Microsoft-Exchange-ESE

122 events across 3 channels

Event	Title	Channel	Sample
100	ESE Trace.		N
101	ESE BF Trace.		N
102	ESE Block Trace.		N
103	ESE NewPage Trace.		N
104	ESE ReadPage Trace.		N
105	ESE PrereadPage Trace.		N
106	ESE WritePage Trace.		N
107	ESE EvictPage Trace.		N
108	ESE RequestPage Trace.		N
110	ESE DirtyPage Trace.		N
111	ESE TransactionBegin Trace.		N
112	ESE TransactionCommit Trace.		N
113	ESE TransactionRollback Trace.		N
114	ESE AllocExt Trace.		N
115	ESE FreeExt Trace.		N
116	ESE AllocPage Trace.		N
117	ESE FreePage Trace.		N
118	ESE IOREQHeapEnqueue Trace.	IODiagnose	N
119	ESE IOREQHeapDequeue Trace.	IODiagnose	N
120	ESE IOCompletion Trace.	IODiagnose	N
121	ESE Log Stall Trace.		N
122	ESE LogWrite Trace.		N
123	ESE EventLog Information Trace.	Operational	N
124	ESE EventLog Warning Trace.	Operational	N
125	ESE EventLog Error Trace.	Operational	N
126	ESE Timer Queue Schedule Trace.		N
127	ESE Timer Queue Run Trace.		N
128	ESE Timer Queue Cancel Trace.		N
129	ESE Timer Task Schedule Trace.		N
130	ESE Timer Task Run Trace.		N
131	ESE Timer Task Cancel Trace.		N
132	ESE Task Manager Post Trace.		N
133	ESE Task Manager Run Trace.		N
134	ESE General Purpose Task Manager Post Trace.		N
135	ESE General Purpose Task Manager Run Trace.		N
136	ESE Test Marker Trace.		N
137	ESE Thread Create Trace.		N
138	ESE Thread Start Trace.		N
139	ESE VersionPage Trace.		N
140	ESE VersionCopyPage Trace.		N
141	ESE Cache Resize Trace.		N
142	ESE Cache Limit Resize Trace.		N
143	ESE Cache Scavenge Progress Trace.		N
144	ESE Function Call Started.		N
145	ESE Function Call Complete.		N
146	ESE ResMgrInit Trace.		N
147	ESE ResMgrTerm Trace.		N
148	ESE CachePage Trace.		N
149	ESE MarkPageAsSuperCold Trace.		N
150	ESE CacheMissLatency Trace.		N
151	ESE BTreePrereadPageRequest Trace.		N
152	ESE DiskFlushFileBuffers Trace.		N
153	ESE DiskFlushFileBuffersBegin Trace.		N
154	ESE CacheFirstDirtyPage Trace.		N
155	ESE SysStationId Trace.		N
156	ESE InstStationId Trace.		N
157	ESE FmpStationId Trace.		N
158	ESE DiskStationId Trace.		N
159	ESE FileStationId Trace.		N
160	ESE IsamDbfilehdrInfo Trace.		N
161	ESE DiskOsDiskCacheInfo Trace.		N
162	ESE DiskOsStorageWriteCacheProp Trace.		N
163	ESE DiskOsDeviceSeekPenaltyDesc Trace.		N
165	ESE IOCompletion2 Trace.		N
166	ESE FCBPurgeFailure Trace.		N
167	ESE IOLatencySpikeNotice Trace.		N
200	ESE tagNull Trace.		N
201	ESE tagInformation Trace.		N
202	ESE tagErrors Trace.		N
203	ESE tagAsserts Trace.		N
204	ESE tagAPI Trace.		N
205	ESE tagInitTerm Trace.		N
206	ESE tagBufferManager Trace.		N
207	ESE tagBufferManagerHashedLatches Trace.		N
208	ESE tagIO Trace.		N
209	ESE tagMemory Trace.		N
210	ESE tagVersionStore Trace.		N
211	ESE tagVersionStoreOOM Trace.		N
212	ESE tagVersionCleanup Trace.		N
213	ESE tagCatalog Trace.		N
214	ESE tagDDLRead Trace.		N
215	ESE tagDDLWrite Trace.		N
216	ESE tagDMLRead Trace.		N
217	ESE tagDMLWrite Trace.		N
218	ESE tagDMLConflicts Trace.		N
219	ESE tagInstances Trace.		N
220	ESE tagDatabases Trace.		N
221	ESE tagSessions Trace.		N
222	ESE tagCursors Trace.		N
223	ESE tagCursorNavigation Trace.		N
224	ESE tagCursorPageRefs Trace.		N
225	ESE tagBtree Trace.		N
226	ESE tagSpace Trace.		N
227	ESE tagFCBs Trace.		N
228	ESE tagTransactions Trace.		N
229	ESE tagLogging Trace.		N
230	ESE tagRecovery Trace.		N
231	ESE tagBackup Trace.		N
232	ESE tagRestore Trace.		N
233	ESE tagOLD Trace.		N
234	ESE tagEventlog Trace.		N
235	ESE tagBufferManagerMaintTasks Trace.		N
236	ESE tagSpaceManagement Trace.		N
237	ESE tagSpaceInternal Trace.		N
238	ESE tagIOQueue Trace.		N
239	ESE tagDiskVolumeManagement Trace.		N
240	ESE tagCallbacks Trace.		N
241	ESE tagIOProblems Trace.		N
242	ESE tagUpgrade Trace.		N
243	ESE tagRecoveryValidation Trace.		N
244	ESE tagBufferManagerBufferCacheState Trace.		N
245	ESE tagBufferManagerBufferDirtyState Trace.		N
246	ESE tagTimerQueue Trace.		N
247	ESE tagSortPerf Trace.		N
248	ESE tagOLDRegistration Trace.		N
249	ESE tagOLDWork Trace.		N
250	ESE tagSysInitTerm Trace.		N
251	ESE tagVersionAndStagingChecks Trace.		N
252	ESE tagFile Trace.		N
253	ESE tagFlushFileBuffers Trace.		N
254	ESE tagCheckpointUpdate Trace.		N
5000	ESE Compression Experiment Trace.		N

