Microsoft-Exchange-DxStoreHA

108 events across 5 channels

Event	Title	Channel	Sample
1	Performance stats for StoreKind (TotalProcessed: TotalCount).	Performance	N
2	Performance stats (cumulative) for StoreKind (TotalProcessed: TotalCount).	Performance	N
3	DxStore variant configuration (Reason: Reason).	Server	N
4	Terminating current process since Distributed store mode changed.	Server	N
201	'ApiName' succeeded (Latency: LatencyInMs μs).	Execution	N
202	'ApiName' failed (Latency: LatencyInMs μs).	Execution	N
203	Api 'ApiName' failed to proceed further since dag configuration was not …	Execution	N
401	Primary changed from InitialPrimary to NewPrimary detected by 'ProcessName'.	General	N
402	Shadow changed from InitialShadow to NewShadow detected by 'ProcessName'.	General	N
403	Failed to publish distributed store perf results.	General	N
1001	[Id] Message.	Server	N
1002	[Id] Message.	Server	N
1003	[Id] Message.	Server	N
2001	Failed to start dxstore instance for group GroupName.	Server	N
2002	Failed to trigger refresh to the dxstore manager.	Server	N
2003	Failed data store validation.	Validation	N
2004	Skipped data store validation.	Validation	N
2005	Completed validation.	Validation	N
2006	Successfuly updated DestinationStore with SourceStore snapshot (Duration: …	Validation	N
2007	Failed to update DestinationStore with SourceStore snapshot (Duration: …	Validation	N
2008	Data Store comparison stats (IsAllMatched: IsEverythingMatches, TotalKeys: …	Validation	N
2009	Data Store comparison verbose report (Part: PartNumber/TotalParts).	Validation	N
2010	Distributed store startup version check satisfied.	General	N
2011	Distributed store startup version check not satisfied.	General	N
2012	Distributed store startup failed with error: ErrorMessage.	Server	N
2013	Distributed store startup failed to register diagnostics handler (Group: …	Server	N
2015	Update to Source store failed.	Server	N
2016	Update to Source store succeeded.	Server	N
2017	Attempt to get database availability group for local server failed.	Server	N
2018	Initiating distributed store switch from 'CurrentConfig' => 'RequestedConfig'.	Server	N
2019	Distributed store switch attempt failed.	Server	N
2020	Distriuted store switch completed successfully.	Server	N
2021	Skipped checking prerequisites due to explicit flag in variant configuration.	Server	N
2022	Skipped distributed store switch processing since Active directory is not …	Server	N
2023	Skipped distributed store switch processing since some of the servers are not …	Server	N
2024	Skipped distributed store switch processing since DAG is not yet fully built or …	Server	N
2025	[Caller] Skipped checking config sync across dag due to explicit flag in variant …	Server	N
2026	[Caller] Dual distributed store AD/Variant configuration is not consistent …	Server	N
2027	Snapshot copy not applicable for the current store switch, hence not proceeding …	Server	N
2028	Copy snapshot from FromStore => ToStore failed.	Server	N
2029	Copy snapshot from FromStore => ToStore succeeded.	Server	N
2030	Attempting do perform full fledged distributed store switch - (Requested config: …	Server	N
2031	Attempting do configuration sync only - (Syncted to config: SyncedTo).	Server	N
2032	Attempt to check for distributed store change failed.	Server	N
2033	Started key swap for open keys in process:'ProcessName' - Initiator: Initiator …	Server	N
2034	Requested to block key operations for process:'ProcessName' - …	Server	N
2035	Finished key swap for open keys in process:'ProcessName' -.	Server	N
2036	Update local distributed store registry configuration initiated from Initiator …	Server	N
2037	Update local distributed store registry configuration failed.	Server	N
2038	Update local distributed store configuration succeeded.	Server	N
2039	Update local distributed store configuration skipped (Previous config: PrevCfg).	Server	N
2040	Skipped distributed store switch processing since a new request to switch is …	Server	N
2041	Process 'Operation' operation for key 'KeyName' cancelled due to dual store …	Server	N
2042	Skipped write test for dual store switch due to explicit flag in variant config …	Server	N
2043	Dual store switch blocked since last test write operation is not completed yet …	Server	N
