Microsoft-Windows-Kernel-WHEA

33 events across 3 channels

Event ID	Title	Channel
1	A non-fatal hardware error occurred.	System
2	A fatal hardware error occurred.	System
3	A non-fatal hardware error occurred.	Errors
4	A fatal hardware error occurred.	Errors
5	WHEA successfully initialized.	Operational
6	Machine Check Event reported is a fatal memory hierarchy error.	System
7	Machine Check Event reported is a memory hierarchy error.	Errors
8	Machine Check Event reported is a fatal TLB error.	System
9	Machine Check Event reported is a TLB error.	Errors
10	Machine Check Event reported is a fatal Bus or Interconnect error.	System
11	Machine Check Event reported is a Bus or Interconnect error.	Errors
12	Machine Check Event reported is a fatal Bus or Interconnect timeout error.	System
13	Machine Check Event reported is a Bus or Interconnect timeout error.	Errors
14	Machine Check Event reported is a fatal internal watchdog timer error.	System
15	Machine Check Event reported is a fatal microcode ROM parity error.	Errors
16	Machine Check Event reported is a fatal condition.	System
17	Machine Check Event reported is a fatal functional redundancy check error.	System
18	PCI Express reported a fatal error.	System
19	PCI Express reported a non-fatal error.	Errors
20	WHEA Event	Errors
21	WHEA Event	Errors
31	The memory page located at physical address PhysicalAddress Pending …	System
32		Operational
33		Operational
34		Operational
35		Operational
36		Operational
37		Operational
38		Operational
39		Operational
40		Operational
41	A processs was terminated due to an uncorrected hardware error.	System
42	WHEA event log entry	Operational

Event ID 1 — A non-fatal hardware error occurred.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

A non-fatal hardware error occurred.

Message #

A non-fatal hardware error occurred.

Fields #

Name	Description
`Signature` UInt32	—
`Revision` UInt16	—
`Reserved1` UInt16	—
`Reserved2` UInt16	—
`SectionCount` UInt16	—
`Severity` UInt32	—
`ValidationBits` UInt32	—
`Length` UInt32	—
`Timestamp` UInt64	—
`PlatformId` GUID	—
`PartitionId` GUID	—
`CreatorId` GUID	—
`NotifyType` GUID	—
`RecordId` UInt64	—
`Flags` UInt32	—
`RawData` Binary	—

Event ID 2 — A fatal hardware error occurred.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

A fatal hardware error occurred.

Message #

A fatal hardware error occurred.

Fields #

Name	Description
`Signature` UInt32	—
`Revision` UInt16	—
`Reserved1` UInt16	—
`Reserved2` UInt16	—
`SectionCount` UInt16	—
`Severity` UInt32	—
`ValidationBits` UInt32	—
`Length` UInt32	—
`Timestamp` UInt64	—
`PlatformId` GUID	—
`PartitionId` GUID	—
`CreatorId` GUID	—
`NotifyType` GUID	—
`RecordId` UInt64	—
`Flags` UInt32	—
`RawData` Binary	—

Event ID 3 — A non-fatal hardware error occurred.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

A non-fatal hardware error occurred.

Message #

A non-fatal hardware error occurred.

Fields #

Name	Description
`Signature` UInt32	—
`Revision` UInt16	—
`Reserved1` UInt16	—
`Reserved2` UInt16	—
`SectionCount` UInt16	—
`Severity` UInt32	—
`ValidationBits` UInt32	—
`Length` UInt32	—
`Timestamp` UInt64	—
`PlatformId` GUID	—
`PartitionId` GUID	—
`CreatorId` GUID	—
`NotifyType` GUID	—
`RecordId` UInt64	—
`Flags` UInt32	—
`RawData` Binary	—

Event ID 4 — A fatal hardware error occurred.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

A fatal hardware error occurred.

Message #

A fatal hardware error occurred.

