detection.wiki

Microsoft-Windows-UserDataAccess-Poom

29 events across 1 channel

Event IDTitleChannel
1Error: P1_HResult Location: P2_String Line Number: P3_UInt32.Operational
2Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.Operational
1000Operational
2000ScheduleExternalNotify: CeRunAppAtTime executed, Process: …Operational
2002SetProperty failed for property = Prop_Handle, Flag = Prop_HRESULT, Error = …Operational
2003Validate failed for property = Prop_Handle, Error = Prop_HRESULT.Operational
2008POOM AggregateCache is being rebuilt.Operational
2009POOM AggregateCache is being backed up to file, size is Prop_UInt32 bytes.Operational
2010POOM Store being deleted id = Prop_UInt32.Operational
2011POOM Folder being deleted type = Prop_Handle, store = Prop_HRESULT, id = …Operational
2012CALSTORE setting global object id with size = Prop_Handle, store = Prop_HRESULT, …Operational
2013CALSTORE creating appointment with no GlobjId enumtype = Prop_UInt32.Operational
2014CALSTORE getting global object id with size = Prop_HexInt1, found = Prop_Bool, …Operational
2015Contact Hash value is truncatedOperational
2016Aggregate Get Picture Path, ContactId: P1_UInt32 Path: P2_String PropId: …Operational
2017Contact Set Picture, ContactId: P1_UInt32 Path: P2_String PropId: P3_UInt32 …Operational
2018Contact Set Picture Stream, ContactId: Prop_UInt32 PropId Prop_Hex_UInt32.Operational
2019Fill String prop out of memory, PropId: P1_HexInt New Val: P2_UnicodeString.Operational
2020POOM AggregateCache Get Generation Value Prop_UInt32.Operational
2021POOM AggregateCache Set Generation Value Prop_UInt32.Operational
2022Invalid recurrence type (Prop_UInt32) for Appt (Prop_Hex_UInt32).Operational
5000Critical Section Prop_CriticalSection_Name was held for Prop_TimeHeld …Operational
5001Prop_UInt32: Function Ptr: Prop_Hex_UInt32.Operational
6000Snapshot generation started for: {P1_UInt32.Operational
6001Snapshot generation completed for: {P1_UInt32.Operational
6002Snapshot generation started for: {P1_UInt32.Operational
6003Snapshot generation completed for: {P1_UInt32.Operational
6004Operational
6005Operational

Event ID 1 — Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32—
P2_String AnsiString—
P3_UInt32 UInt32—

Event ID 2 — Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32—
P2_String AnsiString—
P3_UInt32 UInt32—

Event ID 1000 —

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational
Task
Trace

Fields #

NameDescription
Message Pointer—

Event ID 2000 — ScheduleExternalNotify: CeRunAppAtTime executed, Process: Prop_Process_UnicodeString GetLastError: Prop_ErrorCode.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

ScheduleExternalNotify: CeRunAppAtTime executed, Process: Prop_Process_UnicodeString GetLastError: Prop_ErrorCode.

Message #

ScheduleExternalNotify: CeRunAppAtTime executed, Process: %1 GetLastError: %2

Fields #

NameDescription
Prop_Process_UnicodeString UnicodeString—
Prop_ErrorCode UInt32—

Event ID 2002 — SetProperty failed for property = Prop_Handle, Flag = Prop_HRESULT, Error = Prop_UINT.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

SetProperty failed for property = Prop_Handle, Flag = Prop_HRESULT, Error = Prop_UINT.

Message #

SetProperty failed for property = %1, Flag = %2, Error = %3

Fields #

NameDescription
Prop_Handle UInt32—
Prop_HRESULT UInt32—
Prop_UINT UInt32—

Event ID 2003 — Validate failed for property = Prop_Handle, Error = Prop_HRESULT.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Validate failed for property = Prop_Handle, Error = Prop_HRESULT.

Message #

Validate failed for property = %1, Error = %2

Fields #

NameDescription
Prop_Handle UInt32—
Prop_HRESULT UInt32—

Event ID 2008 — POOM AggregateCache is being rebuilt.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

POOM AggregateCache is being rebuilt.

Message #

POOM AggregateCache is being rebuilt.

Event ID 2009 — POOM AggregateCache is being backed up to file, size is Prop_UInt32 bytes.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

POOM AggregateCache is being backed up to file, size is Prop_UInt32 bytes.

Message #

POOM AggregateCache is being backed up to file, size is %1 bytes.

Fields #

NameDescription
Prop_UInt32 UInt32—

Event ID 2010 — POOM Store being deleted id = Prop_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

POOM Store being deleted id = Prop_UInt32.

Message #

POOM Store being deleted id = %1.

Fields #

NameDescription
Prop_UInt32 UInt32—

Event ID 2011 — POOM Folder being deleted type = Prop_Handle, store = Prop_HRESULT, id = Prop_UINT.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

POOM Folder being deleted type = Prop_Handle, store = Prop_HRESULT, id = Prop_UINT.

Message #

POOM Folder being deleted type = %1, store = %2, id = %3.

Fields #

NameDescription
Prop_Handle UInt32—
Prop_HRESULT UInt32—
Prop_UINT UInt32—

Event ID 2012 — CALSTORE setting global object id with size = Prop_Handle, store = Prop_HRESULT, id = Prop_UINT.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

CALSTORE setting global object id with size = Prop_Handle, store = Prop_HRESULT, id = Prop_UINT.

Message #

CALSTORE setting global object id with size = %1, store = %2, id = %3.

Fields #

NameDescription
Prop_Handle UInt32—
Prop_HRESULT UInt32—
Prop_UINT UInt32—

Event ID 2013 — CALSTORE creating appointment with no GlobjId enumtype = Prop_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

CALSTORE creating appointment with no GlobjId enumtype = Prop_UInt32.

Message #

CALSTORE creating appointment with no GlobjId enumtype = %1.

Fields #

NameDescription
Prop_UInt32 UInt32—

Event ID 2014 — CALSTORE getting global object id with size = Prop_HexInt1, found = Prop_Bool, store = Prop_HexInt2, id = Prop_HexInt3.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

CALSTORE getting global object id with size = Prop_HexInt1, found = Prop_Bool, store = Prop_HexInt2, id = Prop_HexInt3.

Message #

CALSTORE getting global object id with size = %1, found = %2, store = %3, id = %4.

Fields #

NameDescription
Prop_HexInt1 HexInt32—
Prop_Bool Boolean—
Prop_HexInt2 HexInt32—
Prop_HexInt3 HexInt32—

Event ID 2015 — Contact Hash value is truncated

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Contact Hash value is truncated.

Message #

Contact Hash value is truncated

Event ID 2016 — Aggregate Get Picture Path, ContactId: P1_UInt32 Path: P2_String PropId: P3_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Aggregate Get Picture Path, ContactId: P1_UInt32 Path: P2_String PropId: P3_UInt32.

Message #

Aggregate Get Picture Path, ContactId: %1 Path: %2 PropId: %3

Fields #

NameDescription
P1_UInt32 UInt32—
P2_String UnicodeString—
P3_UInt32 UInt32—

Event ID 2017 — Contact Set Picture, ContactId: P1_UInt32 Path: P2_String PropId: P3_UInt32 Type: P4_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Contact Set Picture, ContactId: P1_UInt32 Path: P2_String PropId: P3_UInt32 Type: P4_UInt32.

Message #

Contact Set Picture, ContactId: %1 Path: %2 PropId: %3 Type: %4

Fields #

NameDescription
P1_UInt32 UInt32—
P2_String UnicodeString—
P3_UInt32 UInt32—
P4_UInt32 UInt32—

Event ID 2018 — Contact Set Picture Stream, ContactId: Prop_UInt32 PropId Prop_Hex_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Contact Set Picture Stream, ContactId: Prop_UInt32 PropId Prop_Hex_UInt32.

Message #

Contact Set Picture Stream, ContactId: %1 PropId %2

Fields #

NameDescription
Prop_UInt32 UInt32—
Prop_Hex_UInt32 UInt32—

Event ID 2019 — Fill String prop out of memory, PropId: P1_HexInt New Val: P2_UnicodeString.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Fill String prop out of memory, PropId: P1_HexInt New Val: P2_UnicodeString.

