Microsoft-Windows-ResumeKeyFilter

96 events across 3 channels

Event ID	Title	Channel
1000	The filter loaded successfully.	Operational
1001	The filter was successfully attached to String.	Operational
1002	The resume database for String was loaded successfully.	Operational
1003	The filter received a dismount request for String.	Operational
1004	The re-mount request for String completed successfully.	Operational
1005	The filter was detached from String.	Operational
1006	The filter unloaded.	Operational
1007	The filter detected an incomplete failover recovery and purged the resume …	Operational
1008	The filter failed to attach to a volume because the volume supports short names …	Operational
1010	The filter detected that chkdsk has been run on volume String and has purged the …	Operational
1011	The filter detected that a volume snap shot may have been restored on volume …	Operational
1100	The creation of a bypass handle on file String completed successfully.	Analytic
1100		Operational
1101	The creation of a new resume handle Guid on file String completed successfully.	Analytic
1101		Operational
1102	The replay creation of resume handle Guid on file String completed successfully.	Analytic
1102		Operational
1103	The resume of handle Guid on file String started successfully.	Analytic
1103		Operational
1104	The resume of a handle on file name String1 was successfully reparsed to file …	Analytic
1104		Operational
1105	The resume of handle Guid on file String completed successfully.	Analytic
1105		Operational
1110	The resume handle Guid on file String was suspended.	Analytic
1110		Operational
1111	The resume handle ResumeKey on file String was timed out and cancelled.	Operational
1112	The resume handle Guid on file String was cancelled successfully.	Analytic
1112		Operational
1113	The resume handle Guid on file String was closed.	Analytic
1113		Operational
1114	The deferred delete of file String completed successfully.	Analytic
1114		Operational
1120	The filter delayed the creation of a handle on file String1 because the resume …	Operational
1121	The filter failed the creation of a handle on file String because the file has …	Operational
1122	The filter failed the creation of a handle on file String because the file is …	Operational
1123	The filter failed the creation of a handle on file String because the parent …	Operational
1124	The filter failed the creation of a handle on file String because the parent …	Operational
1130	The filter failed an oplock request on file String because the file has …	Analytic
1130		Operational
1131	The filter failed a write operation on file String because the file has …	Analytic
1131		Operational
1132	The filter failed a read operation on file String because the file has …	Analytic
1132		Operational
1133	The filter failed an exclusive byte range lock request on file String because …	Analytic
1133		Operational
1134	The filter failed a shared byte range lock request on file String because the …	Analytic
1134		Operational
1135	The filter failed the create of a hard link on file String because hard links …	Operational
1136	The filter failed the rename of an alternate data stream on file String because …	Operational
1137	The filter failed a rename replace to file String because this target file has …	Analytic
1137		Operational
1138	The filter failed a set end-of-file request on file String because the file has …	Analytic
1138		Operational
1139	The filter failed a set zero data request on file String because the file has …	Analytic
1139		Operational
1140	The filter failed a rename request on file String because the resume database …	Analytic
1140		Operational
1141	The filter failed a rename request on file String because the file has …	Analytic
1141		Operational
1142	The filter failed a copy offload read operation on file String because the file …	Analytic
1142		Operational
1143	The filter failed a copy offload write operation on file String because the file …	Analytic
1143		Operational
1144	The filter failed a file trim operation on file String because the file has …	Analytic
1144		Operational
1145	The filter failed a file set read only attribute operation on file String …	Analytic
1145		Operational
1150	The creation of a new resume handle on file String failed because the file has …	Operational
1151	The creation of a new handle on file String failed because the supersede of a …	Operational
2000	The filter failed to load with error status Status.	Operational
2001	The filter failed to attach to String with error status Status.	Operational
2002	The resume database for String failed to load with error status Status.	Operational
2004	The re-mount request for String failed with error status Status.	Operational
2100	The creation of a bypass handle on file String failed with error status Status.	Analytic
2100		Operational
2101	The creation of a new resume handle Guid on file String failed with error status …	Analytic
2101		Operational
2102	The replay creation of resume handle Guid on file String failed with error …	Analytic
2102		Operational
2103	The resume of handle Guid on file String failed with error status Status.	Operational
2104	The resume of a handle on file name String1 failed to reparse to a valid file …	Operational
2112	The resume handle Guid on file String failed to cancel with error status Status.	Analytic
2112		Operational
2114	The deferred delete of file String failed with error status Status.	Operational
4000		Operational
4000	Driver entry pre enter: FileObject FileObject (FileObjectName), MajorFunction …	Performance
4001		Operational
4001	Driver entry pre exit: FileObject FileObject, MajorFunction MajorFunction …	Performance
4002		Operational
4002	Driver entry post enter: FileObject FileObject, MajorFunction MajorFunction …	Performance
4003		Operational
4003	Driver entry post exit: FileObject FileObject, MajorFunction MajorFunction …	Performance
4010		Operational
4010	Log file enter: FileObject FileObject, MajorFunction MajorFunction …	Performance
4011		Operational
4011	Log file exit: FileObject FileObject, MajorFunction MajorFunction …	Performance

