Microsoft-Windows-StorDiag
58 events across 4 channels
Event ID 1 — ClassPnP IO request complete
Event ID 2 — ClassPnP Enqueue Idle IO request
Event ID 3 — ClassPnP Boost Idle IO request
Event ID 4 — CopyOffload request servicing time taken by lower driver stack(s).
Event ID 5 — Dispatching a CopyOffload read request.
Event ID 6 — Dispatching a CopyOffload write request.
Event ID 7 — Completing a CopyOffload IO (read/write) request.
Event ID 8 — Device returned sense data.
Event ID 201 — Request servicing time taken by lower driver stack(s).
Event ID 202 — Dispatching a read request.
Event ID 203 — Dispatching a write request.
Event ID 204 — Dispatching a read request.
Event ID 205 — Dispatching a write request.
Event ID 206 — Dispatching a read request.
Event ID 207 — Dispatching a write request.
Event ID 208 — Completing an IO (read/write) request.
Event ID 209 — Retrying an IO (read/write) request.
Event ID 210 — Flush request.
Event ID 211 — Flush request.
Event ID 212 — Dispatching an IOCTL.
Event ID 213 — Dispatching a WMI request.
Event ID 214 — Completing a non-read/write request.
Description
Completing a non-read/write request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceNumber UInt32 | — |
Irp Pointer | — |
Status HexInt32 | — NTSTATUS reference |
Event ID 215 — Dispatching a power request.
Event ID 216 — Completing a power request.
Description
Completing a power request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceNumber UInt32 | — |
Irp Pointer | — |
Status HexInt32 | — NTSTATUS reference |
Event ID 217 — Dispatching a PnP request.
Event ID 218 — Completing a PnP request.
Description
Completing a PnP request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceNumber UInt32 | — |
Irp Pointer | — |
Status HexInt32 | — NTSTATUS reference |
Event ID 219 — Completing a PnP enumeration request.
Description
Completing a PnP enumeration request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceNumber UInt32 | — |
Irp Pointer | — |
NumberOfChildren UInt32 | — |
Status HexInt32 | — NTSTATUS reference |
Event ID 220 — Performing a queue-related operation.
Description
Performing a queue-related operation.
Message #
Fields #
| Name | Description |
|---|---|
DeviceNumber UInt32 | — |
QueueTag HexInt32 | — |
Operation UInt8 | — Known values
|
Status HexInt32 | — NTSTATUS reference |
Event ID 221 — Dispatching a PassThrough request.
Event ID 222 — Upperlevel Trim request servicing time.
Event ID 223 — Downlevel Unmap SRB request servicing time taken by lower driver stack(s)
Description
Downlevel Unmap SRB request servicing time taken by lower driver stack(s).
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
RequestDurationin100ns UInt64 | — |
OriginalIrp Pointer | — |
SrbStatus UInt8 | — |
SrbFlags HexInt32 | — |
MaxAllowedLbaCount UInt64 | — |
MaxAllowedBlockDescriptorCount UInt64 | — |
LbaSizeinBytes UInt32 | — |
Srb_BlockDescriptorCount UInt32 | — |
Srb_BlockDescriptors Float | — |
Event ID 224 — Report Zone Latency
Event ID 225 — Reset Write Pointer Latency
Event ID 226 — Completing a failed IOCTL request.
Event ID 500 — Completing a failed upper level read request.
Description
Completing a failed upper level read request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
IrpStatus HexInt32 | — |
LBA HexInt64 | — |
TransferByteCount UInt64 | — |
NvCachePriority UInt8 | — |
PagingPriority UInt32 | — |
Event ID 501 — Completing a failed upper level write request.
Description
Completing a failed upper level write request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
IrpStatus HexInt32 | — |
LBA HexInt64 | — |
TransferByteCount UInt64 | — |
NvCachePriority UInt8 | — |
PagingPriority UInt32 | — |
Event ID 502 — Completing a failed upper level paging read request.
Description
Completing a failed upper level paging read request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
IrpStatus HexInt32 | — |
LBA HexInt64 | — |
TransferByteCount UInt64 | — |
NvCachePriority UInt8 | — |
PagingPriority UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-StorDiag",
"guid": "F5D05B38-80A6-4653-825D-C414E4AB3C68",
"event_source_name": "",
"event_id": 502,
"version": 1,
"level": 2,
"task": 200,
"opcode": 101,
"keywords": 576460752313909248,
"time_created": "2026-03-13T20:08:10.726401+00:00",
"event_record_id": 2,
"correlation": {},
"execution": {
"process_id": 3952,
"thread_id": 5384
},
"channel": "Microsoft-Windows-Storage-ClassPnP/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"DeviceGUID": "96B63F5A-0716-1FE9-02F0-284D47E6F444",
"DeviceNumber": 1,
"Vendor": "Msft ",
"Model": "Virtual Disk ",
"FirmwareVersion": "1.0 ",
"SerialNumber": "NULL",
"IrpStatus": "0xc000000e",
"LBA": "0x40800",
"TransferByteCount": 4096,
"NvCachePriority": 255,
"PagingPriority": 1
},
"message": ""
}
Event ID 503 — Completing a failed upper level paging write request.
