Microsoft-Windows-Minstore

41 events across 2 channels

Event	Title	Channel
1	Bucket split	Analytic
2	Bucket merge	Analytic
10	Tree update	Analytic
11	Tree update	Analytic
12	Start tree update	Analytic
13	End tree update	Analytic
20	LFF: Redo log	Analytic
21	LFF: Protected space	Analytic
22	Allocation range.	Debug
23	Log tail advance from Lsn1 to Lsn2.	Analytic
24	Log pulse lazy writer.	Analytic
25	Container move.	Analytic
26	Minstore Redo Log application has been skipped.	Analytic
27	An error	Analytic
50	Two threads tried to read bucket IdHigh (table IdLow) for level.	Analytic
51	A thread had to wait to lock bucket IdHigh (table IdLow) for level.	Analytic
52	A thread had to wait for a copy of bucket IdHigh (table IdLow) for level.	Analytic
100	B+ node CRC mismatch	Analytic
101	B+ node repaired via redundant copy	Analytic
1000	B+ tree node started splitting	Analytic
1002	B+ tree node finished splitting	Analytic
1003	B+ tree nodes started merging	Analytic
1004	B+ tree nodes finished merging	Analytic
1005	B+ tree starting pushing its root	Analytic
1006	B+ tree finished pushing its root	Analytic
1007	B+ tree starting popping its root	Analytic
1008	B+ tree finished popping its root	Analytic
1011	Analyze pass start	Analytic
1012	Analyze pass end	Analytic
1013	Redo pass start	Analytic
1014	Redo pass end	Analytic
1015	Flush And Checkpoint start	Analytic
1016	Flush And Checkpoint end	Analytic
1017	First redo transaction found	Analytic
1018	Tree Update Record found	Analytic
1019	Open Table for redo	Analytic
1020	Reserve ranges for redo	Analytic
1030	Binding IdHigh.	Analytic
1031	Binding IdHigh.	Analytic
1032	Binding IdHigh.	Analytic
1033	Binding IdHigh.	Analytic

Event ID 1: Bucket split

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketSplit

Description

Bucket split.

Message #

Bucket split

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 2: Bucket merge

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketMerge

Description

Bucket merge.

Message #

Bucket merge

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 10: Tree update

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TreeUpdateTask
Opcode: WriteB+tree

Description

Tree update.

Message #

Tree update

Fields #

Name	Description
`PageCount` UInt32
`IdHigh` HexInt64
`IdLow` HexInt64

Event ID 11: Tree update

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: VolumeCheckpoint
Opcode: Checkpoint

Description

Tree update.

Message #

Tree update

Fields #

Name	Description
`PageCount` UInt32
`IdHigh` HexInt64
`IdLow` HexInt64

Event ID 12: Start tree update

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TreeUpdateTask
Opcode: StartedwritingB+tree

Description

Start tree update.

Message #

Start tree update

Fields #

Name	Description
`PageCount` UInt32
`IdHigh` HexInt64
`IdLow` HexInt64

Event ID 13: End tree update

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TreeUpdateTask
Opcode: FinishedwritingB+tree

Description

End tree update.

Message #

End tree update

Fields #

Name	Description
`PageCount` UInt32
`IdHigh` HexInt64
`IdLow` HexInt64

Event ID 20: LFF: Redo log

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: ForwardProgress
Opcode: RedoLog

Description

LFF: Redo log.

Message #

LFF: Redo log

Fields #

Name	Description
`Pending` UInt32
`Amount` UInt32
`Lsn1` HexInt64
`Lsn2` HexInt64
`Lsn3` HexInt64

Event ID 21: LFF: Protected space

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: ForwardProgress
Opcode: ProtectedSpace

Description

LFF: Protected space.

Message #

LFF: Protected space

Fields #

Name	Description
`PageCount` UInt32
`IdHigh` HexInt64
`IdLow` HexInt64

Event ID 22: Allocation range.

