unloaded.

Event ID 768 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
InstanceCreation

Description

Instance setup on the volume has completed with status .

Fields #

NameDescription
Volume Pointer—
Instance Pointer—
Context Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
InstanceSetupFlags HexInt32—
DeviceType HexInt32—
FsType HexInt32—
DeviceCharacteristicsFlag HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 768 — Instance setup on the volume VolumeName has completed with status Status.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
InstanceCreation

Description

Instance setup on the volume VolumeName has completed with status Status.

Message #

Instance setup on the volume %5 has completed with status %10.

Fields #

NameDescription
Volume Pointer—
Instance Pointer—
Context Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
InstanceSetupFlags HexInt32—
DeviceType HexInt32—
FsType HexInt32—
DeviceCharacteristicsFlag HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 1024 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
InstanceCreation

Description

Query teardown for has completed with status .

Fields #

NameDescription
Volume Pointer—
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
Flags HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 1024 — Query teardown for VolumeName has completed with status Status.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
InstanceCreation

Description

Query teardown for VolumeName has completed with status Status.

Message #

Query teardown for %4 has completed with status %6.

Fields #

NameDescription
Volume Pointer—
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
Flags HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 1280 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
InstanceCreation

Description

Teardown has started for .

Fields #

NameDescription
Volume Pointer—
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
Flags HexInt32—

Event ID 1280 — Teardown has started for VolumeName.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
InstanceCreation

Description

Teardown has started for VolumeName.

Message #

Teardown has started for %4.

Fields #

NameDescription
Volume Pointer—
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
Flags HexInt32—

Event ID 1536 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
InstanceCreation

Description

Teardown has completed.

Fields #

NameDescription
Ptr Pointer—
Flags HexInt32—

Event ID 1536 — Teardown has completed.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
InstanceCreation

Description

Teardown has completed.

Message #

Teardown has completed.

Fields #

NameDescription
Ptr Pointer—
Flags HexInt32—

Event ID 1792 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
CreateFile

Description

File pre-create , . Status ; Callback Status .

Fields #

NameDescription
Instance Pointer—
File Pointer—
FileNameLength UInt16—
FileName UnicodeString—
Data Pointer—
ClientId GUID—
Status HexInt32— NTSTATUS reference
CallBackStatus HexInt32—

Event ID 1792 — File pre-create File, FileName.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
CreateFile

Description

File pre-create File, FileName. Status Status; Callback Status CallBackStatus.

Message #

File pre-create %2, %4. Status %7; Callback Status %8.

Fields #

NameDescription
Instance Pointer—
File Pointer—
FileNameLength UInt16—
FileName UnicodeString—
Data Pointer—
ClientId GUID—
Status HexInt32— NTSTATUS reference
CallBackStatus HexInt32—

Event ID 2048 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
CreateFile

Description

File post-create . Status .

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—
StreamContext Pointer—
StreamHandleContext Pointer—
CsvFileId HexInt64—
Status HexInt32— NTSTATUS reference

Event ID 2048 — File post-create File.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
CreateFile

Description

File post-create File. Status Status.

Message #

File post-create %2. Status %7.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—
StreamContext Pointer—
StreamHandleContext Pointer—
CsvFileId HexInt64—
Status HexInt32— NTSTATUS reference

Event ID 2304 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
CreateFile

Description

Stream Handle Context is deleted.

Fields #

NameDescription
Ptr Pointer—

Event ID 2304 — Stream Handle Context is deleted.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
CreateFile

Description

Stream Handle Context is deleted.

Message #

Stream Handle Context is deleted.

Fields #

NameDescription
Ptr Pointer—

Event ID 4096 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
CreateFile

Description

Stream Context is deleted.

Fields #

NameDescription
Ptr Pointer—

Event ID 4096 — Stream Context is deleted.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
CreateFile

Description

Stream Context is deleted.

Message #

Stream Context is deleted.

Fields #

NameDescription
Ptr Pointer—

Event ID 4352 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
TunneledIO

Description

Tunneled operation . Status .

