Microsoft-Windows-IIS-Configuration
104 events across 5 channels
Event ID 3 — A cache node for 'ConfigPath' has been added to cache.
Event ID 3 —
Description
A cache node for 'ConfigPath' has been added to cache.
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigCacheAddress Pointer | — |
ConfigPath UnicodeString | — |
FileChangeNotificationMonitorAddress Pointer | — |
ConfigFileAddress Pointer | — |
PhysicalPath UnicodeString | — |
Event ID 7 — Configuration cache is handling change notification for 'ConfigPath'.
Event ID 7 —
Description
Configuration cache is handling change notification for 'ConfigPath'.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
Event ID 8 — Configuration cache is polling for changes at 'ConfigPath'.
Event ID 8 —
Description
Configuration cache is polling for changes at 'ConfigPath'.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
Event ID 9 — Configuration cache is discarding all config files whose configuration path is equal to or a subpath of 'ConfigPath'.
Event ID 9 —
Description
Configuration cache is discarding all config files whose configuration path is equal to or a subpath of 'ConfigPath'.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
Event ID 10 — An error has occurred: Message.
Description
An error has occurred: Message.
Message #
Fields #
| Name | Description |
|---|---|
HRESULT HexInt32 | — |
PhysicalPath UnicodeString | — |
Type UInt32 | — |
Message UnicodeString | — |
LineNumber UInt32 | — |
PreviousLine UnicodeString | — |
ErrorLine UnicodeString | — |
NextLine UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-Configuration",
"guid": "DC0B8E51-4863-407A-BC3C-1B479B2978AC",
"event_source_name": "",
"event_id": 10,
"version": 0,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T20:16:52.684481+00:00",
"event_record_id": 1197,
"correlation": {},
"execution": {
"process_id": 8424,
"thread_id": 2136
},
"channel": "Microsoft-IIS-Configuration/Administrative",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"HRESULT": "0x800700b7",
"PhysicalPath": "",
"Type": 3,
"Message": "Cannot add duplicate collection entry of type 'add' with unique key attribute 'name' set to 'SecurityCertificate'\r\n",
"LineNumber": 0,
"PreviousLine": "",
"ErrorLine": "",
"NextLine": ""
},
"message": ""
}
Event ID 10 —
Description
An error has occurred.
Fields #
| Name | Description |
|---|---|
HRESULT HexInt32 | — |
PhysicalPath UnicodeString | — |
Type UInt32 | — |
Message UnicodeString | — |
LineNumber UInt32 | — |
PreviousLine UnicodeString | — |
ErrorLine UnicodeString | — |
NextLine UnicodeString | — |
Event ID 12 — Unable to find schema for config section 'SectionPath'.
Description
Unable to find schema for config section 'SectionPath'. This section will be ignored.
Message #
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
FileConfigPath UnicodeString | — |
EffectiveLocationPath UnicodeString | — |
SectionPath UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-Configuration",
"guid": "DC0B8E51-4863-407A-BC3C-1B479B2978AC",
"event_source_name": "",
"event_id": 12,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T20:00:13.509827+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 8484,
"thread_id": 8704
},
"channel": "Microsoft-IIS-Configuration/Administrative",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"PhysicalPath": "\\\\?\\C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\CONFIG\\machine.config",
"FileConfigPath": "MACHINE",
"EffectiveLocationPath": "",
"SectionPath": "system.serviceModel/extensions"
},
"message": ""
}
Event ID 12 —
Description
Unable to find schema for config section 'SectionPath'. This section will be ignored.
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
FileConfigPath UnicodeString | — |
EffectiveLocationPath UnicodeString | — |
SectionPath UnicodeString | — |
Event ID 13 — Parsing config file 'PhysicalPath'.
Event ID 13 —
Description
Parsing config file 'PhysicalPath'.
Fields #
| Name | Description |
|---|---|
ConfigFileObjectAddress Pointer | — |
PhysicalPath UnicodeString | — |
ConfigPath UnicodeString | — |
CryptoImpersonationToken Pointer | — |
FileImpersonationToken Pointer | — |
LastModifiedTime FILETIME | — |
FileSize UInt64 | — |
Event ID 14 — MACHINE/WEBROOT/APPHOST configuration redirection has been enabled.
Event ID 14 —
Description
MACHINE/WEBROOT/APPHOST configuration redirection has been enabled. The redirected physical path is 'RedirectionPath'.
