Microsoft-Windows-Search
258 events across 2 channels
Event ID 1003 — The Windows Search Service started.
#Fields #
| Name | Description |
|---|---|
Data | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search",
"guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
"event_source_name": "Windows Search Service",
"event_id": 1003,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2023-11-06T06:25:51.885710+00:00",
"event_record_id": 1450,
"correlation": {},
"execution": {
"process_id": 5004,
"thread_id": 0
},
"channel": "Application",
"computer": "WinDev2310Eval",
"security": {
"user_id": ""
}
},
"event_data": {
"Data": {
"Name": "ExtraInfo",
"Value": "\n"
}
},
"message": "The Windows Search Service started.ExtraInfo"
}
References #
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 1003 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 1004 — The Windows Search service is creating the new search index {Reason: Full Index Reset}.
#Fields #
| Name | Description |
|---|---|
ExtraInfo | — |
Reason | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search",
"guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
"event_source_name": "Windows Search Service",
"event_id": 1004,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2023-11-06T06:25:51.187482+00:00",
"event_record_id": 1447,
"correlation": {},
"execution": {
"process_id": 5004,
"thread_id": 0
},
"channel": "Application",
"computer": "WinDev2310Eval",
"security": {
"user_id": ""
}
},
"event_data": {
"ExtraInfo": "\n",
"Reason": "Full Index Reset"
},
"message": "The Windows Search service is creating the new search index {Reason: Full Index Reset}. \n"
}
References #
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 1004 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Reason UnicodeString | — |
Event ID 1005 — The Windows Search Service has successfully created the new search index.
#Fields #
| Name | Description |
|---|---|
Data | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search",
"guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
"event_source_name": "Windows Search Service",
"event_id": 1005,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2023-11-06T06:25:51.828936+00:00",
"event_record_id": 1449,
"correlation": {},
"execution": {
"process_id": 5004,
"thread_id": 0
},
"channel": "Application",
"computer": "WinDev2310Eval",
"security": {
"user_id": ""
}
},
"event_data": {
"Data": {
"Name": "ExtraInfo",
"Value": "\n"
}
},
"message": "The Windows Search Service has successfully created the new search index. ExtraInfo"
}
References #
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 1005 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 1006 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Phase UnicodeString | — |
HR UnicodeString | — |
DiagnosticsInfo UnicodeString | — |
Event ID 1007 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 1008 — The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}.
#Fields #
| Name | Description |
|---|---|
ExtraInfo | — |
Reason | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search",
"guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
"event_source_name": "Windows Search Service",
"event_id": 1008,
"version": 0,
"level": 3,
"task": 1,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2023-11-06T06:25:47.791114+00:00",
"event_record_id": 1444,
"correlation": {},
"execution": {
"process_id": 5004,
"thread_id": 0
},
"channel": "Application",
"computer": "WinDev2310Eval",
"security": {
"user_id": ""
}
},
"event_data": {
"ExtraInfo": "\n",
"Reason": "Full Index Reset"
},
"message": "The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}. \n"
}
References #
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 1008 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Reason UnicodeString | — |
Event ID 1009 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Address UnicodeString | — |
Event ID 1010 — The Windows Search Service has successfully removed the old search index.
#Fields #
| Name | Description |
|---|---|
Data | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search",
"guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
"event_source_name": "Windows Search Service",
"event_id": 1010,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2023-11-06T06:25:47.798155+00:00",
"event_record_id": 1445,
"correlation": {},
"execution": {
"process_id": 5004,
"thread_id": 0
},
"channel": "Application",
"computer": "WinDev2310Eval",
"security": {
"user_id": ""
}
},
"event_data": {
"Data": {
"Name": "ExtraInfo",
"Value": "\n"
}
},
"message": "The Windows Search Service has successfully removed the old search index. ExtraInfo"
}
References #
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 1010 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 1011 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Phase UnicodeString | — |
HR UnicodeString | — |
Event ID 1013 — Windows Search Service stopped normally.
#Fields #
| Name | Description |
|---|---|
Data | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search",
"guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
"event_source_name": "Windows Search Service",
"event_id": 1013,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2023-10-25T22:56:14.357450+00:00",
"event_record_id": 1432,
"correlation": {},
"execution": {
"process_id": 7916,
"thread_id": 0
},
"channel": "Application",
"computer": "WinDevEval",
"security": {
"user_id": ""
}
},
"event_data": {
"Data": {
"Name": "ExtraInfo",
"Value": "\n"
}
},
"message": "Windows Search Service stopped normally.ExtraInfo"
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 1013 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 1014 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
DebugInfo UnicodeString | — |
Event ID 1015 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
EventID UnicodeString | — |
RepeatCount UnicodeString | — |
ReferenceTime UnicodeString | — |
Event ID 1016 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
OldIndexPath UnicodeString | — |
NewIndexPath UnicodeString | — |
Phase UnicodeString | — |
ErrorCode UnicodeString | — |
Event ID 1017 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
OldIndexPath UnicodeString | — |
NewIndexPath UnicodeString | — |
Event ID 1018 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
OldIndexPath UnicodeString | — |
NewIndexPath UnicodeString | — |
Phase UnicodeString | — |
ErrorCode UnicodeString | — |
Event ID 1019 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Phase UnicodeString | — |
ErrorCode UnicodeString | — |
Path UnicodeString | — |
Event ID 1044 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
FileName UnicodeString | — |
Event ID 1053 —
Fields #
| Name | Description |
|---|---|
Code UnicodeString | — |
StackTrace UnicodeString | — |
Event ID 3003 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3006 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3007 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3008 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Entry UnicodeString | — |
Event ID 3009 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3010 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
FilePath UnicodeString | — |
Event ID 3011 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
FilePath UnicodeString | — |
Event ID 3013 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Entry UnicodeString | — |
Event ID 3014 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
ID UnicodeString | — |
Event ID 3015 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3020 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
ErrorCode UnicodeString | — |
Event ID 3023 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3024 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3025 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
ErrorCode UnicodeString | — |
Event ID 3026 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3027 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
URL UnicodeString | — |
Event ID 3028 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3029 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Plugin UnicodeString | — |
Event ID 3030 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3031 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3032 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3033 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3034 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
ExpectedVersion UnicodeString | — |
Event ID 3036 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
URL UnicodeString | — |
Event ID 3037 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
URL UnicodeString | — |
Event ID 3038 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
RegPath UnicodeString | — |
Event ID 3039 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3040 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
RequestedStatusMessage UnicodeString | — |
Event ID 3041 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3042 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3044 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3045 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
OldLength UnicodeString | — |
NewLength UnicodeString | — |
Event ID 3046 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3048 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3050 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3052 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3053 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3054 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3055 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3056 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3057 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
PluginManager UnicodeString | — |
Event ID 3058 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3059 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3060 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
URL UnicodeString | — |
Event ID 3061 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3062 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Locale UnicodeString | — |
Event ID 3072 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3073 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3078 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3079 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
VolumeName UnicodeString | — |
Event ID 3083 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
ProtocolHandler UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 3084 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
ProtocolHandler UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 3085 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3086 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3087 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3088 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3089 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3090 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3091 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3092 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3093 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3095 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Domain UnicodeString | — |
Account UnicodeString | — |
Users UnicodeString | — |
MaxUsers UnicodeString | — |
Event ID 3096 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Reason UnicodeString | — |
Event ID 3097 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3099 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3100 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 3101 —
Event ID 4103 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
Event ID 4104 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 4105 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 4106 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 4121 —
#Fields #
| Name | Description |
|---|---|
ExtraInfo | — |
CatalogName | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search",
"guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
"event_source_name": "Windows Search Service",
"event_id": 4121,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2014-11-26T23:22:14.000000Z",
"event_record_id": 1157,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "IE10Win7",
"security": {
"user_id": ""
}
},
"event_data": {
"ExtraInfo": "\n",
"CatalogName": "SystemIndex"
}
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 4121 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
Event ID 4138 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Component UnicodeString | — |
CatalogName UnicodeString | — |
Event ID 4163 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
Event ID 4164 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
Event ID 4165 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
IndexesPerMergeLevel UnicodeString | — |
__binLength UInt32 | — |
binary Binary | — |
Event ID 4166 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
ExpectedDocCount UnicodeString | — |
__binLength UInt32 | — |
binary Binary | — |
Event ID 4167 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CatalogName UnicodeString | — |
MasterMergeReason UnicodeString | — |
__binLength UInt32 | — |
binary Binary | — |
Event ID 4168 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
ErrorMessage UnicodeString | — |
__binLength UInt32 | — |
binary Binary | — |
Event ID 4169 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Phase UnicodeString | — |
Event ID 7001 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
SrcFile UnicodeString | — |
DstFile UnicodeString | — |
Event ID 7010 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 7011 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Directory UnicodeString | — |
Event ID 7013 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Directory UnicodeString | — |
Event ID 7040 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
CorruptionId UnicodeString | — |
Event ID 7042 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Reason UnicodeString | — |
Event ID 7043 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 7064 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 7066 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Directory UnicodeString | — |
Event ID 7068 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 7070 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 7071 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 9000 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 9001 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 9002 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 9003 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 10013 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 10014 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
OldNoiseFile UnicodeString | — |
NewNoiseFile UnicodeString | — |
Event ID 10020 —
Fields #
| Name | Description |
|---|---|
Driver UnicodeString | — |
InstanceName UnicodeString | — |
InstanceNum UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 10021 —
Fields #
| Name | Description |
|---|---|
Driver UnicodeString | — |
InstanceName UnicodeString | — |
InstanceNum UnicodeString | — |
ErrorMessage UnicodeString | — |
Event ID 10022 —
Fields #
| Name | Description |
|---|---|
Driver UnicodeString | — |
InstanceName UnicodeString | — |
InstanceNum UnicodeString | — |
Event ID 10023 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
ProtocolHostProcessID UnicodeString | — |
FilterHostProcessID UnicodeString | — |
Event ID 10024 —
#Fields #
| Name | Description |
|---|---|
ExtraInfo | — |
FilterHostProcessID | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search",
"guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
"event_source_name": "Windows Search Service",
"event_id": 10024,
"version": 0,
"level": 3,
"task": 3,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2014-11-25T22:48:11.000000Z",
"event_record_id": 1044,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "IE8Win7",
"security": {
"user_id": ""
}
},
"event_data": {
"ExtraInfo": "\n",
"FilterHostProcessID": "4008"
}
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 10024 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
FilterHostProcessID UnicodeString | — |
Event ID 10025 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 10026 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
Event ID 10027 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
SID UnicodeString | — |
Event ID 10028 —
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
SID UnicodeString | — |
Event ID 1073742827 — The Windows Search Service started.
Event ID 1073742828 — The Windows Search service is creating the new search index {Reason: Reason}.
Event ID 1073742829 — The Windows Search Service has successfully created the new search index.
Event ID 1073742834 — The Windows Search Service has successfully removed the old search index.
Event ID 1073742837 — Windows Search Service stopped normally.
Event ID 1073742841 — The Windows Search Service successfully moved index files from OldIndexPath to NewIndexPath.
Event ID 1073744865 — The index is being reset.
Event ID 1073744868 — The gatherer index resumed.
Event ID 1073744876 — The crawl was requested to be stopped.
Event ID 1073744884 — An update cannot begin because the content source <.
Event ID 1073744919 — The group Domain\Account contains Users members.
Event ID 1073744920 — The local groups cache was flushed, because Reason.
Event ID 1073745927 — ExtraInfoA master merge has completed for catalog CatalogName.
Event ID 1073745928 — ExtraInfoA master merge has been paused for catalog CatalogName due to error ErrorMessage.
Event ID 1073745945 — ExtraInfoA master merge has restarted for catalog CatalogName.
Event ID 1073745962 — An index corruption was detected in component Component in catalog CatalogName.
Event ID 1073745987 — ExtraInfoA master merge has been paused for catalog CatalogName due to low disk space.
