Microsoft-Windows-StorageReplica-Cluster

60 events across 3 channels

Event	Title	Channel
500	Event ID 500	Operational
500	Storage Replica service is not installed.	System
501	Event ID 501	Operational
501	Storage Replica resource failed to open Service Control Manager to register for …	System
502	Event ID 502	Operational
502	Storage Replica resource failed to register for service status change …	System
503	Event ID 503	Operational
503	Storage Replica service is not running.	System
504	Event ID 504	Operational
504	Storage Replica cluster resource failed to read configuration from the metadata …	System
505	Event ID 505	Operational
505	Storage Replica cluster resource is unable to detect disk resources connected to …	Admin
506	Event ID 506	Operational
506	Storage Replica cluster resource failed to persist the replication status of …	System
507	Event ID 507	Operational
507	Storage Replica cluster resource failed to update possible owners.	System
508	Event ID 508	Operational
508	Storage Replica cluster resource could not find any replication group that can …	System
509	Event ID 509	Operational
509	Storage Replica cluster resource received a replication status change …	Admin
510	Event ID 510	Operational
510	Storage Replica cluster resource received a member status change notification …	Admin
511	Event ID 511	Operational
511	Storage Replica source cluster resource is not online.	Admin
512	Event ID 512	Operational
512	Storage Replica cluster resource is unable to detect disk resources connected to …	System
513	Event ID 513	Operational
513	Storage Replica cluster resource has detected that the replication group is in …	System
514	Event ID 514	Operational
514	Storage Replica cluster resource has successfully updated possible owners based …	Admin
515	Event ID 515	Operational
515	Source Storage Replica cluster resource has succesfully completed recovery and …	Admin
516	Event ID 516	Operational
516	Storage Replica cluster resource failed to update possible owners.	System
517	Event ID 517	Operational
517	Storage Replica cluster resource failed to update cluster disk unique identifier …	System
518	Event ID 518	Operational
518	Storage Replica cluster resource cannot be brought online as there is a source …	System
519	Event ID 519	Operational
519	Storage Replica cluster resource failed to come online.	System
520	Event ID 520	Operational
520	Storage Replica cluster resource is online.	Admin
521	Event ID 521	Operational
521	Storage Replica service has entered running state.	Admin
522	Event ID 522	Operational
522	Storage Replica cluster resource has detected incorrect resource dependency.	System
523	Event ID 523	Operational
523	Storage Replica cluster resource has detected invalid resource group …	System
524	Event ID 524	Operational
524	Storage Replica cluster resource failed to bring destination resource offline.	System
525	Event ID 525	Operational
525	Storage Replica cluster resource failed to bring destination resource online.	System
526	Event ID 526	Operational
526	Destination replication group is now disabled for automatic failover.	Admin
527	Event ID 527	Operational
527	Destination replication group is now enabled for automatic failover.	Admin
528	Event ID 528	Operational
528	The Network interface is not constrained.	Admin
529	Event ID 529	Operational
529	Storage Replica cluster resource failed to grant permission for replication to a …	Admin

Event ID 500:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica service is not installed.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 500: Storage Replica service is not installed.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica service is not installed.

Message #

Storage Replica service is not installed.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 501:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica resource failed to open Service Control Manager to register for status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 501: Storage Replica resource failed to open Service Control Manager to register for status change notifications.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica resource failed to open Service Control Manager to register for status change notifications.

Message #

Storage Replica resource failed to open Service Control Manager to register for status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 502:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica resource failed to register for service status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 502: Storage Replica resource failed to register for service status change notifications.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica resource failed to register for service status change notifications.

Message #

Storage Replica resource failed to register for service status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 503:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica service is not running.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 503: Storage Replica service is not running.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica service is not running.

Message #

Storage Replica service is not running.

Guidance: The Storage Replica resource can be brought online only when the service is in the running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 504:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to read configuration from the metadata store.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 504: Storage Replica cluster resource failed to read configuration from the metadata store.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to read configuration from the metadata store.

Message #

Storage Replica cluster resource failed to read configuration from the metadata store.

Resource: %1
Status:%5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 505:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource is unable to detect disk resources connected to this node for the source replication group.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 505: Storage Replica cluster resource is unable to detect disk resources connected to this node for the source replication group.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource is unable to detect disk resources connected to this node for the source replication group.

Message #

Storage Replica cluster resource is unable to detect disk resources connected to this node for the source replication group.

Resource: %1

Guidance: An attempt will now be made to choose a synchronous replication group that can take up the source role.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 506:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to persist the replication status of partner replication groups.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 506: Storage Replica cluster resource failed to persist the replication status of partner replication groups.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to persist the replication status of partner replication groups.

Message #

Storage Replica cluster resource failed to persist the replication status of partner replication groups.