Fields #
| Name | Description |
|---|---|
RedirectionPath UnicodeString | — |
Username UnicodeString | — |
Password UnicodeString | — |
Event ID 15 — Attempting to open file or directory 'lpFileName'.
Description
Attempting to open file or directory 'lpFileName'.
Message #
Fields #
| Name | Description |
|---|---|
CallSite UnicodeString | — |
lpFileName UnicodeString | — |
dwDesiredAccess HexInt32 | — |
dwShareMode HexInt32 | — |
dwCreationDisposition HexInt32 | — |
dwFlagsAndAttributes HexInt32 | — |
IsTransacted Boolean | — |
Handle Pointer | — |
GetLastError HexInt32 | — |
Event ID 15 —
Description
Attempting to open file or directory 'lpFileName'.
Fields #
| Name | Description |
|---|---|
CallSite UnicodeString | — |
lpFileName UnicodeString | — |
dwDesiredAccess HexInt32 | — |
dwShareMode HexInt32 | — |
dwCreationDisposition HexInt32 | — |
dwFlagsAndAttributes HexInt32 | — |
IsTransacted Boolean | — |
Handle Pointer | — |
GetLastError HexInt32 | — |
Event ID 16 — An impersonation token with handle 'TokenHandle' for the credentials of 'Domain\User' has been created.
Event ID 16 —
Description
An impersonation token with handle 'TokenHandle' for the credentials of 'Domain\User' has been created.
Fields #
| Name | Description |
|---|---|
Domain UnicodeString | — |
User UnicodeString | — |
Password UnicodeString | — |
TokenHandle Pointer | — |
Event ID 17 — File change notification monitor that watches for changes in 'Directory' has been created.
Event ID 17 —
Description
File change notification monitor that watches for changes in 'Directory' has been created.
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
File UnicodeString | — |
WatchSubPaths Boolean | — |
IsPollingMonitor Boolean | — |
IsSchemaFileMonitor Boolean | — |
Event ID 18 — File change notification monitor that watches for changes in 'Directory' has blocked waiting for file changes.
Description
File change notification monitor that watches for changes in 'Directory' has blocked waiting for file changes.
Message #
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
File UnicodeString | — |
WatchSubPaths Boolean | — |
IsPollingMonitor Boolean | — |
IsSchemaFileMonitor Boolean | — |
Event ID 18 —
Description
File change notification monitor that watches for changes in 'Directory' has blocked waiting for file changes.
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
File UnicodeString | — |
WatchSubPaths Boolean | — |
IsPollingMonitor Boolean | — |
IsSchemaFileMonitor Boolean | — |
Event ID 19 — File change notification monitor that watches for changes in 'Directory' received a change notification.
Description
File change notification monitor that watches for changes in 'Directory' received a change notification.
Message #
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
File UnicodeString | — |
WatchSubPaths Boolean | — |
IsPollingMonitor Boolean | — |
IsSchemaFileMonitor Boolean | — |
Event ID 19 —
Description
File change notification monitor that watches for changes in 'Directory' received a change notification.
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
File UnicodeString | — |
WatchSubPaths Boolean | — |
IsPollingMonitor Boolean | — |
IsSchemaFileMonitor Boolean | — |
Event ID 20 — File change notification monitor that watches for changes in 'Directory' is processing notified changes.
Description
File change notification monitor that watches for changes in 'Directory' is processing notified changes.
Message #
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
File UnicodeString | — |
WatchSubPaths Boolean | — |
IsPollingMonitor Boolean | — |
IsSchemaFileMonitor Boolean | — |
Event ID 20 —
Description
File change notification monitor that watches for changes in 'Directory' is processing notified changes.
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
File UnicodeString | — |
WatchSubPaths Boolean | — |
IsPollingMonitor Boolean | — |
IsSchemaFileMonitor Boolean | — |
Event ID 21 — File change notification monitor that watches for changes in 'Directory' has been destroyed.
Event ID 21 —
Description
File change notification monitor that watches for changes in 'Directory' has been destroyed.
Fields #
| Name | Description |
|---|---|
Address Pointer | — |
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
File UnicodeString | — |
WatchSubPaths Boolean | — |
IsPollingMonitor Boolean | — |
IsSchemaFileMonitor Boolean | — |
Event ID 23 — A change listener of type 'TargetType' is being informed about a configuration change at 'ConfigPath'.
Event ID 23 —
Description
A change listener of type 'TargetType' is being informed about a configuration change at 'ConfigPath'.