Event ID 1073745988 — 1CatalogCatalog: ExtraInfo.
Event ID 1073745989 — 1CatalogCatalog: ExtraInfo.
Event ID 1073745990 — 1CatalogCatalog: ExtraInfo.
Event ID 1073745991 — 1CatalogCatalog: ExtraInfo.
Event ID 1073748866 — The Windows Search Service is being stopped because there is a problem with the indexer: Reason.
Event ID 2147484656 — The Windows Search Service is starting up and attempting to remove the old search index {Reason: Reason}.
Event ID 2147484662 — The Windows Search Service has failed to create one or more path rules.
Event ID 2147484663 — Event ID EventID for the Windows Search Service has been suppressed RepeatCount time(s) since ReferenceTime.
Event ID 2147484666 — While rolling back the index, the Windows Search Service encountered the following error: <Phase,ErrorCode>.
Description
While rolling back the index, the Windows Search Service encountered the following error: <Phase,ErrorCode>. Index files were not moved from OldIndexPath to NewIndexPath. ExtraInfo.
Message #
Fields #
| Name | Description |
|---|---|
ExtraInfo UnicodeString | — |
OldIndexPath UnicodeString | — |
NewIndexPath UnicodeString | — |
Phase UnicodeString | — |
ErrorCode UnicodeString | — |
Event ID 2147484692 — An error occurred in configuration file <FileName>.
Event ID 2147484701 — The system exception Code occurred, and will be handled.
Event ID 2147486671 — The update cannot be started because all of the content sources were excluded by site path rules, or removed from the index configuration.
Event ID 2147486672 — The update cannot be started because the content sources cannot be accessed.
Event ID 2147486684 — Crawl could not be completed on content source <URL>.
Event ID 2147486685 — Crawl could not be started on content source <URL>.
Event ID 2147486686 — The gatherer is unable to read the registry RegPath.
Event ID 2147486687 — A request to start the update has been ignored because the update is already in progress or is scheduled on one or more content sources.
Event ID 2147486690 — The index was paused.
Event ID 2147486693 — The automatic description length was adjusted from OldLength to NewLength.
Event ID 2147486694 — The update for the index cannot be started because the specified content sources were not configured for updates.
Event ID 2147486701 — The previous update was reset, or was otherwise interrupted.
Event ID 2147486702 — The update has been delayed because a disk is full.
Event ID 2147486703 — The gatherer property mapping file cannot be opened.
Event ID 2147486704 — The automatic description encoding tag value is invalid.
Event ID 2147486709 — The gatherer log cannot be created.
Event ID 2147486710 — The word breaker for language <Locale> cannot be loaded.
Event ID 2147486720 — The gatherer is recovering after an improper shutdown.
Event ID 2147486721 — The gatherer detected pages in the history during recovery that cannot be read, and repaired them.
Event ID 2147486726 — The Windows Search service stopped the Protocol Host process because it was consuming too many resources.
Event ID 2147486734 — The system locale has changed.
Event ID 2147487816 — ExtraInfo Unable to create the query engine's first request item due to error ErrorMessage.
Event ID 2147487817 — Error ID Phase happened in Windows Search recovery stage, please restart the service.
Event ID 2147492651 — The Windows Search Service cannot initialize multi-instancing in Jet.
Event ID 2147493661 — The noise files cannot be renamed.
Event ID 2147493662 — The noise file "OldNoiseFile"" cannot be renamed to ""NewNoiseFile"".
Event ID 2147493668 — Performance Counters could not be loaded for Driver for instance InstanceName InstanceNum due to the following error: ErrorMessage.
Event ID 2147493669 — Could not get performance counter registry info for Driver for instance InstanceName InstanceNum due to the following error: ErrorMessage.
Event ID 2147493670 — Performance counters will not be loaded because the named objects (shared memory or events) are in use for Driver for instance InstanceName InstanceNum.
Event ID 2147493671 — The protocol host process ProtocolHostProcessID did not respond and is being forcibly terminated {filter host process FilterHostProcessID}.