2044	Dual store switch blocked since test write operation did not succeed.	Server	N
2050	Initiating HA Provider switch.	Server	N
2051	HA Provider switch succeeded.	Server	N
2052	HA Provider switch failed.	Server	N
2053	Attempting HA Provider switch.	Server	N
2054	Distributed store component startup failed to register DxStore manager …	Server	N
2100	Attempt to check for distributed store membership change failed.	Server	N
2101	Skipped distributed store membership check processing since Active directory is …	Server	N
2102	Skipped distributed store membership check processing since some of the servers …	Server	N
2103	Witness Server:WitnessServer reported that membership has not been configured.	Server	N
2104	Witness Server:WitnessServer reported a misconfigured membership.	Server	N
2105	Skipped distributed store membership check on witness WitnessServer due to …	Server	N
2106	Skipped distributed store membership update due to preconditions check failure.	Server	N
2107	Skipped distributed store membership update due to preconditions check failure.	Server	N
2108	Skipped best effort group creation on server Server due to exception : …	Server	N
2109	Failed to deserialize MembershipType membership from AD.	Server	N
2110	Successfully issued staging Paxos update.	Server	N
2111	Successfully stamped membership to AD.	Server	N
2112	Successfully issued the UpdateMembership Paxos command to current quorum.	Server	N
2113	Successfully issued the Create Group command to the DxStore Manager on node …	Server	N
2114	Successfully issued the Create Group command to the DxStore Manager on …	Server	N
2115	DxStore Membership - New Variant Config : NewVariantSettings, Existing Variant …	Server	N
2116	Membership Container Updated.	Server	N
2117	Straggler Connectivity Information updated: Message.	Server	N
2200	[GroupName] Local store integrity check failed as checksums did not match.	Server	N
2201	[GroupName] Local store integrity check skipped as the instance number when the …	Server	N
2202	[Identity] Local store integrity check published for …	Server	N
2203	[GroupName] Local store integrity check publish skipped as the leader doesn't …	Server	N
2204	[Identity] Local store integrity check failed as checksums did not match.	Server	N
2205	[Identity] Local store integrity check skipped as there is no locally recorded …	Server	N
2206	[Identity] Local store integrity check skipped as the requested instance number …	Server	N
3001	[GroupName] There has been no leader consensus since Timestamp.	Server	N
3002	[GroupName] There has been no log progress since Timestamp.	Server	N
3003	[GroupName] The DxStore Instance was restarted by the manager.	Server	N
3004	[GroupName] Group status - Leader: Leader InstanceState: InstanceState …	Server	N
3005	[GroupName] Group status - Leader: Leader InstanceState: InstanceState …	Server	N
3006	[GroupName] Group status - Leader: Leader InstanceState: InstanceState …	Server	N
3007	[GroupName] Node activity matrix.	Server	N
3008	Dual store configuration sync was able to successfuly read from AD first time …	Server	N
3009	[GroupName] There has been membership divergence detected since Timestamp.	Server	N
3010	[GroupName] Instance has requested for wipe edb on next instance start.	Server	N
3011	[GroupName] The DxStore Instance on NodeName has been seeing one way …	Server	N
3012	[GroupName] The following nodes are reporting one way communication failures: …	Server	N
3013	[Identity] Instance number out of sequence (IsRestarting: IsRestarting).	Server	N
3014	Identity: Blocked local node from participating in leader election (Reason: …	Server	N
3015	Identity: Allowed local node to participate in leader election.	Server	N
3016	Identity: Maintenance state check failed.	Server	N
3017	Identity: Percentage of servers in maintenance is PercentServersInMaintenance …	Server	N
3018	Identity: Maintenance state not available.	Server	N
3019	Identity: Blocked paxos message Message (Reason: Reason).	Server	N
3020	Heartbeat write failed with exception - Message.	Server	N
3021	[GroupName] There have been heartbeat write failures since LeaderName recorded a …	Server	N
3026	TypeName in TypeNameSpace are not allowed in DxStore.	Server	N