Fields #

NameDescription
Instance Pointer—
File Pointer—
Operation HexInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
Status HexInt32— NTSTATUS reference

Event ID 4352 — Tunneled operation Operation.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
TunneledIO

Description

Tunneled operation Operation. Status Status.

Message #

Tunneled operation %3. Status %4.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Operation HexInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
Status HexInt32— NTSTATUS reference

Event ID 4608 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
CommunicationChannel

Description

Channel connect . Status .

Fields #

NameDescription
Type HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 4608 — Channel connect Type.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
CommunicationChannel

Description

Channel connect Type. Status Status.

Message #

Channel connect %1. Status %2.

Fields #

NameDescription
Type HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 4864 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
CommunicationChannel

Description

Channel disconnect . Status .

Fields #

NameDescription
Type HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 4864 — Channel disconnect Type.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
CommunicationChannel

Description

Channel disconnect Type. Status Status.

Message #

Channel disconnect %1. Status %2.

Fields #

NameDescription
Type HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 5120 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
CommunicationChannel

Description

Message . Status .

Fields #

NameDescription
Type HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 5120 — Message Type.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
CommunicationChannel

Description

Message Type. Status Status.

Message #

Message %1. Status %2.

Fields #

NameDescription
Type HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 5376 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
SingleClientNotify

Description

Single Client Notification is enqueued.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—
IgnoreCurrentConditions Boolean—

Event ID 5376 — Single Client Notification is enqueued.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
SingleClientNotify

Description

Single Client Notification is enqueued.

Message #

Single Client Notification is enqueued.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—
IgnoreCurrentConditions Boolean—

Event ID 5632 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
SingleClientNotify

Description

Single Client Notification is canceled.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—

Event ID 5632 — Single Client Notification is canceled.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
SingleClientNotify

Description

Single Client Notification is canceled.

Message #

Single Client Notification is canceled.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—

Event ID 5888 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
SingleClientNotify

Description

Single Client Notification is Completed. Status . Source: .

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—
Status HexInt32— NTSTATUS reference
Source UInt32—

Event ID 5888 — Single Client Notification is Completed.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
SingleClientNotify

Description

Single Client Notification is Completed. Status Status. Source: Source.

Message #

Single Client Notification is Completed. Status %4. Source: %5.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—
Status HexInt32— NTSTATUS reference
Source UInt32—

Event ID 6144 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
ByteRangeLock

Description

Received Byte Range Lock Request . At ; Length ; Key ; Fail Imediately ; Exclusive .

Fields #

NameDescription
Instance Pointer—
File Pointer—
Stream Pointer—
Data Pointer—
MinorFunction HexInt32—
Flags HexInt32—
Process Pointer—
Offset HexInt64—
Length HexInt64—
Key HexInt32—
FailImmediately Boolean—
Exclusive Boolean—

Event ID 6144 — Received Byte Range Lock Request MinorFunction.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
ByteRangeLock

Description

Received Byte Range Lock Request MinorFunction. At Offset; Length Length; Key Key; Fail Imediately FailImmediately; Exclusive Exclusive.

Message #

Received Byte Range Lock Request %5. At %8; Length %9; Key %10; Fail Imediately %11; Exclusive %12.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Stream Pointer—
Data Pointer—
MinorFunction HexInt32—
Flags HexInt32—
Process Pointer—
Offset HexInt64—
Length HexInt64—
Key HexInt32—
FailImmediately Boolean—
Exclusive Boolean—

Event ID 6400 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
ByteRangeLock

Description

Received Byte Range Lock Request . At ; Length ; Key ; Fail Imediately ; Exclusive ; Status .

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—
MinorFunction HexInt32—
Flags HexInt32—
Process Pointer—
Offset HexInt64—
Length HexInt64—
Key HexInt32—
FailImmediately Boolean—
Exclusive Boolean—
Status HexInt32— NTSTATUS reference

Event ID 6400 — Received Byte Range Lock Request MinorFunction.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
ByteRangeLock

Description

Received Byte Range Lock Request MinorFunction. At Offset; Length Length; Key Key; Fail Imediately FailImmediately; Exclusive Exclusive; Status Status.

