detection.wiki

Microsoft-Windows-ManagementTools-TaskManagerProvider

51 events across 3 channels

Event IDTitleChannel
1000Provider load start: arg0.Operational
1001Provider load stop: arg0.Operational
1002Provider load error: arg0.Operational
1003Provider unload start: arg0.Operational
1004Provider unload stop: arg0.Operational
1005Provider unload error: arg0.Operational
1100Start SetIntervalSeconds method: arg0.Analytic
1101Stop SetIntervalSeconds method: arg0.Analytic
1102Error SetIntervalSeconds: arg1, arg0.Operational
1103Start force refresh data.Analytic
1104Stop force refresh data.Analytic
1105Error force refresh data: arg1, arg0.Operational
1106Start Enumerate MSFT_MTTaskManager instances.Analytic
1107Stop Enumerate MSFT_MTTaskManager instances.Analytic
1108Error Enumerate MSFT_MTTaskManager instances: arg1, arg0.Operational
1109Start Enumerate MSFT_MTProcess instances.Analytic
1110Stop Enumerate MSFT_MTProcess instances.Analytic
1111Error Enumerate MSFT_MTProcess instances: arg1, arg0.Operational
1112Start Enumerate MSFT_MTProcessorSummary instances.Analytic
1113Stop Enumerate MSFT_MTProcessorSummary instances.Analytic
1114Error Enumerate MSFT_MTProcessorSummary instances: arg1, arg0.Operational
1115Start Enumerate MSFT_MTLogicalProcessor instances.Analytic
1116Stop Enumerate MSFT_MTLogicalProcessor instances.Analytic
1117Error Enumerate MSFT_MTLogicalProcessor instances: arg1, arg0.Operational
1118Start Enumerate MSFT_MTMemorySummary instances.Analytic
1119Stop Enumerate MSFT_MTMemorySummary instances.Analytic
1120Error Enumerate MSFT_MTMemorySummary instances: arg1, arg0.Operational
1121Start Enumerate MSFT_MTDisk instances.Analytic
1122Stop Enumerate MSFT_MTDisk instances.Analytic
1123Error Enumerate MSFT_MTDisk instances: arg1, arg0.Operational
1124Start Enumerate MSFT_MTNetworkAdapter instances.Analytic
1125Stop Enumerate MSFT_MTNetworkAdapter instances.Analytic
1126Error Enumerate MSFT_MTNetworkAdapter instances: arg1, arg0.Operational
1200Error initialized data collection: arg1, arg0.Operational
1201Error collect data: arg1, arg0.Operational
1202Start initializing data collection.Analytic
1203Stop initializing data collection.Analytic
1204Start collect data: arg0.Debug
1205Stop collect data: arg0.Debug
1300Start Delete Process instance: arg0.Analytic
1301Stop Delete Process instance: arg0.Analytic
1302Error Delete MSFT_MTProcess instance: arg1, arg0.Operational
1303Start creating process dump: arg0.Analytic
1304Stop creating process dump: arg0.Analytic
1305Error creating process dump: arg1, arg0.Operational
1306Start creating process: arg0.Analytic
1307Stop creating process: arg0.Analytic
1308Error creating process: arg1, arg0.Operational
1309No path or executable specified: arg0.Operational
1400Process update statistics: PID:PID, Index:Index, Duration:Duration, …Debug
1401Failed to open handle for process ID arg0.Analytic

Event ID 1000 — Provider load start: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime
Opcode
Start

Description

Provider load start: arg0.

Message #

Provider load start: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1001 — Provider load stop: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime
Opcode
Stop

Description

Provider load stop: arg0.

Message #

Provider load stop: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1002 — Provider load error: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Provider load error: arg0.

Message #

Provider load error: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1003 — Provider unload start: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime
Opcode
Start

Description

Provider unload start: arg0.

Message #

Provider unload start: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1004 — Provider unload stop: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime
Opcode
Stop

Description

Provider unload stop: arg0.

Message #

Provider unload stop: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1005 — Provider unload error: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Provider unload error: arg0.

Message #

Provider unload error: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1100 — Start SetIntervalSeconds method: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Start

Description

Start SetIntervalSeconds method: arg0.

Message #

Start SetIntervalSeconds method: %1.

Fields #

NameDescription
arg0 UInt16—

Event ID 1101 — Stop SetIntervalSeconds method: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Stop

Description

Stop SetIntervalSeconds method: arg0.

Message #

Stop SetIntervalSeconds method: %1.

Fields #

NameDescription
arg0 UInt16—

Event ID 1102 — Error SetIntervalSeconds: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Action

Description

Error SetIntervalSeconds: arg1, arg0.