Event ID 1: Performance stats for StoreKind (TotalProcessed: TotalCount).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Performance

Description

Performance stats for StoreKind (TotalProcessed: TotalCount).

Fields #

Name	Description
`IsPrimary`
`StoreKind`
`TotalCount`
`TotalInProgress`
`TotalWriteRequestsSkipped`
`TotalReadRequestsSkipped`
`TotalFailedStale`
`TotalFailedNotReady`
`TotalFailedConstraint`
`TotalFailedServerTimeout`
`LatencyStats`
`ExceptionStats`
`ApiStats`
`ProcessName`

Event ID 2: Performance stats (cumulative) for StoreKind (TotalProcessed: TotalCount).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Performance

Description

Performance stats (cumulative) for StoreKind (TotalProcessed: TotalCount).

Fields #

Name	Description
`IsPrimary`
`StoreKind`
`TotalCount`
`TotalInProgress`
`TotalWriteRequestsSkipped`
`TotalReadRequestsSkipped`
`TotalFailedStale`
`TotalFailedNotReady`
`TotalFailedConstraint`
`TotalFailedServerTimeout`
`LatencyStats`
`ExceptionStats`
`ApiStats`
`ProcessName`

Event ID 3: DxStore variant configuration (Reason: Reason).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

DxStore variant configuration (Reason: Reason)

Fields #

Name	Description
`Reason`
`ObjectXml`
`Error`
`ProcessName`
`ProcessId`
`ProcessStartTime`

Event ID 4: Terminating current process since Distributed store mode changed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Terminating current process since Distributed store mode changed. (Previous: 'PreviousMode' New: 'NewMode')

Fields #

Name	Description
`PreviousMode`
`NewMode`
`ProcessName`
`ProcessId`
`ProcessStartTime`

Event ID 201: 'ApiName' succeeded (Latency: LatencyInMs μs).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Execution

Description

'ApiName' succeeded (Latency: LatencyInMs μs)

Fields #

Name	Description
`ApiName`
`IsPrimary`
`StoreKind`
`IsSuccess`
`Key`
`OperationType`
`TimeInitiated`
`LatencyInMs`
`Exception`
`IsSkipped`
`Parameters`
`InstanceId`
`Callstack`
`ProcessName`

Event ID 202: 'ApiName' failed (Latency: LatencyInMs μs).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Execution

Description

'ApiName' failed (Latency: LatencyInMs μs)

Fields #

Name	Description
`ApiName`
`IsPrimary`
`StoreKind`
`IsSuccess`
`Key`
`OperationType`
`TimeInitiated`
`LatencyInMs`
`Exception`
`IsSkipped`
`Parameters`
`InstanceId`
`Callstack`
`ProcessName`

Event ID 203: Api 'ApiName' failed to proceed further since dag configuration was not accessbile even once after reboot.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Execution

Description

Api 'ApiName' failed to proceed further since dag configuration was not accessbile even once after reboot

Fields #

Name	Description
`ApiName`
`LastRecordedAccessTime`
`CurrentBootTime`
`CallStack`
`ProcessName`

Event ID 401: Primary changed from InitialPrimary to NewPrimary detected by 'ProcessName'.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Primary changed from InitialPrimary to NewPrimary detected by 'ProcessName'. Exiting process to run as a different primary data store

Fields #

Name	Description
`InitialPrimary`
`InitialShadow`
`NewPrimary`
`NewShadow`
`ProcessName`

Event ID 402: Shadow changed from InitialShadow to NewShadow detected by 'ProcessName'.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Shadow changed from InitialShadow to NewShadow detected by 'ProcessName'

Fields #

Name	Description
`InitialPrimary`
`InitialShadow`
`NewPrimary`
`NewShadow`
`ProcessName`

Event ID 403: Failed to publish distributed store perf results.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Failed to publish distributed store perf results. (Error: Error)

Fields #

Name	Description
`Error`

Event ID 1001: [Id] Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Id] Message

Fields #

Name	Description
`Id`
`Message`

Event ID 1002: [Id] Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Id] Message

Fields #

Name	Description
`Id`
`Message`

Event ID 1003: [Id] Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Id] Message

Fields #

Name	Description
`Id`
`Message`

Event ID 2001: Failed to start dxstore instance for group GroupName.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Failed to start dxstore instance for group GroupName. (Error: Error)

Fields #

Name	Description
`GroupName`
`Error`

Event ID 2002: Failed to trigger refresh to the dxstore manager.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Failed to trigger refresh to the dxstore manager. (Error: Error)

Fields #

Name	Description
`Error`

Event ID 2003: Failed data store validation.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Failed data store validation. (Reason: ReasonLabel)

Fields #

Name	Description
`ReasonLabel`
`ReasonContext`

Event ID 2004: Skipped data store validation.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Skipped data store validation. (Reason: ReasonLabel, Context: ReasonContext)

Fields #

Name	Description
`ReasonLabel`
`ReasonContext`

Event ID 2005: Completed validation.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Completed validation. (IsEverythingMatches: IsEverythingMatched)

Fields #

Name	Description
`IsEverythingMatched`
`TimingData`

Event ID 2006: Successfuly updated DestinationStore with SourceStore snapshot (Duration: Durationms).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Successfuly updated DestinationStore with SourceStore snapshot (Duration: Durationms)

Fields #

Name	Description
`Duration`
`Error`
`SourceStore`
`DestinationStore`

Event ID 2007: Failed to update DestinationStore with SourceStore snapshot (Duration: Durationms).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Failed to update DestinationStore with SourceStore snapshot (Duration: Durationms)

Fields #

Name	Description
`Duration`
`Error`
`SourceStore`
`DestinationStore`

Event ID 2008: Data Store comparison stats (IsAllMatched: IsEverythingMatches, TotalKeys: TotalKeysCount, TotalProperties: TotalPropertiesCount).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Data Store comparison stats (IsAllMatched: IsEverythingMatches, TotalKeys: TotalKeysCount, TotalProperties: TotalPropertiesCount)

