IIS: WWW Global
29 events across 1 channel
Event ID 10: W3ShutdownProcessMode
#Fields #
| Name | Description |
|---|---|
CommandLineArgs mof:String | |
IIS5CompatMode mof:Boolean | |
UserName mof:String | |
ProcessAffinityMask mof:UInt32 |
Event ID 11: W3ShutdownW3serverShutdownStart
#Event ID 12: W3ShutdownW3serverShutdownEnd
#Event ID 15: W3StartupMetabaseStart
#Event ID 16: W3StartupMblistenerStart
#Event ID 17: W3StartupW3siteStart
#Event ID 18: W3StartupUlatqStart
#Event ID 19: W3StartupGlobalFilterStart
#Event ID 20: W3StartupSiteListStart
#Event ID 21: W3StartupCacheStart
#Event ID 22: W3StartupW3connectionStart
#Event ID 23: W3StartupW3contextStart
#Event ID 24: W3StartupW3requestStart
#Event ID 25: W3StartupW3responseStart
#Event ID 26: W3StartupServerVariableStart
#Event ID 27: W3StartupMimeMapStart
#Event ID 28: W3StartupLoggingStart
#Event ID 29: W3StartupRawConnectionStart
#Event ID 30: W3StartupCertificateStart
#Event ID 31: W3StartupISAPIRestrictionListStart
#Event ID 32: W3StartupCGIRestrictionListStart
#Event ID 33: W3StartupCompressionStart
#Event ID 34: W3StartupW3serverEnd
#Event ID 35: W3StartupW3serverInitError
#Fields #
| Name | Description |
|---|---|
InitStatus mof:UInt32 | |
ErrorCode mof:UInt32 |
Event ID 37: W3StartupFilterLoadEnd
#Fields #
| Name | Description |
|---|---|
FilterName mof:String | |
ErrorCode mof:UInt32 |
Event ID 38: W3StartupUlatqStartListening
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID {D55D3BC9-CBA9-44DF-827E-132D3A4596C2}
Observed on:
- WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26
Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.
- WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02
MOF class: IIS_Global_Trace