Microsoft-Windows-Search-Core

365 events across 1 channel

Event	Title	Channel
1	CrawlStart	Diagnostic
2	CrawlStop	Diagnostic
3	IncCrawlStart	Diagnostic
4	IncCrawlStop	Diagnostic
5	BackOff_MemStart	Diagnostic
6	BackOff_MemStop	Diagnostic
7	BackOff_BatStart	Diagnostic
8	BackOff_BatStop	Diagnostic
9	BackOff_ActStart	Diagnostic
10	BackOff_ActStop	Diagnostic
11	BackOff_IORStart	Diagnostic
12	BackOff_IORStop	Diagnostic
13	BackOff_NtfStart	Diagnostic
14	BackOff_NtfStop	Diagnostic
15	BackOff_CPUStart	Diagnostic
16	BackOff_CPUStop	Diagnostic
17	Index_FileStart	Diagnostic
18	Index_FileStop_V1	Diagnostic
19	USN_Notify	Diagnostic
21	USN_Notify_Filtered	Diagnostic
22	Catalog_MonitorStart	Diagnostic
23	Catalog_MonitorStop	Diagnostic
24	Index_MergeStart	Diagnostic
25	Index_MergeStop	Diagnostic
26	Index_CommitStart	Diagnostic
27	Index_CommitStop	Diagnostic
28	MapiEmailItemStart	Diagnostic
29	MapiEmailItemStop	Diagnostic
30	CSCDocumentStart	Diagnostic
31	CSCDocumentStop	Diagnostic
32	RetrieveValueStart	Diagnostic
33	RetrieveValueStop	Diagnostic
34	MapiOpenMessageStart	Diagnostic
35	MapiOpenMessageStop	Diagnostic
36	MapiGetAttachmentFromMessageStart	Diagnostic
37	MapiGetAttachmentFromMessageStop	Diagnostic
38	MapiEnumerateAttachmentsStart	Diagnostic
39	MapiEnumerateAttachmentsStop	Diagnostic
40	MapiGetMapiFpsPropValsStop	Diagnostic
41	MapiGetMapiFpsPropValsStop41	Diagnostic
42	IndexItemInit	Diagnostic
43	IndexItemSetStatus	Diagnostic
44	OnDataChange	Diagnostic
46	IndexItemDataComplete	Diagnostic
47	HighPriorityItemBoost	Diagnostic
48	HighPriorityThreadBoost	Diagnostic
49	HighPriorityMergeBoost	Diagnostic
50	ClientQueryStart_V1	Diagnostic
51	ClientQueryStop_V1	Diagnostic
52	IndexItemEnd	Diagnostic
53	MergeItemStart	Diagnostic
54	MergeThreadStart_V1	Diagnostic
55	MergeThreadStop_V1	Diagnostic
56	IndexItemPushToFile	Diagnostic
57	ClientGetNextRows	Diagnostic
58	FilterOplockBreak	Diagnostic
59	BackoffThreadWaitStart	Diagnostic
60	BackoffThreadWaitStop	Diagnostic
61	BackoffReason	Diagnostic
62	FilterOplockFail	Diagnostic
63	ServiceStatusUpdate	Diagnostic
64	SearchIndexerStart	Diagnostic
65	SearchIndexerStop	Diagnostic
66	SearchProtocolHostStart	Diagnostic
67	SearchProtocolHostStop	Diagnostic
68	SearchFilterHostStart	Diagnostic
69	SearchFilterHostStop	Diagnostic
70	StatusChange_PostToStatusThread	Diagnostic
71	StatusChange_ProcessInStatusThread	Diagnostic
72	StatusThreadStart	Diagnostic
73	StatusThreadStop	Diagnostic
74	StatusChange_AppendToGathererQueue	Diagnostic
75	StatusChange_AppendCrawlToGathererQueue	Diagnostic
76	StatusChange_RemoveFromGathererQueue	Diagnostic
77	Gatherer_AdviseStatus	Diagnostic
78	Gatherer_RequestStatusChange	Diagnostic
79	GatherProject_AdviseStatusChange_V1	Diagnostic
80	GatherProject_AdviseRequestStatus	Diagnostic
81	GatherProject_PrepareStatusChange	Diagnostic
82	AliasTable_InitSDIDCache	Diagnostic
83	WID_SDID_Cache_Initialize	Diagnostic
84	WID_SDID_Cache_Write	Diagnostic
85	WID_SDID_Cache_SwitchToFull	Diagnostic
86	Backoff_MemoryCheck	Diagnostic
87	Backoff_BatteryPolicyCheck	Diagnostic
88	Backoff_BatteryCheck	Diagnostic
89	Backoff_LowDiskCheck	Diagnostic
90	Backoff_UserActivityCheck	Diagnostic
91	Backoff_HighCPUCheck	Diagnostic
92	Backoff_HighIOCheck	Diagnostic
93	Backoff_HighNotificationsCheck	Diagnostic
94	Backoff_PendingNotificationsCheck	Diagnostic
95	Backoff_AllowNewItemsCheck	Diagnostic
96	Backoff_State	Diagnostic
97	ProtocolHostObjConstructor	Diagnostic
98	ProtocolHostObjInit	Diagnostic
99	ProtocolHostTerminating	Diagnostic
100	ProtocolHostStarted	Diagnostic
101	ProtocolHostStopped	Diagnostic
102	ProtocolHostKilled	Diagnostic
103	ProtocolHostStoppedAlready	Diagnostic
104	ProtocolHostTerminatingInDestructor	Diagnostic
105	ProtocolHostKilledInDestructor	Diagnostic
106	ProtocolHostStoppedInDestructor	Diagnostic
107	ProtocolHostObjDestructor	Diagnostic
108	ProtocolHostNameConflict_FailedToKill	Diagnostic
109	ProtocolHostNameConflict_Killed	Diagnostic
110	ProtocolHostNameConflict_Killing	Diagnostic
111	FilterHostStarting	Diagnostic
112	FilterHostStarted	Diagnostic
113	FilterHostStopping	Diagnostic
114	FilterHostHung	Diagnostic
115	FilterHostStopped	Diagnostic
116	Startup_CSearchService_Init	Diagnostic
117	Startup_CDcomService_Init	Diagnostic
118	Startup_CDcomService_ServiceStart	Diagnostic
119	Startup_CDcomService_ServiceMain	Diagnostic
120	Startup_RecoverIfNecessary	Diagnostic
121	Startup_RecoverDataFiles	Diagnostic
122	Startup_RecoverDataFiles_RemoveDir	Diagnostic
123	Startup_MoveDataFiles	Diagnostic
124	Startup_MoveDataFiles_CopyDir	Diagnostic
125	Startup_MoveDataFiles_RemoveDir	Diagnostic
126	Startup_ReplaceDirectoryPrefixInValue	Diagnostic
127	Startup_SysPrepInProgress	Diagnostic
128	Startup_GuiSetupInProgress	Diagnostic
129	Startup_CDcomService_IsIdleServiceMode	Diagnostic
130	Startup_CSearchService_Init2	Diagnostic
131	Startup_SetupWorkingDirectory	Diagnostic
132	Startup_SetupWorkingDirectory_RemovePath	Diagnostic
133	Startup_CheckAndCleanup	Diagnostic
134	Startup_CSearchServiceObj_Initialize	Diagnostic
135	Startup_CGatherModule_Init	Diagnostic
136	Startup_CGatheringService_InitStart	Diagnostic
137	Startup_CGatheringService_InitStop	Diagnostic
138	Startup_InitialIndexSetup	Diagnostic
139	Setup_DeletePreviousUsersSettingsKey	Diagnostic
140	Setup_SetCompletedSuccessfully	Diagnostic
141	Setup_Phase	Diagnostic
142	Setup_CatalogSetupSucceeded	Diagnostic
143	Setup_CatalogSetupFailed	Diagnostic
144	Setup_CleanupStarted	Diagnostic
145	Setup_CleanupRemoveDir	Diagnostic
146	Setup_CleanupSucceeded	Diagnostic
147	Setup_CleanupFailed	Diagnostic
148	Crawl_InitializeNew	Diagnostic
149	Crawl_Initialize	Diagnostic
150	Crawl_Initialize_Load	Diagnostic
151	Crawl_AddStartPage	Diagnostic
152	Crawl_RemoveStartPage	Diagnostic
153	Crawl_IsDone	Diagnostic
154	Transactions_IterateHistoryStart	Diagnostic
155	Transactions_IterateHistoryStop	Diagnostic
156	Transactions_IterateHistory_Modify	Diagnostic
157	Transactions_IterateHistory_Delete	Diagnostic
158	Transactions_UpdateFailuresStart	Diagnostic
159	Transactions_UpdateFailuresStop	Diagnostic
160	GatherLog_Transaction	Diagnostic
161	GatherLog_Crawl	Diagnostic
162	Gatherer_OnDataChangeStart	Diagnostic
163	Gatherer_OnDataChangeStop	Diagnostic
164	Gatherer_OnDataChange	Diagnostic
165	Gatherer_OnDataChange_Failed	Diagnostic
166	OnDataChange_Failed	Diagnostic
169	RobotThread_BeforeGetNewTransaction	Diagnostic
170	RobotThread_ProcessNewTransaction	Diagnostic
171	RobotThread_FilterDriver_Init_Failed_V1	Diagnostic
172	RobotThread_IsHistoryIterator_V1	Diagnostic
173	RobotThread_IsWildcardTransaction_V1	Diagnostic
174	RobotThread_IsIteratorByStartAddress_V1	Diagnostic
175	RobotThread_IsHistoryIteratorUpdateFailures_V1	Diagnostic
176	RobotThread_ProcessAnnotation_Failed_V1	Diagnostic
177	RobotThread_GetStandardProperties_Failed_V1	Diagnostic
178	RobotThread_TransactionNotModified_V1	Diagnostic
179	RobotThread_CatalogResetRequested_V1	Diagnostic
180	CEnumSearchRoots_Constructor	Diagnostic
181	CEnumSearchRoots_Destructor	Diagnostic
182	CEnumSearchRoots_DestructorStop	Diagnostic
183	CEnumSearchRoots_Reset	Diagnostic
184	CEnumSearchRoots_CloneStart	Diagnostic
185	CEnumSearchRoots_CloneStop	Diagnostic
186	CEnumSearchRoots_NextStart	Diagnostic
187	CEnumSearchRoots_NextStop	Diagnostic
188	CEnumSearchRoots_Next_Fetch	Diagnostic
189	CEnumSearchRoots_SkipStart	Diagnostic
190	CEnumSearchRoots_SkipStop	Diagnostic
191	CEnumSearchScopeRules_Constructor	Diagnostic
192	CEnumSearchScopeRules_DestructorStart	Diagnostic
193	CEnumSearchScopeRules_DestructorStop	Diagnostic
194	CEnumSearchScopeRules_Reset	Diagnostic
195	CEnumSearchScopeRules_CloneStart	Diagnostic
196	CEnumSearchScopeRules_CloneStop	Diagnostic
197	CEnumSearchScopeRules_NextStart	Diagnostic
198	CEnumSearchScopeRules_NextStop	Diagnostic
199	CEnumSearchScopeRules_Next_Fetch	Diagnostic
200	CEnumSearchScopeRules_SkipStart	Diagnostic
201	CEnumSearchScopeRules_SkipStop	Diagnostic
202	CSearchCrawlScopeManager_Constructor	Diagnostic
203	CSearchCrawlScopeManager_Destructor	Diagnostic
204	CSearchCrawlScopeManager_IncludedInCrawlScopeStart	Diagnostic
205	CSearchCrawlScopeManager_IncludedInCrawlScopeStop	Diagnostic
206	CSearchCrawlScopeManager_AddDefaultScopeRuleStart	Diagnostic
207	CSearchCrawlScopeManager_AddDefaultScopeRuleStop	Diagnostic
208	CSearchCrawlScopeManager_AddHierarchicalScopeStart	Diagnostic
209	CSearchCrawlScopeManager_AddHierarchicalScopeStop	Diagnostic
210	CSearchCrawlScopeManager_AddRootStart	Diagnostic
211	CSearchCrawlScopeManager_AddRootStop	Diagnostic
212	CSearchCrawlScopeManager_AddUserScopeRuleStart	Diagnostic
213	CSearchCrawlScopeManager_AddUserScopeRuleStop	Diagnostic
214	CSearchCrawlScopeManager_EnumerateRootsStart	Diagnostic
215	CSearchCrawlScopeManager_EnumerateRootsStop	Diagnostic
216	CSearchCrawlScopeManager_EnumerateScopeRulesStart	Diagnostic
217	CSearchCrawlScopeManager_EnumerateScopeRulesStop	Diagnostic
218	CSearchCrawlScopeManager_GetParentScopeVersionIdStart	Diagnostic
219	CSearchCrawlScopeManager_GetParentScopeVersionIdStop	Diagnostic
220	CSearchCrawlScopeManager_HasChildScopeRuleStart	Diagnostic
221	CSearchCrawlScopeManager_HasChildScopeRuleStop	Diagnostic
222	CSearchCrawlScopeManager_HasParentScopeRuleStart	Diagnostic
223	CSearchCrawlScopeManager_HasParentScopeRuleStop	Diagnostic
224	CSearchCrawlScopeManager_IncludedInCrawlScopeExStart	Diagnostic
225	CSearchCrawlScopeManager_IncludedInCrawlScopeExStop	Diagnostic
226	CSearchCrawlScopeManager_RemoveDefaultScopeRuleStart	Diagnostic
227	CSearchCrawlScopeManager_RemoveDefaultScopeRuleStop	Diagnostic
228	CSearchCrawlScopeManager_RemoveRootStart	Diagnostic
229	CSearchCrawlScopeManager_RemoveRootStop	Diagnostic
230	CSearchCrawlScopeManager_RemoveScopeRuleStart	Diagnostic
231	CSearchCrawlScopeManager_RemoveScopeRuleStop	Diagnostic
232	CSearchCrawlScopeManager_RevertToDefaultScopesStart	Diagnostic
233	CSearchCrawlScopeManager_RevertToDefaultScopesStop	Diagnostic
234	CSearchCrawlScopeManager_SaveAllStart	Diagnostic
235	CSearchCrawlScopeManager_SaveAllStop	Diagnostic
236	CSearchRoot_put_RootURL	Diagnostic
237	CSearchRoot_get_RootURL	Diagnostic
238	CSearchRoot_get_AuthenticationType	Diagnostic
239	CSearchRoot_get_EnumerationDepth	Diagnostic
240	CSearchRoot_get_FollowDirectories	Diagnostic
241	CSearchRoot_get_HostDepth	Diagnostic
242	CSearchRoot_get_IsHierarchical	Diagnostic
243	CSearchRoot_get_ProvidesNotifications	Diagnostic
244	CSearchRoot_get_Schedule	Diagnostic
245	CSearchRoot_get_UseNotificationsOnly	Diagnostic
246	CSearchRoot_put_AuthenticationType	Diagnostic
247	CSearchRoot_put_EnumerationDepth	Diagnostic
248	CSearchRoot_put_FollowDirectories	Diagnostic
249	CSearchRoot_put_HostDepth	Diagnostic
250	CSearchRoot_put_IsHierarchical	Diagnostic
251	CSearchRoot_put_ProvidesNotifications	Diagnostic
252	CSearchRoot_put_Schedule	Diagnostic
253	CSearchRoot_put_UseNotificationsOnly	Diagnostic
254	CSearchScopeRule_get_IsDefault	Diagnostic
255	CSearchScopeRule_get_IsIncluded	Diagnostic
256	CSearchScopeRule_get_PatternOrURL	Diagnostic
257	StatusChange_QueueLocked	Diagnostic
258	StatusChange_QueueUnlocked	Diagnostic
259	Gatherer_OnDataChange_Track_Url	Diagnostic
260	Gatherer_DocIdTable_GetNewId	Diagnostic
261	Gatherer_DocIdTable_UndeleteId	Diagnostic
262	Gatherer_DocIdTable_DeleteId	Diagnostic
263	Gatherer_DocIdTable_GetMaxId	Diagnostic
264	Gatherer_DocIdTable_SetMaxId	Diagnostic
265	WID_SDID_Cache_NumberItems	Diagnostic
266	Gatherer_Queues_QueueLength	Diagnostic
267	Startup_Search_Service_DurationStart	Diagnostic
268	Startup_Search_Service_DurationStop	Diagnostic
269	Shutdown_Search_Service_DurationStart	Diagnostic
270	Shutdown_Search_Service_DurationStop	Diagnostic
271	ServerQueryRelease	Diagnostic
272	CreatePhysCursorStart	Diagnostic
273	CreatePhysCursorStop	Diagnostic
274	CreatePhysCursorRangeStart	Diagnostic
275	CreatePhysCursorRangeStop	Diagnostic
276	MergeStart	Diagnostic
277	MergeStop	Diagnostic
278	CreateWLCursorStart	Diagnostic
279	CreateWLCursorStop	Diagnostic
280	CreateWLCursorRangeStart	Diagnostic
281	CreateWLCursorRangeStop	Diagnostic
282	ServerQueryStart	Diagnostic
283	ServerQuery_Send	Diagnostic
284	ServerQuery_Received	Diagnostic
285	ClientQuery_Send	Diagnostic
286	ClientQuery_Received	Diagnostic
287	ServerQueryStop	Diagnostic
288	ServerQuery_Create	Diagnostic
289	ClientStartFetch	Diagnostic
290	ClientFetched	Diagnostic
291	ServerGetRowsStart	Diagnostic
292	ServerGetRowsStop	Diagnostic
293	RobotThread_LangAutoDetection_Start	Diagnostic
294	RobotThread_LangAutoDetection_Stop	Diagnostic
295	RobotThread_LangAutoDetection_Succeed	Diagnostic
296	RobotThread_LangAutoDetection_Fail	Diagnostic
297	Service_Status_NotifyStart	Diagnostic
298	Service_Status_NotifyStop	Diagnostic
300	ServerQuery_ForcePublishStart	Diagnostic
301	ServerQuery_ForcePublishStop	Diagnostic
302	Wordlist_PublishStart	Diagnostic
303	Wordlist_PublishStop	Diagnostic
304	Flush_Schedule	Diagnostic
305	CBPool_ForceFlush	Diagnostic
306	DocAborted_ForcePublish	Diagnostic
307	DocAborted_CBOverflow	Diagnostic
308	Wordlist_BeginResourceFailed_CBOverflow	Diagnostic
309	Wordlist_BeginResourceFailed_DocInError	Diagnostic
310	Wordlist_BeginResource_InvalidatedPreviousDoc	Diagnostic
311	ClientQuery_Rowset_Reuse	Diagnostic
312	ServerQuery_DeferredProperty	Diagnostic
313	ScopeManager_Init	Diagnostic
314	ScopeManager_Retrieved	Diagnostic
315	ScopeManager_SwitchToFull	Diagnostic
316	ScopeManager_Write	Diagnostic
317	Prioritization_Request	Diagnostic
318	Prioritization_Complete	Diagnostic
319	Prioritization_Statistics	Diagnostic
320	JET_IO_Low_Priority_Change	Diagnostic
321	Gather_Transaction_Failure_Code	Diagnostic
322	ETWLogging	Diagnostic
323	ETWLoggingFailure	Diagnostic
324	ETWLoggingItem	Diagnostic
325	ETWLoggingItemFailure	Diagnostic
326	USN_Notify_Journal_Wrap	Diagnostic
327	GathererRecoverStart	Diagnostic
328	GathererRecoverStop	Diagnostic
329	ValueIndexCreationStart	Diagnostic
330	ValueIndexCreationStop	Diagnostic
331	ValueIndexSeekStart	Diagnostic
332	ValueIndexSeekStop	Diagnostic
333	ValueIndexSeekStart333	Diagnostic
334	ValueIndexSeekStop334	Diagnostic
335	FreeCursor	Diagnostic
336	ReuseRestriction	Diagnostic
337	GetQueryStatusExStart	Diagnostic
338	GetQueryStatusExStop	Diagnostic
339	CreateWordBreakerStart	Diagnostic
340	CreateWordBreakerStop	Diagnostic
341	ReleaseWordBreakerStart	Diagnostic
342	ReleaseWordBreakerStop	Diagnostic
343	CreateStemmerStart	Diagnostic
344	CreateStemmerStop	Diagnostic
345	ReleaseStemmerStart	Diagnostic
346	ReleaseStemmerStop	Diagnostic
347	CreateCatalog	Diagnostic
348	DeleteCatalog	Diagnostic
349	RobotThread_GetWordBreaker	Diagnostic
350	GetWordBreaker	Diagnostic
351	WordBreakerSelector_IncrementHistory	Diagnostic
352	WordBreakerSelector_SubstituteLocale	Diagnostic
353	WordBreakerSelector_Fallback	Diagnostic
354	WordBreakerHistory_Save	Diagnostic
355	WordBreakerHistory_Load	Diagnostic
356	RobotThread_LangAutoDetection_Scores	Diagnostic
357	FileChangeTracker_APICallStart	Diagnostic
358	FileChangeTracker_APICallStop	Diagnostic
359	FileChangeTracker_APICallStart359	Diagnostic
360	FileChangeTracker_APICallStop360	Diagnostic
361	FileChangeTracker_APICallStart361	Diagnostic
362	FileChangeTracker_APICallStop362	Diagnostic
363	FileChangeTracker_ProcessUSN	Diagnostic
364	FileChangeTracker_ProcessUSN	Diagnostic
365	ScopeChangeNotification_OnChanged	Diagnostic
366	ScopeChangeNotification_OnChanged366	Diagnostic
367	ScopeChangeNotification_RegisterStart	Diagnostic
368	ScopeChangeNotification_RegisterStop	Diagnostic
369	ScopeChangeNotification_UnregisterStart	Diagnostic
370	ScopeChangeNotification_UnregisterStop	Diagnostic