Provider: Microsoft-Windows-Minstore
Channel: Debug
Task: Allocation
Opcode: Allocationrange

Description

Allocation range.

Message #

Allocation range:
	Metadata allocation: %1 
	Requested tier: %2, actual tier: %3 
	Requested allocation start: %4, count: %5 
	Actual allocation start: %6, count: %7

Fields #

Name	Description
`IsMetadata` Boolean
`RequestedTier` UInt32
`ActualTier` UInt32
`RequestedStartOfRange` UInt64
`RequestedCountOfRange` UInt64
`AllocatedStartOfRange` UInt64
`AllocatedCountOfRange` UInt64

Event ID 23: Log tail advance from Lsn1 to Lsn2.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: ForwardProgress
Opcode: Logtailadvance

Description

Log tail advance from Lsn1 to Lsn2.

Message #

Log tail advance from %3 to %4.
Log is %2 percent full.

Fields #

Name	Description
`Pending` UInt32
`Amount` UInt32
`Lsn1` HexInt64
`Lsn2` HexInt64
`Lsn3` HexInt64

Event ID 24: Log pulse lazy writer.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: ForwardProgress
Opcode: Logpulselazywriter

Description

Log pulse lazy writer. Log is Amount percent full.

Message #

Log pulse lazy writer. Log is %2 percent full.

Fields #

Name	Description
`Pending` UInt32
`Amount` UInt32
`Lsn1` HexInt64
`Lsn2` HexInt64
`Lsn3` HexInt64

Event ID 25: Container move.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: Allocation
Opcode: Containermove

Description

Container move.

Message #

Container move:
	Source tier: %1, Target tier: %2 
	Source start of range: %3, count: %4 
	 Target physical offset: %5 
	SSD Fill Ratio %6, HDD Fill Ratio %7 
	Reserved: %8
	Destaged allocation count: %9
	Failed SSD Destage: %10

Fields #

Name	Description
`SourceTier` UInt32
`TargetTier` UInt32
`SourceStartOfRange` HexInt64
`SourceCountOfRange` HexInt64
`TargetPhysicalOffset` HexInt64
`SsdFillRatio` UInt32
`HddFillRatio` UInt32
`IsTargetReserved` Boolean
`DestageAllocationCount` HexInt64
`FailedSsdDestage` Boolean

Event ID 26: Minstore Redo Log application has been skipped.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: Logskipreplay

Description

Minstore Redo Log application has been skipped. Minstore will now mount the volume without applying the redo log.

Message #

Minstore Redo Log application has been skipped. Minstore will now mount the volume without applying the redo log.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 27: An error

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: Logreplayfailure

Description

An error

Message #

An error

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 50: Two threads tried to read bucket IdHigh (table IdLow) for level.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: Contention
Opcode: Bucketreadcollision

Description

Two threads tried to read bucket IdHigh (table IdLow) for level.

Message #

Two threads tried to read bucket %1 (table %2) for level

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`Lcn` HexInt64
`Level` HexInt32

Event ID 51: A thread had to wait to lock bucket IdHigh (table IdLow) for level.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: Contention
Opcode: Bucketlockcollision

Description

A thread had to wait to lock bucket IdHigh (table IdLow) for level.

Message #

A thread had to wait to lock bucket %1 (table %2) for level

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`Lcn` HexInt64
`Level` HexInt32

Event ID 52: A thread had to wait for a copy of bucket IdHigh (table IdLow) for level.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: Contention
Opcode: Bucketcowcollision

Description

A thread had to wait for a copy of bucket IdHigh (table IdLow) for level.

Message #

A thread had to wait for a copy of bucket %1 (table %2) for level

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`Lcn` HexInt64
`Level` HexInt32

Event ID 100: B+ node CRC mismatch

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: ErrorDetected
Opcode: B+nodeCRCmismatch

Description

B+ node CRC mismatch.