Resource: %1
PartnerReplicationGroupId: %5
ReplicationGroupInSync: %6
Status: %7

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 507:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to update possible owners.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 507: Storage Replica cluster resource failed to update possible owners.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to update possible owners.

Message #

Storage Replica cluster resource failed to update possible owners.

Resource: %1
Status:%6
Possible owners: %5

Guidance: This can cause unexpected failover behavior. Resources should have the above possible owners.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 508:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource could not find any replication group that can assume the source role on this cluster node.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 508: Storage Replica cluster resource could not find any replication group that can assume the source role on this cluster node.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource could not find any replication group that can assume the source role on this cluster node.

Message #

Storage Replica cluster resource could not find any replication group that can assume the source role on this cluster node.

Resource: %1

Guidance: Either the replication groups were not in the required synchronous state or some of the cluster disks were not connected to this node. Try moving the resource to a node where the disks are attached.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 509:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource received a replication status change notification for one or more replication groups.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReplicationStatus` UInt32
`PossibleOwnersUpdated` Boolean
`ReplicationStateUpdated` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 509: Storage Replica cluster resource received a replication status change notification for one or more replication groups.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource received a replication status change notification for one or more replication groups.

Message #

Storage Replica cluster resource received a replication status change notification for one or more replication groups.

Resource: %1
Replication status: %5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReplicationStatus` UInt32
`PossibleOwnersUpdated` Boolean
`ReplicationStateUpdated` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 510:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource received a member status change notification for replication group.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReplicaState` UInt32
`PossibleOwnersUpdated` Boolean
`ReplicationStateUpdated` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 510: Storage Replica cluster resource received a member status change notification for replication group.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource received a member status change notification for replication group.

Message #

Storage Replica cluster resource received a member status change notification for replication group.

Resource: %1
Replica state: %5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReplicaState` UInt32
`PossibleOwnersUpdated` Boolean
`ReplicationStateUpdated` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 511:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica source cluster resource is not online.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 511: Storage Replica source cluster resource is not online.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica source cluster resource is not online.

Message #

Storage Replica source cluster resource is not online.

Resource: %1

Guidance: The destination replication groups will periodically attempt to connect to source replication group.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 512:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource is unable to detect disk resources connected to this node for this destination replication group.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 512: Storage Replica cluster resource is unable to detect disk resources connected to this node for this destination replication group.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource is unable to detect disk resources connected to this node for this destination replication group.

Message #

Storage Replica cluster resource is unable to detect disk resources connected to this node for this destination replication group.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 513:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource has detected that the replication group is in suspended state and therefore cannot come online on any node.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 513: Storage Replica cluster resource has detected that the replication group is in suspended state and therefore cannot come online on any node.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource has detected that the replication group is in suspended state and therefore cannot come online on any node.

Message #

Storage Replica cluster resource has detected that the replication group is in suspended state and therefore cannot come online on any node.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 514:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource has successfully updated possible owners based on storage and service availability.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 514: Storage Replica cluster resource has successfully updated possible owners based on storage and service availability.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource has successfully updated possible owners based on storage and service availability.

Message #

Storage Replica cluster resource has successfully updated possible owners based on storage and service availability.

Resource: %1
Possible owners: %5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 515:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Source Storage Replica cluster resource has succesfully completed recovery and has entered ready state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReadConfigurationTimeInMilliSeconds` UInt32
`DeterminePrimaryTimeInMilliSeconds` UInt32
`OfflineSecondaryTimeInMilliSeconds` UInt32
`UpdateDiskConfigTimeInMilliSeconds` UInt32
`OnlineSecondaryTimeInMilliSeconds` UInt32
`CreateDriverConfigTimeInMilliSeconds` UInt32
`ResourceOnlineTimeInMilliSeconds` UInt32
`ReplicaReadyTimeInMilliSeconds` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 515: Source Storage Replica cluster resource has succesfully completed recovery and has entered ready state.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Source Storage Replica cluster resource has succesfully completed recovery and has entered ready state.

Message #

Source Storage Replica cluster resource has succesfully completed recovery and has entered ready state.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReadConfigurationTimeInMilliSeconds` UInt32
`DeterminePrimaryTimeInMilliSeconds` UInt32
`OfflineSecondaryTimeInMilliSeconds` UInt32
`UpdateDiskConfigTimeInMilliSeconds` UInt32
`OnlineSecondaryTimeInMilliSeconds` UInt32
`CreateDriverConfigTimeInMilliSeconds` UInt32
`ResourceOnlineTimeInMilliSeconds` UInt32
`ReplicaReadyTimeInMilliSeconds` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 516:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to update possible owners.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 516: Storage Replica cluster resource failed to update possible owners.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to update possible owners.

Message #

Storage Replica cluster resource failed to update possible owners.