Event ID 1: CrawlStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl
Opcode: Start

Event ID 2: CrawlStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl
Opcode: Stop

Event ID 3: IncCrawlStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IncCrawl
Opcode: Start

Event ID 4: IncCrawlStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IncCrawl
Opcode: Stop

Event ID 5: BackOff_MemStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Mem
Opcode: Start

Event ID 6: BackOff_MemStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Mem
Opcode: Stop

Event ID 7: BackOff_BatStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Bat
Opcode: Start

Event ID 8: BackOff_BatStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Bat
Opcode: Stop

Event ID 9: BackOff_ActStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Act
Opcode: Start

Event ID 10: BackOff_ActStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Act
Opcode: Stop

Event ID 11: BackOff_IORStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_IOR
Opcode: Start

Event ID 12: BackOff_IORStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_IOR
Opcode: Stop

Event ID 13: BackOff_NtfStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Ntf
Opcode: Start

Event ID 14: BackOff_NtfStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Ntf
Opcode: Stop

Event ID 15: BackOff_CPUStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_CPU
Opcode: Start

Event ID 16: BackOff_CPUStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_CPU
Opcode: Stop

Event ID 17: Index_FileStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_File
Opcode: Start

Fields #

Name	Description
`Description` UnicodeString

Event ID 18: Index_FileStop_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_File
Opcode: Stop

Fields #

Name	Description
`UsesFilter` Boolean
`UsesPropertyHandler` Boolean

Event ID 19: USN_Notify

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: USN_Notify
Opcode: win:Info

Fields #

Name	Description
`Reason` UInt32
`Path` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 19,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": "0x0000000000200008",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Path": "file attr: 0x00002010 C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\",
    "Reason": 2147485696
  },
  "message": "USN_Notify"
}

Event ID 21: USN_Notify_Filtered

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: USN_Notify_Filtered

Fields #

Name	Description
`Reason` UInt32
`Path` UnicodeString

Event ID 22: Catalog_MonitorStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Catalog_Monitor
Opcode: Start

Event ID 23: Catalog_MonitorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Catalog_Monitor
Opcode: Stop

Event ID 24: Index_MergeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_Merge
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 25: Index_MergeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_Merge
Opcode: Stop

Event ID 26: Index_CommitStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_Commit
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 27: Index_CommitStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_Commit
Opcode: Stop

Event ID 28: MapiEmailItemStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiEmailItem
Opcode: Start

Event ID 29: MapiEmailItemStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiEmailItem
Opcode: Stop

Event ID 30: CSCDocumentStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSCDocument
Opcode: Start

Event ID 31: CSCDocumentStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSCDocument
Opcode: Stop

Event ID 32: RetrieveValueStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RetrieveValue
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 33: RetrieveValueStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RetrieveValue
Opcode: Stop

Event ID 34: MapiOpenMessageStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiOpenMessage
Opcode: Start

Event ID 35: MapiOpenMessageStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiOpenMessage
Opcode: Stop

Event ID 36: MapiGetAttachmentFromMessageStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiGetAttachmentFromMessage
Opcode: Start

Event ID 37: MapiGetAttachmentFromMessageStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiGetAttachmentFromMessage
Opcode: Stop

Event ID 38: MapiEnumerateAttachmentsStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiEnumerateAttachments
Opcode: Start

Event ID 39: MapiEnumerateAttachmentsStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiEnumerateAttachments
Opcode: Stop

Event ID 40: MapiGetMapiFpsPropValsStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiGetMapiFpsPropVals
Opcode: Stop

Event ID 41: MapiGetMapiFpsPropValsStop41

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiGetMapiFpsPropVals
Opcode: Stop

Event ID 42: IndexItemInit

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemInit

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 43: IndexItemSetStatus

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemSetStatus

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 44: OnDataChange

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: OnDataChange

Fields #

Name	Description
`Value` UInt64

Event ID 46: IndexItemDataComplete

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemDataComplete

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 47: HighPriorityItemBoost

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: HighPriorityItemBoost

Fields #

Name	Description
`Value` UInt32

Event ID 48: HighPriorityThreadBoost

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: HighPriorityThreadBoost

Fields #

Name	Description
`Value` UInt32

Event ID 49: HighPriorityMergeBoost

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: HighPriorityMergeBoost

Fields #

Name	Description
`Value` UInt32

Event ID 50: ClientQueryStart_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery
Opcode: Start

Fields #

Name	Description
`QueryText` UnicodeString

Event ID 51: ClientQueryStop_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery
Opcode: Stop

Fields #

Name	Description
`QueryText` UnicodeString
`ErrorCode` UInt32

Event ID 52: IndexItemEnd

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemEnd

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 53: MergeItemStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MergeItem
Opcode: Start