Event ID 2147493672 — The filter host process FilterHostProcessID did not respond and is being forcibly terminated.
Event ID 2147493673 — The search service has failed to create database instance for the index {ExtraInfo} due to maximum number of instance reached.
Event ID 2147493674 — The search service has failed to configure maximum number of database instance.
Event ID 2147493675 — The search service has failed to create or load catalog for an user with SID {.
Event ID 2147493676 — The search service has failed to unload catalog for an user with SID {SID}.
Event ID 3221226478 — The Windows Search Service has failed to create the new search index.
Event ID 3221226479 — The Windows Search Service was unable to allocate memory.
Event ID 3221226481 — An exception occurred in Address.
Event ID 3221226483 — The Windows Search Service has failed to remove the old search index.
Event ID 3221226488 — The Windows Search Service failed to move Index files from OldIndexPath to NewIndexPath with the following error: <Phase,ErrorCode>.
Event ID 3221226491 — Windows Search Service failed to process the list of included and excluded locations with the error <Phase, ErrorCode, "Path">.
Event ID 3221228475 — A configuration error occurred.
Event ID 3221228478 — Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be op...
Event ID 3221228479 — Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be ope...
Event ID 3221228480 — The entry <Entry> cannot be inserted into the history.
Event ID 3221228481 — The transaction object cannot be created.
Event ID 3221228482 — The transaction cannot be appended to the queue.
Event ID 3221228483 — The transaction cannot be updated in the queue.
Event ID 3221228485 — The entry <Entry> in the hash map cannot be updated.
Event ID 3221228486 — An exception occurred.
Event ID 3221228487 — The transaction file cannot be read.
Event ID 3221228492 — Internal gatherer error ErrorCode occurred.
Event ID 3221228497 — Critical error ErrorCode occurred, and the index was shut down.
Event ID 3221228498 — Advise Status Change failed.
Event ID 3221228499 — The URL <URL> cannot be crawled.
Event ID 3221228500 — The gatherer object cannot be initialized.
Event ID 3221228501 — The plug-in in <Plugin> cannot be initialized.
Event ID 3221228502 — The gatherer service cannot be initialized.
Event ID 3221228503 — A document ID cannot be allocated.
Event ID 3221228504 — A document ID cannot be freed.
Event ID 3221228505 — A new queue file cannot be created.
Event ID 3221228506 — The registry version does not match with the expected <.
Event ID 3221228512 — The status change request RequestedStatusMessage cannot be processed.
Event ID 3221228520 — No documents were accessed because no e-mail address is specified in the content index server properties.
Event ID 3221228522 — Unvisited items cannot be deleted from the history after a full update.
Event ID 3221228529 — The plug-in manager <PluginManager> cannot be initialized.
Event ID 3221228530 — The application cannot be initialized.
Event ID 3221228531 — The update cannot be initialized.
Event ID 3221228551 — Notifications for the volume VolumeName are not active.
Event ID 3221228555 — The protocol handler ProtocolHandler cannot be loaded.
Event ID 3221228556 — Failed to load protocol handler ProtocolHandler.
Event ID 3221228557 — The application network access account is invalid.
Event ID 3221228559 — The gatherer files cannot be flushed, and this action cannot be completed.
Event ID 3221228560 — The checkpoint record cannot be updated, and this action cannot be completed.
Event ID 3221228561 — The gatherer files cannot be saved, and this action cannot be completed.
Event ID 3221228562 — The gatherer files from the previous checkpoint cannot be restored, and this action cannot be completed.
Event ID 3221228563 — The checkpoint record cannot be read, and this action cannot be completed.
Event ID 3221228564 — The project cannot be initialized, because the checkpoint record cannot be read.
Event ID 3221228565 — The project cannot be initialized, because one of the checkpoint files is missing.
Event ID 3221228569 — The gatherer did not connect to the SQLServer instance.
Event ID 3221228571 — Unable to terminate notifications normally.
Event ID 3221228572 — Unable to initialize the filter host process.
Event ID 3221228573 — The filter host process could not be terminated.
Description
The filter host process could not be terminated.