Event ID 1000 — The filter loaded successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter loaded successfully.

Message #

The filter loaded successfully.

Fields #

Name	Description
`Status` UInt32	— NTSTATUS reference

Event ID 1001 — The filter was successfully attached to String.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter was successfully attached to String.

Message #

The filter was successfully attached to %2.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1002 — The resume database for String was loaded successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume database for String was loaded successfully. The load operation took Valuems to complete.

Message #

The resume database for %2 was loaded successfully. The load operation took %3ms to complete.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1003 — The filter received a dismount request for String.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter received a dismount request for String.

Message #

The filter received a dismount request for %2.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1004 — The re-mount request for String completed successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The re-mount request for String completed successfully.

Message #

The re-mount request for %2 completed successfully.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1005 — The filter was detached from String.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter was detached from String.

Message #

The filter was detached from %2.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1006 — The filter unloaded.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter unloaded.

Message #

The filter unloaded.

Fields #

Name	Description
`Status` UInt32	— NTSTATUS reference

Event ID 1007 — The filter detected an incomplete failover recovery and purged the resume database for String.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter detected an incomplete failover recovery and purged the resume database for String.

Message #

The filter detected an incomplete failover recovery and purged the resume database for %2.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1008 — The filter failed to attach to a volume because the volume supports short names but the filter does not support short names.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed to attach to a volume because the volume supports short names but the filter does not support short names.

Message #

The filter failed to attach to a volume because the volume supports short names but the filter does not support short names.

Fields #

Name	Description
`Status` UInt32	— NTSTATUS reference

Event ID 1010 — The filter detected that chkdsk has been run on volume String and has purged the resume database.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter detected that chkdsk has been run on volume String and has purged the resume database.

Message #

The filter detected that chkdsk has been run on volume %2 and has purged the resume database.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1011 — The filter detected that a volume snap shot may have been restored on volume String and has purged the resume database.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter detected that a volume snap shot may have been restored on volume String and has purged the resume database.

Message #

The filter detected that a volume snap shot may have been restored on volume %2 and has purged the resume database.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1100 — The creation of a bypass handle on file String completed successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The creation of a bypass handle on file String completed successfully.

Message #

The creation of a bypass handle on file %3 completed successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1100 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The creation of a bypass handle on file completed successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1101 — The creation of a new resume handle Guid on file String completed successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The creation of a new resume handle Guid on file String completed successfully.

Message #

The creation of a new resume handle %1 on file %3 completed successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1101 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The creation of a new resume handle on file completed successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1102 — The replay creation of resume handle Guid on file String completed successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The replay creation of resume handle Guid on file String completed successfully.

Message #

The replay creation of resume handle %1 on file %3 completed successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1102 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The replay creation of resume handle on file completed successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1103 — The resume of handle Guid on file String started successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The resume of handle Guid on file String started successfully.

Message #

The resume of handle %1 on file %3 started successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1103 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume of handle on file started successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1104 — The resume of a handle on file name String1 was successfully reparsed to file name String2.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The resume of a handle on file name String1 was successfully reparsed to file name String2.

Message #

The resume of a handle on file name %2 was successfully reparsed to file name %4.

Fields #

Name	Description
`String1Length` UInt16	—
`String1` UnicodeString	—
`String2Length` UInt16	—
`String2` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1104 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume of a handle on file name was successfully reparsed to file name .

Fields #

Name	Description
`String1Length` UInt16	—
`String1` UnicodeString	—
`String2Length` UInt16	—
`String2` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1105 — The resume of handle Guid on file String completed successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The resume of handle Guid on file String completed successfully.

Message #

The resume of handle %1 on file %3 completed successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1105 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume of handle on file completed successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1110 — The resume handle Guid on file String was suspended.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The resume handle Guid on file String was suspended.

Message #

The resume handle %1 on file %3 was suspended.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1110 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume handle on file was suspended.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1111 — The resume handle ResumeKey on file String was timed out and cancelled.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume handle ResumeKey on file String was timed out and cancelled.

Message #

The resume handle %1 on file %3 was timed out and cancelled.

Fields #

Name	Description
`ResumeKey` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference
`RfsKey` GUID	—
`NodeId` GUID	—
`AppId` GUID	—
`DesiredAccess` UInt32	— Process access rights reference
`ShareMode` UInt32	—
`CreateOptions` UInt32	—
`FileAttribs` UInt32	—
`CreateDisp` UInt32	—

Event ID 1112 — The resume handle Guid on file String was cancelled successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The resume handle Guid on file String was cancelled successfully.

Message #

The resume handle %1 on file %3 was cancelled successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1112 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume handle on file was cancelled successfully.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1113 — The resume handle Guid on file String was closed.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The resume handle Guid on file String was closed.

Message #

The resume handle %1 on file %3 was closed.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1113 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume handle on file was closed.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 1114 — The deferred delete of file String completed successfully.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The deferred delete of file String completed successfully.

Message #

The deferred delete of file %2 completed successfully.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1114 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The deferred delete of file completed successfully.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1120 — The filter delayed the creation of a handle on file String1 because the resume database for the volume was still loading.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter delayed the creation of a handle on file String1 because the resume database for the volume was still loading.

Message #

The filter delayed the creation of a handle on file %2 because the resume database for the volume was still loading.

Fields #

Name	Description
`String1Length` UInt16	—
`String1` UnicodeString	—
`String2Length` UInt16	—
`String2` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1121 — The filter failed the creation of a handle on file String because the file has pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed the creation of a handle on file String because the file has pending resume handles.

Message #

The filter failed the creation of a handle on file %2 because the file has pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1122 — The filter failed the creation of a handle on file String because the file is delete pending.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed the creation of a handle on file String because the file is delete pending.

Message #

The filter failed the creation of a handle on file %2 because the file is delete pending.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1123 — The filter failed the creation of a handle on file String because the parent directory has pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed the creation of a handle on file String because the parent directory has pending resume handles.

Message #

The filter failed the creation of a handle on file %2 because the parent directory has pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1124 — The filter failed the creation of a handle on file String because the parent directory is delete pending.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed the creation of a handle on file String because the parent directory is delete pending.

Message #

The filter failed the creation of a handle on file %2 because the parent directory is delete pending.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1130 — The filter failed an oplock request on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed an oplock request on file String because the file has conflicting pending resume handles.

Message #

The filter failed an oplock request on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1130 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed an oplock request on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1131 — The filter failed a write operation on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a write operation on file String because the file has conflicting pending resume handles.

Message #

The filter failed a write operation on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1131 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a write operation on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1132 — The filter failed a read operation on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a read operation on file String because the file has conflicting pending resume handles.

Message #

The filter failed a read operation on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1132 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a read operation on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1133 — The filter failed an exclusive byte range lock request on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed an exclusive byte range lock request on file String because the file has conflicting pending resume handles.

Message #

The filter failed an exclusive byte range lock request on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1133 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed an exclusive byte range lock request on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1134 — The filter failed a shared byte range lock request on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a shared byte range lock request on file String because the file has conflicting pending resume handles.

Message #

The filter failed a shared byte range lock request on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1134 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a shared byte range lock request on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1135 — The filter failed the create of a hard link on file String because hard links are not supported.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed the create of a hard link on file String because hard links are not supported.

Message #

The filter failed the create of a hard link on file %2 because hard links are not supported.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1136 — The filter failed the rename of an alternate data stream on file String because rename of alternate data streams is not supported.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed the rename of an alternate data stream on file String because rename of alternate data streams is not supported.

Message #

The filter failed the rename of an alternate data stream on file %2 because rename of alternate data streams is not supported.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1137 — The filter failed a rename replace to file String because this target file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a rename replace to file String because this target file has conflicting pending resume handles.

Message #

The filter failed a rename replace to file %2 because this target file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1137 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a rename replace to file because this target file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1138 — The filter failed a set end-of-file request on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a set end-of-file request on file String because the file has conflicting pending resume handles.

Message #

The filter failed a set end-of-file request on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1138 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a set end-of-file request on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1139 — The filter failed a set zero data request on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a set zero data request on file String because the file has conflicting pending resume handles.

Message #

The filter failed a set zero data request on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1139 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a set zero data request on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1140 — The filter failed a rename request on file String because the resume database was still being processed.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a rename request on file String because the resume database was still being processed.

Message #

The filter failed a rename request on file %2 because the resume database was still being processed.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1140 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a rename request on file because the resume database was still being processed.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1141 — The filter failed a rename request on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a rename request on file String because the file has conflicting pending resume handles.

Message #

The filter failed a rename request on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1141 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a rename request on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1142 — The filter failed a copy offload read operation on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a copy offload read operation on file String because the file has conflicting pending resume handles.

Message #

The filter failed a copy offload read operation on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1142 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a copy offload read operation on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1143 — The filter failed a copy offload write operation on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a copy offload write operation on file String because the file has conflicting pending resume handles.

Message #

The filter failed a copy offload write operation on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1143 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a copy offload write operation on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1144 — The filter failed a file trim operation on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a file trim operation on file String because the file has conflicting pending resume handles.

Message #

The filter failed a file trim operation on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1144 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a file trim operation on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1145 — The filter failed a file set read only attribute operation on file String because the file has conflicting pending resume handles.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The filter failed a file set read only attribute operation on file String because the file has conflicting pending resume handles.

Message #

The filter failed a file set read only attribute operation on file %2 because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1145 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed a file set read only attribute operation on file because the file has conflicting pending resume handles.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1150 — The creation of a new resume handle on file String failed because the file has hard links.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The creation of a new resume handle on file String failed because the file has hard links.

Message #

The creation of a new resume handle on file %2 failed because the file has hard links.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 1151 — The creation of a new handle on file String failed because the supersede of a file that has open resume handles on Alternate Data Streams is not suppor...

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The creation of a new handle on file String failed because the supersede of a file that has open resume handles on Alternate Data Streams is not supported.

Message #

The creation of a new handle on file %2 failed because the supersede of a file that has open resume handles on Alternate Data Streams is not supported.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 2000 — The filter failed to load with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed to load with error status Status.

Message #

The filter failed to load with error status %1.

Fields #

Name	Description
`Status` UInt32	— NTSTATUS reference

Event ID 2001 — The filter failed to attach to String with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The filter failed to attach to String with error status Status.

Message #

The filter failed to attach to %2 with error status %3.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 2002 — The resume database for String failed to load with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume database for String failed to load with error status Status. The load operation took Valuems to complete.

Message #

The resume database for %2 failed to load with error status %4. The load operation took %3ms to complete.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2004 — The re-mount request for String failed with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The re-mount request for String failed with error status Status.

Message #

The re-mount request for %2 failed with error status %3.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 2100 — The creation of a bypass handle on file String failed with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The creation of a bypass handle on file String failed with error status Status.

Message #

The creation of a bypass handle on file %3 failed with error status %5.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2100 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The creation of a bypass handle on file failed with error status .

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2101 — The creation of a new resume handle Guid on file String failed with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The creation of a new resume handle Guid on file String failed with error status Status.

Message #

The creation of a new resume handle %1 on file %3 failed with error status %5.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2101 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The creation of a new resume handle on file failed with error status .

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2102 — The replay creation of resume handle Guid on file String failed with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The replay creation of resume handle Guid on file String failed with error status Status.

Message #

The replay creation of resume handle %1 on file %3 failed with error status %5.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2102 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The replay creation of resume handle on file failed with error status .

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2103 — The resume of handle Guid on file String failed with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume of handle Guid on file String failed with error status Status.

Message #

The resume of handle %1 on file %3 failed with error status %5.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2104 — The resume of a handle on file name String1 failed to reparse to a valid file name with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume of a handle on file name String1 failed to reparse to a valid file name with error status Status.

Message #

The resume of a handle on file name %2 failed to reparse to a valid file name with error status %5.

Fields #

Name	Description
`String1Length` UInt16	—
`String1` UnicodeString	—
`String2Length` UInt16	—
`String2` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 2112 — The resume handle Guid on file String failed to cancel with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Analytic

Description

The resume handle Guid on file String failed to cancel with error status Status.

Message #

The resume handle %1 on file %3 failed to cancel with error status %5.

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2112 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The resume handle on file failed to cancel with error status .

Fields #

Name	Description
`Guid` GUID	—
`StringLength` UInt16	—
`String` UnicodeString	—
`Value` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 2114 — The deferred delete of file String failed with error status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

The deferred delete of file String failed with error status Status.

Message #

The deferred delete of file %2 failed with error status %3.

Fields #

Name	Description
`StringLength` UInt16	—
`String` UnicodeString	—
`Status` UInt32	— NTSTATUS reference

Event ID 4000 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

Driver entry pre enter: FileObject (), MajorFunction (), MinorFunction , ControlCode.

Fields #

Name	Description
`FileObject` UInt64	—
`FileObjectNameLength` UInt16	—
`FileObjectName` UnicodeString	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`MinorFunction` UInt8	—
`ControlCode` UInt32	—

Event ID 4000 — Driver entry pre enter: FileObject FileObject (FileObjectName), MajorFunction MajorFunction (MajorFunctionName), MinorFunction MinorFunction, ControlCode ControlCode.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Performance

Description

Driver entry pre enter: FileObject FileObject (FileObjectName), MajorFunction MajorFunction (MajorFunctionName), MinorFunction MinorFunction, ControlCode ControlCode.

Message #

Driver entry pre enter: FileObject %1 (%3), MajorFunction %4 (%5), MinorFunction %6, ControlCode %7

Fields #

Name	Description
`FileObject` UInt64	—
`FileObjectNameLength` UInt16	—
`FileObjectName` UnicodeString	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`MinorFunction` UInt8	—
`ControlCode` UInt32	—

Event ID 4001 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

Driver entry pre exit: FileObject , MajorFunction (), MinorFunction , ControlCode , Status , IoStatus , IoInformation , FltStatus.

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`MinorFunction` UInt8	—
`ControlCode` UInt32	—
`Status` UInt32	— NTSTATUS reference
`IoStatus` UInt32	—
`IoInformation` UInt64	—
`FltStatus` UInt32	—

Event ID 4001 — Driver entry pre exit: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), MinorFunction MinorFunction, ControlCode ControlCode, Status Status, IoStatus IoStatus, IoInformation ...

