detection.wiki

Microsoft-Windows-StorPort › Event 512

Event ID 512 — NVMe Health Information Log for Storport Device (Port = PortNumber, Path = PathID, Target = TargetID, Lun = LUN).

Provider
Microsoft-Windows-StorPort
Channel
Health
Level
Informational
Task
Port

Description

NVMe Health Information Log for Storport Device (Port = PortNumber, Path = PathID, Target = TargetID, Lun = LUN).

Message #

NVMe Health Information Log for Storport Device (Port = %1, Path = %2, Target = %3, Lun = %4).                    
Corresponding Class Disk Device Guid is %5.

Fields #

NameDescription
PortNumber UInt32—
PathID UInt8—
TargetID UInt8—
LUN UInt8—
ClassDeviceGuid GUID—
AdapterGuid GUID—
MiniportName UnicodeString—
VendorId AnsiString—
ProductId AnsiString—
SerialNumber UnicodeString—
FirmwareRevision AnsiString—
BootDevice Boolean—
SystemUptime_s UInt64—
CriticalWarning UInt32—
NvmeHealthLogLength UInt32—
NvmeHealthLog Binary—
VendorSpecificLogPageCode UInt8—
VendorSpecificLogPageVersion UInt16—
VendorSpecificLogLength UInt32—
VendorSpecificLog Binary—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorPort",
    "guid": "C4636A1E-7986-4646-BF10-7BC3B4A76E8E",
    "event_source_name": "",
    "event_id": 512,
    "version": 6,
    "level": 4,
    "task": 201,
    "opcode": 0,
    "keywords": 144115188075855936,
    "time_created": "2022-04-07T17:03:35.204438+00:00",
    "event_record_id": 153,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 328
    },
    "channel": "Microsoft-Windows-Storage-Storport/Health",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNumber": 3,
    "PathID": 0,
    "TargetID": 0,
    "LUN": 0,
    "ClassDeviceGuid": "7B6F1752-BD95-6E22-E3A5-6EE8419ECAD7",
    "AdapterGuid": "61E10B57-B69A-11EC-9774-806E6F6E6963",
    "MiniportName": "stornvme",
    "VendorId": "NVMe    ",
    "ProductId": "VMware Virtual N",
    "SerialNumber": "VMWare NVME_0000",
    "FirmwareRevision": "1.0",
    "BootDevice": true,
    "SystemUptime_s": 662,
    "CriticalWarning": 0,
    "NvmeHealthLogLength": 216,
    "NvmeHealthLog": "00002F0164000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000050000000000000000000000000000007017000000000000000000000000000088130000000000000000000000000000050000000000000000000000000000000A0000000000000000000000000000003C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "VendorSpecificLogPageCode": 0,
    "VendorSpecificLogPageVersion": 0,
    "VendorSpecificLogLength": 0,
    "VendorSpecificLog": ""
  },
  "message": ""
}

References #