Fields #

Name	Description
`Value` UInt64

Event ID 54: MergeThreadStart_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MergeThread
Opcode: Start

Fields #

Name	Description
`Level` UInt32
`Type` UInt64

Event ID 55: MergeThreadStop_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MergeThread
Opcode: Stop

Fields #

Name	Description
`Level` UInt32
`Type` UInt64

Event ID 56: IndexItemPushToFile

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemPushToFile

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 57: ClientGetNextRows

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientGetNextRows

Fields #

Name	Description
`Rowset` UInt64
`Chapter` UInt64
`RowsToSkip` Int64
`RowsRequested` Int64
`RowsReturned` UInt64

Event ID 58: FilterOplockBreak

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterOplockBreak

Fields #

Name	Description
`Description` UnicodeString

Event ID 59: BackoffThreadWaitStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackoffThreadWait
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 60: BackoffThreadWaitStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackoffThreadWait
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 61: BackoffReason

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackoffReason

Fields #

Name	Description
`Value` UInt32

Event ID 62: FilterOplockFail

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterOplockFail

Fields #

Name	Description
`Description` UnicodeString

Event ID 63: ServiceStatusUpdate

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServiceStatusUpdate

Fields #

Name	Description
`WaitHint` UInt32
`State` UInt32
`CheckPoint` UInt32

Event ID 64: SearchIndexerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchIndexer
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 65: SearchIndexerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchIndexer
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 66: SearchProtocolHostStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchProtocolHost
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 67: SearchProtocolHostStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchProtocolHost
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 68: SearchFilterHostStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchFilterHost
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 69: SearchFilterHostStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchFilterHost
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 70: StatusChange_PostToStatusThread

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_PostToStatusThread

Fields #

Name	Description
`Value` UInt32

Event ID 71: StatusChange_ProcessInStatusThread

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_ProcessInStatusThread

Fields #

Name	Description
`Value` UInt32

Event ID 72: StatusThreadStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusThread
Opcode: Start

Event ID 73: StatusThreadStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusThread
Opcode: Stop

Event ID 74: StatusChange_AppendToGathererQueue

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_AppendToGathererQueue

Fields #

Name	Description
`Value` UInt32

Event ID 75: StatusChange_AppendCrawlToGathererQueue

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_AppendCrawlToGathererQueue

Fields #

Name	Description
`Value` UInt32

Event ID 76: StatusChange_RemoveFromGathererQueue

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_RemoveFromGathererQueue

Fields #

Name	Description
`Value` UInt32

Event ID 77: Gatherer_AdviseStatus

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_AdviseStatus

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`hrReason` UInt32

Event ID 78: Gatherer_RequestStatusChange

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_RequestStatusChange

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`hrReason` UInt32

Event ID 79: GatherProject_AdviseStatusChange_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherProject_AdviseStatusChange

Fields #

Name	Description
`ProjectPtr` UInt64
`Status` UInt32	NTSTATUS reference
`hrReason` UInt32

Event ID 80: GatherProject_AdviseRequestStatus

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherProject_AdviseRequestStatus

Fields #

Name	Description
`Value` UInt32

Event ID 81: GatherProject_PrepareStatusChange

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherProject_PrepareStatusChange

Fields #

Name	Description
`Value` UInt32

Event ID 82: AliasTable_InitSDIDCache

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: AliasTable_InitSDIDCache

Event ID 83: WID_SDID_Cache_Initialize

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WID_SDID_Cache_Initialize

Fields #

Name	Description
`IsCompact` Boolean
`CacheCapacity` UInt32

Event ID 84: WID_SDID_Cache_Write

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WID_SDID_Cache_Write

Fields #

Name	Description
`MaxWID` UInt32
`SDID` UInt32
`IsCompact` Boolean
`CacheCapacity` UInt32

Event ID 85: WID_SDID_Cache_SwitchToFull

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WID_SDID_Cache_SwitchToFull

Fields #

Name	Description
`Value` UInt32

Event ID 86: Backoff_MemoryCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_MemoryCheck

Fields #

Name	Description
`MemAvail` UInt32
`MemTreshold` UInt32
`IsLow` Boolean

Event ID 87: Backoff_BatteryPolicyCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_BatteryPolicyCheck

Fields #

Name	Description
`ACLineStatus` UInt8
`BackOffOnBattery` Boolean
`IsBackOffNeeded` Boolean

Event ID 88: Backoff_BatteryCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_BatteryCheck

Fields #

Name	Description
`ACLineStatus` UInt8
`BatteryFlag` UInt8
`BatteryLifePercent` UInt8
`LowBatteryThreshold` UInt32
`IsLow` Boolean

Event ID 89: Backoff_LowDiskCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_LowDiskCheck

Fields #

Name	Description
`DiskAvail` Double
`LowDiskThreshold` UInt32
`IsLow` Boolean

Event ID 90: Backoff_UserActivityCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_UserActivityCheck

Fields #

Name	Description
`Interval` UInt32
`IsUserActive` Boolean

Event ID 91: Backoff_HighCPUCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_HighCPUCheck

Fields #

Name	Description
`Idle` Double
`MaxIdle` UInt32
`IsHigh` Boolean

Event ID 92: Backoff_HighIOCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_HighIOCheck

Fields #

Name	Description
`IORate` UInt32
`HighIOThreshold` UInt32
`IsHigh` Boolean

Event ID 93: Backoff_HighNotificationsCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_HighNotificationsCheck

Fields #

Name	Description
`NotificationRate` UInt32
`HighNotificationThreshold` UInt32
`IsHigh` Boolean

Event ID 94: Backoff_PendingNotificationsCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_PendingNotificationsCheck

Fields #

Name	Description
`PendingNotifications` UInt32
`NotificationsForceAtMost` UInt32
`NotificationsForced` Boolean

Event ID 95: Backoff_AllowNewItemsCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_AllowNewItemsCheck

Fields #

Name	Description
`LastIndexNewItemReason` UInt32
`IndexNewItemReason` UInt32
`BackoffReason` UInt32

Event ID 96: Backoff_State

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_State

Fields #

Name	Description
`BackoffReason` UInt32
`IndexNewItemReason` UInt32
`AllReasons` UInt32
`FeatureDisabled` UInt32
`PowerSetting` UInt32
`BackoffRecoveryIsON` Boolean
`ProcessNotifications` Boolean
`BackOffOnPendingNotifications` Boolean
`PendingHiPriNotifications` UInt32
`BackOffOnPowerSetting` Boolean
`XPScreenSaverAndNoBattery` Boolean
`Merging` Boolean

Event ID 97: ProtocolHostObjConstructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostObjConstructor

Event ID 98: ProtocolHostObjInit

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostObjInit

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 99: ProtocolHostTerminating

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostTerminating

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 100: ProtocolHostStarted

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostStarted

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 101: ProtocolHostStopped

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostStopped

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 102: ProtocolHostKilled

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostKilled

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 103: ProtocolHostStoppedAlready

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostStoppedAlready

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 104: ProtocolHostTerminatingInDestructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostTerminatingInDestructor

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 105: ProtocolHostKilledInDestructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostKilledInDestructor

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 106: ProtocolHostStoppedInDestructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostStoppedInDestructor

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 107: ProtocolHostObjDestructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostObjDestructor

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 108: ProtocolHostNameConflict_FailedToKill

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostNameConflict_FailedToKill

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString

Event ID 109: ProtocolHostNameConflict_Killed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostNameConflict_Killed

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString

Event ID 110: ProtocolHostNameConflict_Killing

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostNameConflict_Killing

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString

Event ID 111: FilterHostStarting

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostStarting

Event ID 112: FilterHostStarted

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostStarted

Fields #

Name	Description
`Value` UInt32

Event ID 113: FilterHostStopping

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostStopping

Fields #

Name	Description
`Value` UInt32

Event ID 114: FilterHostHung

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostHung

Fields #

Name	Description
`Value` UInt32

Event ID 115: FilterHostStopped

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostStopped

Fields #

Name	Description
`Value` UInt32

Event ID 116: Startup_CSearchService_Init

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CSearchService_Init

Event ID 117: Startup_CDcomService_Init

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CDcomService_Init

Event ID 118: Startup_CDcomService_ServiceStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CDcomService_ServiceStart

Event ID 119: Startup_CDcomService_ServiceMain

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CDcomService_ServiceMain

Event ID 120: Startup_RecoverIfNecessary

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_RecoverIfNecessary

Event ID 121: Startup_RecoverDataFiles

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_RecoverDataFiles

Event ID 122: Startup_RecoverDataFiles_RemoveDir

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_RecoverDataFiles_RemoveDir

Fields #

Name	Description
`Path` UnicodeString

Event ID 123: Startup_MoveDataFiles

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_MoveDataFiles

Fields #

Name	Description
`OldPath` UnicodeString
`NewPath` UnicodeString

Event ID 124: Startup_MoveDataFiles_CopyDir

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_MoveDataFiles_CopyDir

Fields #

Name	Description
`OldPath` UnicodeString
`NewPath` UnicodeString

Event ID 125: Startup_MoveDataFiles_RemoveDir

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_MoveDataFiles_RemoveDir

Fields #

Name	Description
`Path` UnicodeString

Event ID 126: Startup_ReplaceDirectoryPrefixInValue

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_ReplaceDirectoryPrefixInValue