Event ID 100: ESE Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Trace

Event ID 101: ESE BF Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE BF Trace

Event ID 102: ESE Block Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Block Trace

Event ID 103: ESE NewPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE NewPage Trace

Fields #

Name	Description
`ifmp`
`pgno`
`LatchFlags`
`objid`
`PageFlags`
`UserId`
`OperationId`
`OperationType`
`ClientType`
`Flags`
`CorrelationId`
`Iorp`
`Iors`
`Iort`
`Ioru`
`Iorf`
`ParentObjectClass`
`dbtimeDirtied`
`itagMicFree`
`cbFree`

Event ID 104: ESE ReadPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE ReadPage Trace

Fields #

Name	Description
`ifmp`
`pgno`
`LatchFlags`
`objid`
`PageFlags`
`UserId`
`OperationId`
`OperationType`
`ClientType`
`Flags`
`CorrelationId`
`Iorp`
`Iors`
`Iort`
`Ioru`
`Iorf`
`ParentObjectClass`
`dbtimeDirtied`
`itagMicFree`
`cbFree`

Event ID 105: ESE PrereadPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE PrereadPage Trace

Fields #

Name	Description
`ifmp`
`pgno`
`UserId`
`OperationId`
`OperationType`
`ClientType`
`Flags`
`CorrelationId`
`Iorp`
`Iors`
`Iort`
`Ioru`
`Iorf`
`ParentObjectClass`

Event ID 106: ESE WritePage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE WritePage Trace

Fields #

Name	Description
`tick`
`ifmp`
`pgno`
`objid`
`PageFlags`
`DirtyLevel`
`UserId`
`OperationId`
`OperationType`
`ClientType`
`Flags`
`CorrelationId`
`Iorp`
`Iors`
`Iort`
`Ioru`
`Iorf`
`ParentObjectClass`

Event ID 107: ESE EvictPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE EvictPage Trace

Fields #

Name	Description
`tick`
`ifmp`
`pgno`
`fCurrentVersion`
`errBF`
`bfef`
`pctPriority`

Event ID 108: ESE RequestPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE RequestPage Trace

Fields #

Name	Description
`tick`
`ifmp`
`pgno`
`bflf`
`objid`
`PageFlags`
`bflt`
`pctPriority`
`bfrtf`
`ClientType`