Message #

Received Byte Range Lock Request %4. At %7; Length %8; Key %9; Fail Imediately %10; Exclusive %11; Status %12.

Fields #

NameDescription
Instance Pointer—
File Pointer—
Data Pointer—
MinorFunction HexInt32—
Flags HexInt32—
Process Pointer—
Offset HexInt64—
Length HexInt64—
Key HexInt32—
FailImmediately Boolean—
Exclusive Boolean—
Status HexInt32— NTSTATUS reference

Event ID 8448 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
Oplock

Description

Oplock request. FileId ; Client ; Code ; Flags .

Fields #

NameDescription
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
File Pointer—
FileId HexInt64—
ClientId GUID—
Data Pointer—
OplockCode HexInt32—
OplockFlags HexInt32—
FileIdHi HexInt64—

Event ID 8448 — Oplock request.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
Oplock

Description

Oplock request. FileId FileId; Client ClientId; Code OplockCode; Flags OplockFlags.

Message #

Oplock request. FileId %5; Client %6; Code %8; Flags %9.

Fields #

NameDescription
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
File Pointer—
FileId HexInt64—
ClientId GUID—
Data Pointer—
OplockCode HexInt32—
OplockFlags HexInt32—
FileIdHi HexInt64—

Event ID 8704 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
Oplock

Description

Oplock status. FileId ; Client ; Status .

Fields #

NameDescription
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
File Pointer—
FileId HexInt64—
ClientId GUID—
Status HexInt32— NTSTATUS reference
FileIdHi HexInt64—

Event ID 8704 — Oplock status.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
Oplock

Description

Oplock status. FileId FileId; Client ClientId; Status Status.

Message #

Oplock status. FileId %5; Client %6; Status %7.

Fields #

NameDescription
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
File Pointer—
FileId HexInt64—
ClientId GUID—
Status HexInt32— NTSTATUS reference
FileIdHi HexInt64—

Event ID 8960 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
Oplock

Description

Oplock break. FileId ; Client ; Status ; Information .

Fields #

NameDescription
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
File Pointer—
FileId HexInt64—
ClientId GUID—
Data Pointer—
Status HexInt32— NTSTATUS reference
Information HexInt64—
FileIdHi HexInt64—

Event ID 8960 — Oplock break.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
Oplock

Description

Oplock break. FileId FileId; Client ClientId; Status Status; Information Information.

Message #

Oplock break. FileId %5; Client %6; Status %8; Information %9.

Fields #

NameDescription
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
File Pointer—
FileId HexInt64—
ClientId GUID—
Data Pointer—
Status HexInt32— NTSTATUS reference
Information HexInt64—
FileIdHi HexInt64—

Event ID 9216 —

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Operational
Task
VetoDirectIO

Description

Filter at altitude . has vetoed Direct IO for the file . Reason: .

Fields #

NameDescription
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
FileNameLength UInt16—
FileName UnicodeString—
File Pointer—
FileId HexInt64—
VetoFromAltitudeIntegral UInt64—
VetoFromAltitudeDecimal UInt64—
Reason UnicodeString—
FileIdHi HexInt64—

Event ID 9216 — Filter at altitude VetoFromAltitudeIntegral.

Provider
Microsoft-Windows-FailoverClustering-CsvFlt-Diagnostic
Channel
Diagnostic
Task
VetoDirectIO

Description

Filter at altitude VetoFromAltitudeIntegral.VetoFromAltitudeDecimal has vetoed Direct IO for the file FileName. Reason: Reason.

Message #

Filter at altitude %8.%9 has vetoed Direct IO for the file %5. Reason: %10.

Fields #

NameDescription
Instance Pointer—
VolumeNameLength UInt16—
VolumeName UnicodeString—
FileNameLength UInt16—
FileName UnicodeString—
File Pointer—
FileId HexInt64—
VetoFromAltitudeIntegral UInt64—
VetoFromAltitudeDecimal UInt64—
Reason UnicodeString—
FileIdHi HexInt64—