Fields #

Name	Description
`Value` UnicodeString
`OldPrefix` UnicodeString
`NewPrefix` UnicodeString

Event ID 127: Startup_SysPrepInProgress

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_SysPrepInProgress

Fields #

Name	Description
`Value` UInt32

Event ID 128: Startup_GuiSetupInProgress

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_GuiSetupInProgress

Fields #

Name	Description
`Value` UInt32

Event ID 129: Startup_CDcomService_IsIdleServiceMode

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CDcomService_IsIdleServiceMode

Fields #

Name	Description
`Value` UInt32

Event ID 130: Startup_CSearchService_Init2

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CSearchService_Init2

Fields #

Name	Description
`NoRun` Boolean
`SystemSetupOver` Boolean

Event ID 131: Startup_SetupWorkingDirectory

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_SetupWorkingDirectory

Event ID 132: Startup_SetupWorkingDirectory_RemovePath

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_SetupWorkingDirectory_RemovePath

Fields #

Name	Description
`Path` UnicodeString

Event ID 133: Startup_CheckAndCleanup

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CheckAndCleanup

Event ID 134: Startup_CSearchServiceObj_Initialize

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CSearchServiceObj_Initialize

Fields #

Name	Description
`Value` UInt32

Event ID 135: Startup_CGatherModule_Init

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CGatherModule_Init

Event ID 136: Startup_CGatheringService_InitStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CGatheringService_Init
Opcode: Start

Fields #

Name	Description
`NoRun` Boolean

Event ID 137: Startup_CGatheringService_InitStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CGatheringService_Init
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 138: Startup_InitialIndexSetup

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_InitialIndexSetup

Event ID 139: Setup_DeletePreviousUsersSettingsKey

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_DeletePreviousUsersSettingsKey

Event ID 140: Setup_SetCompletedSuccessfully

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_SetCompletedSuccessfully

Fields #

Name	Description
`Value` UInt32

Event ID 141: Setup_Phase

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_Phase

Fields #

Name	Description
`Value` UInt32

Event ID 142: Setup_CatalogSetupSucceeded

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CatalogSetupSucceeded

Event ID 143: Setup_CatalogSetupFailed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CatalogSetupFailed

Fields #

Name	Description
`hr` UInt32
`Message` UnicodeString

Event ID 144: Setup_CleanupStarted

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CleanupStarted

Event ID 145: Setup_CleanupRemoveDir

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CleanupRemoveDir

Fields #

Name	Description
`Path` UnicodeString

Event ID 146: Setup_CleanupSucceeded

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CleanupSucceeded

Event ID 147: Setup_CleanupFailed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CleanupFailed

Fields #

Name	Description
`hr` UInt32

Event ID 148: Crawl_InitializeNew

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_InitializeNew

Fields #

Name	Description
`CrawlNo` UInt32
`CrawlType` UInt32
`FileName` UnicodeString
`IsCatalogLevel` Boolean

Event ID 149: Crawl_Initialize

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_Initialize

Fields #

Name	Description
`CrawlNo` UInt32

Event ID 150: Crawl_Initialize_Load

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_Initialize_Load

Fields #

Name	Description
`CrawlNo` UInt32
`CrawlType` UInt32
`FileName` UnicodeString
`IsCatalogLevel` Boolean

Event ID 151: Crawl_AddStartPage

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_AddStartPage

Fields #

Name	Description
`CrawlNo` UInt32
`StartPageName` UnicodeString
`StartPageRefID` UInt32

Event ID 152: Crawl_RemoveStartPage

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_RemoveStartPage

Fields #

Name	Description
`CrawlNo` UInt32
`StartPageName` UnicodeString
`StartPageRefID` UInt32
`CrawlIsInProgress` UInt32

Event ID 153: Crawl_IsDone

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_IsDone

Fields #

Name	Description
`CrawlNo` UInt32
`IsDone` Boolean

Event ID 154: Transactions_IterateHistoryStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_IterateHistory
Opcode: Start

Fields #

Name	Description
`CrawlNo` UInt32
`CrawlType` UInt32

Event ID 155: Transactions_IterateHistoryStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_IterateHistory
Opcode: Stop

Fields #

Name	Description
`CrawlNo` UInt32
`hr` UInt32

Event ID 156: Transactions_IterateHistory_Modify

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_IterateHistory_Modify

Fields #

Name	Description
`CrawlNo` UInt32
`URL` UnicodeString

Event ID 157: Transactions_IterateHistory_Delete

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_IterateHistory_Delete

Fields #

Name	Description
`CrawlNo` UInt32
`URL` UnicodeString

Event ID 158: Transactions_UpdateFailuresStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_UpdateFailures
Opcode: Start

Event ID 159: Transactions_UpdateFailuresStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_UpdateFailures
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 160: GatherLog_Transaction

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherLog_Transaction

Fields #

Name	Description
`hrCode` UInt32
`URL` UnicodeString
`TransactionType` UInt32
`StartAddressId` UInt32
`CrawlNo` UInt32
`DocId` UInt32
`hrTransactionError` UInt32
`Description` UnicodeString

Event ID 161: GatherLog_Crawl

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherLog_Crawl

Fields #

Name	Description
`hrCode` UInt32
`URL` UnicodeString
`TransactionType` UInt32
`StartAddressId` UInt32
`CrawlNo` UInt32
`DocId` UInt32
`hrTransactionError` UInt32
`Description` UnicodeString

Event ID 162: Gatherer_OnDataChangeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_OnDataChange
Opcode: Start

Fields #

Name	Description
`Resource` UInt64
`ChangeAdvice` UInt32

Event ID 163: Gatherer_OnDataChangeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_OnDataChange
Opcode: Stop

Fields #

Name	Description
`Resource` UInt64
`hr` UInt32

Event ID 164: Gatherer_OnDataChange

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_OnDataChange

Fields #

Name	Description
`Resource` UInt64
`TransactionURL` UnicodeString
`TransactionType` UInt32

Event ID 165: Gatherer_OnDataChange_Failed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_OnDataChange_Failed

Event ID 166: OnDataChange_Failed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: OnDataChange_Failed

Event ID 169: RobotThread_BeforeGetNewTransaction

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_BeforeGetNewTransaction

Event ID 170: RobotThread_ProcessNewTransaction

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_ProcessNewTransaction

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 171: RobotThread_FilterDriver_Init_Failed_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_FilterDriver_Init_Failed

Fields #

Name	Description
`ITrans` UInt64

Event ID 172: RobotThread_IsHistoryIterator_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_IsHistoryIterator

Fields #

Name	Description
`ITrans` UInt64

Event ID 173: RobotThread_IsWildcardTransaction_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_IsWildcardTransaction

Fields #

Name	Description
`ITrans` UInt64

Event ID 174: RobotThread_IsIteratorByStartAddress_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_IsIteratorByStartAddress

Fields #

Name	Description
`ITrans` UInt64

Event ID 175: RobotThread_IsHistoryIteratorUpdateFailures_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_IsHistoryIteratorUpdateFailures

Fields #

Name	Description
`ITrans` UInt64

Event ID 176: RobotThread_ProcessAnnotation_Failed_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_ProcessAnnotation_Failed

Fields #

Name	Description
`ITrans` UInt64
`hr` UInt32

Event ID 177: RobotThread_GetStandardProperties_Failed_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_GetStandardProperties_Failed

Fields #

Name	Description
`ITrans` UInt64
`hr` UInt32

Event ID 178: RobotThread_TransactionNotModified_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_TransactionNotModified

Fields #

Name	Description
`ITrans` UInt64

Event ID 179: RobotThread_CatalogResetRequested_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_CatalogResetRequested

Fields #

Name	Description
`ITrans` UInt64

Event ID 180: CEnumSearchRoots_Constructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Constructor

Event ID 181: CEnumSearchRoots_Destructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Destructor

Event ID 182: CEnumSearchRoots_DestructorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Destructor
Opcode: Stop

Event ID 183: CEnumSearchRoots_Reset

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Reset

Event ID 184: CEnumSearchRoots_CloneStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Clone
Opcode: Start

Event ID 185: CEnumSearchRoots_CloneStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Clone
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 186: CEnumSearchRoots_NextStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Next
Opcode: Start

Fields #

Name	Description
`ElementCount` UInt32

Event ID 187: CEnumSearchRoots_NextStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Next
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`ElementCount` UInt32

Event ID 188: CEnumSearchRoots_Next_Fetch

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Next_Fetch

Fields #

Name	Description
`SearchRootURL` UnicodeString

Event ID 189: CEnumSearchRoots_SkipStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Skip
Opcode: Start