Fields #

Name	Description
`IsEverythingMatches`
`TotalKeysCount`
`TotalPropertiesCount`
`TotalClusdbKeysCount`
`TotalClusdbPropertiesCount`
`TotalDxStoreKeysCount`
`TotalDxStorePropertiesCount`
`CountKeysOnlyInClusdb`
`CountKeysOnlyInDxStore`
`CountKeysInClusdbAndDxStoreAndPropertiesMatch`
`CountKeysInClusdbAndDxStoreButPropertiesDifferent`
`CountPropertiesOnlyInClusdb`
`CountPropertiesOnlyInDxStore`
`CountPropertiesSameInClusdbAndDxStore`
`CountPropertiesDifferentInClusdbAndDxStore`

Event ID 2009: Data Store comparison verbose report (Part: PartNumber/TotalParts).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Validation

Description

Data Store comparison verbose report (Part: PartNumber/TotalParts)

Fields #

Name	Description
`PartNumber`
`TotalParts`
`Report`

Event ID 2010: Distributed store startup version check satisfied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Distributed store startup version check satisfied

Fields #

Name	Description
`PersistedVersion`
`LowestVersionInDagServer`
`LowestVersionInDag`
`MinimumRequired`
`Error`

Event ID 2011: Distributed store startup version check not satisfied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: General

Description

Distributed store startup version check not satisfied

Fields #

Name	Description
`PersistedVersion`
`LowestVersionInDagServer`
`LowestVersionInDag`
`MinimumRequired`
`Error`

Event ID 2012: Distributed store startup failed with error: ErrorMessage.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distributed store startup failed with error: ErrorMessage

Fields #

Name	Description
`ErrorMessage`
`Exception`

Event ID 2013: Distributed store startup failed to register diagnostics handler (Group: GroupName).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distributed store startup failed to register diagnostics handler (Group: GroupName)

Fields #

Name	Description
`GroupName`
`Error`

Event ID 2015: Update to Source store failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update to Source store failed. Duration: Elapsed, (Error: ErrorMessage)

Fields #

Name	Description
`Source`
`Elapsed`
`ErrorMessage`

Event ID 2016: Update to Source store succeeded.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update to Source store succeeded. Duration: Elapsed

Fields #

Name	Description
`Source`
`Elapsed`

Event ID 2017: Attempt to get database availability group for local server failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempt to get database availability group for local server failed. (Check for possible exception in event data)

Fields #

Name	Description
`Message`
`StackTrace`

Event ID 2018: Initiating distributed store switch from 'CurrentConfig' => 'RequestedConfig'.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Initiating distributed store switch from 'CurrentConfig' => 'RequestedConfig'

Fields #

Name	Description
`CurrentConfig`
`RequestedConfig`

Event ID 2019: Distributed store switch attempt failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distributed store switch attempt failed. Duration (Elapsed), Error: ErrorMessage

Fields #

Name	Description
`Elapsed`
`ErrorMessage`

Event ID 2020: Distriuted store switch completed successfully.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distriuted store switch completed successfully. Duration: Elapsed

Fields #

Name	Description
`Elapsed`

Event ID 2021: Skipped checking prerequisites due to explicit flag in variant configuration.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped checking prerequisites due to explicit flag in variant configuration

Event ID 2022: Skipped distributed store switch processing since Active directory is not accessible.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store switch processing since Active directory is not accessible

Event ID 2023: Skipped distributed store switch processing since some of the servers are not yet upgraded to the required version.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store switch processing since some of the servers are not yet upgraded to the required version. (Required: 'RequiredVersion')

Fields #

Name	Description
`RequiredVersion`
`FailedServerAndVersions`

Event ID 2024: Skipped distributed store switch processing since DAG is not yet fully built or ready to provision.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store switch processing since DAG is not yet fully built or ready to provision

Event ID 2025: [Caller] Skipped checking config sync across dag due to explicit flag in variant configuration.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Caller] Skipped checking config sync across dag due to explicit flag in variant configuration

Fields #

Name	Description
`Caller`

Event ID 2026: [Caller] Dual distributed store AD/Variant configuration is not consistent across the dag (Possibly due to AD replication delays).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Caller] Dual distributed store AD/Variant configuration is not consistent across the dag (Possibly due to AD replication delays). Operation can not continue until AD/VariantConfig is in sync across the dag and majority servers are reachable to determine that. (Result: ResultXml)

Fields #

Name	Description
`Caller`
`ResultXml`

Event ID 2027: Snapshot copy not applicable for the current store switch, hence not proceeding with copy snapshot.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Snapshot copy not applicable for the current store switch, hence not proceeding with copy snapshot

Event ID 2028: Copy snapshot from FromStore => ToStore failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Copy snapshot from FromStore => ToStore failed. Duration: Elapsed, IsAborting: IsAborting, (Error: ErrorMessage)