Event ID 110: ESE DirtyPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE DirtyPage Trace

Fields #

Name	Description
`tick`
`ifmp`
`pgno`
`objid`
`PageFlags`
`DirtyLevel`
`LgposModify`
`UserId`
`OperationId`
`OperationType`
`ClientType`
`Flags`
`CorrelationId`
`Iorp`
`Iors`
`Iort`
`Ioru`
`Iorf`
`ParentObjectClass`

Event ID 111: ESE TransactionBegin Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE TransactionBegin Trace

Fields #

Name	Description
`SessionNumber`
`TransactionNumber`
`TransactionLevel`

Event ID 112: ESE TransactionCommit Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE TransactionCommit Trace

Fields #

Name	Description
`SessionNumber`
`TransactionNumber`
`TransactionLevel`

Event ID 113: ESE TransactionRollback Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE TransactionRollback Trace

Fields #

Name	Description
`SessionNumber`
`TransactionNumber`
`TransactionLevel`

Event ID 114: ESE AllocExt Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE AllocExt Trace

Fields #

Name	Description
`ifmp`
`pgnoFDP`
`pgnoFirst`
`cpg`
`objidFDP`
`tce`

Event ID 115: ESE FreeExt Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE FreeExt Trace

Fields #

Name	Description
`ifmp`
`pgnoFDP`
`pgnoFirst`
`cpg`
`objidFDP`
`tce`

Event ID 116: ESE AllocPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE AllocPage Trace

Fields #

Name	Description
`ifmp`
`pgnoFDP`
`pgnoAlloc`
`objidFDP`
`tce`

Event ID 117: ESE FreePage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE FreePage Trace

Fields #

Name	Description
`ifmp`
`pgnoFDP`
`pgnoFree`
`objidFDP`
`tce`

Event ID 118: ESE IOREQHeapEnqueue Trace.

Provider: Microsoft-Exchange-ESE
Channel: IODiagnose

Description

ESE IOREQHeapEnqueue Trace

Fields #

Name	Description
`iFile`
`ibOffset`
`cbData`
`tidAlloc`
`fHeapA`
`fWrite`
`EngineFileType`
`EngineFileId`
`cusecEnqueueLatency`

Event ID 119: ESE IOREQHeapDequeue Trace.

Provider: Microsoft-Exchange-ESE
Channel: IODiagnose

Description

ESE IOREQHeapDequeue Trace

Fields #

Name	Description
`iFile`
`ibOffset`
`cbData`
`tidAlloc`
`fHeapA`
`fWrite`
`Iorp`
`Iors`
`Ioru`
`Iorf`
`grbitQos`
`cmsecTimeInQueue`
`EngineFileType`
`EngineFileId`
`cDispatchPass`
`cIorunCombined`
`cusecDequeueLatency`

Event ID 120: ESE IOCompletion Trace.

Provider: Microsoft-Exchange-ESE
Channel: IODiagnose

Description

ESE IOCompletion Trace

Fields #

Name	Description
`iFile`
`fMultiIor`
`fWrite`
`UserId`
`OperationId`
`OperationType`
`ClientType`
`Flags`
`CorrelationId`
`Iorp`
`Iors`
`Iort`
`Ioru`
`Iorf`
`ParentObjectClass`
`ibOffset`
`cbTransfer`
`error`
`qosHighestFirst`
`cmsecIOElapsed`
`dtickCompletionDelay`
`tidAlloc`
`EngineFileType`
`EngineFileId`
`fmfFile`
`DiskNumber`

Event ID 121: ESE Log Stall Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Log Stall Trace

Event ID 122: ESE LogWrite Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE LogWrite Trace

Fields #

Name	Description
`lgenData`
`ibLogData`
`cbLogData`

Event ID 123: ESE EventLog Information Trace.

Provider: Microsoft-Exchange-ESE
Channel: Operational

Description

ESE EventLog Information Trace

Fields #

Name	Description
`szTrace`

Event ID 124: ESE EventLog Warning Trace.

Provider: Microsoft-Exchange-ESE
Channel: Operational

Description

ESE EventLog Warning Trace

Fields #

Name	Description
`szTrace`

Event ID 125: ESE EventLog Error Trace.

Provider: Microsoft-Exchange-ESE
Channel: Operational

Description

ESE EventLog Error Trace

Fields #

Name	Description
`szTrace`

Event ID 126: ESE Timer Queue Schedule Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Timer Queue Schedule Trace

Fields #

Name	Description
`pfnTask`
`pvTaskContext`
`dwContext`
`dtickDelay`
`dtickPeriod`

Event ID 127: ESE Timer Queue Run Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Timer Queue Run Trace

Fields #

Name	Description
`pfnTask`
`pvTaskContext`
`dwContext`
`cRuns`

Event ID 128: ESE Timer Queue Cancel Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Timer Queue Cancel Trace

Fields #

Name	Description
`pfnTask`
`pvTaskContext`

Event ID 129: ESE Timer Task Schedule Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Timer Task Schedule Trace

Fields #

Name	Description
`posttTimerHandle`
`pfnTask`
`pvTaskGroupContext`
`pvRuntimeContext`
`dtickMinDelay`
`dtickSlopDelay`

Event ID 130: ESE Timer Task Run Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Timer Task Run Trace

Fields #

Name	Description
`posttTimerHandle`
`pfnTask`
`pvTaskGroupContext`
`pvRuntimeContext`
`cRuns`

Event ID 131: ESE Timer Task Cancel Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Timer Task Cancel Trace

Fields #

Name	Description
`posttTimerHandle`
`pfnTask`
`pvTaskGroupContext`

Event ID 132: ESE Task Manager Post Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Task Manager Post Trace

Fields #

Name	Description
`ptm`
`pfnCompletion`
`dwCompletionKey1`
`dwCompletionKey2`

Event ID 133: ESE Task Manager Run Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Task Manager Run Trace

Fields #

Name	Description
`ptm`
`pfnCompletion`
`dwCompletionKey1`
`dwCompletionKey2`
`gle`
`dwThreadContext`

Event ID 134: ESE General Purpose Task Manager Post Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE General Purpose Task Manager Post Trace

Fields #

Name	Description
`pgptm`
`pfnCompletion`
`pvParam`
`pTaskInfo`

Event ID 135: ESE General Purpose Task Manager Run Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE General Purpose Task Manager Run Trace

Fields #

Name	Description
`pgptm`
`pfnCompletion`
`pvParam`
`pTaskInfo`

Event ID 136: ESE Test Marker Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Test Marker Trace

Fields #

Name	Description
`qwMarkerID`
`szAnnotation`

Event ID 137: ESE Thread Create Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Thread Create Trace

Fields #

Name	Description
`Thread`
`pfnStart`
`dwParam`

Event ID 138: ESE Thread Start Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Thread Start Trace

Fields #

Name	Description
`Thread`
`pfnStart`
`dwParam`

Event ID 139: ESE VersionPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE VersionPage Trace

Fields #

Name	Description
`ifmp`
`pgno`

Event ID 140: ESE VersionCopyPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE VersionCopyPage Trace

Fields #

Name	Description
`ifmp`
`pgno`

Event ID 141: ESE Cache Resize Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Cache Resize Trace

Fields #

Name	Description
`cbfCacheAddressableInitial`
`cbfCacheSizeInitial`
`cbfCacheAddressableFinal`
`cbfCacheSizeFinal`

Event ID 142: ESE Cache Limit Resize Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Cache Limit Resize Trace

Fields #

Name	Description
`cacheSizeLimitInitial`
`cacheSizeLimitFinal`

Event ID 143: ESE Cache Scavenge Progress Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Cache Scavenge Progress Trace

Fields #

Name	Description
`iRun`
`cbfVisited`
`cbfCacheSize`
`cbfCacheTarget`
`cbfCacheSizeStartShrink`
`dtickShrinkDuration`
`cbfAvail`
`cbfAvailPoolLow`
`cbfAvailPoolHigh`
`cbfFlushPending`
`cbfFlushPendingSlow`
`cbfFlushPendingHung`
`cbfOutOfMemory`
`cbfPermanentErrs`
`eStopReason`
`errRun`

Event ID 144: ESE Function Call Started.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Function Call Started

Fields #

Name	Description
`opApi`

Event ID 145: ESE Function Call Complete.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Function Call Complete

Fields #

Name	Description
`opApi`
`err`

Event ID 146: ESE ResMgrInit Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE ResMgrInit Trace

Fields #

Name	Description
`tick`
`K`
`csecCorrelatedTouch`
`csecTimeout`
`csecUncertainty`
`dblHashLoadFactor`
`dblHashUniformity`
`dblSpeedSizeTradeoff`

Event ID 147: ESE ResMgrTerm Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE ResMgrTerm Trace

Fields #

Name	Description
`tick`

Event ID 148: ESE CachePage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE CachePage Trace

Fields #

Name	Description
`tick`
`ifmp`
`pgno`
`bflf`
`bflt`
`pctPriority`
`bfrtf`
`ClientType`

Event ID 149: ESE MarkPageAsSuperCold Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE MarkPageAsSuperCold Trace

Fields #

Name	Description
`tick`
`ifmp`
`pgno`

Event ID 150: ESE CacheMissLatency Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE CacheMissLatency Trace

Fields #

Name	Description
`ifmp`
`pgno`
`dwUserId`
`bOperationId`
`bOperationType`
`bClientType`
`bFlags`
`dwCorrelationId`
`iorp`
`iors`
`iort`
`ioru`
`iorf`
`tce`
`usecsWait`
`bftcmr`

Event ID 151: ESE BTreePrereadPageRequest Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE BTreePrereadPageRequest Trace

Fields #

Name	Description
`ifmp`
`pgno`
`dwUserId`
`bOperationId`
`bOperationType`
`bClientType`
`bFlags`
`dwCorrelationId`
`iorp`
`iors`
`iort`
`ioru`
`iorf`
`tce`
`fOpFlags`

Event ID 152: ESE DiskFlushFileBuffers Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE DiskFlushFileBuffers Trace

Fields #

Name	Description
`Disk`
`wszFileName`
`iofr`
`cioreqFileFlushing`
`usFfb`
`error`

Event ID 153: ESE DiskFlushFileBuffersBegin Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE DiskFlushFileBuffersBegin Trace

Fields #

Name	Description
`dwDisk`
`hFile`
`iofr`

Event ID 154: ESE CacheFirstDirtyPage Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE CacheFirstDirtyPage Trace

Fields #

Name	Description
`tick`
`ifmp`
`pgno`
`objid`
`fFlags`
`bfdfNew`
`lgposModify`
`dwUserId`
`bOperationId`
`bOperationType`
`bClientType`
`bFlags`
`dwCorrelationId`
`iorp`
`iors`
`iort`
`ioru`
`iorf`
`tce`

Event ID 155: ESE SysStationId Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE SysStationId Trace

Fields #

Name	Description
`tsidr`
`dwImageVerMajor`
`dwImageVerMinor`
`dwImageBuildMajor`
`dwImageBuildMinor`
`wszDisplayName`

Event ID 156: ESE InstStationId Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE InstStationId Trace

Fields #

Name	Description
`tsidr`
`iInstance`
`perfstatusEvent`
`wszInstanceName`
`wszDisplayName`

Event ID 157: ESE FmpStationId Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE FmpStationId Trace

Fields #

Name	Description
`tsidr`
`ifmp`
`iInstance`
`dbid`
`wszDatabaseName`

Event ID 158: ESE DiskStationId Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE DiskStationId Trace

Fields #

Name	Description
`tsidr`
`dwDiskNumber`
`wszDiskPathId`
`szDiskModel`
`szDiskFirmwareRev`
`szDiskSerialNumber`

Event ID 159: ESE FileStationId Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE FileStationId Trace

Fields #

Name	Description
`tsidr`
`hFile`
`dwDiskNumber`
`dwEngineFileType`
`qwEngineFileId`
`fmf`
`cbFileSize`
`wszAbsPath`

Event ID 160: ESE IsamDbfilehdrInfo Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE IsamDbfilehdrInfo Trace

Fields #

Name	Description
`tsidr`
`ifmp`
`filetype`
`ulMagic`
`ulChecksum`
`cbPageSize`
`ulDbFlags`
`psignDb`

Event ID 161: ESE DiskOsDiskCacheInfo Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE DiskOsDiskCacheInfo Trace

Fields #

Name	Description
`tsidr`
`posdci`

Event ID 162: ESE DiskOsStorageWriteCacheProp Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE DiskOsStorageWriteCacheProp Trace

Fields #

Name	Description
`tsidr`
`posswcp`

Event ID 163: ESE DiskOsDeviceSeekPenaltyDesc Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE DiskOsDeviceSeekPenaltyDesc Trace

Fields #

Name	Description
`tsidr`
`posdspd`

Event ID 165: ESE IOCompletion2 Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE IOCompletion2 Trace

Fields #

Name	Description
`wszFilename`
`fMultiIor`
`fWrite`
`dwUserId`
`bOperationId`
`bOperationType`
`bClientType`
`bFlags`
`dwCorrelationId`
`iorp`
`iors`
`iort`
`ioru`
`iorf`
`tce`
`szClientComponent`
`szClientAction`
`szClientActionContext`
`guidActivityId`
`ibOffset`
`cbTransfer`
`dwError`
`qosHighestFirst`
`cmsecIOElapsed`
`dtickCompletionDelay`
`tidAlloc`
`dwEngineFileType`
`dwEngineFileId`
`fmfFile`
`dwDiskNumber`

Event ID 166: ESE FCBPurgeFailure Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE FCBPurgeFailure Trace

Fields #

Name	Description
`iInstance`
`grbitPurgeFlags`
`fcbpfr`
`tce`

Event ID 167: ESE IOLatencySpikeNotice Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE IOLatencySpikeNotice Trace

Fields #

Name	Description
`dwDiskNumber`
`dtickSpikeLength`

Event ID 200: ESE tagNull Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagNull Trace

Fields #

Name	Description
`szTrace`

Event ID 201: ESE tagInformation Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagInformation Trace

Fields #

Name	Description
`szTrace`

Event ID 202: ESE tagErrors Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagErrors Trace

Fields #

Name	Description
`szTrace`

Event ID 203: ESE tagAsserts Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagAsserts Trace

Fields #

Name	Description
`szTrace`

Event ID 204: ESE tagAPI Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagAPI Trace

Fields #

Name	Description
`szTrace`

Event ID 205: ESE tagInitTerm Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagInitTerm Trace

Fields #

Name	Description
`szTrace`

Event ID 206: ESE tagBufferManager Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagBufferManager Trace

Fields #

Name	Description
`szTrace`

Event ID 207: ESE tagBufferManagerHashedLatches Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagBufferManagerHashedLatches Trace

Fields #

Name	Description
`szTrace`

Event ID 208: ESE tagIO Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagIO Trace

Fields #

Name	Description
`szTrace`

Event ID 209: ESE tagMemory Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagMemory Trace

Fields #

Name	Description
`szTrace`

Event ID 210: ESE tagVersionStore Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagVersionStore Trace

Fields #

Name	Description
`szTrace`

Event ID 211: ESE tagVersionStoreOOM Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagVersionStoreOOM Trace

Fields #

Name	Description
`szTrace`

Event ID 212: ESE tagVersionCleanup Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagVersionCleanup Trace

Fields #

Name	Description
`szTrace`

Event ID 213: ESE tagCatalog Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagCatalog Trace

Fields #

Name	Description
`szTrace`

Event ID 214: ESE tagDDLRead Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagDDLRead Trace

Fields #

Name	Description
`szTrace`

Event ID 215: ESE tagDDLWrite Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagDDLWrite Trace

Fields #

Name	Description
`szTrace`

Event ID 216: ESE tagDMLRead Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagDMLRead Trace

Fields #

Name	Description
`szTrace`

Event ID 217: ESE tagDMLWrite Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagDMLWrite Trace

Fields #

Name	Description
`szTrace`

Event ID 218: ESE tagDMLConflicts Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagDMLConflicts Trace

Fields #

Name	Description
`szTrace`

Event ID 219: ESE tagInstances Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagInstances Trace

Fields #

Name	Description
`szTrace`

Event ID 220: ESE tagDatabases Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagDatabases Trace

Fields #

Name	Description
`szTrace`

Event ID 221: ESE tagSessions Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagSessions Trace

Fields #

Name	Description
`szTrace`

Event ID 222: ESE tagCursors Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagCursors Trace

Fields #

Name	Description
`szTrace`

Event ID 223: ESE tagCursorNavigation Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagCursorNavigation Trace

Fields #

Name	Description
`szTrace`

Event ID 224: ESE tagCursorPageRefs Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagCursorPageRefs Trace

Fields #

Name	Description
`szTrace`

Event ID 225: ESE tagBtree Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagBtree Trace

Fields #

Name	Description
`szTrace`

Event ID 226: ESE tagSpace Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagSpace Trace

Fields #

Name	Description
`szTrace`

Event ID 227: ESE tagFCBs Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagFCBs Trace

Fields #

Name	Description
`szTrace`

Event ID 228: ESE tagTransactions Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagTransactions Trace

Fields #

Name	Description
`szTrace`

Event ID 229: ESE tagLogging Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagLogging Trace

Fields #

Name	Description
`szTrace`

Event ID 230: ESE tagRecovery Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagRecovery Trace

Fields #

Name	Description
`szTrace`

Event ID 231: ESE tagBackup Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagBackup Trace

Fields #

Name	Description
`szTrace`

Event ID 232: ESE tagRestore Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagRestore Trace

Fields #

Name	Description
`szTrace`

Event ID 233: ESE tagOLD Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagOLD Trace

Fields #

Name	Description
`szTrace`

Event ID 234: ESE tagEventlog Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagEventlog Trace

Fields #

Name	Description
`szTrace`

Event ID 235: ESE tagBufferManagerMaintTasks Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagBufferManagerMaintTasks Trace

Fields #

Name	Description
`szTrace`

Event ID 236: ESE tagSpaceManagement Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagSpaceManagement Trace

Fields #

Name	Description
`szTrace`

Event ID 237: ESE tagSpaceInternal Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagSpaceInternal Trace

Fields #

Name	Description
`szTrace`

Event ID 238: ESE tagIOQueue Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagIOQueue Trace

Fields #

Name	Description
`szTrace`

Event ID 239: ESE tagDiskVolumeManagement Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagDiskVolumeManagement Trace

Fields #

Name	Description
`szTrace`

Event ID 240: ESE tagCallbacks Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagCallbacks Trace

Fields #

Name	Description
`szTrace`

Event ID 241: ESE tagIOProblems Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagIOProblems Trace

Fields #

Name	Description
`szTrace`

Event ID 242: ESE tagUpgrade Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagUpgrade Trace

Fields #

Name	Description
`szTrace`

Event ID 243: ESE tagRecoveryValidation Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagRecoveryValidation Trace

Fields #

Name	Description
`szTrace`

Event ID 244: ESE tagBufferManagerBufferCacheState Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagBufferManagerBufferCacheState Trace

Fields #

Name	Description
`szTrace`

Event ID 245: ESE tagBufferManagerBufferDirtyState Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagBufferManagerBufferDirtyState Trace

Fields #

Name	Description
`szTrace`

Event ID 246: ESE tagTimerQueue Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagTimerQueue Trace

Fields #

Name	Description
`szTrace`

Event ID 247: ESE tagSortPerf Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagSortPerf Trace

Fields #

Name	Description
`szTrace`

Event ID 248: ESE tagOLDRegistration Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagOLDRegistration Trace

Fields #

Name	Description
`szTrace`

Event ID 249: ESE tagOLDWork Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagOLDWork Trace

Fields #

Name	Description
`szTrace`

Event ID 250: ESE tagSysInitTerm Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagSysInitTerm Trace

Fields #

Name	Description
`szTrace`

Event ID 251: ESE tagVersionAndStagingChecks Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagVersionAndStagingChecks Trace

Fields #

Name	Description
`szTrace`

Event ID 252: ESE tagFile Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagFile Trace

Fields #

Name	Description
`szTrace`

Event ID 253: ESE tagFlushFileBuffers Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagFlushFileBuffers Trace

Fields #

Name	Description
`szTrace`

Event ID 254: ESE tagCheckpointUpdate Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE tagCheckpointUpdate Trace

Fields #

Name	Description
`szTrace`

Event ID 5000: ESE Compression Experiment Trace.

Provider: Microsoft-Exchange-ESE
Channel

Description

ESE Compression Experiment Trace

Fields #

Name	Description
`TableClass`
`OrigSize`
`XpressSize`
`Xpress9Size`
`usecXpressTime`
`usecXpress9Time`
`ShannonEntropy`
`ChiSquared`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)