Message #

B+ node CRC mismatch

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`PageLcn` HexInt64
`Lcn` HexInt64
`PageVirtualClock` HexInt64
`VolumeVirtualClock` HexInt64
`Scrubbing` Boolean

Event ID 101: B+ node repaired via redundant copy

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: ErrorDetected
Opcode: B+noderepairedviaredundantcopy

Description

B+ node repaired via redundant copy.

Message #

B+ node repaired via redundant copy

Fields #

Name	Description
`Lcn` HexInt64
`Scrubbing` Boolean

Event ID 1000: B+ tree node started splitting

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketSplit

Description

B+ tree node started splitting.

Message #

B+ tree node started splitting

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 1002: B+ tree node finished splitting

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketSplit

Description

B+ tree node finished splitting.

Message #

B+ tree node finished splitting

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 1003: B+ tree nodes started merging

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketMerge

Description

B+ tree nodes started merging.

Message #

B+ tree nodes started merging

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 1004: B+ tree nodes finished merging

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketMerge

Description

B+ tree nodes finished merging.

Message #

B+ tree nodes finished merging

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 1005: B+ tree starting pushing its root

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketSplit

Description

B+ tree starting pushing its root.

Message #

B+ tree starting pushing its root

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 1006: B+ tree finished pushing its root

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketSplit

Description

B+ tree finished pushing its root.

Message #

B+ tree finished pushing its root

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 1007: B+ tree starting popping its root

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketMerge

Description

B+ tree starting popping its root.

Message #

B+ tree starting popping its root

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 1008: B+ tree finished popping its root

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: TableEvent
Opcode: BucketMerge

Description

B+ tree finished popping its root.

Message #

B+ tree finished popping its root

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`TableType` UInt32

Event ID 1011: Analyze pass start

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Analyze pass start.

Message #

Analyze pass start

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1012: Analyze pass end

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Analyze pass end.

Message #

Analyze pass end

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1013: Redo pass start

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Redo pass start.

Message #

Redo pass start

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1014: Redo pass end

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Redo pass end.

Message #

Redo pass end

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1015: Flush And Checkpoint start

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Flush And Checkpoint start.

Message #

Flush And Checkpoint start

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1016: Flush And Checkpoint end

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Flush And Checkpoint end.

Message #

Flush And Checkpoint end

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1017: First redo transaction found

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

First redo transaction found.

Message #

First redo transaction found

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1018: Tree Update Record found

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Tree Update Record found.

Message #

Tree Update Record found

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1019: Open Table for redo

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Open Table for redo.

Message #

Open Table for redo

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1020: Reserve ranges for redo

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LogRedo
Opcode: LogRedo

Description

Reserve ranges for redo.

Message #

Reserve ranges for redo

Fields #

Name	Description
`StartLsn` HexInt64
`EndLsn` HexInt64
`TransactionsRemaining` UInt64

Event ID 1030: Binding IdHigh.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LazyWriter
Opcode: LazyWriter

Description

Binding IdHigh.IdLow was added to lazy writer list.

Message #

Binding %1.%2 was added to lazy writer list

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64

Event ID 1031: Binding IdHigh.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LazyWriter
Opcode: LazyWriter

Description

Binding IdHigh.IdLow was removed from lazy writer list.

Message #

Binding %1.%2 was removed from lazy writer list

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64

Event ID 1032: Binding IdHigh.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LazyWriter
Opcode: LazyWriter

Description

Binding IdHigh.IdLow was queued by rule Reason.

Message #

Binding %1.%2 was queued by rule %3

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64
`Reason` UInt32

Event ID 1033: Binding IdHigh.

Provider: Microsoft-Windows-Minstore
Channel: Analytic
Task: LazyWriter
Opcode: LazyWriter

Description

Binding IdHigh.IdLow write starts.

Message #

Binding %1.%2 write starts

Fields #

Name	Description
`IdHigh` HexInt64
`IdLow` HexInt64

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 55b24b1d-dd9c-44c0-ba77-4f749f1b6976

Defined in minstoreevents.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-Minstore registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Minstore registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)