Fields #

Name	Description
`FromStore`
`ToStore`
`Elapsed`
`IsAborting`
`ErrorMessage`

Event ID 2029: Copy snapshot from FromStore => ToStore succeeded.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Copy snapshot from FromStore => ToStore succeeded. Duration: Elapsed

Fields #

Name	Description
`FromStore`
`ToStore`
`Elapsed`

Event ID 2030: Attempting do perform full fledged distributed store switch - (Requested config: NewCfg).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempting do perform full fledged distributed store switch - (Requested config: NewCfg)

Fields #

Name	Description
`CfgPack`
`NewCfg`
`PrevCfg`

Event ID 2031: Attempting do configuration sync only - (Syncted to config: SyncedTo).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempting do configuration sync only - (Syncted to config: SyncedTo)

Fields #

Name	Description
`CfgPack`
`SyncedTo`

Event ID 2032: Attempt to check for distributed store change failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempt to check for distributed store change failed. Error: ErrorMessage

Fields #

Name	Description
`ErrorMessage`

Event ID 2033: Started key swap for open keys in process:'ProcessName' - Initiator: Initiator (PrevConfig: PreviousConfig, NewConfig: NewConfig).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Started key swap for open keys in process:'ProcessName' - Initiator: Initiator (PrevConfig: PreviousConfig, NewConfig: NewConfig)

Fields #

Name	Description
`ProcessName`
`Initiator`
`PreviousConfig`
`NewConfig`
`IsCancelPendingWrites`
`IsWritesAlreadyBlocked`

Event ID 2034: Requested to block key operations for process:'ProcessName' - ReadsInProgress:ReadsInProgress, WritesInProgress:WritesInProgress, ShadowInProgress:ShadowInProgress.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Requested to block key operations for process:'ProcessName' - ReadsInProgress:ReadsInProgress, WritesInProgress:WritesInProgress, ShadowInProgress:ShadowInProgress

Fields #

Name	Description
`ProcessName`
`ReadsInProgress`
`WritesInProgress`
`ShadowInProgress`

Event ID 2035: Finished key swap for open keys in process:'ProcessName' -.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Finished key swap for open keys in process:'ProcessName' - (Keys updated: TotalKeysUpdated, ReadsInProgress:ReadsInProgress, WritesInProgress:WritesInProgress, ShadowInProgress:ShadowInProgress

Fields #

Name	Description
`ProcessName`
`TotalKeysUpdated`
`ReadsInProgress`
`WritesInProgress`
`ShadowInProgress`

Event ID 2036: Update local distributed store registry configuration initiated from Initiator (IsForce:IsForce Config:Config).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update local distributed store registry configuration initiated from Initiator (IsForce:IsForce Config:Config)

Fields #

Name	Description
`Initiator`
`IsForce`
`Config`

Event ID 2037: Update local distributed store registry configuration failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update local distributed store registry configuration failed. (IsAttempted:IsAttempted, PrevCfg:PreviousConfig, Error:ErrorMessage)

Fields #

Name	Description
`IsAttempted`
`PreviousConfig`
`ErrorMessage`

Event ID 2038: Update local distributed store configuration succeeded.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update local distributed store configuration succeeded. (Previous config: PrevCfg)

Fields #

Name	Description
`PrevCfg`

Event ID 2039: Update local distributed store configuration skipped (Previous config: PrevCfg).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Update local distributed store configuration skipped (Previous config: PrevCfg)

Fields #

Name	Description
`PrevCfg`

Event ID 2040: Skipped distributed store switch processing since a new request to switch is issued before minimum time passed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store switch processing since a new request to switch is issued before minimum time passed. (LastSuccessfulSwitchTime: LastSuccessfulSwitchTime, Elasped: Elasped, MinimumRequired: MinimumRequired)

Fields #

Name	Description
`LastSuccessfulSwitchTime`
`Elasped`
`MinimumRequired`

Event ID 2041: Process 'Operation' operation for key 'KeyName' cancelled due to dual store switch.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Process 'Operation' operation for key 'KeyName' cancelled due to dual store switch. (Hung duration: HungDuration)

Fields #

Name	Description
`Process`
`Operation`
`KeyName`
`HungDuration`
`InitiatedTime`
`CutoffTime`

Event ID 2042: Skipped write test for dual store switch due to explicit flag in variant config (NewStore: NewStore, PendingDuration: PendingDuration).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped write test for dual store switch due to explicit flag in variant config (NewStore: NewStore, PendingDuration: PendingDuration)

Fields #

Name	Description
`NewStore`
`PendingDuration`

Event ID 2043: Dual store switch blocked since last test write operation is not completed yet (NewStore: NewStore, PendingDuration: PendingDuration).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Dual store switch blocked since last test write operation is not completed yet (NewStore: NewStore, PendingDuration: PendingDuration)

