Microsoft-Windows-StorageManagement-WSP-Host

4 events across 1 channel

Event ID	Title	Channel
1000	A Windows Storage Provider failed to load.	Operational
1001	A Windows Storage Provider was loaded successfully.	Operational
1002	Shutdown has been initiated for the Windows Storage Provider host service.	Operational
1003	Shutdown for the Windows Storage Provider host service has been completed.	Operational

Event ID 1000 — A Windows Storage Provider failed to load.

Provider: Microsoft-Windows-StorageManagement-WSP-Host
Channel: Operational

Message

A Windows Storage Provider failed to load.             
Provider: %1             
Provider DLL: %2             
Error Code: %3             
Load Phase: %4             

This failure is indicative of a bad installation, or a missing or corrupt DLL.

Fields

Name	Description
`ProviderName`	—
`ProviderDLL`	—
`ErrorCode`	—
`LoadPhase`	—

Event ID 1001 — A Windows Storage Provider was loaded successfully.

Provider: Microsoft-Windows-StorageManagement-WSP-Host
Channel: Operational
Level: 4
Samples: 1

Message

A Windows Storage Provider was loaded successfully.             
Provider: %1             
Provider DLL: %2

Fields

Name	Description
`ProviderName`	—
`ProviderDLL`	—

Example Event

system:
  provider: Microsoft-Windows-StorageManagement-WSP-Host
  guid: 595F33EA-D4AF-4F4D-B4DD-9DACDD17FC6E
  event_source_name: ''
  event_id: 1001
  version: 1
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-10-25T22:49:38.650790+00:00'
  event_record_id: 8
  correlation: {}
  execution:
    process_id: 6420
    thread_id: 6800
  channel: Microsoft-Windows-StorageManagement/Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-20
event_data:
  ProviderName: wsp_health
  ProviderDLL: wsp_health.dll
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1002 — Shutdown has been initiated for the Windows Storage Provider host service.

Provider: Microsoft-Windows-StorageManagement-WSP-Host
Channel: Operational
Level: 4
Samples: 1

Message

Shutdown has been initiated for the Windows Storage Provider host service.

Example Event

system:
  provider: Microsoft-Windows-StorageManagement-WSP-Host
  guid: 595F33EA-D4AF-4F4D-B4DD-9DACDD17FC6E
  event_source_name: ''
  event_id: 1002
  version: 1
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2022-04-07T17:36:56.572612+00:00'
  event_record_id: 35
  correlation: {}
  execution:
    process_id: 5108
    thread_id: 516
  channel: Microsoft-Windows-StorageManagement/Operational
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-20
event_data: {}
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1003 — Shutdown for the Windows Storage Provider host service has been completed.

Provider: Microsoft-Windows-StorageManagement-WSP-Host
Channel: Operational
Level: 4
Samples: 1

Message

Shutdown for the Windows Storage Provider host service has been completed.

Example Event

system:
  provider: Microsoft-Windows-StorageManagement-WSP-Host
  guid: 595F33EA-D4AF-4F4D-B4DD-9DACDD17FC6E
  event_source_name: ''
  event_id: 1003
  version: 1
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2022-04-07T17:36:56.602787+00:00'
  event_record_id: 36
  correlation: {}
  execution:
    process_id: 5108
    thread_id: 516
  channel: Microsoft-Windows-StorageManagement/Operational
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-20
event_data: {}
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline