mrcbt

63 events across 1 channel

Event ID	Title	Channel
1	Driver Loaded %1.	Unknown
2	Driver Unloaded	Unknown
3	The $LogFile restart count has changed on device %1.	Unknown
4	Successfully attached to device %1.	Unknown
5	Device has been stopped (IRP_MN_STOP_DEVICE)	Unknown
6	Device has been removed (IRP_MN_REMOVE_DEVICE)	Unknown
7	Device has been surprise removed (IRP_MN_SURPRISE_REMOVAL)	Unknown
8	Tracking has been enabled on device %1.	Unknown
9	Tracking has been disabled on device %1.	Unknown
10	MRCBT has detected that Raxco Perfectdisk DefragFs has been scheduled to perform …	Unknown
11	Failed to enable tracking on device %1.	Unknown
12	IRP_MJ_SHUTDOWN received on device %1.	Unknown
13	IOCTL_MRCBT_QUERY_VOLUME_TRACKING_INFORMATION failed on device %1 with status …	Unknown
14	Invalidating boot sector on device %1.	Unknown
15	The NTFS $LogFile has been reset.	Unknown
16	Failed to allocate file buffer with size %2 for device %1.	Unknown
17	Reading boot sector on device %1.	Unknown
18	The file-system on device is not supported	Unknown
19	The volume is offline	Unknown
20	The file-system on device is locked	Unknown
21	Failed to create log file with status %1.	Unknown
1000	Received GUID_TARGET_DEVICE_REMOVE_COMPLETE for device %1 with ReferenceCount …	Unknown
1001	Received GUID_IO_VOLUME_MOUNT for device %1.	Unknown
1002	Received GUID_IO_VOLUME_DISMOUNT for device %1.	Unknown
1003	Received GUID_IO_VOLUME_PHYSICAL_CONFIGURATION_CHANGE for device %1.	Unknown
1004	Failed to initialize the tracking file on device %1.	Unknown
1005	PlugPlay notification has been registered for device %1 with ReferenceCount %2.	Unknown
1006	PlugPlay notification has been unregistered for device %1 with ReferenceCount …	Unknown
1007	Received GUID_IO_VOLUME_LOCK_FAILED for device %1.	Unknown
1008	Received GUID_IO_VOLUME_UNLOCK for device %1.	Unknown
1009	Received GUID_TARGET_DEVICE_REMOVE_CANCELLED for device %1.	Unknown
1010	Received GUID_TARGET_DEVICE_QUERY_REMOVE for device %1.	Unknown
1011	Received GUID_IO_VOLUME_LOCK for device %1.	Unknown
1012	Received GUID_IO_VOLUME_FVE_STATUS_CHANGE for device %1.	Unknown
1013	IRP_MJ_READ failed on device with status	Unknown
1014	IRP_MJ_WRITE failed on device %1 with status %2.	Unknown
1015	Received GUID_IO_VOLUME_SIZE_CHANGE for device %1.	Unknown
1016	Received GUID_IO_VOLUME_DISMOUNT_FAILED for device %1.	Unknown
1017	Received GUID_IO_VOLUME_NEED_CHKDSK for device %1.	Unknown
2001	Failed to open an existing tracking file on device %1 with status %2.	Unknown
2002	Failed to protect the tracking file on device %1 with status %2.	Unknown
2003	Failed to get retrieval pointers for the tracking file on device %1 with status …	Unknown
2004	The tracking file on device is corrupt	Unknown
2005	Failed to create the tracking file on device %1 with status %2.	Unknown
2006	Failed to write to the tracking file on device %1 with status %2.	Unknown
2007	The checksum for the tracking file on device %1 is incorrect.	Unknown
2008	The previous session did not finalize the tracking file on device %1.	Unknown
2009	Failed to reopen an existing tracking file on device %1 with status %2.	Unknown
3001	Received IRP_MN_SET_POWER with type of SystemPowerState and SystemState %2 for …	Unknown
3002	Received IRP_MN_SET_POWER with type of DevicePowerState and DeviceState %2 for …	Unknown
3003	Received IRP_MN_QUERY_POWER with type of SystemPowerState and SystemState %2 for …	Unknown
3004	Received IRP_MN_QUERY_POWER with type of DevicePowerState and DeviceState %2 for …	Unknown
4004	Received IRP_MJ_WRITE request at DISPATCH_LEVEL for device %1.	Unknown
5001	An error was encountered while processing the Ntfs system metadata on line %1.	Unknown
5002	The size of the $LogFile on device %1 is %2 bytes with %3 fragments.	Unknown
5003	Failed to read the $LogFile metadata for device %1.	Unknown
5004	Failed to read bytes from device with status	Unknown
5006	MappingPairsLength=.	Unknown
5007	CurrentLcn=, CurrentVcn=, LcnBytes=, VcnBytes	Unknown
5008	Detected Windows Sandbox Virtual Disk (%1).	Unknown
5009	Detected Windows Xvdd Virtual Disk (%1).	Unknown
6001	Detected ReFS version. boot sector sector on device	Unknown
6002	Found ReFS SuperBlock on device %1.	Unknown

Event ID 1 — Driver Loaded %1.