Message #

Fill String prop out of memory, PropId: %1 New Val: %2

Fields #

NameDescription
P1_HexInt HexInt32—
P2_UnicodeString UnicodeString—

Event ID 2020 — POOM AggregateCache Get Generation Value Prop_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

POOM AggregateCache Get Generation Value Prop_UInt32.

Message #

POOM AggregateCache Get Generation Value %1

Fields #

NameDescription
Prop_UInt32 UInt32—

Event ID 2021 — POOM AggregateCache Set Generation Value Prop_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

POOM AggregateCache Set Generation Value Prop_UInt32.

Message #

POOM AggregateCache Set Generation Value %1

Fields #

NameDescription
Prop_UInt32 UInt32—

Event ID 2022 — Invalid recurrence type (Prop_UInt32) for Appt (Prop_Hex_UInt32).

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Invalid recurrence type (Prop_UInt32) for Appt (Prop_Hex_UInt32).

Message #

Invalid recurrence type (%1) for Appt (%2)

Fields #

NameDescription
Prop_UInt32 UInt32—
Prop_Hex_UInt32 UInt32—

Event ID 5000 — Critical Section Prop_CriticalSection_Name was held for Prop_TimeHeld milliseconds.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Critical Section Prop_CriticalSection_Name was held for Prop_TimeHeld milliseconds. Release Function: Prop_ReleaseFunction.

Message #

Critical Section %1 was held for %2 milliseconds. Release Function: %3

Fields #

NameDescription
Prop_CriticalSection_Name UnicodeString—
Prop_TimeHeld UInt64—
Prop_ReleaseFunction UInt32—

Event ID 5001 — Prop_UInt32: Function Ptr: Prop_Hex_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational

Description

Prop_UInt32: Function Ptr: Prop_Hex_UInt32.

Message #

%1: Function Ptr: %2

Fields #

NameDescription
Prop_UInt32 UInt32—
Prop_Hex_UInt32 UInt32—

Event ID 6000 — Snapshot generation started for: {P1_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational
Task
SODA_ActivitySnapshot
Opcode
Start

Description

Snapshot generation started for: {P1_UInt32.P2_UInt32.P3_UInt32}.

Message #

Snapshot generation started for: {%1.%2.%3}

Fields #

NameDescription
P1_UInt32 UInt32—
P2_UInt32 UInt32—
P3_UInt32 UInt32—

Event ID 6001 — Snapshot generation completed for: {P1_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational
Task
SODA_ActivitySnapshot
Opcode
Stop

Description

Snapshot generation completed for: {P1_UInt32.P2_UInt32.P3_UInt32}.

Message #

Snapshot generation completed for: {%1.%2.%3}

Fields #

NameDescription
P1_UInt32 UInt32—
P2_UInt32 UInt32—
P3_UInt32 UInt32—

Event ID 6002 — Snapshot generation started for: {P1_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational
Task
SODA_ActivitySnapshot_AggregateFeed
Opcode
Start

Description

Snapshot generation started for: {P1_UInt32.P2_UInt32.P3_UInt32}.

Message #

Snapshot generation started for: {%1.%2.%3}

Fields #

NameDescription
P1_UInt32 UInt32—
P2_UInt32 UInt32—
P3_UInt32 UInt32—

Event ID 6003 — Snapshot generation completed for: {P1_UInt32.

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational
Task
SODA_ActivitySnapshot_AggregateFeed
Opcode
Stop

Description

Snapshot generation completed for: {P1_UInt32.P2_UInt32.P3_UInt32}.

Message #

Snapshot generation completed for: {%1.%2.%3}

Fields #

NameDescription
P1_UInt32 UInt32—
P2_UInt32 UInt32—
P3_UInt32 UInt32—

Event ID 6004 —

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational
Task
SODA_ActivitySnapshot_MergeFeed
Opcode
Start

Event ID 6005 —

Provider
Microsoft-Windows-UserDataAccess-Poom
Channel
Operational
Task
SODA_ActivitySnapshot_MergeFeed
Opcode
Stop