Fields #

Name	Description
`NewStore`
`PendingDuration`

Event ID 2044: Dual store switch blocked since test write operation did not succeed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Dual store switch blocked since test write operation did not succeed. (IsTimedOut:IsTimedOut, IsVerificationSucceeded:IsVerificationSucceeded, ErrorMessage:ErrorMessage)

Fields #

Name	Description
`IsTimedOut`
`IsVerificationSucceeded`
`ErrorMessage`

Event ID 2050: Initiating HA Provider switch.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Initiating HA Provider switch

Fields #

Name	Description
`CurrentConfig`
`RequestedConfig`

Event ID 2051: HA Provider switch succeeded.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

HA Provider switch succeeded

Fields #

Name	Description
`Duration`

Event ID 2052: HA Provider switch failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

HA Provider switch failed

Fields #

Name	Description
`Duration`
`ErrorMessage`

Event ID 2053: Attempting HA Provider switch.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempting HA Provider switch

Fields #

Name	Description
`CfgPack`
`NewCfg`
`PrevCfg`

Event ID 2054: Distributed store component startup failed to register DxStore manager diagnostics handler.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Distributed store component startup failed to register DxStore manager diagnostics handler

Fields #

Name	Description
`Error`

Event ID 2100: Attempt to check for distributed store membership change failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Attempt to check for distributed store membership change failed. Error: ErrorMessage

Fields #

Name	Description
`ErrorMessage`
`StackTrace`

Event ID 2101: Skipped distributed store membership check processing since Active directory is not accessible.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership check processing since Active directory is not accessible

Event ID 2102: Skipped distributed store membership check processing since some of the servers are not yet upgraded to the required version.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership check processing since some of the servers are not yet upgraded to the required version. (Required: 'RequiredVersion')

Fields #

Name	Description
`RequiredVersion`
`FailedServerAndVersions`

Event ID 2103: Witness Server:WitnessServer reported that membership has not been configured.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Witness Server:WitnessServer reported that membership has not been configured. Attempt to fix configured to AttemptToFix

Fields #

Name	Description
`WitnessServer`
`AttemptToFix`

Event ID 2104: Witness Server:WitnessServer reported a misconfigured membership.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Witness Server:WitnessServer reported a misconfigured membership. Look at event XML for expected and reported servers list.

Fields #

Name	Description
`WitnessServer`
`ExpectedServers`
`ReportedServers`

Event ID 2105: Skipped distributed store membership check on witness WitnessServer due to exception : ExceptionMessage.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership check on witness WitnessServer due to exception : ExceptionMessage

Fields #

Name	Description
`WitnessServer`
`ExceptionMessage`
`ExceptionStackTrace`

Event ID 2106: Skipped distributed store membership update due to preconditions check failure.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership update due to preconditions check failure. Exception : ExceptionMessage

Fields #

Name	Description
`ExceptionMessage`
`ExceptionStackTrace`

Event ID 2107: Skipped distributed store membership update due to preconditions check failure.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped distributed store membership update due to preconditions check failure. Failure Message : FailureMessage

Fields #

Name	Description
`FailureMessage`

Event ID 2108: Skipped best effort group creation on server Server due to exception : ExceptionMessage.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Skipped best effort group creation on server Server due to exception : ExceptionMessage

Fields #

Name	Description
`Server`
`ExceptionMessage`
`ExceptionStackTrace`

Event ID 2109: Failed to deserialize MembershipType membership from AD.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Failed to deserialize MembershipType membership from AD.

Fields #

Name	Description
`MembershipType`
`SerializedMembershipFromAD`

Event ID 2110: Successfully issued staging Paxos update.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully issued staging Paxos update. Update's Paxos Sequence Number estimate - PaxosSequenceNumber.

Fields #

Name	Description
`PaxosSequenceNumber`

Event ID 2111: Successfully stamped membership to AD.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully stamped membership to AD.

Fields #

Name	Description
`GenerationTimestamp`
`InstanceNumber`
`Members`

Event ID 2112: Successfully issued the UpdateMembership Paxos command to current quorum.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully issued the UpdateMembership Paxos command to current quorum.

Fields #

Name	Description
`GenerationTimestamp`
`InstanceNumber`
`Members`

Event ID 2113: Successfully issued the Create Group command to the DxStore Manager on node NewServer.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully issued the Create Group command to the DxStore Manager on node NewServer.

Fields #

Name	Description
`NewServer`
`GenerationTimestamp`
`InstanceNumber`
`Members`

Event ID 2114: Successfully issued the Create Group command to the DxStore Manager on unconfigured witness server NewServer.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Successfully issued the Create Group command to the DxStore Manager on unconfigured witness server NewServer.