Event ID 190: CEnumSearchRoots_SkipStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Skip
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 191: CEnumSearchScopeRules_Constructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Constructor

Event ID 192: CEnumSearchScopeRules_DestructorStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Destructor
Opcode: Start

Event ID 193: CEnumSearchScopeRules_DestructorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Destructor
Opcode: Stop

Event ID 194: CEnumSearchScopeRules_Reset

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Reset

Event ID 195: CEnumSearchScopeRules_CloneStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Clone
Opcode: Start

Event ID 196: CEnumSearchScopeRules_CloneStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Clone
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 197: CEnumSearchScopeRules_NextStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Next
Opcode: Start

Event ID 198: CEnumSearchScopeRules_NextStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Next
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 199: CEnumSearchScopeRules_Next_Fetch

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Next_Fetch

Fields #

Name	Description
`ScopeRuleURL` UnicodeString

Event ID 200: CEnumSearchScopeRules_SkipStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Skip
Opcode: Start

Event ID 201: CEnumSearchScopeRules_SkipStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Skip
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 202: CSearchCrawlScopeManager_Constructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_Constructor

Event ID 203: CSearchCrawlScopeManager_Destructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_Destructor

Event ID 204: CSearchCrawlScopeManager_IncludedInCrawlScopeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_IncludedInCrawlScope
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 205: CSearchCrawlScopeManager_IncludedInCrawlScopeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_IncludedInCrawlScope
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`IsIncluded` Boolean

Event ID 206: CSearchCrawlScopeManager_AddDefaultScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddDefaultScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString
`IsInclude` Boolean
`FollowFlags` UInt32

Event ID 207: CSearchCrawlScopeManager_AddDefaultScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddDefaultScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 208: CSearchCrawlScopeManager_AddHierarchicalScopeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddHierarchicalScope
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString
`IsInclude` Boolean
`IsDefault` Boolean
`OverrideChildren` Boolean

Event ID 209: CSearchCrawlScopeManager_AddHierarchicalScopeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddHierarchicalScope
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 210: CSearchCrawlScopeManager_AddRootStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddRoot
Opcode: Start

Fields #

Name	Description
`SearchRootURL` UnicodeString

Event ID 211: CSearchCrawlScopeManager_AddRootStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddRoot
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 212: CSearchCrawlScopeManager_AddUserScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddUserScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString
`IsInclude` Boolean
`OverrideChildren` Boolean
`FollowFlags` UInt32

Event ID 213: CSearchCrawlScopeManager_AddUserScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddUserScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 214: CSearchCrawlScopeManager_EnumerateRootsStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_EnumerateRoots
Opcode: Start

Event ID 215: CSearchCrawlScopeManager_EnumerateRootsStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_EnumerateRoots
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 216: CSearchCrawlScopeManager_EnumerateScopeRulesStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_EnumerateScopeRules
Opcode: Start

Event ID 217: CSearchCrawlScopeManager_EnumerateScopeRulesStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_EnumerateScopeRules
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 218: CSearchCrawlScopeManager_GetParentScopeVersionIdStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_GetParentScopeVersionId
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 219: CSearchCrawlScopeManager_GetParentScopeVersionIdStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_GetParentScopeVersionId
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`ScopeId` UInt32

Event ID 220: CSearchCrawlScopeManager_HasChildScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_HasChildScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 221: CSearchCrawlScopeManager_HasChildScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_HasChildScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`HasChildRule` Boolean

Event ID 222: CSearchCrawlScopeManager_HasParentScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_HasParentScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 223: CSearchCrawlScopeManager_HasParentScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_HasParentScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`HasParentRule` Boolean

Event ID 224: CSearchCrawlScopeManager_IncludedInCrawlScopeExStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_IncludedInCrawlScopeEx
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 225: CSearchCrawlScopeManager_IncludedInCrawlScopeExStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_IncludedInCrawlScopeEx
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`IsIncluded` Boolean
`Reason` UInt32

Event ID 226: CSearchCrawlScopeManager_RemoveDefaultScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveDefaultScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 227: CSearchCrawlScopeManager_RemoveDefaultScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveDefaultScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 228: CSearchCrawlScopeManager_RemoveRootStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveRoot
Opcode: Start

Fields #

Name	Description
`SearchRootURL` UnicodeString

Event ID 229: CSearchCrawlScopeManager_RemoveRootStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveRoot
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 230: CSearchCrawlScopeManager_RemoveScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveScopeRule
Opcode: Start

Fields #

Name	Description
`ScopeRuleURL` UnicodeString

Event ID 231: CSearchCrawlScopeManager_RemoveScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 232: CSearchCrawlScopeManager_RevertToDefaultScopesStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RevertToDefaultScopes
Opcode: Start

Event ID 233: CSearchCrawlScopeManager_RevertToDefaultScopesStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RevertToDefaultScopes
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 234: CSearchCrawlScopeManager_SaveAllStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_SaveAll
Opcode: Start

Event ID 235: CSearchCrawlScopeManager_SaveAllStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_SaveAll
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 236: CSearchRoot_put_RootURL

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_RootURL

Fields #

Name	Description
`SearchRootURL` UnicodeString

Event ID 237: CSearchRoot_get_RootURL

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_RootURL

Fields #

Name	Description
`hr` UInt32
`SearchRootURL` UnicodeString

Event ID 238: CSearchRoot_get_AuthenticationType

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_AuthenticationType

Fields #

Name	Description
`hr` UInt32
`Value` UInt32

Event ID 239: CSearchRoot_get_EnumerationDepth

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_EnumerationDepth

Fields #

Name	Description
`hr` UInt32
`Value` UInt32

Event ID 240: CSearchRoot_get_FollowDirectories

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_FollowDirectories

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 241: CSearchRoot_get_HostDepth

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_HostDepth

Fields #

Name	Description
`hr` UInt32
`Value` UInt32

Event ID 242: CSearchRoot_get_IsHierarchical

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_IsHierarchical

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 243: CSearchRoot_get_ProvidesNotifications

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_ProvidesNotifications

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 244: CSearchRoot_get_Schedule

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_Schedule

Fields #

Name	Description
`hr` UInt32
`Value` UnicodeString

Event ID 245: CSearchRoot_get_UseNotificationsOnly

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_UseNotificationsOnly

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 246: CSearchRoot_put_AuthenticationType

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_AuthenticationType

Fields #

Name	Description
`Value` UInt32

Event ID 247: CSearchRoot_put_EnumerationDepth

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_EnumerationDepth

Fields #

Name	Description
`Value` UInt32

Event ID 248: CSearchRoot_put_FollowDirectories

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_FollowDirectories

Fields #

Name	Description
`Value` Boolean

Event ID 249: CSearchRoot_put_HostDepth

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_HostDepth

Fields #

Name	Description
`Value` UInt32

Event ID 250: CSearchRoot_put_IsHierarchical

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_IsHierarchical

Fields #

Name	Description
`Value` Boolean

Event ID 251: CSearchRoot_put_ProvidesNotifications

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_ProvidesNotifications

Fields #

Name	Description
`Value` Boolean

Event ID 252: CSearchRoot_put_Schedule

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_Schedule

Fields #

Name	Description
`Description` UnicodeString

Event ID 253: CSearchRoot_put_UseNotificationsOnly

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_UseNotificationsOnly

Fields #

Name	Description
`Value` Boolean

Event ID 254: CSearchScopeRule_get_IsDefault

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchScopeRule_get_IsDefault

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 255: CSearchScopeRule_get_IsIncluded

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchScopeRule_get_IsIncluded

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 256: CSearchScopeRule_get_PatternOrURL

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchScopeRule_get_PatternOrURL

Fields #

Name	Description
`hr` UInt32
`Value` UnicodeString

Event ID 257: StatusChange_QueueLocked

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_QueueLocked

Fields #

Name	Description
`Value` UInt32

Event ID 258: StatusChange_QueueUnlocked

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_QueueUnlocked

Event ID 259: Gatherer_OnDataChange_Track_Url

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: Gatherer_OnDataChange_Track_Url
Opcode: win:Info

Fields #

Name	Description
`Resource` UInt64
`TransactionURL` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 259,
    "version": 0,
    "level": 4,
    "task": 209,
    "opcode": 0,
    "keywords": "0x0000000000000408",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Resource": 0,
    "TransactionURL": "file:C:/ProgramData/Microsoft/Windows/WER/Temp/"
  },
  "message": "Gatherer_OnDataChange_Track_Url"
}

Event ID 260: Gatherer_DocIdTable_GetNewId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_GetNewId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 261: Gatherer_DocIdTable_UndeleteId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_UndeleteId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 262: Gatherer_DocIdTable_DeleteId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_DeleteId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 263: Gatherer_DocIdTable_GetMaxId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_GetMaxId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 264: Gatherer_DocIdTable_SetMaxId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_SetMaxId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 265: WID_SDID_Cache_NumberItems