Fields #
| Name | Description |
|---|---|
TargetAddress Pointer | — |
TargetType UInt32 | — |
ConfigPath UnicodeString | — |
IsGranular Boolean | — |
IsApplicationSpecific Boolean | — |
IsLocationTag Boolean | — |
Event ID 24 — During schema file enumeration, the file 'PhysicalPath' was detected in the schema directory.
Event ID 24 —
Description
During schema file enumeration, the file 'PhysicalPath' was detected in the schema directory.
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
LastModifiedTime FILETIME | — |
FileSize UInt64 | — |
Event ID 25 — The virtual path 'ConfigPath' has been mapped to the physical path 'PhysicalPath'.
Event ID 25 —
Description
The virtual path 'ConfigPath' has been mapped to the physical path 'PhysicalPath'.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
PhysicalPath UnicodeString | — |
Event ID 27 — The 'MetadataName' metadata of a configuration system object was set to 'Value'.
Event ID 27 —
Description
The 'MetadataName' metadata of a configuration system object was set to 'Value'.
Fields #
| Name | Description |
|---|---|
FileConfigPath UnicodeString | — |
EffectiveLocationPath UnicodeString | — |
CallSite UnicodeString | — |
Address Pointer | — |
TargetName UnicodeString | — |
MetadataName UnicodeString | — |
Value UnicodeString | — |
Event ID 28 — Thread is impersonating an access token belonging to handle 'ImpersonationTokenHandle'.
Event ID 28 —
Description
Thread is impersonating an access token belonging to handle 'ImpersonationTokenHandle'.
Fields #
| Name | Description |
|---|---|
OriginalImpersonationTokenHandle Pointer | — |
ImpersonationTokenHandle Pointer | — |
Event ID 29 — Changes to 'Configuration' at 'ConfigPath' have successfully been committed.
#Description
Changes to 'Configuration' at 'ConfigPath' have successfully been committed.
Message #
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
ConfigPath UnicodeString | — |
EffectiveLocationPath UnicodeString | — |
Configuration UnicodeString | — |
EditOperationType UInt32 | — |
OldValue UnicodeString | — |
NewValue UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-Configuration",
"guid": "DC0B8E51-4863-407A-BC3C-1B479B2978AC",
"event_source_name": "",
"event_id": 29,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:06:38.758372+00:00",
"event_record_id": 2219,
"correlation": {},
"execution": {
"process_id": 2732,
"thread_id": 1444
},
"channel": "Microsoft-IIS-Configuration/Operational",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"PhysicalPath": "\\\\?\\C:\\Windows\\system32\\inetsrv\\config\\applicationHost.config",
"ConfigPath": "MACHINE/WEBROOT/APPHOST",
"EffectiveLocationPath": "",
"Configuration": "/system.webServer/handlers/add[@name=\"HttpRemotingHandlerFactory-rem-Integrated-4.0\"]/@type",
"EditOperationType": 1,
"OldValue": "",
"NewValue": "System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
},
"message": ""
}
Detection Rules #
View all rules referencing this event →
Sigma # view in reference
- ETW Logging/Processing Option Disabled On IIS Server source medium: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
- HTTP Logging Disabled On IIS Server source high: Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
- New Module Module Added To IIS Server source medium: Detects the addition of a new module to an IIS server.
Show 1 more (4 total)
- Previously Installed IIS Module Was Removed source low: Detects the removal of a previously installed IIS module.
Event ID 29 —
Description
Changes to 'Configuration' at 'ConfigPath' have successfully been committed.
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
ConfigPath UnicodeString | — |
EffectiveLocationPath UnicodeString | — |
Configuration UnicodeString | — |
EditOperationType UInt32 | — |
OldValue UnicodeString | — |
NewValue UnicodeString | — |
Detection Rules #
View all rules referencing this event →
Sigma # view in reference
- ETW Logging/Processing Option Disabled On IIS Server source medium: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
- HTTP Logging Disabled On IIS Server source high: Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
- New Module Module Added To IIS Server source medium: Detects the addition of a new module to an IIS server.
Show 1 more (4 total)
- Previously Installed IIS Module Was Removed source low: Detects the removal of a previously installed IIS module.
Event ID 30 — Failed to commit changes to 'Configuration' at 'ConfigPath'.
Event ID 30 —
Description
Failed to commit changes to 'Configuration' at 'ConfigPath'.
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
ConfigPath UnicodeString | — |
EffectiveLocationPath UnicodeString | — |
Configuration UnicodeString | — |
EditOperationType UInt32 | — |
OldValue UnicodeString | — |
NewValue UnicodeString | — |
Event ID 33 — Unable to locate IIS_Schema.
Event ID 33 —
Description
Unable to locate IIS_Schema.xml in 'PhysicalPath'.
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
Event ID 36 — Handle 'hSourceHandle' duplicated to 'hTargetHandle'.
Event ID 36 —
Description
Handle 'hSourceHandle' duplicated to 'hTargetHandle'.
Fields #
| Name | Description |
|---|---|
CallSite UnicodeString | — |
hSourceHandle Pointer | — |
hTargetHandle Pointer | — |
Event ID 37 — Unable to locate a site with SiteName 'SiteName'.
Event ID 37 —
Description
Unable to locate a site with SiteName 'SiteName'.
Fields #
| Name | Description |
|---|---|
SiteName UnicodeString | — |
Event ID 38 — Unable to locate a site with SiteId 'Id'.
Event ID 38 —
Description
Unable to locate a site with SiteId 'Id'.
Fields #
| Name | Description |
|---|---|
Id UInt32 | — |
Event ID 39 — The SiteId 'Id' has been assigned to more than one site.
Event ID 39 —
Description
The SiteId 'Id' has been assigned to more than one site. Please change your configuration such that each site is assigned a unique SiteId.
Fields #
| Name | Description |
|---|---|
Id UInt32 | — |
Event ID 40 — The SiteName 'SiteName' has been assigned to more than one site.
Event ID 40 —
Description
The SiteName 'SiteName' has been assigned to more than one site. Please change your configuration such that each site is assigned a unique SiteName.
Fields #
| Name | Description |
|---|---|
SiteName UnicodeString | — |
Event ID 41 — Failed to instantiate 'ProgId' when attempting to populate dynamic configuration for 'Configuration'.
Event ID 41 —
Description
Failed to instantiate 'ProgId' when attempting to populate dynamic configuration for 'Configuration'. This COM component may not be registered.
Fields #
| Name | Description |
|---|---|
Configuration UnicodeString | — |
CLSID GUID | — |
ProgId UnicodeString | — |
HRESULT HexInt32 | — |
Event ID 42 — Failed to initialize the 'ProviderName' encryption provider in 'PhysicalPath'.
Description
Failed to initialize the 'ProviderName' encryption provider in 'PhysicalPath'. Please check your configuration.
Message #
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
FileConfigPath UnicodeString | — |
ProviderName UnicodeString | — |
ProviderType UnicodeString | — |
Blob UnicodeString | — |
ErrorType UInt32 | — |
HRESULT HexInt32 | — |
Event ID 42 —
Description
Failed to initialize the 'ProviderName' encryption provider in 'PhysicalPath'. Please check your configuration.
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
FileConfigPath UnicodeString | — |
ProviderName UnicodeString | — |
ProviderType UnicodeString | — |
Blob UnicodeString | — |
ErrorType UInt32 | — |
HRESULT HexInt32 | — |
Event ID 43 — Failed to encrypt attribute 'ProviderType'.
Event ID 43 —
Description
Failed to encrypt attribute 'ProviderType'.
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
FileConfigPath UnicodeString | — |
ProviderName UnicodeString | — |
ProviderType UnicodeString | — |
Blob UnicodeString | — |
ErrorType UInt32 | — |
HRESULT HexInt32 | — |
Event ID 44 — Failed to decrypt attribute 'ProviderType'.
Event ID 44 —
Description
Failed to decrypt attribute 'ProviderType'.
Fields #
| Name | Description |
|---|---|
PhysicalPath UnicodeString | — |
FileConfigPath UnicodeString | — |
ProviderName UnicodeString | — |
ProviderType UnicodeString | — |
Blob UnicodeString | — |
ErrorType UInt32 | — |
HRESULT HexInt32 | — |
Event ID 45 — Unable to map 'ConfigPath' to the subpath of any known virtual directory.
Event ID 45 —
Description
Unable to map 'ConfigPath' to the subpath of any known virtual directory.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
Event ID 46 — Virtual directory mapping from 'RelativeVirtualPath' to 'PhysicalPath' created.
Event ID 46 —
Description
Virtual directory mapping from 'RelativeVirtualPath' to 'PhysicalPath' created.