Fields #

Name	Description
`Signature` UInt32	—
`Revision` UInt16	—
`Reserved1` UInt16	—
`Reserved2` UInt16	—
`SectionCount` UInt16	—
`Severity` UInt32	—
`ValidationBits` UInt32	—
`Length` UInt32	—
`Timestamp` UInt64	—
`PlatformId` GUID	—
`PartitionId` GUID	—
`CreatorId` GUID	—
`NotifyType` GUID	—
`RecordId` UInt64	—
`Flags` UInt32	—
`RawData` Binary	—

Event ID 5 — WHEA successfully initialized.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational
Level: Informational

Description

WHEA successfully initialized.

Message #

WHEA successfully initialized.
   %1 error sources are active
   Error record format version is %2.

Fields #

Name	Description
`ErrorSourceCount` UInt32	—
`ErrorRecordFormat` UInt32	—
`ErrorSourceTableLength` UInt32	—
`ErrorSourceTable` Binary	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-WHEA",
    "guid": "7B563579-53C8-44E7-8236-0F87B9FE6594",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-06T06:25:15.449105+00:00",
    "event_record_id": 54,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-Kernel-WHEA/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorSourceCount": 5,
    "ErrorRecordFormat": 10,
    "ErrorSourceTableLength": 5360,
    "ErrorSourceTable": "B01AB2CE0DA6FFFF28778F5905F8FFFF00000000000000000000000001000000F829000057686561100000000000000000A071CE0DA6FFFF0000000000000000030000007C0D0000000000000000000000000000000000000000000000000000CC0300000B00000010000000020000002C0D00000100000003000000010000000000000000000000000000003C60C1835215A74887D114D9467D776550530000D80E00000100000050607DCE0DA6FFFF0001BF5C05F8FFFF1001BF5C05F8FFFFC0DAF65805F8FFFF8D7C2157665EFB4480339B74CACEDF5B00000000000000000000000000000000640400000100000010DE4FCE0DA6FFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000A028B4CE0DA6FFFFE0F878CE0DA6FFFF00000000000000000000000004000000481000005768656100000000000000000020B5CE0DA6FFFF00000000000000000900000074010000000000000000000000000000000000000000000000000000CC0300000A000000000000000200000041010000040000000900000002000000000000000000008000000106000000000000000000000000FFFFFFFFFFFFFFFF0001000000040000010400000204000003040000FFFFFFFFFFFFFFFF0101000004040000050400000604000007040000FFFFFFFFFFFFFFFF0201000008040000090400000A0400000B040000FFFFFFFFFFFFFFFF030100000C0400000D0400000E0400000F040000FFFFFFFFFFFFFFFF0401000010040000110400001204000013040000FFFFFFFFFFFFFFFF0501000014040000150400001604000017040000FFFFFFFFFFFFFFFF0601000018040000190400001A0400001B040000FFFFFFFFFFFFFFFF070100001C0400001D0400001E0400001F040000FFFFFFFFFFFFFFFF0801000020040000210400002204000023040000FFFFFFFFFFFFFFFF0901000024040000250400002604000027040000FFFFFFFFFFFFFFFF0A01000028040000290400002A0400002B040000FFFFFFFFFFFFFFFF0B0100002C0400002D0400002E0400002F040000FFFFFFFFFFFFFFFF0C01000030040000310400003204000033040000FFFFFFFFFFFFFFFF0D01000034040000350400003604000037040000FFFFFFFFFFFFFFFF0E01000038040000390400003A0400003B040000FFFFFFFFFFFFFFFF0F0100003C0400003D0400003E0400003F040000FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000A038B4CE0DA6FFFFB01AB2CE0DA6FFFF00000000000000000000000003000000481000005768656101000000000000000070B5CE0DA6FFFF00000000000000000900000074010000000000000000000000000000000000000000000000000000CC0300000A00000001000000020000004101000003000000090000000300000000000000000000800100010600000000001C000060EA000000000000000000000000000000000000000000000001000000040000010400000204000003040000FFFFFFFFFFFFFFFF0101000004040000050400000604000007040000FFFFFFFFFFFFFFFF0201000008040000090400000A0400000B040000FFFFFFFFFFFFFFFF030100000C0400000D0400000E0400000F040000FFFFFFFFFFFFFFFF0401000010040000110400001204000013040000FFFFFFFFFFFFFFFF0501000014040000150400001604000017040000FFFFFFFFFFFFFFFF0601000018040000190400001A0400001B040000FFFFFFFFFFFFFFFF070100001C0400001D0400001E0400001F040000FFFFFFFFFFFFFFFF0801000020040000210400002204000023040000FFFFFFFFFFFFFFFF0901000024040000250400002604000027040000FFFFFFFFFFFFFFFF0A01000028040000290400002A0400002B040000FFFFFFFFFFFFFFFF0B0100002C0400002D0400002E0400002F040000FFFFFFFFFFFFFFFF0C01000030040000310400003204000033040000FFFFFFFFFFFFFFFF0D01000034040000350400003604000037040000FFFFFFFFFFFFFFFF0E01000038040000390400003A0400003B040000FFFFFFFFFFFFFFFF0F0100003C0400003D0400003E0400003F040000FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000A098A5CE0DA6FFFFA028B4CE0DA6FFFF00000000000000000000000001000000C0060000576865610300000000000000A0B8A5CE0DA6FFFF000000000000000001000000C0010000000000000000000000000000000000000000000000000000CC0300000A000000030000000200000000010000010000000300000004000000000000000000008002000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028778F5905F8FFFFA038B4CE0DA6FFFF0000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000CC0300000A0000000700000002000000001000000100000008000000050000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 6 — Machine Check Event reported is a fatal memory hierarchy error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal memory hierarchy error.