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WID_SDID_Cache_NumberItems

Fields #

Name	Description
`NumWID` UInt32

Event ID 266: Gatherer_Queues_QueueLength

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_Queues_QueueLength

Fields #

Name	Description
`GathererCodeLocation` UInt32
`TransactionsInFile` UInt32
`TransactionsInMemory` UInt32
`TransactionQueueLength` UInt32
`TransactionsInFileNotifications` UInt32
`TransactionsInMemoryNotifications` UInt32
`TransactionQueueLengthNotifications` UInt32
`TransactionsHighLimit` UInt32
`TransactionsLowLimitPerCrawl` UInt32
`TransactionsHighLimitPerCrawl` UInt32
`TransactionsInIncrementalQueue` UInt32
`TransactionsInNotificationQueue` UInt32
`TansactionsInNotificationHighPriorityQueue` UInt32

Event ID 267: Startup_Search_Service_DurationStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_Search_Service_Duration
Opcode: Start

Event ID 268: Startup_Search_Service_DurationStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_Search_Service_Duration
Opcode: Stop

Event ID 269: Shutdown_Search_Service_DurationStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Shutdown_Search_Service_Duration
Opcode: Start

Event ID 270: Shutdown_Search_Service_DurationStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Shutdown_Search_Service_Duration
Opcode: Stop

Event ID 271: ServerQueryRelease

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQueryRelease

Fields #

Name	Description
`Qid` UInt32

Event ID 272: CreatePhysCursorStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreatePhysCursor
Opcode: Start

Fields #

Name	Description
`ObjectWid` UInt32
`KeyPid` UInt32
`GroupPids` UnicodeString
`KeyStr` UnicodeString

Event ID 273: CreatePhysCursorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreatePhysCursor
Opcode: Stop

Fields #

Name	Description
`ObjectWid` UInt32

Event ID 274: CreatePhysCursorRangeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreatePhysCursorRange
Opcode: Start

Fields #

Name	Description
`ObjectWid` UInt32
`KeyStartPid` UInt32
`GroupPids` UnicodeString
`KeyEndStr` UnicodeString

Event ID 275: CreatePhysCursorRangeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreatePhysCursorRange
Opcode: Stop

Fields #

Name	Description
`ObjectWid` UInt32
`StackCount` UInt32

Event ID 276: MergeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Merge
Opcode: Start

Fields #

Name	Description
`ObjectWid` UInt32
`UseQueryPerfOpt` Boolean
`Restarted` Boolean
`IndexIds` UnicodeString
`TotalSizeInPages` UInt32
`MaxWid` UInt32

Event ID 277: MergeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Merge
Opcode: Stop

Fields #

Name	Description
`ObjectWid` UInt32

Event ID 278: CreateWLCursorStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWLCursor
Opcode: Start

Fields #

Name	Description
`WordListId` UInt64
`KeyTargetPid` UInt32
`KeyTargetStr` UnicodeString

Event ID 279: CreateWLCursorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWLCursor
Opcode: Stop

Fields #

Name	Description
`WordListId` UInt64

Event ID 280: CreateWLCursorRangeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWLCursorRange
Opcode: Start

Fields #

Name	Description
`WordListId` UInt64
`KeyStartPid` UInt32
`GroupPids` UnicodeString
`KeyEndStr` UnicodeString

Event ID 281: CreateWLCursorRangeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWLCursorRange
Opcode: Stop

Fields #

Name	Description
`WordListId` UInt64
`StackCount` UInt32

Event ID 282: ServerQueryStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery
Opcode: Start

Fields #

Name	Description
`Qid` UInt32

Event ID 283: ServerQuery_Send

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_Send

Fields #

Name	Description
`Qid` UInt32
`BytesSent` UInt32
`MessageId` Int32

Event ID 284: ServerQuery_Received

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_Received

Fields #

Name	Description
`Qid` UInt32
`BytesReceived` UInt32
`MessageId` Int32

Event ID 285: ClientQuery_Send

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery_Send

Fields #

Name	Description
`BytesSent` UInt32
`MessageId` Int32

Event ID 286: ClientQuery_Received

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery_Received

Fields #

Name	Description
`BytesReceived` UInt32
`MessageId` Int32

Event ID 287: ServerQueryStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery
Opcode: Stop

Fields #

Name	Description
`Qid` UInt32

Event ID 288: ServerQuery_Create

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_Create

Fields #

Name	Description
`Qid` UInt32

Event ID 289: ClientStartFetch

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientStartFetch

Fields #

Name	Description
`Rowset` UInt64
`Chapter` UInt64
`RowsRequested` Int64
`RowSeekMethod` Int32
`RowsToSkip` Int64
`RowOffset` Int32
`Bookmark` UInt32
`Bookmarks` UnicodeString
`Numerator` UInt32
`Denominator` UInt32

Event ID 290: ClientFetched

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientFetched

Fields #

Name	Description
`Rowset` UInt64
`RowsReturned` Int64
`ErrorCode` UInt32

Event ID 291: ServerGetRowsStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerGetRows
Opcode: Start

Fields #

Name	Description
`Qid` UInt32
`WidStart` UInt32
`Chapter` UInt32
`Depth` UInt32
`RowOffset` Int64
`RequestedRows` UInt32

Event ID 292: ServerGetRowsStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerGetRows
Opcode: Stop

Fields #

Name	Description
`Qid` UInt32
`RowsTransferred` UInt32
`ErrorCode` UInt32

Event ID 293: RobotThread_LangAutoDetection_Start

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Start
Opcode: Start

Fields #

Name	Description
`fmtid` GUID
`pid` UInt32
`TextPrefix` UnicodeString
`TextLength` UInt32

Event ID 294: RobotThread_LangAutoDetection_Stop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Stop
Opcode: Stop

Fields #

Name	Description
`LocaleID` UInt32

Event ID 295: RobotThread_LangAutoDetection_Succeed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Succeed

Fields #

Name	Description
`LocaleName` UnicodeString

Event ID 296: RobotThread_LangAutoDetection_Fail

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Fail

Fields #

Name	Description
`hr` UInt32

Event ID 297: Service_Status_NotifyStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Service_Status_Notify
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 298: Service_Status_NotifyStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Service_Status_Notify
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 300: ServerQuery_ForcePublishStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_ForcePublish
Opcode: Start

Fields #

Name	Description
`Qid` UInt32

Event ID 301: ServerQuery_ForcePublishStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_ForcePublish
Opcode: Stop

Fields #

Name	Description
`Qid` UInt32

Event ID 302: Wordlist_PublishStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_Publish
Opcode: Start

Fields #

Name	Description
`CBID` UInt64
`DocCount` UInt32
`BytesAvailable` UInt64

Event ID 303: Wordlist_PublishStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_Publish
Opcode: Stop

Fields #

Name	Description
`CBID` UInt64

Event ID 304: Flush_Schedule

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Flush_Schedule

Fields #

Name	Description
`Scheduled` Boolean
`Reason` UInt32

Event ID 305: CBPool_ForceFlush

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CBPool_ForceFlush

Fields #

Name	Description
`AvailableCBCount` UInt32
`DirtyCBCount` UInt32
`InUseCBCount` UInt32
`PublishedCBCount` UInt32

Event ID 306: DocAborted_ForcePublish

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: DocAborted_ForcePublish

Fields #

Name	Description
`DocID` UInt32

Event ID 307: DocAborted_CBOverflow

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: DocAborted_CBOverflow

Fields #

Name	Description
`DocID` UInt32

Event ID 308: Wordlist_BeginResourceFailed_CBOverflow

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_BeginResourceFailed_CBOverflow

Fields #

Name	Description
`DocID` UInt32
`BytesAvailable` UInt32

Event ID 309: Wordlist_BeginResourceFailed_DocInError

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_BeginResourceFailed_DocInError

Fields #

Name	Description
`DocID` UInt32

Event ID 310: Wordlist_BeginResource_InvalidatedPreviousDoc

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_BeginResource_InvalidatedPreviousDoc

Fields #

Name	Description
`DocID` UInt32
`CBID` UInt64

Event ID 311: ClientQuery_Rowset_Reuse

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery_Rowset_Reuse

Fields #

Name	Description
`Value` UInt32

Event ID 312: ServerQuery_DeferredProperty

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_DeferredProperty

Fields #

Name	Description
`DocID` UInt32
`PropID` UInt32

Event ID 313: ScopeManager_Init

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeManager_Init

Fields #

Name	Description
`IsCompact` Boolean
`CacheCapacity` UInt32

Event ID 314: ScopeManager_Retrieved

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeManager_Retrieved

Fields #

Name	Description
`NumWID` UInt32

Event ID 315: ScopeManager_SwitchToFull

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeManager_SwitchToFull

Fields #

Name	Description
`Value` UInt32

Event ID 316: ScopeManager_Write

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeManager_Write

Fields #

Name	Description
`MaxWID` UInt32
`Scope` UInt32
`IsCompact` Boolean
`CacheCapacity` UInt32