Description
Completing a failed upper level paging write request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
IrpStatus HexInt32 | — |
LBA HexInt64 | — |
TransferByteCount UInt64 | — |
NvCachePriority UInt8 | — |
PagingPriority UInt32 | — |
Event ID 504 — Completing a failed IOCTL request.
Event ID 505 — Completing a failed Read SCSI SRB request
Description
Completing a failed Read SCSI SRB request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
DownLevelIrpStatus HexInt32 | — |
SrbStatus UInt8 | — |
ScsiStatus UInt8 | — |
SenseKey UInt8 | — |
AdditionalSenseCode UInt8 | — |
AdditionalSenseCodeQualifier UInt8 | — |
CdbByteCount UInt32 | — |
CdbBytes Binary | — |
NumberOfRetriesDone UInt8 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-StorDiag",
"guid": "F5D05B38-80A6-4653-825D-C414E4AB3C68",
"event_source_name": "",
"event_id": 505,
"version": 1,
"level": 2,
"task": 200,
"opcode": 101,
"keywords": 576460752347463680,
"time_created": "2026-03-13T20:08:10.726385+00:00",
"event_record_id": 1,
"correlation": {
"ActivityID": "03A00006-0001-0000-6096-45970B92FFFF"
},
"execution": {
"process_id": 3952,
"thread_id": 5384
},
"channel": "Microsoft-Windows-Storage-ClassPnP/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"DeviceGUID": "96B63F5A-0716-1FE9-02F0-284D47E6F444",
"DeviceNumber": 1,
"Vendor": "Msft ",
"Model": "Virtual Disk ",
"FirmwareVersion": "1.0 ",
"SerialNumber": "NULL",
"DownLevelIrpStatus": "0xc000000e",
"SrbStatus": 8,
"ScsiStatus": 2,
"SenseKey": 0,
"AdditionalSenseCode": 0,
"AdditionalSenseCodeQualifier": 0,
"CdbByteCount": 16,
"CdbBytes": "88000000000000040800000000080000",
"NumberOfRetriesDone": 0
},
"message": ""
}
Event ID 506 — Completing a failed Write SCSI SRB request
Description
Completing a failed Write SCSI SRB request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
DownLevelIrpStatus HexInt32 | — |
SrbStatus UInt8 | — |
ScsiStatus UInt8 | — |
SenseKey UInt8 | — |
AdditionalSenseCode UInt8 | — |
AdditionalSenseCodeQualifier UInt8 | — |
CdbByteCount UInt32 | — |
CdbBytes Binary | — |
NumberOfRetriesDone UInt8 | — |
Event ID 507 — Completing a failed non-ReadWrite SCSI SRB request
#Description
Completing a failed non-ReadWrite SCSI SRB request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
DownLevelIrpStatus HexInt32 | — |
SrbStatus UInt8 | — |
ScsiStatus UInt8 | — |
SenseKey UInt8 | — |
AdditionalSenseCode UInt8 | — |
AdditionalSenseCodeQualifier UInt8 | — |
CdbByteCount UInt32 | — |
CdbBytes Binary | — |
NumberOfRetriesDone UInt8 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-StorDiag",
"guid": "F5D05B38-80A6-4653-825D-C414E4AB3C68",
"event_source_name": "",
"event_id": 507,
"version": 1,
"level": 2,
"task": 200,
"opcode": 101,
"keywords": 576460752437641216,
"time_created": "2022-04-07T17:41:19.261973+00:00",
"event_record_id": 10,
"correlation": {
"ActivityID": "00000000-0000-0000-0000-000000000001"
},
"execution": {
"process_id": 4,
"thread_id": 32
},
"channel": "Microsoft-Windows-Storage-ClassPnP/Operational",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"DeviceGUID": "E9A1B7AB-024C-F6F4-5089-48CC840C29D0",
"DeviceNumber": 1,
"Vendor": "VendorCo",
"Model": "ProductCode",
"FirmwareVersion": "2.00",
"SerialNumber": "9207032533193411390",
"DownLevelIrpStatus": "0xc000000d",
"SrbStatus": 132,
"ScsiStatus": 2,
"SenseKey": 5,
"AdditionalSenseCode": 32,
"AdditionalSenseCodeQualifier": 0,
"CdbByteCount": 16,
"CdbBytes": "9E100000000000000000000000200000",
"NumberOfRetriesDone": 0
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 508 — Completing a failed Non-SCSI SRB request
Description
Completing a failed Non-SCSI SRB request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
DownLevelIrpStatus HexInt32 | — |
SrbStatus UInt8 | — |
SrbFunction HexInt32 | — |
SrbFlags HexInt32 | — |
NumberOfRetriesDone UInt8 | — |
Event ID 509 — Completing a failed PNP request.
Description
Completing a failed PNP request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
IrpStatus HexInt32 | — |
IrpMinorFunction UInt8 | — |
PnPType UInt32 | — |
PnPUsageInPath Boolean | — |
CurrentPnpState UInt32 | — |
PreviousPnpState UInt32 | — |
PagingPathUsageCount UInt32 | — |
HibernationPathUsageCount UInt32 | — |
DumpPathUsageCount UInt32 | — |
Event ID 510 — Completing a failed Power request.
Description
Completing a failed Power request.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
IrpStatus HexInt32 | — |
IrpMinorFunction UInt8 | — |
PowerSystemContext UInt32 | — |
PowerStateType UInt32 | — |
PowerState UInt32 | — |
PowerShutdownType UInt32 | — |
CurrentPowerState UInt32 | — |
ContextPowerChangeState UInt32 | — |
Event ID 511 — Completing a failed WMI request
Event ID 512 — Get Storage Firmware Information
Description
Get Storage Firmware Information.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
Status HexInt32 | — NTSTATUS reference |
InputBufferLength UInt32 | — |
OutputBufferLength UInt32 | — |
DeviceNumber UInt32 | — |
PortDriverCodeSet UInt32 | — |
FirmwareGetInfoSupport UInt32 | — |
QueryFlag UInt32 | — |
Event ID 513 — Download Storage Firmware
Description
Download Storage Firmware.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
Status HexInt32 | — NTSTATUS reference |
InputBufferLength UInt32 | — |
DeviceNumber UInt32 | — |
PortDriverCodeSet UInt32 | — |
FirmwareGetInfoSupport UInt32 | — |
HWFirmwareSupportUpgrade UInt8 | — |
ImagePayloadAlignment UInt32 | — |
SlotCount UInt8 | — |
SlotIndex UInt32 | — |
FWImageVersion UInt32 | — |
FWSize UInt32 | — |
FWSlot UInt8 | — |
FWImageBufferSize UInt64 | — |
Flags UInt32 | — |
FWImageOffset UInt64 | — |
Event ID 514 — Activate New Storage Firmware
Description
Activate New Storage Firmware.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
Status HexInt32 | — NTSTATUS reference |
InputBufferLength UInt32 | — |
DeviceNumber UInt32 | — |
PortDriverCodeSet UInt32 | — |
FirmwareGetInfoSupport UInt32 | — |
HWFirmwareSupportUpgrade UInt8 | — |
SlotCount UInt8 | — |
SlotIndex UInt32 | — |
FWImageVersion UInt32 | — |
FWSize UInt32 | — |
FWSlot UInt8 | — |
Flags UInt32 | — |
Event ID 515 — Query Device Telemetry
Description
Query Device Telemetry.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
T10VendorIdLength UInt32 | — |
T10VendorId Binary | — |
DataSet1Length UInt32 | — |
DataSet2Length UInt32 | — |
DataSet3Length UInt32 | — |
DataSet4Length UInt32 | — |
DataVersion UInt8 | — |
ReasonIdentifierLength UInt32 | — |
ReasonIdentifier Binary | — |
Event ID 516 — Failed to process zone command asynchronously
Event ID 517 — Read capacity failed with SMR device
Event ID 518 — Zone count mismatch
Event ID 519 — Retrieve zone information failed
Event ID 520 — Query Command Duration Limit support and its Mode Page
Event ID 521 — Query Command Duration Limit Mode Page failed
Description
Query Command Duration Limit Mode Page failed.
Message #
Fields #
| Name | Description |
|---|---|
DeviceGUID GUID | — |
DeviceNumber UInt32 | — |
Vendor AnsiString | — |
Model AnsiString | — |
FirmwareVersion AnsiString | — |
SerialNumber AnsiString | — |
NTStatus HexInt32 | — |
CDLSupported Boolean | — |
PageSavable Boolean | — |
T2CDLPage UInt8 | — |
CDLPage UInt8 | — |