Message #

Error SetIntervalSeconds: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1103 — Start force refresh data.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Start

Description

Start force refresh data.

Message #

Start force refresh data.

Event ID 1104 — Stop force refresh data.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Stop

Description

Stop force refresh data.

Message #

Stop force refresh data.

Event ID 1105 — Error force refresh data: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Action

Description

Error force refresh data: arg1, arg0.

Message #

Error force refresh data: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1106 — Start Enumerate MSFT_MTTaskManager instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Start

Description

Start Enumerate MSFT_MTTaskManager instances.

Message #

Start Enumerate MSFT_MTTaskManager instances.

Event ID 1107 — Stop Enumerate MSFT_MTTaskManager instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Stop

Description

Stop Enumerate MSFT_MTTaskManager instances.

Message #

Stop Enumerate MSFT_MTTaskManager instances.

Event ID 1108 — Error Enumerate MSFT_MTTaskManager instances: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Error Enumerate MSFT_MTTaskManager instances: arg1, arg0.

Message #

Error Enumerate MSFT_MTTaskManager instances: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1109 — Start Enumerate MSFT_MTProcess instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Start

Description

Start Enumerate MSFT_MTProcess instances.

Message #

Start Enumerate MSFT_MTProcess instances.

Event ID 1110 — Stop Enumerate MSFT_MTProcess instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Stop

Description

Stop Enumerate MSFT_MTProcess instances.

Message #

Stop Enumerate MSFT_MTProcess instances.

Event ID 1111 — Error Enumerate MSFT_MTProcess instances: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Error Enumerate MSFT_MTProcess instances: arg1, arg0.

Message #

Error Enumerate MSFT_MTProcess instances: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1112 — Start Enumerate MSFT_MTProcessorSummary instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Start

Description

Start Enumerate MSFT_MTProcessorSummary instances.

Message #

Start Enumerate MSFT_MTProcessorSummary instances.

Event ID 1113 — Stop Enumerate MSFT_MTProcessorSummary instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Stop

Description

Stop Enumerate MSFT_MTProcessorSummary instances.

Message #

Stop Enumerate MSFT_MTProcessorSummary instances.

Event ID 1114 — Error Enumerate MSFT_MTProcessorSummary instances: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Error Enumerate MSFT_MTProcessorSummary instances: arg1, arg0.

Message #

Error Enumerate MSFT_MTProcessorSummary instances: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1115 — Start Enumerate MSFT_MTLogicalProcessor instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Start

Description

Start Enumerate MSFT_MTLogicalProcessor instances.

Message #

Start Enumerate MSFT_MTLogicalProcessor instances.

Event ID 1116 — Stop Enumerate MSFT_MTLogicalProcessor instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Stop

Description

Stop Enumerate MSFT_MTLogicalProcessor instances.

Message #

Stop Enumerate MSFT_MTLogicalProcessor instances.

Event ID 1117 — Error Enumerate MSFT_MTLogicalProcessor instances: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Error Enumerate MSFT_MTLogicalProcessor instances: arg1, arg0.

Message #

Error Enumerate MSFT_MTLogicalProcessor instances: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1118 — Start Enumerate MSFT_MTMemorySummary instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Start

Description

Start Enumerate MSFT_MTMemorySummary instances.

Message #

Start Enumerate MSFT_MTMemorySummary instances.

Event ID 1119 — Stop Enumerate MSFT_MTMemorySummary instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Stop

Description

Stop Enumerate MSFT_MTMemorySummary instances.

Message #

Stop Enumerate MSFT_MTMemorySummary instances.

Event ID 1120 — Error Enumerate MSFT_MTMemorySummary instances: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Error Enumerate MSFT_MTMemorySummary instances: arg1, arg0.

Message #

Error Enumerate MSFT_MTMemorySummary instances: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1121 — Start Enumerate MSFT_MTDisk instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Start

Description

Start Enumerate MSFT_MTDisk instances.

Message #

Start Enumerate MSFT_MTDisk instances.

Event ID 1122 — Stop Enumerate MSFT_MTDisk instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Stop

Description

Stop Enumerate MSFT_MTDisk instances.

Message #

Stop Enumerate MSFT_MTDisk instances.

Event ID 1123 — Error Enumerate MSFT_MTDisk instances: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Error Enumerate MSFT_MTDisk instances: arg1, arg0.

Message #

Error Enumerate MSFT_MTDisk instances: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1124 — Start Enumerate MSFT_MTNetworkAdapter instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Start

Description

Start Enumerate MSFT_MTNetworkAdapter instances.