Fields #

Name	Description
`NewServer`
`GenerationTimestamp`
`InstanceNumber`
`Members`

Event ID 2115: DxStore Membership - New Variant Config : NewVariantSettings, Existing Variant Config : ExistingVariantSettings.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

DxStore Membership - New Variant Config : NewVariantSettings, Existing Variant Config : ExistingVariantSettings.

Fields #

Name	Description
`NewVariantSettings`
`ExistingVariantSettings`

Event ID 2116: Membership Container Updated.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Membership Container Updated. IntendedMembership:IntendedMembership; FinalVettedMembership:FinalVettedMembership; CurrentDxStoreMembership:CurrentMembership; StragglerServers:StragglerServers; ReturningStragglerServers:ReturningStragglerServers; FieldsChanged:FieldsChanged

Fields #

Name	Description
`IntendedMembership`
`FinalVettedMembership`
`CurrentMembership`
`StragglerServers`
`ReturningStragglerServers`
`FieldsChanged`

Event ID 2117: Straggler Connectivity Information updated: Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Straggler Connectivity Information updated: Message

Fields #

Name	Description
`Message`

Event ID 2200: [GroupName] Local store integrity check failed as checksums did not match.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Local store integrity check failed as checksums did not match

Fields #

Name	Description
`GroupName`

Event ID 2201: [GroupName] Local store integrity check skipped as the instance number when the checksum was computed and when this check is being run don't match.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Local store integrity check skipped as the instance number when the checksum was computed and when this check is being run don't match

Fields #

Name	Description
`GroupName`

Event ID 2202: [Identity] Local store integrity check published for InstanceNumber:RequestedInstanceNumber.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Local store integrity check published for InstanceNumber:RequestedInstanceNumber

Fields #

Name	Description
`Identity`
`InitiatingServer`
`RequestedInstanceNumber`

Event ID 2203: [GroupName] Local store integrity check publish skipped as the leader doesn't have a recorded checksum.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Local store integrity check publish skipped as the leader doesn't have a recorded checksum.

Fields #

Name	Description
`GroupName`

Event ID 2204: [Identity] Local store integrity check failed as checksums did not match.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Local store integrity check failed as checksums did not match. Initator:InitiatingServer. InstanceNumber:RequestedInstanceNumber

Fields #

Name	Description
`Identity`
`InitiatingServer`
`RequestedInstanceNumber`

Event ID 2205: [Identity] Local store integrity check skipped as there is no locally recorded checksum.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Local store integrity check skipped as there is no locally recorded checksum. Initator:InitiatingServer. InstanceNumber:RequestedInstanceNumber

Fields #

Name	Description
`Identity`
`InitiatingServer`
`RequestedInstanceNumber`

Event ID 2206: [Identity] Local store integrity check skipped as the requested instance number (RequestedInstanceNumber) did not match the recorded instance number (RecordedInstanceNumber).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Local store integrity check skipped as the requested instance number (RequestedInstanceNumber) did not match the recorded instance number (RecordedInstanceNumber). Initiator:InitiatingServer

Fields #

Name	Description
`Identity`
`InitiatingServer`
`RequestedInstanceNumber`
`RecordedInstanceNumber`

Event ID 3001: [GroupName] There has been no leader consensus since Timestamp.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] There has been no leader consensus since Timestamp

Fields #

Name	Description
`Timestamp`
`GroupName`

Event ID 3002: [GroupName] There has been no log progress since Timestamp.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] There has been no log progress since Timestamp. Last recorded heartbeat write content : LastHeartbeatWriteContent

Fields #

Name	Description
`Timestamp`
`LastHeartbeatWriteContent`
`GroupName`

Event ID 3003: [GroupName] The DxStore Instance was restarted by the manager.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] The DxStore Instance was restarted by the manager. Reason: Message

Fields #

Name	Description
`Message`
`GroupName`

Event ID 3004: [GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied

Fields #

Name	Description
`IsLeader`
`Leader`
`Lag`
`InstanceState`
`StoreState`
`IsMajoritySuccessfulyReplied`
`IsMajorityPaxosInitialized`
`IsMajorityAgreeWithLeader`
`TotalRequested`
`TotalSuccessful`
`TotalFailed`
`TotalNoReplies`
`FailedServerInfo`
`LastFailedServerInfo`
`ServersNotReplied`
`Reason`
`GroupName`
`SequencePositions`

Event ID 3005: [GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied

Fields #

Name	Description
`IsLeader`
`Leader`
`Lag`
`InstanceState`
`StoreState`
`IsMajoritySuccessfulyReplied`
`IsMajorityPaxosInitialized`
`IsMajorityAgreeWithLeader`
`TotalRequested`
`TotalSuccessful`
`TotalFailed`
`TotalNoReplies`
`FailedServerInfo`
`LastFailedServerInfo`
`ServersNotReplied`
`Reason`
`GroupName`
`SequencePositions`

Event ID 3006: [GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Group status - Leader: Leader InstanceState: InstanceState StoreState: StoreState IsMajority: IsMajoritySuccessfulyReplied

Fields #

Name	Description
`IsLeader`
`Leader`
`Lag`
`InstanceState`
`StoreState`
`IsMajoritySuccessfulyReplied`
`IsMajorityPaxosInitialized`
`IsMajorityAgreeWithLeader`
`TotalRequested`
`TotalSuccessful`
`TotalFailed`
`TotalNoReplies`
`FailedServerInfo`
`LastFailedServerInfo`
`ServersNotReplied`
`Reason`
`GroupName`
`SequencePositions`

Event ID 3007: [GroupName] Node activity matrix.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Node activity matrix

Fields #

Name	Description
`NodeActivity`
`GroupName`

Event ID 3008: Dual store configuration sync was able to successfuly read from AD first time after reboot.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Dual store configuration sync was able to successfuly read from AD first time after reboot

Fields #

Name	Description
`LastRecordedAccessTime`
`CurrentBootTime`

Event ID 3009: [GroupName] There has been membership divergence detected since Timestamp.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] There has been membership divergence detected since Timestamp. Diagnostics:Message

Fields #

Name	Description
`Timestamp`
`GroupName`
`Message`

Event ID 3010: [GroupName] Instance has requested for wipe edb on next instance start.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] Instance has requested for wipe edb on next instance start. Process will exit now. (Reason: Reason, EseExceptionType: ExceptionType)

Fields #

Name	Description
`GroupName`
`Reason`
`ExceptionType`
`Exception`

Event ID 3011: [GroupName] The DxStore Instance on NodeName has been seeing one way communication issues.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] The DxStore Instance on NodeName has been seeing one way communication issues. FailureDirection: FailureMode

Fields #

Name	Description
`GroupName`
`NodeName`
`FailureMode`

Event ID 3012: [GroupName] The following nodes are reporting one way communication failures: FailureReport.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] The following nodes are reporting one way communication failures: FailureReport

Fields #

Name	Description
`GroupName`
`FailureReport`

Event ID 3013: [Identity] Instance number out of sequence (IsRestarting: IsRestarting).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[Identity] Instance number out of sequence (IsRestarting: IsRestarting)

Fields #

Name	Description
`Identity`
`IsRestarting`
`LastSequenceNumberExecuted`
`CurrentSequenceNumberExecuted`

Event ID 3014: Identity: Blocked local node from participating in leader election (Reason: Reason).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Blocked local node from participating in leader election (Reason: Reason)

Fields #

Name	Description
`Identity`
`Reason`
`PrevIsAllowed`
`PrevReason`

Event ID 3015: Identity: Allowed local node to participate in leader election.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Allowed local node to participate in leader election

Fields #

Name	Description
`Identity`
`PrevIsAllowed`
`PrevReason`

Event ID 3016: Identity: Maintenance state check failed.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Maintenance state check failed

Fields #

Name	Description
`Identity`
`Error`

Event ID 3017: Identity: Percentage of servers in maintenance is PercentServersInMaintenance which exceeded limit.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Percentage of servers in maintenance is PercentServersInMaintenance which exceeded limit. Allowing local node to participate in leader elections to be safe

Fields #

Name	Description
`Identity`
`ServersInGroupCount`
`ServersInMaintenanceCount`
`PercentServersInMaintenance`
`LeaderBlockSafetyPercentage`

Event ID 3018: Identity: Maintenance state not available.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Maintenance state not available

Fields #

Name	Description
`Identity`
`Reason`

Event ID 3019: Identity: Blocked paxos message Message (Reason: Reason).

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Identity: Blocked paxos message Message (Reason: Reason)

Fields #

Name	Description
`Identity`
`Message`
`Reason`

Event ID 3020: Heartbeat write failed with exception - Message.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

Heartbeat write failed with exception - Message

Fields #

Name	Description
`Message`
`StackTrace`

Event ID 3021: [GroupName] There have been heartbeat write failures since LeaderName recorded a heartbeat write at Timestamp.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

[GroupName] There have been heartbeat write failures since LeaderName recorded a heartbeat write at Timestamp.

Fields #

Name	Description
`Timestamp`
`LeaderName`
`GroupName`

Event ID 3026: TypeName in TypeNameSpace are not allowed in DxStore.

Provider: Microsoft-Exchange-DxStoreHA
Channel: Server

Description

TypeName in TypeNameSpace are not allowed in DxStore. Current unknown type list:UnknowTypeList

Fields #

Name	Description
`TypeName`
`TypeNameSpace`
`UnknowTypeList`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)