Resource: %1
Status:%6
Possible owners list: %5

Guidance: This can cause unexpected failover behavior. Resource should have the above entries in the possible owners list but does not.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 517:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to update cluster disk unique identifier property. The source resource cannot come online unless this property can be updated successfully.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 517: Storage Replica cluster resource failed to update cluster disk unique identifier property.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to update cluster disk unique identifier property. The source resource cannot come online unless this property can be updated successfully.

Message #

Storage Replica cluster resource failed to update cluster disk unique identifier property. The source resource cannot come online unless this property can be updated successfully.

Resource: %1
Status:%5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 518:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource cannot be brought online as there is a source resource that represents the same replication group as this resource.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 518: Storage Replica cluster resource cannot be brought online as there is a source resource that represents the same replication group as this resource.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource cannot be brought online as there is a source resource that represents the same replication group as this resource.

Message #

Storage Replica cluster resource cannot be brought online as there is a source resource that represents the same replication group as this resource.

Resource: %1
Status:%5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 519:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to come online.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 519: Storage Replica cluster resource failed to come online.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to come online.

Message #

Storage Replica cluster resource failed to come online.

Resource: %1
Status:%5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 520:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource is online.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 520: Storage Replica cluster resource is online.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource is online.

Message #

Storage Replica cluster resource is online.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 521:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica service has entered running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 521: Storage Replica service has entered running state.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica service has entered running state.

Message #

Storage Replica service has entered running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 522:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource has detected incorrect resource dependency.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PDRResourceName` UnicodeString
`DependentResourceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 522: Storage Replica cluster resource has detected incorrect resource dependency.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource has detected incorrect resource dependency.

Message #

Storage Replica cluster resource has detected incorrect resource dependency.

Resource 1: %5
Resource 2: %6

Guidance: The above cluster resource 1 must depend on resource 2, but does not.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PDRResourceName` UnicodeString
`DependentResourceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 523:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource has detected invalid resource group configuration.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PDRResourceName` UnicodeString
`PDRResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 523: Storage Replica cluster resource has detected invalid resource group configuration.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource has detected invalid resource group configuration.

Message #

Storage Replica cluster resource has detected invalid resource group configuration.

Resource: %5
Cluster group: %6

Guidance: The above cluster resource must belong to the above resource group, but does not.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PDRResourceName` UnicodeString
`PDRResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 524:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to bring destination resource offline.

Fields #

Name	Description
`SecondaryResource` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 524: Storage Replica cluster resource failed to bring destination resource offline.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to bring destination resource offline.

Message #

Storage Replica cluster resource failed to bring destination resource offline.

Resource: %1
Status:%2

Fields #

Name	Description
`SecondaryResource` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 525:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to bring destination resource online.

Fields #

Name	Description
`SecondaryResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 525: Storage Replica cluster resource failed to bring destination resource online.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to bring destination resource online.

Message #

Storage Replica cluster resource failed to bring destination resource online.

Resource group: %1
Status:%2

Fields #

Name	Description
`SecondaryResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 526:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Destination replication group is now disabled for automatic failover.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 526: Destination replication group is now disabled for automatic failover.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Destination replication group is now disabled for automatic failover.

Message #

Destination replication group is now disabled for automatic failover.

Resource: %1

Guidance: When the destination replication group achieves synchronous replication state, it will be enabled for automatic failover.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 527:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Destination replication group is now enabled for automatic failover.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 527: Destination replication group is now enabled for automatic failover.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Destination replication group is now enabled for automatic failover.

Message #

Destination replication group is now enabled for automatic failover.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 528:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

The Network interface is not constrained.

Fields #

Name	Description
`ResourceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 528: The Network interface is not constrained.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

The Network interface is not constrained.

Message #

The Network interface is not constrained. 

%Interface: %1
Status:%2

Guidance: An attempt was made to add the network interface to network constraint as it was part of the constrained network. Please make sure the specified network interface is Online in cluster.

Fields #

Name	Description
`ResourceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 529:

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to grant permission for replication to a partner cluster.

Fields #

Name	Description
`ResourceName` UnicodeString
`ClusterName` UnicodeString
`PairedClusterName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 529: Storage Replica cluster resource failed to grant permission for replication to a partner cluster.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource failed to grant permission for replication to a partner cluster.

Message #

Storage Replica cluster resource failed to grant permission for replication to a partner cluster. 

Resource: %1
PairedCluster:%3
Status:%4

Guidance: An attempt was made to pair a cluster account to this cluster's access control list. To resolve, run the following command:

 Grant-SrAccess.

Fields #

Name	Description
`ResourceName` UnicodeString
`ClusterName` UnicodeString
`PairedClusterName` UnicodeString
`Status` UInt32	NTSTATUS reference

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 35a2925c-30a3-43eb-b737-03e9659955e2

Defined in wvrres.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.2849 · captured 2026-06-02

Downloads

Microsoft-Windows-StorageReplica-Cluster registered manifest XML (WS2022-20348.4893) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)