Fields #
| Name | Description |
|---|---|
SiteName UnicodeString | — |
ApplicationPath UnicodeString | — |
VirtualDirectoryPath UnicodeString | — |
RelativeVirtualPath UnicodeString | — |
PhysicalPath UnicodeString | — |
Event ID 47 — The location of the configuration file whose config path is 'ConfigPath' was mapped to 'Directory'.
Event ID 47 —
Description
The location of the configuration file whose config path is 'ConfigPath' was mapped to 'Directory'.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
Directory UnicodeString | — |
Filename UnicodeString | — |
ImpersonationToken Pointer | — |
IsCustomMapping Boolean | — |
Event ID 49 — Config/child source file for configuration 'ConfigSourceFilePath' specified in 'PhysicalPath' is being loaded.
Description
Config/child source file for configuration 'ConfigSourceFilePath' specified in 'PhysicalPath' is being loaded.
Message #
Fields #
| Name | Description |
|---|---|
CallSite UnicodeString | — |
PhysicalPath UnicodeString | — |
FileConfigPath UnicodeString | — |
EffectiveLocationPath UnicodeString | — |
ConfigurationElementName UnicodeString | — |
ConfigSourceFilePath UnicodeString | — |
LastModifiedTime FILETIME | — |
Event ID 49 —
Description
Config/child source file for configuration 'ConfigSourceFilePath' specified in 'PhysicalPath' is being loaded.
Fields #
| Name | Description |
|---|---|
CallSite UnicodeString | — |
PhysicalPath UnicodeString | — |
FileConfigPath UnicodeString | — |
EffectiveLocationPath UnicodeString | — |
ConfigurationElementName UnicodeString | — |
ConfigSourceFilePath UnicodeString | — |
LastModifiedTime FILETIME | — |
Event ID 50 — Changes have successfully been committed to 'ConfigPath'.
Description
Changes have successfully been committed to 'ConfigPath'.
Message #
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-Configuration",
"guid": "DC0B8E51-4863-407A-BC3C-1B479B2978AC",
"event_source_name": "",
"event_id": 50,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:06:38.758521+00:00",
"event_record_id": 2281,
"correlation": {},
"execution": {
"process_id": 2732,
"thread_id": 1444
},
"channel": "Microsoft-IIS-Configuration/Operational",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"ConfigPath": "MACHINE/WEBROOT/APPHOST"
},
"message": ""
}
Event ID 50 —
Description
Changes have successfully been committed to 'ConfigPath'.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
Event ID 51 — Failed to commit changes to 'PhysicalPath' because file on the disk has been changed.
Description
Failed to commit changes to 'PhysicalPath' because file on the disk has been changed.
Message #
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
PhysicalPath UnicodeString | — |
FileExistsInMemory Boolean | — |
FileLastModifiedTimeInMemory FILETIME | — |
FileSizeInMemory UInt64 | — |
FileExistsOnDisk Boolean | — |
FileLastModifiedTimeOnDisk FILETIME | — |
FileSizeOnDisk UInt64 | — |
IsInMemoryViewOfFileRecent Boolean | — |
Event ID 51 —
Description
Failed to commit changes to 'PhysicalPath' because file on the disk has been changed.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
PhysicalPath UnicodeString | — |
FileExistsInMemory Boolean | — |
FileLastModifiedTimeInMemory FILETIME | — |
FileSizeInMemory UInt64 | — |
FileExistsOnDisk Boolean | — |
FileLastModifiedTimeOnDisk FILETIME | — |
FileSizeOnDisk UInt64 | — |
IsInMemoryViewOfFileRecent Boolean | — |
Event ID 52 — Checking whether file 'PhysicalPath' has changed on the disk returned 'IsInMemoryViewOfFileRecent'.
Description
Checking whether file 'PhysicalPath' has changed on the disk returned 'IsInMemoryViewOfFileRecent'.
Message #
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
PhysicalPath UnicodeString | — |
FileExistsInMemory Boolean | — |
FileLastModifiedTimeInMemory FILETIME | — |
FileSizeInMemory UInt64 | — |
FileExistsOnDisk Boolean | — |
FileLastModifiedTimeOnDisk FILETIME | — |
FileSizeOnDisk UInt64 | — |
IsInMemoryViewOfFileRecent Boolean | — |
Event ID 52 —
Description
Checking whether file 'PhysicalPath' has changed on the disk returned 'IsInMemoryViewOfFileRecent'.
Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | — |
PhysicalPath UnicodeString | — |
FileExistsInMemory Boolean | — |
FileLastModifiedTimeInMemory FILETIME | — |
FileSizeInMemory UInt64 | — |
FileExistsOnDisk Boolean | — |
FileLastModifiedTimeOnDisk FILETIME | — |
FileSizeOnDisk UInt64 | — |
IsInMemoryViewOfFileRecent Boolean | — |
Event ID 53 — Unable to create a path mapping for the virtual directory, /system.
Event ID 53 —
Fields #
| Name | Description |
|---|---|
SiteName UnicodeString | — |
ApplicationPath UnicodeString | — |
VirtualDirectoryPath UnicodeString | — |
RelativeVirtualPath UnicodeString | — |
PhysicalPath UnicodeString | — |
Event ID 54 — A commit operation has been initiated.
Description
A commit operation has been initiated.
Message #
Event ID 54 —
Description
A commit operation has been initiated.
Event ID 55 — A commit operation has completed.
Event ID 55 —
Description
A commit operation has completed. The status code is: 'HRESULT'.
Fields #
| Name | Description |
|---|---|
HRESULT HexInt32 | — |
Event ID 56 — A kernel transaction for a commit operation has been created.
Event ID 56 —
Description
A kernel transaction for a commit operation has been created.
Fields #
| Name | Description |
|---|---|
Handle Pointer | — |
HRESULT HexInt32 | — |
Event ID 57 — Failed to create a kernel transaction for the commit operation.
Event ID 57 —
Description
Failed to create a kernel transaction for the commit operation. The commit operation will proceed without a kernel transaction.
Fields #
| Name | Description |
|---|---|
HRESULT HexInt32 | — |
Event ID 58 — Changes have successfully been committed with a kernel transaction.
Event ID 58 —
Description
Changes have successfully been committed with a kernel transaction.
Fields #
| Name | Description |
|---|---|
Handle Pointer | — |
HRESULT HexInt32 | — |
Event ID 59 — Failed to commit the changes with a kernel transaction.
Event ID 59 —
Description
Failed to commit the changes with a kernel transaction. The changes will be reverted.
Fields #
| Name | Description |
|---|---|
Handle Pointer | — |
HRESULT HexInt32 | — |
Event ID 60 — A file write operation in a commit operation has been initiated.
Description
A file write operation in a commit operation has been initiated.
Message #
Event ID 60 —
Description
A file write operation in a commit operation has been initiated.
Event ID 61 — The contents of the file 'PhysicalPath' could not be erased.
Event ID 61 —
Description
The contents of the file 'PhysicalPath' could not be erased. The operation will be tried 'RemainingRetryCount' more time(s).
Fields #
| Name | Description |
|---|---|
Handle Pointer | — |
PhysicalPath UnicodeString | — |
ConfigPath UnicodeString | — |
RemainingRetryCount UInt32 | — |
HRESULT HexInt32 | — |
Event ID 62 — The contents of the file 'PhysicalPath' have successfully been erased.
Event ID 62 —
Description
The contents of the file 'PhysicalPath' have successfully been erased. The size of the file is now zero.
Fields #
| Name | Description |
|---|---|
Handle Pointer | — |
PhysicalPath UnicodeString | — |
ConfigPath UnicodeString | — |
HRESULT HexInt32 | — |
Event ID 63 — The new contents of the file 'PhysicalPath' could not be written to.
Event ID 63 —
Description
The new contents of the file 'PhysicalPath' could not be written to.
Fields #
| Name | Description |
|---|---|
Handle Pointer | — |
PhysicalPath UnicodeString | — |
ConfigPath UnicodeString | — |
SizeInBytes HexInt32 | — |
HRESULT HexInt32 | — |
Event ID 64 — A file write operation in a commit operation has completed.
Event ID 64 —
Description
A file write operation in a commit operation has completed. The status code is: 'HRESULT'.
Fields #
| Name | Description |
|---|---|
HRESULT HexInt32 | — |
Event ID 65 — A change listener of type 'TargetType' has been informed about a configuration change at 'ConfigPath'.
Event ID 65 —
Description
A change listener of type 'TargetType' has been informed about a configuration change at 'ConfigPath'.
Fields #
| Name | Description |
|---|---|
TargetAddress Pointer | — |
TargetType UInt32 | — |
ConfigPath UnicodeString | — |
IsGranular Boolean | — |
IsApplicationSpecific Boolean | — |
IsLocationTag Boolean | — |