Provider: mrcbt
Channel: Unknown

Message

Driver Loaded %1

Fields

Name	Description
`version`	—

Event ID 2 — Driver Unloaded

Provider: mrcbt
Channel: Unknown

Message

Driver Unloaded

Event ID 3 — The $LogFile restart count has changed on device %1.

Provider: mrcbt
Channel: Unknown

Message

The $LogFile restart count has changed on device %1

Fields

Name	Description
`DeviceName`	—

Event ID 4 — Successfully attached to device %1.

Provider: mrcbt
Channel: Unknown

Message

Successfully attached to device %1

Fields

Name	Description
`DeviceName`	—

Event ID 5 — Device has been stopped (IRP_MN_STOP_DEVICE)

Provider: mrcbt
Channel: Unknown

Message

Device %1 has been stopped (IRP_MN_STOP_DEVICE)

Fields

Name	Description
`DeviceName`	—

Event ID 6 — Device has been removed (IRP_MN_REMOVE_DEVICE)

Provider: mrcbt
Channel: Unknown

Message

Device %1 has been removed (IRP_MN_REMOVE_DEVICE)

Fields

Name	Description
`DeviceName`	—

Event ID 7 — Device has been surprise removed (IRP_MN_SURPRISE_REMOVAL)

Provider: mrcbt
Channel: Unknown

Message

Device %1 has been surprise removed (IRP_MN_SURPRISE_REMOVAL)

Fields

Name	Description
`DeviceName`	—

Event ID 8 — Tracking has been enabled on device %1.

Provider: mrcbt
Channel: Unknown

Message

Tracking has been enabled on device %1

Fields

Name	Description
`DeviceName`	—

Event ID 9 — Tracking has been disabled on device %1.

Provider: mrcbt
Channel: Unknown

Message

Tracking has been disabled on device %1

Fields

Name	Description
`DeviceName`	—

Event ID 10 — MRCBT has detected that Raxco Perfectdisk DefragFs has been scheduled to perform a boot-time defrag of one or more volumes.

Provider: mrcbt
Channel: Unknown

Message

MRCBT has detected that Raxco Perfectdisk DefragFs has been scheduled to perform a boot-time defrag of one or more volumes. CBT will not be available until the system is rebooted without a boot-time defrag scheduled.

Event ID 11 — Failed to enable tracking on device %1.

Provider: mrcbt
Channel: Unknown

Message

Failed to enable tracking on device %1

Fields

Name	Description
`DeviceName`	—

Event ID 12 — IRP_MJ_SHUTDOWN received on device %1.

Provider: mrcbt
Channel: Unknown

Message

IRP_MJ_SHUTDOWN received on device %1

Fields

Name	Description
`DeviceName`	—

Event ID 13 — IOCTL_MRCBT_QUERY_VOLUME_TRACKING_INFORMATION failed on device %1 with status %2.

Provider: mrcbt
Channel: Unknown

Message

IOCTL_MRCBT_QUERY_VOLUME_TRACKING_INFORMATION failed on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`Status`	—

Event ID 14 — Invalidating boot sector on device %1.

Provider: mrcbt
Channel: Unknown

Message

Invalidating boot sector on device %1

Fields

Name	Description
`DeviceName`	—

Event ID 15 — The NTFS $LogFile has been reset.

Provider: mrcbt
Channel: Unknown

Message

The NTFS $LogFile has been reset. This is normally caused by the Linux NTFS-3G driver.

Fields

Name	Description
`DeviceName`	—

Event ID 16 — Failed to allocate file buffer with size %2 for device %1.

Provider: mrcbt
Channel: Unknown

Message

Failed to allocate file buffer with size %2 for device %1

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 17 — Reading boot sector on device %1.