Message #

Machine Check Event reported is a fatal memory hierarchy error.
 Trasaction Type: %1
 Memory Hierarchy Level: %5
 Request Type: %3
 Address: %6

Fields #

Name	Description
`Trasaction_Type`	—
`Request_Type`	—
`Memory_Hierarchy_Level`	—
`Address` UInt64	—
`TransactionType` UInt32	—
`Participation` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 7 — Machine Check Event reported is a memory hierarchy error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a memory hierarchy error.

Message #

Machine Check Event reported is a memory hierarchy error.
 Trasaction Type: %1
 Memory Hierarchy Level: %5
 Request Type: %3
 Address: %6

Fields #

Name	Description
`Trasaction_Type`	—
`Request_Type`	—
`Memory_Hierarchy_Level`	—
`Address` UInt64	—
`TransactionType` UInt32	—
`Participation` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 8 — Machine Check Event reported is a fatal TLB error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal TLB error.

Message #

Machine Check Event reported is a fatal TLB error.
 Transaction Type: %1
 Memory Hierarchy Level: %5
 Address: %6

Fields #

Name	Description
`Transaction_Type`	—
`Memory_Hierarchy_Level`	—
`Address` UInt64	—
`TransactionType` UInt32	—
`Participation` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 9 — Machine Check Event reported is a TLB error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a TLB error.

Message #

Machine Check Event reported is a TLB error.
 Transaction Type: %1
 Memory Hierarchy Level: %5
 Address: %6

Fields #

Name	Description
`Transaction_Type`	—
`Memory_Hierarchy_Level`	—
`Address` UInt64	—
`TransactionType` UInt32	—
`Participation` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 10 — Machine Check Event reported is a fatal Bus or Interconnect error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal Bus or Interconnect error.

Message #

Machine Check Event reported is a fatal Bus or Interconnect error.
 Memory Hierarchy Level: %5
 Participation: %2
 Request Type: %3
 Memory/IO: %4
 Address: %6

Fields #

Name	Description
`Participation` UInt32	—
`Request_Type`	—
`MemoryIO`	—
`Memory_Hierarchy_Level`	Memory/IO.
`Address` UInt64	—
`TransactionType` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 11 — Machine Check Event reported is a Bus or Interconnect error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a Bus or Interconnect error.