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Performance

Description

Driver entry pre exit: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), MinorFunction MinorFunction, ControlCode ControlCode, Status Status, IoStatus IoStatus, IoInformation IoInformation, FltStatus FltStatus.

Message #

Driver entry pre exit: FileObject %1, MajorFunction %2 (%3), MinorFunction %4, ControlCode %5, Status %6, IoStatus %7, IoInformation %8, FltStatus %9

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`MinorFunction` UInt8	—
`ControlCode` UInt32	—
`Status` UInt32	— NTSTATUS reference
`IoStatus` UInt32	—
`IoInformation` UInt64	—
`FltStatus` UInt32	—

Event ID 4002 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

Driver entry post enter: FileObject , MajorFunction (), MinorFunction , ControlCode , IoStatus , IoInformation.

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`MinorFunction` UInt8	—
`ControlCode` UInt32	—
`IoStatus` UInt32	—
`IoInformation` UInt64	—

Event ID 4002 — Driver entry post enter: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), MinorFunction MinorFunction, ControlCode ControlCode, IoStatus IoStatus, IoInformation IoInformation.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Performance

Description

Driver entry post enter: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), MinorFunction MinorFunction, ControlCode ControlCode, IoStatus IoStatus, IoInformation IoInformation.

Message #

Driver entry post enter: FileObject %1, MajorFunction %2 (%3), MinorFunction %4, ControlCode %5, IoStatus %6, IoInformation %7

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`MinorFunction` UInt8	—
`ControlCode` UInt32	—
`IoStatus` UInt32	—
`IoInformation` UInt64	—

Event ID 4003 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

Driver entry post exit: FileObject , MajorFunction (), MinorFunction , ControlCode , Status.

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`MinorFunction` UInt8	—
`ControlCode` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 4003 — Driver entry post exit: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), MinorFunction MinorFunction, ControlCode ControlCode, Status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Performance

Description

Driver entry post exit: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), MinorFunction MinorFunction, ControlCode ControlCode, Status Status.

Message #

Driver entry post exit: FileObject %1, MajorFunction %2 (%3), MinorFunction %4, ControlCode %5, Status %6

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`MinorFunction` UInt8	—
`ControlCode` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 4010 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

Log file enter: FileObject , MajorFunction (), ControlCode , ByteOffset , Length.

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`ControlCode` UInt32	—
`ByteOffset` UInt64	—
`Length` UInt32	—

Event ID 4010 — Log file enter: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), ControlCode ControlCode, ByteOffset ByteOffset, Length Length.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Performance

Description

Log file enter: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), ControlCode ControlCode, ByteOffset ByteOffset, Length Length.

Message #

Log file enter: FileObject %1, MajorFunction %2 (%3), ControlCode %4, ByteOffset %5, Length %6

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`ControlCode` UInt32	—
`ByteOffset` UInt64	—
`Length` UInt32	—

Event ID 4011 —

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Operational

Description

Log file exit: FileObject , MajorFunction (), ControlCode , Status.

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`ControlCode` UInt32	—
`Status` UInt32	— NTSTATUS reference

Event ID 4011 — Log file exit: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), ControlCode ControlCode, Status Status.

Provider: Microsoft-Windows-ResumeKeyFilter
Channel: Performance

Description

Log file exit: FileObject FileObject, MajorFunction MajorFunction (MajorFunctionName), ControlCode ControlCode, Status Status.

Message #

Log file exit: FileObject %1, MajorFunction %2 (%3), ControlCode %4, Status %5

Fields #

Name	Description
`FileObject` UInt64	—
`MajorFunction` UInt8	—
`MajorFunctionName` AnsiString	—
`ControlCode` UInt32	—
`Status` UInt32	— NTSTATUS reference