Message #

Start Enumerate MSFT_MTNetworkAdapter instances.

Event ID 1125 — Stop Enumerate MSFT_MTNetworkAdapter instances.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Lifetime
Opcode
Stop

Description

Stop Enumerate MSFT_MTNetworkAdapter instances.

Message #

Stop Enumerate MSFT_MTNetworkAdapter instances.

Event ID 1126 — Error Enumerate MSFT_MTNetworkAdapter instances: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Lifetime

Description

Error Enumerate MSFT_MTNetworkAdapter instances: arg1, arg0.

Message #

Error Enumerate MSFT_MTNetworkAdapter instances: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1200 — Error initialized data collection: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Collection

Description

Error initialized data collection: arg1, arg0.

Message #

Error initialized data collection: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1201 — Error collect data: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Collection

Description

Error collect data: arg1, arg0.

Message #

Error collect data: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1202 — Start initializing data collection.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Collection
Opcode
Start

Description

Start initializing data collection.

Message #

Start initializing data collection.

Event ID 1203 — Stop initializing data collection.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Collection
Opcode
Stop

Description

Stop initializing data collection.

Message #

Stop initializing data collection.

Event ID 1204 — Start collect data: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Debug
Task
Collection
Opcode
Start

Description

Start collect data: arg0.

Message #

Start collect data: %1.

Fields #

NameDescription
arg0 UInt16—

Event ID 1205 — Stop collect data: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Debug
Task
Collection
Opcode
Stop

Description

Stop collect data: arg0.

Message #

Stop collect data: %1.

Fields #

NameDescription
arg0 UInt16—

Event ID 1300 — Start Delete Process instance: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Start

Description

Start Delete Process instance: arg0.

Message #

Start Delete Process instance: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1301 — Stop Delete Process instance: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Stop

Description

Stop Delete Process instance: arg0.

Message #

Stop Delete Process instance: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1302 — Error Delete MSFT_MTProcess instance: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Action

Description

Error Delete MSFT_MTProcess instance: arg1, arg0.

Message #

Error Delete MSFT_MTProcess instance: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1303 — Start creating process dump: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Start

Description

Start creating process dump: arg0.

Message #

Start creating process dump: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1304 — Stop creating process dump: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Stop

Description

Stop creating process dump: arg0.

Message #

Stop creating process dump: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1305 — Error creating process dump: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Action

Description

Error creating process dump: arg1, arg0.

Message #

Error creating process dump: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1306 — Start creating process: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Start

Description

Start creating process: arg0.

Message #

Start creating process: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1307 — Stop creating process: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Action
Opcode
Stop

Description

Stop creating process: arg0.

Message #

Stop creating process: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1308 — Error creating process: arg1, arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Action

Description

Error creating process: arg1, arg0.

Message #

Error creating process: %1, %2

Fields #

NameDescription
arg1 Int32—
arg0 UnicodeString—

Event ID 1309 — No path or executable specified: arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Operational
Task
Action

Description

No path or executable specified: arg0.

Message #

No path or executable specified: %1.

Fields #

NameDescription
arg0 UnicodeString—

Event ID 1400 — Process update statistics: PID:PID, Index:Index, Duration:Duration, CycleDuration:CycleDuration, Total:Total, CyclesTotal:CyclesTotal, CpuCount:CpuCount, OldCpuTime:OldCpuTime, OldCycleTime:OldCycl...

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Debug
Task
Collection

Message #

Process update statistics: PID:%1, Index:%2, Duration:%3, CycleDuration:%4, Total:%5, CyclesTotal:%6, CpuCount:%7, OldCpuTime:%8, OldCycleTime:%9, OldWorkingSet:%10, OldPageFaults:%11, NewUserTime:%12, NewKernelTime:%13, NewWorkingSet:%14, NewPageFaults:%15, NewCycleTime:%16.

Fields #

NameDescription
PID UInt32—
Index UInt16—
Duration UInt64—
CycleDuration UInt64—
Total Double—
CyclesTotal Double—
CpuCount Int16—
OldCpuTime UInt64—
OldCycleTime UInt64—
OldWorkingSet UInt64—
OldPageFaults UInt32—
NewUserTime Int64—
NewKernelTime Int64—
NewWorkingSet UInt64—
NewPageFaults UInt32—
NewCycleTime UInt64—

Event ID 1401 — Failed to open handle for process ID arg0.

Provider
Microsoft-Windows-ManagementTools-TaskManagerProvider
Channel
Analytic
Task
Collection

Description

Failed to open handle for process ID arg0.

Message #

Failed to open handle for process ID %1.

Fields #

NameDescription
arg0 Int32—