Message #

Machine Check Event reported is a Bus or Interconnect error.
 Memory Hierarchy Level: %5
 Participation: %2
 Request Type: %3
 Memory/IO: %4
 Address: %6

Fields #

Name	Description
`Participation` UInt32	—
`Request_Type`	—
`MemoryIO`	—
`Memory_Hierarchy_Level`	Memory/IO.
`Address` UInt64	—
`TransactionType` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 12 — Machine Check Event reported is a fatal Bus or Interconnect timeout error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal Bus or Interconnect timeout error.

Message #

Machine Check Event reported is a fatal Bus or Interconnect timeout error.
 Memory Hierarchy Level: %5
 Participation: %2
 Request Type: %3
 Memory/IO: %4
 Address: %6

Fields #

Name	Description
`Participation` UInt32	—
`Request_Type`	—
`MemoryIO`	—
`Memory_Hierarchy_Level`	Memory/IO.
`Address` UInt64	—
`TransactionType` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 13 — Machine Check Event reported is a Bus or Interconnect timeout error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a Bus or Interconnect timeout error.

Message #

Machine Check Event reported is a Bus or Interconnect timeout error.
 Memory Hierarchy Level: %5
 Participation: %2
 Request Type: %3
 Memory/IO: %4
 Address: %6

Fields #

Name	Description
`Participation` UInt32	—
`Request_Type`	—
`MemoryIO`	—
`Memory_Hierarchy_Level`	Memory/IO.
`Address` UInt64	—
`TransactionType` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 14 — Machine Check Event reported is a fatal internal watchdog timer error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal internal watchdog timer error.

Message #

Machine Check Event reported is a fatal internal watchdog timer error.

Fields #

Name	Description
`TransactionType` UInt32	—
`Participation` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Address` UInt64	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 15 — Machine Check Event reported is a fatal microcode ROM parity error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a fatal microcode ROM parity error.

Message #

Machine Check Event reported is a fatal microcode ROM parity error.

Fields #

Name	Description
`TransactionType` UInt32	—
`Participation` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Address` UInt64	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 16 — Machine Check Event reported is a fatal condition.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal condition. A processor received an external signal that an unrecoverable error has occurred.

Message #

Machine Check Event reported is a fatal condition. A processor received an external signal that an unrecoverable error has occurred.

Fields #

Name	Description
`TransactionType` UInt32	—
`Participation` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Address` UInt64	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 17 — Machine Check Event reported is a fatal functional redundancy check error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal functional redundancy check error.

Message #

Machine Check Event reported is a fatal functional redundancy check error.

Fields #

Name	Description
`TransactionType` UInt32	—
`Participation` UInt32	—
`RequestType` UInt32	—
`MemorIO` UInt32	—
`MemHierarchyLvl` UInt32	—
`Address` UInt64	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 18 — PCI Express reported a fatal error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

PCI Express reported a fatal error.

Message #

PCI Express reported a fatal error.
 Device Identifier: Bus %1 Device %2 Function %3
 Uncorrectable Error Status: %4
 Correctable Error Status: %5
 Header Log: %6 %7 %8 %9

Fields #

Name	Description
`Uncorrectable_Error_Status`	—
`Correctable_Error_Status`	—
`Header_Log`	—
`SourceIdBus` UInt32	—
`SourceIdDev` UInt32	—
`SourceIdFun` UInt32	—
`UncorrectableErrorStatus` UInt32	—
`CorrectableErrorStatus` UInt32	—
`HeaderLog0` UInt32	—
`HeaderLog1` UInt32	—
`HeaderLog2` UInt32	—
`HeaderLog3` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 19 — PCI Express reported a non-fatal error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

PCI Express reported a non-fatal error.

Message #

PCI Express reported a non-fatal error.
 Device Identifier: Bus %1 Device %2 Function %3
 Uncorrectable Error Status: %4
 Correctable Error Status: %5
 Header Log: %6 %7 %8 %9

Fields #

Name	Description
`Uncorrectable_Error_Status`	—
`Correctable_Error_Status`	—
`Header_Log`	—
`SourceIdBus` UInt32	—
`SourceIdDev` UInt32	—
`SourceIdFun` UInt32	—
`UncorrectableErrorStatus` UInt32	—
`CorrectableErrorStatus` UInt32	—
`HeaderLog0` UInt32	—
`HeaderLog1` UInt32	—
`HeaderLog2` UInt32	—
`HeaderLog3` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 20 — WHEA Event

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

WHEA Event.

Message #

WHEA Event

Fields #

Name	Description
`Length` UInt32	—
`RawData` Binary	—

Event ID 21 — WHEA Event

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

WHEA Event.

Message #

WHEA Event

Fields #

Name	Description
`RecordId` UInt32	—
`SeqNum` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Event ID 31 — The memory page located at physical address PhysicalAddress Pending PlatformDirected Uncorrected.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

The memory page located at physical address PhysicalAddress Pending PlatformDirected Uncorrected. Persisted.

Message #

The memory page located at physical address %1 %2 %3 %4. %5

Fields #

Name	Description
`PhysicalAddress` HexInt64	—
`Pending` UInt8	—
`PlatformDirected` UInt8	—
`Uncorrected` UInt8	—
`Persisted` UInt8	—

Event ID 32 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—
`SqmSid` SID	—
`SqmWindowsSessionId` UInt32	—
`SqmSessionFlags` UInt32	—

Event ID 33 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—

Event ID 34 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—
`SqmID` UInt32	—
`SqmDWORDDatapointValue` UInt32	—

Event ID 35 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational
Opcode: Stop

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—
`SqmID` UInt32	—
`SqmDWORDDatapointValue` UInt32	—

Event ID 36 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—
`SqmID` UInt32	—
`SqmDWORDDatapointValue` UInt32	—

Event ID 37 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—
`SqmID` UInt32	—
`SqmDWORDDatapointValue` UInt32	—

Event ID 38 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—
`SqmID` UInt32	—
`SqmDWORDDatapointValue` UInt32	—

Event ID 39 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—
`SqmID` UInt32	—
`SqmStringDatapointValue` UnicodeString	—

Event ID 40 —

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32	—
`SqmSessionGuid` GUID	—
`SqmID` UInt32	—
`SqmStreamRowLength` UInt32	—
`SqmStreamRow` Int16	—

Event ID 41 — A processs was terminated due to an uncorrected hardware error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

A processs was terminated due to an uncorrected hardware error.

Message #

A processs was terminated due to an uncorrected hardware error.
 Process ID: %1
 Image name: %2

Fields #

Name	Description
`Process_ID` UInt32	—
`Image_name` UnicodeString	—
`ProcessId` UInt32	—
`ProcessName` UnicodeString	—

Event ID 42 — WHEA event log entry

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational
Level: Informational

Description

WHEA event log entry.