Provider: mrcbt
Channel: Unknown

Message

Reading boot sector on device %1

Fields

Name	Description
`DeviceName`	—

Event ID 18 — The file-system on device is not supported

Provider: mrcbt
Channel: Unknown

Message

The file-system on device %1 is not supported

Fields

Name	Description
`DeviceName`	—

Event ID 19 — The volume is offline

Provider: mrcbt
Channel: Unknown

Message

The volume %1 is offline

Fields

Name	Description
`DeviceName`	—

Event ID 20 — The file-system on device is locked

Provider: mrcbt
Channel: Unknown

Message

The file-system on device %1 is locked

Fields

Name	Description
`DeviceName`	—

Event ID 21 — Failed to create log file with status %1.

Provider: mrcbt
Channel: Unknown

Message

Failed to create log file with status %1

Fields

Name	Description
`ErrorCode`	—

Event ID 1000 — Received GUID_TARGET_DEVICE_REMOVE_COMPLETE for device %1 with ReferenceCount %2.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_TARGET_DEVICE_REMOVE_COMPLETE for device %1 with ReferenceCount %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 1001 — Received GUID_IO_VOLUME_MOUNT for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_MOUNT for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1002 — Received GUID_IO_VOLUME_DISMOUNT for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_DISMOUNT for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1003 — Received GUID_IO_VOLUME_PHYSICAL_CONFIGURATION_CHANGE for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_PHYSICAL_CONFIGURATION_CHANGE for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1004 — Failed to initialize the tracking file on device %1.

Provider: mrcbt
Channel: Unknown

Message

Failed to initialize the tracking file on device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1005 — PlugPlay notification has been registered for device %1 with ReferenceCount %2.

Provider: mrcbt
Channel: Unknown

Message

PlugPlay notification has been registered for device %1 with ReferenceCount %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 1006 — PlugPlay notification has been unregistered for device %1 with ReferenceCount %2.

Provider: mrcbt
Channel: Unknown

Message

PlugPlay notification has been unregistered for device %1 with ReferenceCount %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 1007 — Received GUID_IO_VOLUME_LOCK_FAILED for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_LOCK_FAILED for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1008 — Received GUID_IO_VOLUME_UNLOCK for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_UNLOCK for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1009 — Received GUID_TARGET_DEVICE_REMOVE_CANCELLED for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_TARGET_DEVICE_REMOVE_CANCELLED for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1010 — Received GUID_TARGET_DEVICE_QUERY_REMOVE for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_TARGET_DEVICE_QUERY_REMOVE for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1011 — Received GUID_IO_VOLUME_LOCK for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_LOCK for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1012 — Received GUID_IO_VOLUME_FVE_STATUS_CHANGE for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_FVE_STATUS_CHANGE for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1013 — IRP_MJ_READ failed on device with status

Provider: mrcbt
Channel: Unknown

Message

IRP_MJ_READ failed on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 1014 — IRP_MJ_WRITE failed on device %1 with status %2.

Provider: mrcbt
Channel: Unknown

Message

IRP_MJ_WRITE failed on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 1015 — Received GUID_IO_VOLUME_SIZE_CHANGE for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_SIZE_CHANGE for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1016 — Received GUID_IO_VOLUME_DISMOUNT_FAILED for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_DISMOUNT_FAILED for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 1017 — Received GUID_IO_VOLUME_NEED_CHKDSK for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received GUID_IO_VOLUME_NEED_CHKDSK for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 2001 — Failed to open an existing tracking file on device %1 with status %2.

Provider: mrcbt
Channel: Unknown

Message

Failed to open an existing tracking file on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 2002 — Failed to protect the tracking file on device %1 with status %2.

Provider: mrcbt
Channel: Unknown

Message

Failed to protect the tracking file on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 2003 — Failed to get retrieval pointers for the tracking file on device %1 with status %2.

Provider: mrcbt
Channel: Unknown

Message

Failed to get retrieval pointers for the tracking file on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 2004 — The tracking file on device is corrupt

Provider: mrcbt
Channel: Unknown

Message

The tracking file on device %1 is corrupt

Fields

Name	Description
`DeviceName`	—

Event ID 2005 — Failed to create the tracking file on device %1 with status %2.

Provider: mrcbt
Channel: Unknown

Message

Failed to create the tracking file on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`Status`	—

Event ID 2006 — Failed to write to the tracking file on device %1 with status %2.

Provider: mrcbt
Channel: Unknown

Message

Failed to write to the tracking file on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`Status`	—

Event ID 2007 — The checksum for the tracking file on device %1 is incorrect.

Provider: mrcbt
Channel: Unknown

Message

The checksum for the tracking file on device %1 is incorrect. The tracking file has been reset.

Fields

Name	Description
`DeviceName`	—

Event ID 2008 — The previous session did not finalize the tracking file on device %1.

