detection.wiki

Microsoft-Windows-StorageSpaces-Parser

11 events across 2 channels

Event IDTitleChannel
100Space attached.Operational
101Space attach Failed.Operational
102Space paused.Operational
103Space resumed.Operational
104Space detached.Operational
105Space resume Failed.Operational
200Operation Operation Pool PoolId, Space SpaceId, Function:Function, Line:Line, …Operational
201Operation Operation failed.Operational
202Command Cdb for Pool PoolId Space SpaceId failed.Operational
203Command Cdb for Pool PoolId Space SpaceId failed.Diagnostic
204Space attach Failed.Operational

Event ID 100 — Space attached.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Space attached. Pool PoolId, Space SpaceId, Return Code: Status.

Message #

Space attached. Pool %1, Space %2, Return Code: %3

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Status UInt32— NTSTATUS reference

Event ID 101 — Space attach Failed.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Space attach Failed. Pool PoolId, Space SpaceId, Function:Function, Line:Line, Return Code: Status.

Message #

Space attach Failed. Pool %1, Space %2, Function:%3, Line:%4, Return Code: %5

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Function AnsiString—
Line UInt32—
Status UInt32— NTSTATUS reference

Event ID 102 — Space paused.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Space paused. Pool PoolId, Space SpaceId, Return Code: Status.

Message #

Space paused. Pool %1, Space %2, Return Code: %3

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Status UInt32— NTSTATUS reference

Event ID 103 — Space resumed.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Space resumed. Pool PoolId, Space SpaceId, Return Code: Status.

Message #

Space resumed. Pool %1, Space %2, Return Code: %3

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Status UInt32— NTSTATUS reference

Event ID 104 — Space detached.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Space detached. Pool PoolId, Space SpaceId, Return Code: Status.

Message #

Space detached. Pool %1, Space %2, Return Code: %3

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Status UInt32— NTSTATUS reference

Event ID 105 — Space resume Failed.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Space resume Failed. Pool PoolId, Space SpaceId, Function:Function, Line:Line, Return Code: Status.

Message #

Space resume Failed. Pool %1, Space %2, Function:%3, Line:%4, Return Code: %5

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Function AnsiString—
Line UInt32—
Status UInt32— NTSTATUS reference

Event ID 200 — Operation Operation Pool PoolId, Space SpaceId, Function:Function, Line:Line, Return Code: Status.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Operation Operation Pool PoolId, Space SpaceId, Function:Function, Line:Line, Return Code: Status.

Message #

Operation %3 Pool %1, Space %2, Function:%4, Line:%5, Return Code: %6

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Operation AnsiString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
Function AnsiString—
Line UInt32—
Status UInt32— NTSTATUS reference

Event ID 201 — Operation Operation failed.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Operation Operation failed. Pool PoolId, Space SpaceId, Function:Function, Line:Line, Return Code: Status.

Message #

Operation %3 failed. Pool %1, Space %2, Function:%4, Line:%5, Return Code: %6

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Operation AnsiString—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
Function AnsiString—
Line UInt32—
Status UInt32— NTSTATUS reference

Event ID 202 — Command Cdb for Pool PoolId Space SpaceId failed.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Command Cdb for Pool PoolId Space SpaceId failed. Function:Function, Line:Line, Return Code: Status.

Message #

Command %3 for Pool %1 Space %2 failed. Function:%4, Line:%5, Return Code: %6

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Cdb UInt8—
Function AnsiString—
Line UInt32—
Status UInt32— NTSTATUS reference

Event ID 203 — Command Cdb for Pool PoolId Space SpaceId failed.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Diagnostic

Description

Command Cdb for Pool PoolId Space SpaceId failed. Function:Function, Line:Line, Return Code: Status.

Message #

Command %3 for Pool %1 Space %2 failed. Function:%4, Line:%5, Return Code: %6

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Cdb UInt8—
Function AnsiString—
Line UInt32—
Status UInt32— NTSTATUS reference

Event ID 204 — Space attach Failed.

Provider
Microsoft-Windows-StorageSpaces-Parser
Channel
Operational

Description

Space attach Failed. Pool PoolId, Space SpaceId, Function:Function, Line:Line, Return Code: Status.

Message #

Space attach Failed. Pool %1, Space %2, Function:%3, Line:%4, Return Code: %5

Fields #

NameDescription
PoolId GUID—
SpaceId GUID—
Function AnsiString—
Line UInt32—
Status UInt32— NTSTATUS reference