Event ID 317: Prioritization_Request

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Prioritization_Request

Fields #

Name	Description
`RequestID` UInt64
`Priority` UInt32
`Indexed` UInt32
`OutstandingAdds` UInt32
`OutstandingModifies` UInt32

Event ID 318: Prioritization_Complete

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Prioritization_Complete

Fields #

Name	Description
`RequestID` UInt64
`Priority` UInt32
`Indexed` UInt32
`OutstandingAdds` UInt32
`OutstandingModifies` UInt32

Event ID 319: Prioritization_Statistics

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Prioritization_Statistics

Fields #

Name	Description
`RequestID` UInt64
`Priority` UInt32
`Indexed` UInt32
`OutstandingAdds` UInt32
`OutstandingModifies` UInt32

Event ID 320: JET_IO_Low_Priority_Change

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: JET_IO_Low_Priority_Change

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 321: Gather_Transaction_Failure_Code

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gather_Transaction_Failure_Code

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`URL` UnicodeString
`DocID` UInt32
`hr` UInt32
`Passes` UInt32

Event ID 322: ETWLogging

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ETWLogging
Opcode: win:Info

Fields #

Name	Description
`Info` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 322,
    "version": 0,
    "level": 4,
    "task": 258,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Info": "ProcessDataChange_Internal for {, flags: 0, flags_e 0"
  },
  "message": "ETWLogging"
}

Event ID 323: ETWLoggingFailure

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ETWLoggingFailure

Fields #

Name	Description
`Hr` UInt32
`Info` UnicodeString

Event ID 324: ETWLoggingItem

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ETWLoggingItem

Fields #

Name	Description
`DocID` UInt32
`URL` UnicodeString
`Info` UnicodeString

Event ID 325: ETWLoggingItemFailure

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ETWLoggingItemFailure

Fields #

Name	Description
`Hr` UInt32
`DocID` UInt32
`URL` UnicodeString
`Info` UnicodeString

Event ID 326: USN_Notify_Journal_Wrap

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: USN_Notify_Journal_Wrap

Fields #

Name	Description
`Volume` UnicodeString
`DesiredPosition` Int64
`CurrentPosition` Int64
`hr` UInt32

Event ID 327: GathererRecoverStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GathererRecover
Opcode: Start

Event ID 328: GathererRecoverStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GathererRecover
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 329: ValueIndexCreationStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexCreation
Opcode: Start

Fields #

Name	Description
`Locale` UInt32
`IdxName` AnsiString
`IsShadow` Boolean
`ColumnType` UInt64

Event ID 330: ValueIndexCreationStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexCreation
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32
`IdxName` AnsiString
`IsShadow` Boolean
`ErrorCode` UInt32

Event ID 331: ValueIndexSeekStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexSeek
Opcode: Start

Fields #

Name	Description
`SeekType` UnicodeString
`ColumnType` UInt32

Event ID 332: ValueIndexSeekStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexSeek
Opcode: Stop

Fields #

Name	Description
`SeekType` UnicodeString
`Result` UInt32

Event ID 333: ValueIndexSeekStart333

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexSeek
Opcode: Start

Fields #

Name	Description
`HasStartVariant` Boolean
`HasEndVariant` Boolean
`ExcludeStartVariant` Boolean
`ExcludeEndVariant` Boolean

Event ID 334: ValueIndexSeekStop334

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexSeek
Opcode: Stop

Fields #

Name	Description
`RangeSet` UInt32

Event ID 335: FreeCursor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FreeCursor

Fields #

Name	Description
`Qid` UInt32
`Cursor` UInt32

Event ID 336: ReuseRestriction

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReuseRestriction

Fields #

Name	Description
`WhereID` UInt32

Event ID 337: GetQueryStatusExStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GetQueryStatusEx
Opcode: Start

Fields #

Name	Description
`Qid` UInt32

Event ID 338: GetQueryStatusExStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GetQueryStatusEx
Opcode: Stop

Fields #

Name	Description
`Qid` UInt32

Event ID 339: CreateWordBreakerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWordBreaker
Opcode: Start

Fields #

Name	Description
`Locale` UInt32

Event ID 340: CreateWordBreakerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWordBreaker
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32

Event ID 341: ReleaseWordBreakerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReleaseWordBreaker
Opcode: Start

Fields #

Name	Description
`Locale` UInt32

Event ID 342: ReleaseWordBreakerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReleaseWordBreaker
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32

Event ID 343: CreateStemmerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateStemmer
Opcode: Start

Fields #

Name	Description
`Locale` UInt32

Event ID 344: CreateStemmerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateStemmer
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32

Event ID 345: ReleaseStemmerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReleaseStemmer
Opcode: Start

Fields #

Name	Description
`Locale` UInt32

Event ID 346: ReleaseStemmerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReleaseStemmer
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32

Event ID 347: CreateCatalog

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateCatalog

Fields #

Name	Description
`hr` UInt32
`Message` UnicodeString

Event ID 348: DeleteCatalog

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: DeleteCatalog

Fields #

Name	Description
`hr` UInt32
`Message` UnicodeString

Event ID 349: RobotThread_GetWordBreaker

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_GetWordBreaker

Fields #

Name	Description
`fmtid` GUID
`pid` UInt32
`LocaleID` UInt32
`LocaleSource` UInt32

Event ID 350: GetWordBreaker

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GetWordBreaker

Fields #

Name	Description
`Locale` UInt32

Event ID 351: WordBreakerSelector_IncrementHistory

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerSelector_IncrementHistory

Fields #

Name	Description
`LocaleID` UInt32
`IncrementCallID` UInt32

Event ID 352: WordBreakerSelector_SubstituteLocale

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerSelector_SubstituteLocale

Fields #

Name	Description
`LocaleOriginal` UInt32
`LocaleSubstitute` UInt32

Event ID 353: WordBreakerSelector_Fallback

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerSelector_Fallback

Fields #

Name	Description
`LocaleID` UInt32

Event ID 354: WordBreakerHistory_Save

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerHistory_Save

Fields #

Name	Description
`Data` AnsiString

Event ID 355: WordBreakerHistory_Load

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerHistory_Load

Fields #

Name	Description
`Data` AnsiString

Event ID 356: RobotThread_LangAutoDetection_Scores

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Scores

Fields #

Name	Description
`TextLength` UInt32
`TopLCID` UInt32
`TopScore` UInt32
`SecondLCID` UInt32
`SecondScore` UInt32

Event ID 357: FileChangeTracker_APICallStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Start

Event ID 358: FileChangeTracker_APICallStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 359: FileChangeTracker_APICallStart359

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Start

Event ID 360: FileChangeTracker_APICallStop360

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 361: FileChangeTracker_APICallStart361

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Start

Event ID 362: FileChangeTracker_APICallStop362

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 363: FileChangeTracker_ProcessUSN

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Level: Informational
Task: FileChangeTracker_ProcessUSN
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 363,
    "version": 0,
    "level": 4,
    "task": 284,
    "opcode": 1,
    "keywords": "0x0000000000000410",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "FileChangeTracker_ProcessUSN"
}

Event ID 364: FileChangeTracker_ProcessUSN

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Level: Informational
Task: FileChangeTracker_ProcessUSN
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 364,
    "version": 0,
    "level": 4,
    "task": 284,
    "opcode": 2,
    "keywords": "0x0000000000000410",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "FileChangeTracker_ProcessUSN"
}

Event ID 365: ScopeChangeNotification_OnChanged

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_OnChanged

Fields #

Name	Description
`ScopeId` UInt32
`EventId` GUID
`PackageFamilyName` UnicodeString
`Path` UnicodeString
`Result` UInt32
`SuccessEvent` Boolean

Event ID 366: ScopeChangeNotification_OnChanged366

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_OnChanged

Fields #

Name	Description
`ScopeId` UInt32

Event ID 367: ScopeChangeNotification_RegisterStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_Register
Opcode: Start

Fields #

Name	Description
`UserSid` UnicodeString
`PackageFamilyName` UnicodeString
`EventId` GUID
`Count` UInt32
`Paths` UnicodeString

Event ID 368: ScopeChangeNotification_RegisterStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_Register
Opcode: Stop

Event ID 369: ScopeChangeNotification_UnregisterStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_Unregister
Opcode: Start

Fields #

Name	Description
`UserSid` UnicodeString
`PackageFamilyName` UnicodeString
`EventId` GUID

Event ID 370: ScopeChangeNotification_UnregisterStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_Unregister
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}

Defined in SearchIndexer.exe, which carries the event manifest.

Observed on:

Win11-26200.6584 · sample captured from a live trace · binary version 7.0.26100.4946 · captured 2026-06-02
WS2022-20348.4893 · schema read from the registered manifest · binary version 7.0.20348.2849 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 7.0.26100.4946 · captured 2026-06-02

Downloads

Microsoft-Windows-Search-Core registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Search-Core registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)