Provider: mrcbt
Channel: Unknown

Message

The previous session did not finalize the tracking file on device %1. The tracking file has been reset.

Fields

Name	Description
`DeviceName`	—

Event ID 2009 — Failed to reopen an existing tracking file on device %1 with status %2.

Provider: mrcbt
Channel: Unknown

Message

Failed to reopen an existing tracking file on device %1 with status %2

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 3001 — Received IRP_MN_SET_POWER with type of SystemPowerState and SystemState %2 for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received IRP_MN_SET_POWER with type of SystemPowerState and SystemState %2 for device %1

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 3002 — Received IRP_MN_SET_POWER with type of DevicePowerState and DeviceState %2 for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received IRP_MN_SET_POWER with type of DevicePowerState and DeviceState %2 for device %1

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 3003 — Received IRP_MN_QUERY_POWER with type of SystemPowerState and SystemState %2 for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received IRP_MN_QUERY_POWER with type of SystemPowerState and SystemState %2 for device %1

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 3004 — Received IRP_MN_QUERY_POWER with type of DevicePowerState and DeviceState %2 for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received IRP_MN_QUERY_POWER with type of DevicePowerState and DeviceState %2 for device %1

Fields

Name	Description
`DeviceName`	—
`ReferenceCount`	—

Event ID 4004 — Received IRP_MJ_WRITE request at DISPATCH_LEVEL for device %1.

Provider: mrcbt
Channel: Unknown

Message

Received IRP_MJ_WRITE request at DISPATCH_LEVEL for device %1. You are receiving this warning because a third-party filter driver has generated an illegitimate request and CBT has been forced to take appropriate steps to avoid generating a system crash. This will not effect the integrity of your backups, but is an indication that you are possibly running faulty third-party software. This message will no longer be displayed for this volume during this session.

Fields

Name	Description
`DeviceName`	—

Event ID 5001 — An error was encountered while processing the Ntfs system metadata on line %1.

Provider: mrcbt
Channel: Unknown

Message

An error was encountered while processing the Ntfs system metadata on line %1. Status %2.

Fields

Name	Description
`SourceLine`	—
`Status`	—

Event ID 5002 — The size of the $LogFile on device %1 is %2 bytes with %3 fragments.

Provider: mrcbt
Channel: Unknown

Message

The size of the $LogFile on device %1 is %2 bytes with %3 fragments

Fields

Name	Description
`DeviceName`	—
`Size`	—
`Fragments`	—

Event ID 5003 — Failed to read the $LogFile metadata for device %1.

Provider: mrcbt
Channel: Unknown

Message

Failed to read the $LogFile metadata for device %1

Fields

Name	Description
`DeviceName`	—

Event ID 5004 — Failed to read bytes from device with status

Provider: mrcbt
Channel: Unknown

Message

Failed to read %1 bytes from device %2 with status %3

Fields

Name	Description
`Length`	—
`DeviceName`	—
`Status`	—

Event ID 5006 — MappingPairsLength=.

Provider: mrcbt
Channel: Unknown

Message

MappingPairsLength=%1

Fields

Name	Description
`Length`	—

Event ID 5007 — CurrentLcn=, CurrentVcn=, LcnBytes=, VcnBytes

Provider: mrcbt
Channel: Unknown

Message

CurrentLcn=%1, CurrentVcn=%2, LcnBytes=%3, VcnBytes=%4

Fields

Name	Description
`CurrentLcn`	—
`CurrentVcn`	—
`LcnBytes`	—
`VcnBytes`	—

Event ID 5008 — Detected Windows Sandbox Virtual Disk (%1).

Provider: mrcbt
Channel: Unknown

Message

Detected Windows Sandbox Virtual Disk (%1). Tracking will not be available on this device.

Fields

Name	Description
`DeviceName`	—

Event ID 5009 — Detected Windows Xvdd Virtual Disk (%1).

Provider: mrcbt
Channel: Unknown

Message

Detected Windows Xvdd Virtual Disk (%1). Tracking will not be available on this device.

Fields

Name	Description
`DeviceName`	—

Event ID 6001 — Detected ReFS version. boot sector sector on device

Provider: mrcbt
Channel: Unknown

Message

Detected ReFS version %1.%2 boot sector sector on device %3

Fields

Name	Description
`MajorVersion`	—
`MinorVersion`	—
`DeviceName`	—

Event ID 6002 — Found ReFS SuperBlock on device %1.

Provider: mrcbt
Channel: Unknown

Message

Found ReFS SuperBlock on device %1

Fields

Name	Description
`DeviceName`	—