Message #

WHEA event log entry

Fields #

Name	Description
`Type` UInt32	—
`Owner` UInt32	—
`Id` UInt32	—
`Flags` UInt32	—
`Length` UInt32	—
`RawData` Binary	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-WHEA",
    "guid": "7B563579-53C8-44E7-8236-0F87B9FE6594",
    "event_source_name": "",
    "event_id": 42,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213694976,
    "time_created": "2023-11-06T06:25:15.449227+00:00",
    "event_record_id": 55,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-Kernel-WHEA/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Type": 0,
    "Owner": 1280201291,
    "Id": 2147483650,
    "Flags": 2,
    "Length": 5392,
    "RawData": "57684C670100000010150000000000004B524E4C0200008002000000F0140000B01AB2CE0DA6FFFF28778F5905F8FFFF00000000000000000000000001000000F829000057686561100000000000000000A071CE0DA6FFFF0000000000000000030000007C0D0000000000000000000000000000000000000000000000000000CC0300000B00000010000000020000002C0D00000100000003000000010000000000000000000000000000003C60C1835215A74887D114D9467D776550530000D80E00000100000050607DCE0DA6FFFF0001BF5C05F8FFFF1001BF5C05F8FFFFC0DAF65805F8FFFF8D7C2157665EFB4480339B74CACEDF5B00000000000000000000000000000000640400000100000010DE4FCE0DA6FFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000A028B4CE0DA6FFFFE0F878CE0DA6FFFF00000000000000000000000004000000481000005768656100000000000000000020B5CE0DA6FFFF00000000000000000900000074010000000000000000000000000000000000000000000000000000CC0300000A000000000000000200000041010000040000000900000002000000000000000000008000000106000000000000000000000000FFFFFFFFFFFFFFFF0001000000040000010400000204000003040000FFFFFFFFFFFFFFFF0101000004040000050400000604000007040000FFFFFFFFFFFFFFFF0201000008040000090400000A0400000B040000FFFFFFFFFFFFFFFF030100000C0400000D0400000E0400000F040000FFFFFFFFFFFFFFFF0401000010040000110400001204000013040000FFFFFFFFFFFFFFFF0501000014040000150400001604000017040000FFFFFFFFFFFFFFFF0601000018040000190400001A0400001B040000FFFFFFFFFFFFFFFF070100001C0400001D0400001E0400001F040000FFFFFFFFFFFFFFFF0801000020040000210400002204000023040000FFFFFFFFFFFFFFFF0901000024040000250400002604000027040000FFFFFFFFFFFFFFFF0A01000028040000290400002A0400002B040000FFFFFFFFFFFFFFFF0B0100002C0400002D0400002E0400002F040000FFFFFFFFFFFFFFFF0C01000030040000310400003204000033040000FFFFFFFFFFFFFFFF0D01000034040000350400003604000037040000FFFFFFFFFFFFFFFF0E01000038040000390400003A0400003B040000FFFFFFFFFFFFFFFF0F0100003C0400003D0400003E0400003F040000FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000A038B4CE0DA6FFFFB01AB2CE0DA6FFFF00000000000000000000000003000000481000005768656101000000000000000070B5CE0DA6FFFF00000000000000000900000074010000000000000000000000000000000000000000000000000000CC0300000A00000001000000020000004101000003000000090000000300000000000000000000800100010600000000001C000060EA000000000000000000000000000000000000000000000001000000040000010400000204000003040000FFFFFFFFFFFFFFFF0101000004040000050400000604000007040000FFFFFFFFFFFFFFFF0201000008040000090400000A0400000B040000FFFFFFFFFFFFFFFF030100000C0400000D0400000E0400000F040000FFFFFFFFFFFFFFFF0401000010040000110400001204000013040000FFFFFFFFFFFFFFFF0501000014040000150400001604000017040000FFFFFFFFFFFFFFFF0601000018040000190400001A0400001B040000FFFFFFFFFFFFFFFF070100001C0400001D0400001E0400001F040000FFFFFFFFFFFFFFFF0801000020040000210400002204000023040000FFFFFFFFFFFFFFFF0901000024040000250400002604000027040000FFFFFFFFFFFFFFFF0A01000028040000290400002A0400002B040000FFFFFFFFFFFFFFFF0B0100002C0400002D0400002E0400002F040000FFFFFFFFFFFFFFFF0C01000030040000310400003204000033040000FFFFFFFFFFFFFFFF0D01000034040000350400003604000037040000FFFFFFFFFFFFFFFF0E01000038040000390400003A0400003B040000FFFFFFFFFFFFFFFF0F0100003C0400003D0400003E0400003F040000FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000A098A5CE0DA6FFFFA028B4CE0DA6FFFF00000000000000000000000001000000C0060000576865610300000000000000A0B8A5CE0DA6FFFF000000000000000001000000C0010000000000000000000000000000000000000000000000000000CC0300000A000000030000000200000000010000010000000300000004000000000000000000008002000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028778F5905F8FFFFA038B4CE0DA6FFFF0000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000CC0300000A0000000700000002000000001000000100000008000000050000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline