Microsoft-Windows-Application Server-Applications

Event	Title	Channel	Sample	Rule
100	TrackRecord= WorkflowInstanceRecord, InstanceID = InstanceId, RecordNumber = …	Analytic	N	N
101	TrackRecord = WorkflowInstanceUnhandledExceptionRecord, InstanceID = InstanceId, …	Analytic	N	N
102	TrackRecord = WorkflowInstanceAbortedRecord, InstanceID = InstanceId, …	Analytic	N	N
103	TrackRecord = ActivityStateRecord, InstanceID = InstanceId, …	Analytic	N	N
104	TrackRecord = ActivityScheduledRecord, InstanceID = InstanceId, RecordNumber = …	Analytic	N	N
105	TrackRecord = FaultPropagationRecord, InstanceID=.	Analytic	N	N
106	TrackRecord = CancelRequestedRecord, InstanceID=.	Analytic	N	N
107	TrackRecord = BookmarkResumptionRecord, InstanceID=.	Analytic	N	N
108	TrackRecord = CustomTrackingRecord, InstanceID = InstanceId, …	Analytic	N	N
110	TrackRecord = CustomTrackingRecord, InstanceID = InstanceId, …	Analytic	N	N
111	TrackRecord = CustomTrackingRecord, InstanceID = InstanceId, …	Analytic	N	N
112	TrackRecord = WorkflowInstanceSuspendedRecord, InstanceID = InstanceId, …	Analytic	N	N
113	TrackRecord = WorkflowInstanceTerminatedRecord, InstanceID = InstanceId, …	Analytic	N	N
114	TrackRecord= WorkflowInstanceRecord, InstanceID = InstanceId, RecordNumber = …	Analytic	N	N
115	TrackRecord = WorkflowInstanceAbortedRecord, InstanceID = InstanceId, …	Analytic	N	N
116	TrackRecord = WorkflowInstanceSuspendedRecord, InstanceID = InstanceId, …	Analytic	N	N
117	TrackRecord = WorkflowInstanceTerminatedRecord, InstanceID = InstanceId, …	Analytic	N	N
118	TrackRecord = WorkflowInstanceUnhandledExceptionRecord, InstanceID = InstanceId, …	Analytic	N	N
119	TrackRecord= WorkflowInstanceUpdatedRecord, InstanceID = InstanceId, …	Analytic	N	N
131	Pool allocating Size Bytes.	Debug	Y	N
132	BufferPool of size PoolSize, changing quota by Delta.	Debug	Y	N
133	IO Thread scheduler callback invoked.	Debug	Y	N
134	IO Thread scheduler callback invoked.	Debug	Y	N
201	The Dispatcher invoked 'AfterReceiveReply' on a ClientMessageInspector of type …	Debug	N	N
202	The Dispatcher invoked 'BeforeSendRequest' on a ClientMessageInspector of type …	Analytic	N	N
203	The Dispatcher invoked 'AfterCall' on a ClientParameterInspector of type …	Analytic	N	N
204	The Dispatcher invoked 'BeforeCall' on a ClientParameterInspector of type …	Analytic	N	N
205	An OperationInvoker invoked the 'MethodName' method.	Analytic	Y	N
206	The Dispatcher invoked an ErrorHandler of type 'TypeName' with an exception of …	Analytic	N	N
207	The Dispatcher invoked a FaultProvider of type 'TypeName' with an exception of …	Analytic	N	N
208	The Dispatcher invoked 'AfterReceiveReply' on a MessageInspector of type …	Analytic	Y	N
209	The Dispatcher invoked 'BeforeSendRequest' on a MessageInspector of type …	Analytic	Y	N
210	The 'ThrottleName' throttle limit of 'Limit' was hit.	Analytic	N	N
211	The Dispatcher invoked 'AfterCall' on a ParameterInspector of type 'TypeName'.	Analytic	N	N
212	The Dispatcher invoked 'BeforeCall' on a ParameterInspector of type 'TypeName'.	Analytic	N	N
213	ServiceHost started: 'ServiceTypeName'.	Analytic	N	N
214	An OperationInvoker completed the call to the 'MethodName' method.	Analytic	Y	N
215	The transport received a message from 'ListenAddress'.	Analytic	Y	N
216	The transport sent a message to 'DestinationAddress'.	Analytic	Y	N
217	The Client is executing Action 'Action' associated with the 'ContractName' …	Debug	Y	N
218	The Client completed executing Action 'Action' associated with the …	Analytic	Y	N
219	There was an unhandled exception of type 'ExceptionTypeName' during message …	Analytic	Y	N
220	The Dispatcher sent a message to the transport.	Analytic	N	N
221	The Dispatcher received a message from the transport.	Analytic	N	N
222	The 'MethodName' method threw an unhandled exception when invoked by the …	Analytic	N	N
223	The 'MethodName' method threw a FaultException when invoked by the …	Analytic	Y	N
224	The 'ThrottleName' throttle limit of 'Limit' is at 70%.	Analytic	N	N
225	Calculated correlation key 'InstanceKey' using values 'Values' in parent scope …	Analytic	N	N
226	ClosedCount idle services out of total TotalCount activated services closed.	Analytic	N	N
301	Name:'Name', Reference:'HostReference', Payload:Payload.	Analytic	N	N
302	Name:'Name', Reference:'HostReference', Payload:Payload.	Analytic	N	N
303	Name:'Name', Reference:'HostReference', Payload:Payload.	Analytic	N	N
401	Activity boundary.	Analytic	N	N
402	Activity boundary.	Analytic	N	N
403	Activity boundary.	Analytic	N	N
404	Activity boundary.	Analytic	N	N
440	Activity boundary.	Analytic	N	N
441	Activity boundary.	Analytic	N	N
451	data1.	Analytic	N	N
452	data1.	Analytic	N	N
499	Transfer event emitted.	Analytic	N	N
501	Begin compilation	Debug	N	N
502	End compilation	Debug	N	N
503	ServiceHostFactory begin creation	Debug	N	N
504	ServiceHostFactory end creation	Debug	N	N
505	Begin CreateServiceHost	Debug	N	N
506	End CreateServiceHost	Debug	N	N
507	HostedTransportConfigurationManager begin configuration initialization	Debug	N	N
508	HostedTransportConfigurationManager end configuration initialization	Debug	N	N
509	ServiceHost Open started.	Analytic	N	N
510	ServiceHost Open completed.	Analytic	N	N
513	Received request with virtual path 'VirtualPath' from the AppDomain …	Debug	N	N
514	WebHostRequest stop.	Debug	N	N
601	Processed ServiceActivation Element Relative Address:'RelativeAddress', …	Debug	N	N
602	Incoming request matches a ServiceActivation element with address …	Debug	N	N
603	Incoming request matches a WCF Service defined in Asp.	Debug	N	N
604	A new Asp.	Debug	N	N
605	IncrementBusyCount called.	Debug	N	N
606	DecrementBusyCount called.	Debug	N	N
701	ServiceChannelOpen started.	Analytic	Y	N
702	ServiceChannelOpen completed.	Analytic	Y	N
703	ServiceChannelCall started.	Analytic	Y	N
704	ServiceChannel asynchronous calls started.	Analytic	N	N
706	Http Send Request Start.	Debug	N	N
707	Http Send Request Stop.	Debug	N	N
708	Message received from http transport.	Analytic	N	N
709	Message dispatching started.	Analytic	Y	N
710	Start authentication for message dispatching	Analytic	N	N
711	Start authorization for message dispatching	Analytic	Y	N
712	Message dispatching completed	Analytic	Y	N
715	ServiceChannel Open Start.	Analytic	Y	N
716	ServiceChannel Open Stop.	Analytic	Y	N
717	Http Send streamed message started.	Analytic	N	N
1001	WorkflowInstance Id: 'data1' has completed in the Closed state.	Debug	N	N
1002	WorkflowApplication Id: 'data1' was terminated.	Debug	N	N
1003	WorkflowInstance Id: 'data1' has completed in the Canceled state.	Debug	N	N
1004	WorkflowInstance Id: 'data1' was aborted with an exception.	Debug	N	N
1005	WorkflowApplication Id: 'data1' went idle.	Debug	N	N
1006	WorkflowInstance Id: 'data1' has encountered an unhandled exception.	Debug	N	N
1007	WorkflowApplication Id: 'data1' was Persisted.	Debug	N	N
1008	WorkflowInstance Id: 'data1' was Unloaded.	Debug	N	N
1009	Parent Activity 'data1', DisplayName: 'data2', InstanceId: 'data3' scheduled …	Debug	N	N
1010	Activity 'data1', DisplayName: 'data2', InstanceId: 'data3' has completed in the …	Debug	N	N
1011	An ExecuteActivityWorkItem has been scheduled for Activity 'data1', DisplayName: …	Debug	N	N
1012	Starting execution of an ExecuteActivityWorkItem for Activity 'data1', …	Debug	N	N
1013	An ExecuteActivityWorkItem has completed for Activity 'data1', DisplayName: …	Debug	N	N
1014	A CompletionWorkItem has been scheduled for parent Activity 'data1', …	Debug	N	N
1015	Starting execution of a CompletionWorkItem for parent Activity 'data1', …	Debug	N	N
1016	A CompletionWorkItem has completed for parent Activity 'data1', DisplayName: …	Debug	N	N
1017	A CancelActivityWorkItem has been scheduled for Activity 'data1', DisplayName: …	Debug	N	N
1018	Starting execution of a CancelActivityWorkItem for Activity 'data1', …	Debug	N	N
1019	A CancelActivityWorkItem has completed for Activity 'data1', DisplayName: …	Debug	N	N
1020	A Bookmark has been created for Activity 'BookmarkScope', DisplayName: 'data1', …	Debug	N	N
1021	A BookmarkWorkItem has been scheduled for Activity 'BookmarkScope', DisplayName: …	Debug	N	N
1022	Starting execution of a BookmarkWorkItem for Activity 'BookmarkScope', …	Debug	N	N
1023	A BookmarkWorkItem has completed for Activity 'BookmarkScope', DisplayName: …	Debug	N	N
1024	A BookmarkScope has been created: data1.	Debug	N	N
1025	The BookmarkScope that had TemporaryId: 'data1' has been initialized with Id: …	Debug	N	N
1026	A TransactionContextWorkItem has been scheduled for Activity 'data1', …	Debug	N	N
1027	Starting execution of a TransactionContextWorkItem for Activity 'data1', …	Debug	N	N
1028	A TransactionContextWorkItem has completed for Activity 'data1', DisplayName: …	Debug	N	N
1029	A FaultWorkItem has been scheduled for Activity 'data1', DisplayName: 'data2', …	Debug	N	N
1030	Starting execution of a FaultWorkItem for Activity 'data1', DisplayName: …	Debug	N	N
1031	A FaultWorkItem has completed for Activity 'data1', DisplayName: 'data2', …	Debug	N	N
1032	A runtime work item has been scheduled for Activity 'data1', DisplayName: …	Debug	N	N
1033	Starting execution of a runtime work item for Activity 'data1', DisplayName: …	Debug	N	N
1034	A runtime work item has completed for Activity 'data1', DisplayName: 'data2', …	Debug	N	N
1035	The runtime transaction has been set by Activity 'data1', DisplayName: 'data2', …	Debug	N	N
1036	Activity 'data1', DisplayName: 'data2', InstanceId: 'data3' has scheduled …	Debug	N	N
1037	The runtime transaction has completed with the state 'data1'.	Debug	N	N
1038	Entering a no persist block.	Debug	N	N
1039	Exiting a no persist block.	Debug	N	N
1040	In argument 'data1' on Activity 'data2', DisplayName: 'data3', InstanceId: …	Debug	N	N
1041	WorkflowApplication Id: 'data1' is idle and persistable.	Debug	N	N
1101	WorkflowInstance Id: 'Id' E2E Activity.	Debug	N	N
1102	WorkflowInstance Id: 'Id' E2E Activity.	Debug	N	N
1103	WorkflowInstance Id: 'Id' E2E Activity.	Debug	N	N
1104	WorkflowInstance Id: 'Id' E2E Activity.	Debug	N	N
1124	InvokeMethod 'data1' - method is Static.	Debug	N	N
1125	InvokeMethod 'data1' - method is not Static.	Debug	N	N
1126	An exception was thrown in the method called by the activity 'data1'.	Debug	N	N
1131	InvokeMethod 'data1' - method uses asynchronous pattern of 'data2' and 'data3'.	Debug	N	N
1132	InvokeMethod 'data1' - method does not use asynchronous pattern.	Debug	N	N
1140	Flowchart 'data1' - Start has been scheduled.	Debug	N	N
1141	Flowchart 'data1' - was executed with no Nodes.	Debug	N	N
1143	Flowchart 'data1'/FlowStep - Next node is null.	Debug	N	N
1146	Flowchart 'data1'/FlowSwitch - Case 'data2' was selected.	Debug	N	N
1147	Flowchart 'data1'/FlowSwitch - Default Case was selected.	Debug	N	N
1148	Flowchart 'data1'/FlowSwitch - could find neither a Case activity nor a Default …	Debug	N	N
1150	CompensableActivity 'data1' is in the 'data2' state.	Debug	N	N
1223	The Switch activity 'data1' could not find a Case activity matching the …	Debug	N	N
1400	data1.	Analytic	Y	N
1401	data1.	Analytic	N	N
1402	msg Connection pool key: key.	Analytic	Y	N
1403	msg Connection pool key: key.	Analytic	N	N
1405	data1.	Analytic	N	N
1406	data1.	Analytic	N	N
1407	data1.	Analytic	N	N
1409	data1.	Analytic	N	N
1416	data1.	Analytic	N	N
1417	data1.	Analytic	N	N
1418	data1.	Debug	N	N
1419	data1.	Debug	N	N
1420	data1.	Analytic	N	N
1422	msg.	Analytic	N	N
1423	Negotiate token authenticator state cache ratio: cur/max.	Debug	N	N
1424	Security session ratio: Security_session_ratio/cur.	Debug	N	N
1430	Pending connections ratio: cur/max.	Analytic	Y	N
1431	Concurrent calls ratio: cur/max.	Analytic	Y	N
1432	Concurrent sessions ratio: cur/max.	Analytic	Y	N
1433	Outbound connections per endpoint ratio: cur/max.	Analytic	Y	N
1436	Pending messages per channel ratio: Pending_messages_per_channel_ratio/cur.	Analytic	N	N
1438	Concurrent instances ratio: cur/max.	Analytic	Y	N
1439	Zero pending accepts left	Debug	N	N
1441	data1.	Analytic	N	N
1442	Receive retry count reached on MSMQ message with id 'data1'.	Analytic	N	N
1443	Max retry cycles exceeded on MSMQ message with id 'data1'.	Analytic	N	N
1445	Created new 'itemTypeName'.	Analytic	Y	N
1446	Created new 'itemTypeName'.	Analytic	N	N
1449	Message received by workflow	Debug	N	N
1450	Message sent from workflow	Debug	N	N
1451	data1.	Analytic	N	N
2021	Execute work item start	Debug	N	N
2022	Execute work item stop	Debug	N	N
2023	SendMessageChannelCache miss	Debug	N	N
2024	InternalCacheMetadata started on activity 'id'.	Debug	N	N
2025	InternalCacheMetadata stopped on activity 'id'.	Debug	N	N
2026	Compiling VB expression 'expr'.	Debug	N	N
2027	CacheRootMetadata started on activity 'activityName'.	Debug	N	N
2028	CacheRootMetadata stopped on activity activityName.	Debug	N	N
2029	Finished compiling VB expression.	Debug	N	N
2576	The TryCatch activity 'data1' has caught an exception of type 'data2'.	Debug	N	N
2577	A child activity of the TryCatch activity 'data1' has thrown an exception during …	Debug	N	N
2578	A Catch or Finally activity that is associated with the TryCatch activity …	Debug	N	N
3300	Failed to Complete TypeName.	Analytic	N	N
3301	Failed to Abandon TypeName.	Debug	N	N
3302	Receive Context faulted.	Analytic	N	N
3303	TypeName was Abandoned with exception ExceptionToString.	Debug	N	N
3305	Number of cached channel factories is: 'Count'.	Debug	N	N
3306	A channel factory has been aged out of the cache because the cache has reached …	Debug	N	N
3307	Used matching channel factory found in cache.	Debug	N	N
3308	Not using channel factory from cache, i.	Debug	Y	N
3309	Query composition using 'TypeName' was executed on the Request Uri: 'Uri'.	Debug	N	N
3310	The 'OperationName' operation was dispatched with errors.	Analytic	N	N
3311	The 'OperationName' operation was dispatched successfully.	Analytic	Y	N
3312	A message with size 'Size' bytes was read by the encoder.	Debug	Y	N
3313	A message with size 'Size' bytes was written by the encoder.	Debug	Y	N
3314	Session aborting for idle channel to uri:'RemoteAddress'.	Analytic	N	N
3319	Connection accept started.	Debug	Y	N
3320	ListenerId:ListenerHashCode accepted SocketId:SocketHashCode.	Debug	Y	N
3321	Pool for PoolKey has no available connection and busy busy connections.	Debug	Y	N
3322	Dispatcher started deserialization the request message.	Debug	Y	N
3323	Dispatcher completed deserialization the request message.	Debug	Y	N
3324	Dispatcher started serialization of the reply message.	Debug	Y	N
3325	Dispatcher completed serialization of the reply message.	Debug	Y	N
3326	Client request serialization started.	Debug	Y	N
3327	Client completed serialization of the request message.	Debug	Y	N
3328	Client started deserializing the reply message.	Debug	Y	N
3329	Client completed deserializing the reply message.	Debug	Y	N
3330	Security negotiation started.	Debug	N	N
3331	Security negotiation completed.	Debug	N	N
3332	SecurityTokenProvider opening completed.	Debug	N	N
3333	Outgoing message has been secured.	Debug	N	N
3334	Incoming message has been verified.	Debug	N	N
3335	Service instance retrieval started.	Debug	Y	N
3336	Service instance retrieved.	Debug	Y	N
3337	ChannelHandlerId:ChannelId - Message receive loop started.	Debug	Y	N
3338	ChannelHandlerId:ChannelId - Message receive loop stopped.	Debug	Y	N
3339	ChannelFactory created.	Debug	Y	N
3340	Pipe connection accept started on uri .	Debug	N	N
3341	Pipe connection accepted.	Debug	N	N
3342	Connection establishment started for Key.	Debug	Y	N
3343	Connection established.	Debug	Y	N
3345	Session preamble for 'Via' understood.	Debug	Y	N
3346	Connection reader sending fault 'FaultString'.	Debug	N	N
3347	Socket accept closed.	Debug	N	N
3348	Service host faulted.	Analytic	N	N
3349	Listener opening for 'Uri'.	Debug	N	N
3350	Listener open completed.	Debug	N	N
3351	Server max pooled connections quota reached.	Analytic	N	N
3352	SocketId:SocketId to remote address Uri timed out.	Analytic	N	N
3353	SocketId:SocketId to remote address Uri had a connection reset error.	Analytic	Y	N
3354	Service security negotiation completed.	Debug	N	N
3355	Security negotiation processing failed.	Analytic	N	N
3356	Security verification succeeded.	Debug	N	N
3357	Security verification failed.	Analytic	N	N
3358	Socket duplicated for Uri.	Debug	N	N
3359	Security impersonation succeeded.	Debug	Y	N
3360	Security impersonation failed.	Analytic	N	N
3361	Http channel request aborted.	Analytic	N	N
3362	Http channel response aborted.	Analytic	N	N
3363	Http authentication failed.	Analytic	N	N
3364	SharedListenerProxy registration started for uri 'Uri'.	Analytic	N	N
3365	SharedListenerProxy Register Stop.	Analytic	N	N
3366	SharedListenerProxy register failed with status 'Status'.	Analytic	N	N
3367	ConnectionPoolPreambleFailed.	Analytic	N	N
3368	SslOnAcceptUpgradeStart	Analytic	N	N
3369	SslOnAcceptUpgradeStop	Analytic	N	N
3370	BinaryMessageEncoder started encoding the message.	Debug	Y	N
3371	MtomMessageEncoder started encoding the message.	Debug	N	N
3372	TextMessageEncoder started encoding the message.	Debug	N	N
3373	BinaryMessageEncoder started decoding the message.	Debug	Y	N
3374	MtomMessageEncoder started decoding the message.	Debug	N	N
3375	TextMessageEncoder started decoding the message.	Debug	N	N
3376	Http transport started receiving a message.	Debug	N	N
3377	SocketId:SocketId read 'Size' bytes read from 'Endpoint'.	Debug	Y	N
3378	SocketId:SocketId read 'Size' bytes read from 'Endpoint'.	Debug	Y	N
3379	SocketId:SocketId writing 'Size' bytes to 'Endpoint'.	Debug	Y	N
3380	SocketId:SocketId writing 'Size' bytes to 'Endpoint'.	Debug	N	N
3381	SessionId:SessionId acknowledgement sent.	Debug	N	N
3382	SessionId:SessionId reconnecting.	Debug	N	N
3383	SessionId:SessionId faulted.	Debug	N	N
3384	WindowsStreamSecurity initiating security upgrade.	Analytic	Y	N
3385	Windows streaming security on accepting upgrade.	Analytic	Y	N
3386	SocketId:SocketId is aborting.	Analytic	Y	N
3388	HttpGetContext start.	Analytic	N	N
3389	Client sending preamble start.	Debug	Y	N
3390	Client sending preamble stop.	Debug	Y	N
3391	Http Message receive failed.	Analytic	N	N
3392	TransactionScope is being created with LocalIdentifier:'LocalId' and …	Debug	N	N
3393	A streamed message was read by the encoder.	Debug	N	N
3394	A streamed message was written by the encoder.	Debug	N	N
3395	A message was written asynchronously by the encoder.	Debug	N	N
3396	BufferId:BufferId completed writing 'Size' bytes to underlying stream.	Debug	N	N
3397	A message was written asynchronously by the encoder.	Debug	N	N
3398	Pipe shared memory created at 'sharedMemoryName' .	Debug	N	N
3399	NamedPipe 'pipeName' created.	Debug	N	N
3401	Signature verification started.	Debug	N	N
3402	Signature verification succeeded	Debug	N	N
3403	Wrapped key decryption started.	Debug	N	N
3404	Wrapped key decryption succeeded.	Debug	N	N
3405	Encrypted data processing started.	Debug	N	N
3406	Encrypted data processing succeeded.	Debug	N	N
3407	Http message handler started processing the inbound request.	Debug	N	N
3408	Http message handler started processing the inbound request asynchronously.	Debug	N	N
3409	Http message handler completed processing an inbound request.	Debug	N	N
3410	Http message handler is faulted.	Analytic	N	N
3411	WebSocket connection timed out.	Analytic	N	N
3412	Http message handler started processing the response.	Debug	N	N
3413	Http message handler started processing the response asynchronously.	Debug	N	N
3414	Http message handler completed processing the response.	Debug	N	N
3415	WebSocket connection request to 'remoteAddress' send start.	Debug	N	N
3416	WebSocketId:WebSocketId connection request sent.	Debug	N	N
3417	WebSocket connection accept start.	Debug	N	N
3418	WebSocketId:WebSocketId connection accepted.	Debug	N	N
3419	WebSocket connection declined with status code 'errorMessage'.	Analytic	N	N
3420	WebSocket connection request failed: 'errorMessage'.	Analytic	N	N
3421	WebSocketId:WebSocketId connection is aborted.	Analytic	N	N
3422	WebSocketId:WebSocketId writing 'websocketId' bytes to 'byteCount'.	Debug	N	N
3423	WebSocketId:WebSocketId asynchronous write stop.	Debug	N	N
3424	WebSocketId:WebSocketId read start.	Debug	N	N
3425	WebSocketId:WebSocketId read 'websocketId' bytes from 'byteCount'.	Debug	N	N
3426	WebSocketId:WebSocketId sending close message to 'websocketId' with close status …	Debug	N	N
3427	WebSocketId:WebSocketId sending close output message to 'websocketId' with close …	Debug	N	N
3428	WebSocketId:WebSocketId connection closed.	Debug	N	N
3429	WebSocketId:WebSocketId connection close message received with status …	Debug	N	N
3430	Using the WebSocketVersion from a client WebSocket factory of type …	Debug	N	N
3431	Creating the client WebSocket with a factory of type …	Debug	N	N
3501	ContractDescription with Name='data1' and Namespace='data2' has been inferred …	Analytic	N	N
3502	OperationDescription with Name='data1' in contract 'data2' has been inferred …	Analytic	N	N
3503	A duplicate CorrelationQuery was found with Where='data1'.	Analytic	N	N
3507	A service endpoint has been added for address 'data1', binding 'data2', and …	Analytic	N	N
3508	TrackingProfile 'TrackingProfile' for the ActivityDefinitionId …	Analytic	N	N
3550	Operation 'data1' cannot be performed at this time.	Analytic	N	N
3551	Operation 'data2' on service instance 'data1' cannot be performed at this time.	Analytic	N	N
3552	The throttle 'MaxPendingMessagesPerChannel' limit of 'limit' was hit.	Analytic	N	N
3553	XamlServicesLoad start	Debug	N	N
3554	XamlServicesLoad Stop	Debug	N	N
3555	CreateWorkflowServiceHost start	Debug	N	N
3556	CreateWorkflowServiceHost Stop	Debug	N	N
3557	The call to EndCommit on the CommittableTransaction with id = 'data1' threw a …	Analytic	N	N
3558	Service activation start	Analytic	N	N
3559	Service activation Stop	Analytic	N	N
3560	Available memory (bytes): Available_memory_bytes.	Analytic	N	N
3561	The service could not be activated.	Operational	N	N
3800	The Routing Service is closing client 'data1'.	Debug	N	N
3801	Routing Service client 'data1' has faulted.	Debug	N	N
3802	A Routing Service one way message is completing.	Debug	N	N
3803	The Routing Service failed while processing a message on the endpoint with …	Debug	N	N
3804	The Routing Service is creating a client for endpoint: 'data1'.	Debug	N	N
3805	The Routing Service is configured with RouteOnHeadersOnly: data1, …	Debug	N	N
3807	A Routing Service request reply message is completing.	Debug	N	N
3809	The Routing Service routed message with ID: 'data1' to data2 endpoint lists.	Debug	N	N
3810	A new RoutingConfiguration has been applied to the Routing Service.	Debug	N	N
3815	The Routing Service is processing a message with ID: 'data1', Action: 'data2', …	Debug	N	N
3816	The Routing Service is transmitting the message with ID: 'data1' [operation …	Debug	N	N
3817	The Routing Service is committing a transaction with id: 'data1'.	Debug	N	N
3818	Routing Service component data1 encountered a duplex callback exception.	Debug	N	N
3819	Routing Service message with ID: 'data1' [operation data2] moved to backup …	Debug	N	N
3820	The Routing Service created a new Transaction with id 'data1' for processing …	Debug	N	N
3821	The Routing Service failed while closing outbound client 'data1'.	Debug	N	N
3822	The Routing Service is sending back a response message with Action 'data1'.	Debug	N	N
3823	The Routing Service is sending back a Fault response message with Action …	Debug	N	N
3824	The Routing Service is calling ReceiveContext.	Debug	N	N
3825	The Routing Service is calling ReceiveContext.	Debug	N	N
3826	The Routing Service will send messages using existing transaction 'data1'.	Debug	N	N
3827	The Routing Service failed while sending to 'data1'.	Debug	N	N
3828	Routing Service MessageFilterTable Match Start.	Analytic	N	N
3829	Routing Service MessageFilterTable Match Stop.	Analytic	N	N
3830	The Routing Service is calling abort on channel: 'data1'.	Debug	N	N
3831	The Routing Service has handled an exception.	Debug	N	N
3832	The Routing Service successfully transmitted Message with ID: 'data1 [operation …	Debug	N	N
4001	Transport listener session received with via 'via'.	Analytic	N	N
4002	FailFastException.	Analytic	N	N
4003	Service start pipe error.	Analytic	N	N
4008	Session dispatch started.	Analytic	N	N
4010	Session dispatch for 'Uri' failed since pending session queue is full with …	Analytic	N	N
4011	Message queue register start.	Analytic	N	N
4012	Message queue registration aborted with status:'Status' for uri:'Uri'.	Analytic	N	N
4013	Message queue unregister succeeded for uri:'Uri'.	Analytic	N	N
4014	Message queue registration for uri:'Uri' failed with status:'Status'.	Analytic	N	N
4015	Message queue registration completed for uri 'Uri'.	Analytic	N	N
4016	Message queue failed duplicating socket.	Analytic	N	N
4019	MessageQueueDuplicatedSocketComplete	Analytic	N	N
4020	Tcp transport listener starting to listen on uri:'Uri'.	Analytic	N	N
4021	Tcp transport listener listening.	Analytic	N	N
4022	Error Code:Error_Code.	Analytic	N	N
4023	Was closing all listener channel instances completed.	Analytic	N	N
4024	Error Code:Error_Code.	Analytic	N	N
4025	Error Code:Error_Code.	Analytic	N	N
4026	WAS Connected.	Analytic	N	N
4027	WAS Disconnected.	Analytic	N	N
4028	Pipe transport listener listening start on uri:Uri.	Analytic	N	N
4029	Pipe transport listener listening stop.	Analytic	N	N
4030	Session dispatch succeeded.	Analytic	N	N
4031	Session dispatch failed.	Analytic	N	N
4032	WAS connection timed out.	Analytic	N	N
4033	Routing table lookup started.	Debug	N	N
4034	Routing table lookup completed.	Debug	N	N
4035	Pending session queue ratio: Pending_session_queue_ratio/curr.	Debug	N	N
4201	End SQL command execution: End_SQL_command_execution.	Debug	N	N
4202	Starting SQL command execution: Starting_SQL_command_execution.	Debug	N	N
4203	Failed to extend lock expiration, lock expiration already passed or the lock …	Debug	N	N
4205	Command failed: Command_failed.	Debug	N	N
4206	Encountered exception data1 while attempting to unlock instance.	Debug	N	N
4207	Giving up retrying a SQL command as the maximum number of retries have been …	Debug	N	N
4208	Retrying a SQL command due to SQL error number data1.	Debug	N	N
4209	Timeout trying to open a SQL connection.	Debug	N	N
4210	Caught SQL Exception number data1 message data2.	Debug	N	N
4211	Queuing SQL retry with delay data1 milliseconds.	Debug	N	N
4212	Timeout trying to acquire the instance lock.	Debug	N	N
4213	Detection of runnable instances failed due to the following exception	Debug	N	N
4214	Recovering instance locks failed due to the following exception	Debug	N	N
4600	Message could not be logged as it exceeds the ETW event size	Debug	N	N
4801	The DiscoveryClient created inside DiscoveryClientChannel failed to close and …	Debug	N	N
4802	A ProtocolException was suppressed while closing the DiscoveryClient.	Debug	N	N
4803	The DiscoveryClient received a multicast suppression message from a …	Debug	N	N
4804	A discoveryMessageName message with messageId='messageId' was dropped by the …	Debug	N	N
4805	A messageType message with messageId='messageId' was dropped because it had …	Debug	N	N
4806	A discoveryMessageName message with messageId='messageId' and …	Debug	N	N
4807	A discovery request message with messageId='messageId' was dropped because it …	Debug	N	N
4808	A messageType message was dropped because it did not have any content.	Debug	N	N
4809	A messageType message was dropped because the message header did not contain the …	Debug	N	N
4810	A discoveryMessageName message with messageId='messageId' was dropped by the …	Debug	N	N
4811	A discoveryMessageName message with messageId='messageId' was dropped by the …	Debug	N	N
4812	A discovery request message with messageId='messageId' was dropped because it …	Debug	N	N
4813	A messageType message with messageId='messageId' was dropped because it was a …	Debug	N	N
4814	The discoverability of endpoint with EndpointAddress='endpointAddress' and …	Debug	N	N
4815	The discoverability of endpoint with EndpointAddress='endpointAddress' and …	Debug	N	N
4816	A Find operation was initiated in the DiscoveryClientChannel to discover …	Debug	N	N
4817	The DiscoveryClientChannel failed to create the channel with a discovered …	Debug	N	N
4818	The DiscoveryClientChannel failed to open the channel with a discovered endpoint …	Debug	N	N
4819	The DiscoveryClientChannel successfully discovered an endpoint and opened the …	Debug	N	N
4820	The SynchronizationContext has been reset to its original value of …	Debug	N	N
4821	The SynchronizationContext has been set to null by DiscoveryClientChannel before …	Debug	N	N
5001	DataContract serialize SurrogateType with surrogates start.	Debug	N	N
5002	DataContract serialize with surrogates stop.	Debug	N	N
5003	DataContract deserialize SurrogateType with surrogates start.	Debug	N	N
5004	DataContract deserialize with surrogates stop.	Debug	N	N
5005	ImportKnownTypes start.	Debug	Y	N
5006	ImportKnownTypes stop.	Debug	Y	N
5007	DataContract resolver resolving TypeName start.	Debug	N	N
5008	DataContract generate Kind writer for TypeName start.	Debug	Y	N
5009	DataContract generate writer stop.	Debug	Y	N
5010	DataContract generate Kind reader for TypeName start.	Debug	Y	N
5011	DataContract generation stop.	Debug	Y	N
5012	Json generate Kind reader for TypeName start.	Debug	N	N
5013	Json reader generation stop.	Debug	N	N
5014	Json generate Kind writer for TypeName start.	Debug	N	N
5015	Json generate writer stop.	Debug	N	N
5016	Generate Xml serializable for 'DCType' start.	Debug	N	N
5017	Generate Xml serializable stop.	Debug	N	N
5203	JsonMessageEncoder started decoding the message.	Debug	N	N
5204	JsonMessageEncoder started encoding the message.	Debug	N	N
5402	SecurityToken (type 'tokenType' and id 'tokenID') validation started.	Debug	Y	N
5403	SecurityToken (type 'tokenType' and id 'tokenID') validation succeeded.	Debug	Y	N
5404	SecurityToken (type 'tokenType' and id 'tokenID') validation failed.	Debug	N	N
5405	Retrieval of issuer name:issuerName from tokenId:tokenID succeeded.	Debug	N	N
5406	Retrieval of issuer name from tokenId:tokenID failed.	Debug	N	N
5600	Federation message processing started.	Debug	N	N
5601	Federation message processing succeeded.	Debug	N	N
5602	Creating federation message from form post started.	Debug	N	N
5603	Creating federation message from form post succeeded.	Debug	N	N
5604	Reading session token from session cookie started.	Debug	N	N
5605	Reading session token from session cookie succeeded.	Debug	N	N
5606	Principal setting from session token started.	Debug	N	N
5607	Principal setting from session token succeeded.	Debug	N	N
39456	Size of tracking record RecordNumber exceeds maximum allowed by the ETW session …	Debug	N	N
39457	Tracking Record data1 raised to data2.	Debug	N	N
39458	Truncated tracking record RecordNumber written to ETW session with provider …	Debug	N	N
39459	Tracking data Data extracted in activity Activity.	Debug	N	N
39460	The extracted argument/variable 'name' is not serializable.	Debug	N	N
57393	AppDomain unloading.	Debug	N	N
57394	Handling an exception.	Analytic	Y	N
57395	An unexpected failure occurred.	Analytic	N	N
57396	Throwing an exception.	Analytic	Y	N
57397	Unhandled exception.	Operational	N	N
57398	The system hit the limit set for throttle 'MaxConcurrentInstances'.	Analytic	N	N
57399	Wrote to the EventLog.	Debug	N	N
57400	Wrote to the EventLog.	Debug	N	N
57401	Wrote to the EventLog.	Debug	N	N
57402	Wrote to the EventLog.	Debug	N	N
57403	Wrote to the EventLog.	Debug	N	N
57404	Handling an exception.	Analytic	N	N
57405	Handling an exception.	Operational	Y	N
57406	Handling an exception Exception details: data1.	Analytic	N	N
57407	Throwing an exception.	Analytic	N	N
57408	Unhandled exception.	Operational	N	N
57409	Throwing an exception.	Analytic	Y	N
57410	Throwing an exception.	Analytic	Y	N
62326	The url 'data1' hosts XAML document with root element type 'data2'.	Debug	N	N

Event ID 100: TrackRecord= WorkflowInstanceRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, State = State, Annotations = Annotatio...

Channel: Analytic
Task: WorkflowInstanceRecord

Description

TrackRecord= WorkflowInstanceRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, State = State, Annotations = Annotations, ProfileName = ProfileName.

Message #

TrackRecord= WorkflowInstanceRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, State = %5, Annotations = %6, ProfileName = %7

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`State` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 101: TrackRecord = WorkflowInstanceUnhandledExceptionRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, SourceName =...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: UnhandledExceptionRecord

Description

TrackRecord = WorkflowInstanceUnhandledExceptionRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, SourceName = SourceName, SourceId = SourceId, SourceInstanceId = SourceInstanceId, SourceTypeName=SourceTypeName, Exception=Exception, Annotations= Annotations, ProfileName = ProfileName

Message #

TrackRecord = WorkflowInstanceUnhandledExceptionRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, SourceName = %5, SourceId = %6, SourceInstanceId = %7, SourceTypeName=%8, Exception=%9, Annotations= %10, ProfileName = %11

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`SourceName` UnicodeString
`SourceId` UnicodeString
`SourceInstanceId` UnicodeString
`SourceTypeName` UnicodeString
`Exception` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 102: TrackRecord = WorkflowInstanceAbortedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotation...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: AbortedRecord

Description

TrackRecord = WorkflowInstanceAbortedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotations = Annotations, ProfileName = ProfileName.

Message #

TrackRecord = WorkflowInstanceAbortedRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, Reason = %5, Annotations = %6, ProfileName = %7

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`Reason` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 103: TrackRecord = ActivityStateRecord, InstanceID = InstanceId, RecordNumber=RecordNumber, EventTime=EventTime, State = State, Name=Name, ActivityId=ActivityId, ActivityInstanceId=ActivityInstanceId, A...

Channel: Analytic
Task: WorkflowTracking

Description

TrackRecord = ActivityStateRecord, InstanceID = , RecordNumber=, EventTime=, State = , Name=, ActivityId=, ActivityInstanceId=, ActivityTypeName=, Arguments=, Variables=, Annotations=, ProfileName =.

Message #

TrackRecord = ActivityStateRecord, InstanceID = %1, RecordNumber=%2, EventTime=%3, State = %4, Name=%5, ActivityId=%6, ActivityInstanceId=%7, ActivityTypeName=%8, Arguments=%9, Variables=%10, Annotations=%11, ProfileName = %12

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`State` UnicodeString
`Name` UnicodeString
`ActivityId` UnicodeString
`ActivityInstanceId` UnicodeString
`ActivityTypeName` UnicodeString
`Arguments` UnicodeString
`Variables` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 104: TrackRecord = ActivityScheduledRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, Name = Name, ActivityId = ActivityId, ActivityInstanceId = ActivityInstanceId, Ac...

Channel: Analytic
Task: WorkflowTracking

Description

TrackRecord = ActivityScheduledRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, Name = Name, ActivityId = ActivityId, ActivityInstanceId = ActivityInstanceId, ActivityTypeName = ActivityTypeName, ChildActivityName = ChildActivityName, ChildActivityId = ChildActivityId, ChildActivityInstanceId = ChildActivityInstanceId, ChildActivityTypeName =ChildActivityTypeName, Annotations=Annotations, ProfileName = ProfileName

Message #

TrackRecord = ActivityScheduledRecord, InstanceID = %1,  RecordNumber = %2, EventTime = %3, Name = %4, ActivityId = %5, ActivityInstanceId = %6, ActivityTypeName = %7, ChildActivityName = %8, ChildActivityId = %9, ChildActivityInstanceId = %10, ChildActivityTypeName =%11, Annotations=%12, ProfileName = %13

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`Name` UnicodeString
`ActivityId` UnicodeString
`ActivityInstanceId` UnicodeString
`ActivityTypeName` UnicodeString
`ChildActivityName` UnicodeString
`ChildActivityId` UnicodeString
`ChildActivityInstanceId` UnicodeString
`ChildActivityTypeName` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 105: TrackRecord = FaultPropagationRecord, InstanceID=.

Channel: Analytic
Task: WorkflowTracking

Description

TrackRecord = FaultPropagationRecord, InstanceID=InstanceId, RecordNumber=RecordNumber, EventTime=EventTime, FaultSourceActivityName=FaultSourceActivityName, FaultSourceActivityId=FaultSourceActivityId, FaultSourceActivityInstanceId=FaultSourceActivityInstanceId, FaultSourceActivityTypeName=FaultSourceActivityTypeName, FaultHandlerActivityName=FaultHandlerActivityName, FaultHandlerActivityId = FaultHandlerActivityId, FaultHandlerActivityInstanceId =FaultHandlerActivityInstanceId, FaultHandlerActivityTypeName=FaultHandlerActivityTypeName, Fault=Fault, IsFaultSource=IsFaultSource, Annotations=Annotations, ProfileName = ProfileName

Message #

TrackRecord = FaultPropagationRecord, InstanceID=%1, RecordNumber=%2, EventTime=%3, FaultSourceActivityName=%4, FaultSourceActivityId=%5, FaultSourceActivityInstanceId=%6, FaultSourceActivityTypeName=%7, FaultHandlerActivityName=%8,  FaultHandlerActivityId = %9, FaultHandlerActivityInstanceId =%10, FaultHandlerActivityTypeName=%11, Fault=%12, IsFaultSource=%13, Annotations=%14, ProfileName = %15

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`FaultSourceActivityName` UnicodeString
`FaultSourceActivityId` UnicodeString
`FaultSourceActivityInstanceId` UnicodeString
`FaultSourceActivityTypeName` UnicodeString
`FaultHandlerActivityName` UnicodeString
`FaultHandlerActivityId` UnicodeString
`FaultHandlerActivityInstanceId` UnicodeString
`FaultHandlerActivityTypeName` UnicodeString
`Fault` UnicodeString
`IsFaultSource` UInt8
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 106: TrackRecord = CancelRequestedRecord, InstanceID=.

Channel: Analytic
Task: WorkflowTracking

Description

TrackRecord = CancelRequestedRecord, InstanceID=InstanceId, RecordNumber=RecordNumber, EventTime=EventTime, Name=Name, ActivityId=ActivityId, ActivityInstanceId=ActivityInstanceId, ActivityTypeName = ActivityTypeName, ChildActivityName = ChildActivityName, ChildActivityId = ChildActivityId, ChildActivityInstanceId = ChildActivityInstanceId, ChildActivityTypeName =ChildActivityTypeName, Annotations=Annotations, ProfileName = ProfileName

Message #

TrackRecord = CancelRequestedRecord, InstanceID=%1, RecordNumber=%2, EventTime=%3, Name=%4, ActivityId=%5, ActivityInstanceId=%6, ActivityTypeName = %7, ChildActivityName = %8, ChildActivityId = %9, ChildActivityInstanceId = %10, ChildActivityTypeName =%11, Annotations=%12, ProfileName = %13

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`Name` UnicodeString
`ActivityId` UnicodeString
`ActivityInstanceId` UnicodeString
`ActivityTypeName` UnicodeString
`ChildActivityName` UnicodeString
`ChildActivityId` UnicodeString
`ChildActivityInstanceId` UnicodeString
`ChildActivityTypeName` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 107: TrackRecord = BookmarkResumptionRecord, InstanceID=.

Channel: Analytic
Task: WorkflowTracking

Description

TrackRecord = BookmarkResumptionRecord, InstanceID=InstanceId, RecordNumber=RecordNumber,EventTime=EventTime, Name=Name, SubInstanceID=SubInstanceID, OwnerActivityName=OwnerActivityName, OwnerActivityId =OwnerActivityId, OwnerActivityInstanceId=OwnerActivityInstanceId, OwnerActivityTypeName=OwnerActivityTypeName, Annotations=Annotations, ProfileName = ProfileName

Message #

TrackRecord = BookmarkResumptionRecord, InstanceID=%1, RecordNumber=%2,EventTime=%3, Name=%4, SubInstanceID=%5,  OwnerActivityName=%6, OwnerActivityId =%7, OwnerActivityInstanceId=%8, OwnerActivityTypeName=%9, Annotations=%10, ProfileName = %11

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`Name` UnicodeString
`SubInstanceID` GUID
`OwnerActivityName` UnicodeString
`OwnerActivityId` UnicodeString
`OwnerActivityInstanceId` UnicodeString
`OwnerActivityTypeName` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 108: TrackRecord = CustomTrackingRecord, InstanceID = InstanceId, RecordNumber=RecordNumber, EventTime=EventTime, Name=Name, ActivityName=ActivityName, ActivityId=ActivityId, ActivityInstanceId=Activity...

Channel: Analytic
Task: CustomTrackingRecord

Description

TrackRecord = CustomTrackingRecord, InstanceID = , RecordNumber=, EventTime=, Name=, ActivityName=, ActivityId=, ActivityInstanceId=, ActivityTypeName=, Data=, Annotations=, ProfileName =.

Message #

TrackRecord = CustomTrackingRecord, InstanceID = %1, RecordNumber=%2, EventTime=%3,  Name=%4, ActivityName=%5, ActivityId=%6, ActivityInstanceId=%7, ActivityTypeName=%8, Data=%9, Annotations=%10, ProfileName = %11

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`Name` UnicodeString
`ActivityName` UnicodeString
`ActivityId` UnicodeString
`ActivityInstanceId` UnicodeString
`ActivityTypeName` UnicodeString
`Data` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 110: TrackRecord = CustomTrackingRecord, InstanceID = InstanceId, RecordNumber=RecordNumber, EventTime=EventTime, Name=Name, ActivityName=ActivityName, ActivityId=ActivityId, ActivityInstanceId=Activity...

Channel: Analytic
Task: CustomTrackingRecord

Description

TrackRecord = CustomTrackingRecord, InstanceID = , RecordNumber=, EventTime=, Name=, ActivityName=, ActivityId=, ActivityInstanceId=, ActivityTypeName=, Data=, Annotations=, ProfileName =.

Message #

TrackRecord = CustomTrackingRecord, InstanceID = %1, RecordNumber=%2, EventTime=%3, Name=%4, ActivityName=%5, ActivityId=%6, ActivityInstanceId=%7, ActivityTypeName=%8, Data=%9, Annotations=%10, ProfileName = %11

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`Name` UnicodeString
`ActivityName` UnicodeString
`ActivityId` UnicodeString
`ActivityInstanceId` UnicodeString
`ActivityTypeName` UnicodeString
`Data` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 111: TrackRecord = CustomTrackingRecord, InstanceID = InstanceId, RecordNumber=RecordNumber, EventTime=EventTime, Name=Name, ActivityName=ActivityName, ActivityId=ActivityId, ActivityInstanceId=Activity...

Channel: Analytic
Task: CustomTrackingRecord

Description

TrackRecord = CustomTrackingRecord, InstanceID = , RecordNumber=, EventTime=, Name=, ActivityName=, ActivityId=, ActivityInstanceId=, ActivityTypeName=, Data=, Annotations=, ProfileName =.

Message #

TrackRecord = CustomTrackingRecord, InstanceID = %1, RecordNumber=%2, EventTime=%3, Name=%4, ActivityName=%5, ActivityId=%6, ActivityInstanceId=%7, ActivityTypeName=%8, Data=%9, Annotations=%10, ProfileName = %11

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`Name` UnicodeString
`ActivityName` UnicodeString
`ActivityId` UnicodeString
`ActivityInstanceId` UnicodeString
`ActivityTypeName` UnicodeString
`Data` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 112: TrackRecord = WorkflowInstanceSuspendedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotati...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: SuspendedRecord

Description

TrackRecord = WorkflowInstanceSuspendedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotations = Annotations, ProfileName = ProfileName.

Message #

TrackRecord = WorkflowInstanceSuspendedRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, Reason = %5, Annotations = %6, ProfileName = %7

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`Reason` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 113: TrackRecord = WorkflowInstanceTerminatedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotat...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: TerminatedRecord

Description

TrackRecord = WorkflowInstanceTerminatedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotations = Annotations, ProfileName = ProfileName.

Message #

TrackRecord = WorkflowInstanceTerminatedRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, Reason = %5, Annotations = %6, ProfileName = %7

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`Reason` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 114: TrackRecord= WorkflowInstanceRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, State = State, Annotations = Annotatio...

Channel: Analytic
Task: WorkflowInstanceRecord

Description

Message #

TrackRecord= WorkflowInstanceRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, State = %5, Annotations = %6, ProfileName = %7, WorkflowDefinitionIdentity = %8

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`State` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`WorkflowDefinitionIdentity` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 115: TrackRecord = WorkflowInstanceAbortedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotation...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: AbortedWithId

Description

TrackRecord = WorkflowInstanceAbortedRecord, InstanceID = , RecordNumber = , EventTime = , ActivityDefinitionId = , Reason = , Annotations = , ProfileName = , WorkflowDefinitionIdentity =.

Message #

TrackRecord = WorkflowInstanceAbortedRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, Reason = %5,  Annotations = %6, ProfileName = %7, WorkflowDefinitionIdentity = %8

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`Reason` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`WorkflowDefinitionIdentity` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 116: TrackRecord = WorkflowInstanceSuspendedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotati...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: SuspendedWithId

Description

TrackRecord = WorkflowInstanceSuspendedRecord, InstanceID = , RecordNumber = , EventTime = , ActivityDefinitionId = , Reason = , Annotations = , ProfileName = , WorkflowDefinitionIdentity =.

Message #

TrackRecord = WorkflowInstanceSuspendedRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, Reason = %5, Annotations = %6, ProfileName = %7, WorkflowDefinitionIdentity = %8

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`Reason` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`WorkflowDefinitionIdentity` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 117: TrackRecord = WorkflowInstanceTerminatedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, Reason = Reason, Annotat...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: TerminatedWithId

Description

TrackRecord = WorkflowInstanceTerminatedRecord, InstanceID = , RecordNumber = , EventTime = , ActivityDefinitionId = , Reason = , Annotations = , ProfileName = , WorkflowDefinitionIdentity =.

Message #

TrackRecord = WorkflowInstanceTerminatedRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, Reason = %5,  Annotations = %6, ProfileName = %7, WorkflowDefinitionIdentity = %8

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`Reason` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`WorkflowDefinitionIdentity` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 118: TrackRecord = WorkflowInstanceUnhandledExceptionRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, SourceName =...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: UnhandledExceptionWithId

Description

Message #

TrackRecord = WorkflowInstanceUnhandledExceptionRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, SourceName = %5, SourceId = %6, SourceInstanceId = %7, SourceTypeName=%8, Exception=%9,  Annotations= %10, ProfileName = %11, WorkflowDefinitionIdentity = %12

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`SourceName` UnicodeString
`SourceId` UnicodeString
`SourceInstanceId` UnicodeString
`SourceTypeName` UnicodeString
`Exception` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`WorkflowDefinitionIdentity` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 119: TrackRecord= WorkflowInstanceUpdatedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, State = State, OriginalDefi...

Channel: Analytic
Task: WorkflowInstanceRecord
Opcode: UpdatedRecord

Description

TrackRecord= WorkflowInstanceUpdatedRecord, InstanceID = InstanceId, RecordNumber = RecordNumber, EventTime = EventTime, ActivityDefinitionId = ActivityDefinitionId, State = State, OriginalDefinitionIdentity = OriginalDefinitionIdentity, UpdatedDefinitionIdentity = UpdatedDefinitionIdentity, Annotations = Annotations, ProfileName = ProfileName

Message #

TrackRecord= WorkflowInstanceUpdatedRecord, InstanceID = %1, RecordNumber = %2, EventTime = %3, ActivityDefinitionId = %4, State = %5, OriginalDefinitionIdentity = %6, UpdatedDefinitionIdentity = %7, Annotations = %8, ProfileName = %9

Fields #

Name	Description
`InstanceId` GUID
`RecordNumber` Int64
`EventTime` FILETIME
`ActivityDefinitionId` UnicodeString
`State` UnicodeString
`OriginalDefinitionIdentity` UnicodeString
`UpdatedDefinitionIdentity` UnicodeString
`Annotations` UnicodeString
`ProfileName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 131: Pool allocating Size Bytes.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: BufferPooling
Opcode: Allocate

Message #

Pool allocating %1 Bytes.

Fields #

Name	Description
`Size` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "131",
    "version": "0",
    "level": "5",
    "task": "2509",
    "opcode": "12",
    "keywords": 1152921504606912512,
    "time_created": "2026-03-15T23:29:50.493381100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Size": "512",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 132: BufferPool of size PoolSize, changing quota by Delta.

Channel: Debug
Level: Verbose
Task: BufferPooling
Opcode: Tune

Message #

BufferPool of size %1, changing quota by %2.

Fields #

Name	Description
`PoolSize` Int32
`Delta` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "132",
    "version": "0",
    "level": "5",
    "task": "2509",
    "opcode": "13",
    "keywords": 1152921504606912512,
    "time_created": "2026-03-15T23:30:24.092322400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{a63d8622-0688-48d2-ba27-d3a099f2fe3d}"
    },
    "execution": {
      "process_id": "8484",
      "thread_id": "2808"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PoolSize": "262144",
    "Delta": "-1",
    "AppDomain": "DefaultDomain"
  },
  "message": ""
}

Event ID 133: IO Thread scheduler callback invoked.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ThreadScheduling
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "133",
    "version": "0",
    "level": "5",
    "task": "2593",
    "opcode": "1",
    "keywords": 1152921504608944128,
    "time_created": "2026-03-15T23:29:50.489398700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{fb0a7822-7b4b-45f4-bf59-3e1c0df8827e}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "7796"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 134: IO Thread scheduler callback invoked.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ThreadScheduling
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "134",
    "version": "0",
    "level": "5",
    "task": "2593",
    "opcode": "2",
    "keywords": 1152921504608944128,
    "time_created": "2026-03-15T23:29:50.489603500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{fb0a7822-7b4b-45f4-bf59-3e1c0df8827e}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "8452"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 201: The Dispatcher invoked 'AfterReceiveReply' on a ClientMessageInspector of type 'TypeName'.

Channel: Debug
Task: ClientRuntime
Opcode: ClientMessageInspectorAfterReceiveInvoked

Message #

The Dispatcher invoked 'AfterReceiveReply' on a ClientMessageInspector of type '%1'.

Fields #

Name	Description
`TypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 202: The Dispatcher invoked 'BeforeSendRequest' on a ClientMessageInspector of type 'TypeName'.

Channel: Analytic
Task: ClientRuntime
Opcode: ClientMessageInspectorBeforeSendInvoked

Message #

The Dispatcher invoked 'BeforeSendRequest' on a ClientMessageInspector of type  '%1'.

Fields #

Name	Description
`TypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 203: The Dispatcher invoked 'AfterCall' on a ClientParameterInspector of type 'TypeName'.

Channel: Analytic
Task: ClientRuntime
Opcode: ClientParameterInspectorStop

Message #

The Dispatcher invoked 'AfterCall' on a ClientParameterInspector of type '%1'.

Fields #

Name	Description
`TypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 204: The Dispatcher invoked 'BeforeCall' on a ClientParameterInspector of type 'TypeName'.

Channel: Analytic
Task: ClientRuntime
Opcode: ClientParameterInspectorStart

Message #

The Dispatcher invoked 'BeforeCall' on a ClientParameterInspector of type '%1'.

Fields #

Name	Description
`TypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 205: An OperationInvoker invoked the 'MethodName' method.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: OperationInvokerStart

Description

An OperationInvoker invoked the 'MethodName' method. Caller information: 'CallerInfo'.

Message #

An OperationInvoker invoked the '%1' method. Caller information: '%2'.

Fields #

Name	Description
`MethodName` UnicodeString
`CallerInfo` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "205",
    "version": "0",
    "level": "4",
    "task": "2533",
    "opcode": "53",
    "keywords": 2305843009214218244,
    "time_created": "2026-03-15T23:29:50.496508900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "MethodName": "TryAcquireTaskOwnershipLease",
    "CallerInfo": "::1:51230",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 206: The Dispatcher invoked an ErrorHandler of type 'TypeName' with an exception of type 'ExceptionTypeName'.

Channel: Analytic
Opcode: Info

Description

The Dispatcher invoked an ErrorHandler of type 'TypeName' with an exception of type 'ExceptionTypeName'. ErrorHandled == 'Handled'.

Message #

The Dispatcher invoked an ErrorHandler of type  '%1' with an exception of type '%3'.  ErrorHandled == '%2'.

Fields #

Name	Description
`TypeName` UnicodeString
`Handled` UInt8
`ExceptionTypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 207: The Dispatcher invoked a FaultProvider of type 'TypeName' with an exception of type 'ExceptionTypeName'.

Channel: Analytic
Opcode: Info

Message #

The Dispatcher invoked a FaultProvider of type '%1' with an exception of type '%2'.

Fields #

Name	Description
`TypeName` UnicodeString
`ExceptionTypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 208: The Dispatcher invoked 'AfterReceiveReply' on a MessageInspector of type 'TypeName'.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: DispathMessageInspectorAfterReceiveInvoked

Message #

The Dispatcher invoked 'AfterReceiveReply' on a MessageInspector of type '%1'.

Fields #

Name	Description
`TypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "208",
    "version": "0",
    "level": "4",
    "task": "2533",
    "opcode": "51",
    "keywords": 2305843009214218244,
    "time_created": "2026-03-15T23:30:19.363350200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{11da94e5-a08b-4071-9f06-9cc69bdc3867}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "1108"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "TypeName": "Microsoft.ActiveDirectory.WebServices.Shared.WebServices.IdentityManagementOperations.IdentityManagementMessageInspector",
    "HostReference": "",
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 209: The Dispatcher invoked 'BeforeSendRequest' on a MessageInspector of type 'TypeName'.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: DispathMessageInspectorBeforeSendInvoked

Message #

The Dispatcher invoked 'BeforeSendRequest' on a MessageInspector of type '%1'.

Fields #

Name	Description
`TypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "209",
    "version": "0",
    "level": "4",
    "task": "2533",
    "opcode": "52",
    "keywords": 2305843009214218244,
    "time_created": "2026-03-15T23:30:19.493348800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{11da94e5-a08b-4071-9f06-9cc69bdc3867}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "1108"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "TypeName": "Microsoft.ActiveDirectory.WebServices.Shared.WebServices.IdentityManagementOperations.IdentityManagementMessageInspector",
    "HostReference": "",
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 210: The 'ThrottleName' throttle limit of 'Limit' was hit.

Channel: Analytic
Opcode: Info

Message #

The '%1' throttle limit of '%2' was hit.

Fields #

Name	Description
`ThrottleName` UnicodeString
`Limit` Int64
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 211: The Dispatcher invoked 'AfterCall' on a ParameterInspector of type 'TypeName'.

Channel: Analytic
Task: DispatchMessage
Opcode: ParameterInspectorStop

Message #

The Dispatcher invoked 'AfterCall' on a ParameterInspector of type '%1'.

Fields #

Name	Description
`TypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 212: The Dispatcher invoked 'BeforeCall' on a ParameterInspector of type 'TypeName'.

Channel: Analytic
Task: DispatchMessage
Opcode: ParameterInspectorStart

Message #

The Dispatcher invoked 'BeforeCall' on a ParameterInspector of type '%1'.

Fields #

Name	Description
`TypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 213: ServiceHost started: 'ServiceTypeName'.

Channel: Analytic
Task: ServiceHostActivation
Opcode: Start

Message #

ServiceHost started: '%1'.

Fields #

Name	Description
`ServiceTypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 214: An OperationInvoker completed the call to the 'MethodName' method.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: OperationInvokerStop

Description

An OperationInvoker completed the call to the 'MethodName' method. The method call duration was 'Duration' ms.

Message #

An OperationInvoker completed the call to the '%1' method.  The method call duration was '%2' ms.

Fields #

Name	Description
`MethodName` UnicodeString
`Duration` Int64
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "214",
    "version": "0",
    "level": "4",
    "task": "2533",
    "opcode": "54",
    "keywords": 2305843009214611460,
    "time_created": "2026-03-15T23:29:50.497903800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "MethodName": "TryAcquireTaskOwnershipLease",
    "Duration": "15",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 215: The transport received a message from 'ListenAddress'.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: TransportReceive
Opcode: Stop

Message #

The transport received a message from '%1'.

Fields #

Name	Description
`ListenAddress` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "215",
    "version": "0",
    "level": "4",
    "task": "2599",
    "opcode": "2",
    "keywords": 2305843009214219264,
    "time_created": "2026-03-15T23:29:50.494160400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}",
      "RelatedActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ListenAddress": "net.tcp://localhost:1500/policy",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 216: The transport sent a message to 'DestinationAddress'.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: TransportSend
Opcode: Stop

Message #

The transport sent a message to '%1'.

Fields #

Name	Description
`DestinationAddress` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "216",
    "version": "0",
    "level": "4",
    "task": "2600",
    "opcode": "2",
    "keywords": 2305843009214219264,
    "time_created": "2026-03-15T23:29:50.493824000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DestinationAddress": "net.tcp://localhost:1500/policy",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 217: The Client is executing Action 'Action' associated with the 'ContractName' contract.

Channel: Debug
Also via: realtime ETW trace
Level: Informational
Task: ClientRuntime
Opcode: OperationPrepared

Description

The Client is executing Action 'Action' associated with the 'ContractName' contract. The message will be sent to 'Destination'.

Message #

The Client is executing Action '%1' associated with the '%2' contract. The message will be sent to '%3'.

Fields #

Name	Description
`Action` UnicodeString
`ContractName` UnicodeString
`Destination` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "217",
    "version": "0",
    "level": "4",
    "task": "2514",
    "opcode": "20",
    "keywords": 1152921504607371268,
    "time_created": "2026-03-15T23:29:50.483821000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}",
      "RelatedActivityID": "{d0302fac-41f0-4eb2-9a47-143bb68642d5}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Action": "http://schemas.microsoft.com/ws/2009/12/identityserver/protocols/policystore/IPolicyStore/TryAcquireTaskOwnershipLease",
    "ContractName": "IPolicyStore",
    "Destination": "net.tcp://localhost:1500/policy",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 218: The Client completed executing Action 'Action' associated with the 'ContractName' contract.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: ServiceChannelCall
Opcode: Stop

Description

The Client completed executing Action 'Action' associated with the 'ContractName' contract. The message was sent to 'Destination'.

Message #

The Client completed executing Action '%1' associated with the '%2' contract. The message was sent to '%3'.

Fields #

Name	Description
`Action` UnicodeString
`ContractName` UnicodeString
`Destination` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "218",
    "version": "0",
    "level": "4",
    "task": "2576",
    "opcode": "2",
    "keywords": 2305843009214218244,
    "time_created": "2026-03-15T23:29:50.498428800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Action": "http://schemas.microsoft.com/ws/2009/12/identityserver/protocols/policystore/IPolicyStore/TryAcquireTaskOwnershipLease",
    "ContractName": "IPolicyStore",
    "Destination": "net.tcp://localhost:1500/policy",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 219: There was an unhandled exception of type 'ExceptionTypeName' during message processing.

Channel: Analytic
Also via: realtime ETW trace
Level: Error
Task: DispatchMessage

Description

There was an unhandled exception of type 'ExceptionTypeName' during message processing. Full Exception Details: ExceptionToString.

Message #

There was an unhandled exception of type '%2' during message processing.  Full Exception Details: %1.

Fields #

Name	Description
`ExceptionToString` UnicodeString
`ExceptionTypeName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "219",
    "version": "0",
    "level": "2",
    "task": "2533",
    "opcode": "0",
    "keywords": 2305843009214611460,
    "time_created": "2026-03-15T23:30:27.680010500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{79d7d62d-1a6a-435e-b74a-b71f353b47cc}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "12988"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExceptionToString": "System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '10675199.02:48:05.4775807'. ---> System.IO.IOException: The read operation failed, see inner exception. ---> System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '10675199.02:48:05.4775807'. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)\n   --- End of inner exception stack trace ---\n   at System.Runtime.AsyncResult.End[TAsyncResult](IAsyncResult result)\n   at System.ServiceModel.Channels.ConnectionStream.EndRead(IAsyncResult asyncResult)\n   at System.Net.FixedSizeReader.ReadCallback(IAsyncResult transportResult)\n   --- End of inner exception stack trace ---\n   at System.Net.Security.NegotiateStream.EndRead(IAsyncResult asyncResult)\n   at System.ServiceModel.Channels.StreamConnection.EndRead()\n   --- End of inner exception stack trace ---\n   at System.Runtime.AsyncResult.End[TAsyncResult](IAsyncResult result)\n   at System.ServiceModel.Channels.TransportDuplexSessionChannel.EndTryReceive(IAsyncResult result, Message& message)\n   at System.ServiceModel.Dispatcher.DuplexChannelBinder.EndTryReceive(IAsyncResult result, RequestContext& requestContext)\n   at System.ServiceModel.Dispatcher.ErrorHandlingReceiver.EndTryReceive(IAsyncResult result, RequestContext& requestContext)",
    "ExceptionTypeName": "System.ServiceModel.CommunicationException",
    "HostReference": "",
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 220: The Dispatcher sent a message to the transport.

Channel: Analytic
Opcode: Info

Description

The Dispatcher sent a message to the transport. Correlation ID == 'CorrelationId'.

Message #

The Dispatcher sent a message to the transport. Correlation ID == '%1'.

Fields #

Name	Description
`CorrelationId` GUID
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 221: The Dispatcher received a message from the transport.

Channel: Analytic
Opcode: Info

Description

The Dispatcher received a message from the transport. Correlation ID == 'CorrelationId'.

Message #

The Dispatcher received a message from the transport. Correlation ID == '%1'.

Fields #

Name	Description
`CorrelationId` GUID
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 222: The 'MethodName' method threw an unhandled exception when invoked by the OperationInvoker.

Channel: Analytic
Task: DispatchMessage

Description

The 'MethodName' method threw an unhandled exception when invoked by the OperationInvoker. The method call duration was 'Duration' ms.

Message #

The '%1' method threw an unhandled exception when invoked by the OperationInvoker. The method call duration was '%2' ms.

Fields #

Name	Description
`MethodName` UnicodeString
`Duration` Int64
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 223: The 'MethodName' method threw a FaultException when invoked by the OperationInvoker.

Channel: Analytic
Also via: realtime ETW trace
Level: Warning
Task: DispatchMessage
Opcode: win:Info

Description

The 'MethodName' method threw a FaultException when invoked by the OperationInvoker. The method call duration was 'Duration' ms.

Message #

The '%1' method threw a FaultException when invoked by the OperationInvoker. The method call duration was '%2' ms.

Fields #

Name	Description
`MethodName` UnicodeString
`Duration` Int64
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{C651F5F6-1C0D-492E-8AE1-B4EFD7C9D503}",
    "event_source_name": "",
    "event_id": 223,
    "version": 0,
    "level": 3,
    "task": 2533,
    "opcode": 0,
    "keywords": "0x20000000000E0004",
    "time_created": "2026-06-02T05:18:59.146+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{77F3E607-361B-4E1B-94A1-97AA6C5D1BC1}"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 8268
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe",
    "Duration": 46,
    "HostReference": "",
    "MethodName": "GetADDomain"
  },
  "message": "DispatchMessage"
}

Event ID 224: The 'ThrottleName' throttle limit of 'Limit' is at 70%.

Channel: Analytic
Task: DispatchMessage

Message #

The '%1' throttle limit of '%2' is at 70%%.

Fields #

Name	Description
`ThrottleName` UnicodeString
`Limit` Int64
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 225: Calculated correlation key 'InstanceKey' using values 'Values' in parent scope 'ParentScope'.

Channel: Analytic
Task: Correlation

Message #

Calculated correlation key '%1' using values '%2' in parent scope '%3'.

Fields #

Name	Description
`InstanceKey` GUID
`Values` UnicodeString
`ParentScope` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 226: ClosedCount idle services out of total TotalCount activated services closed.

Channel: Analytic
Task: ServiceShutdown

Message #

%1 idle services out of total %2 activated services closed.

Fields #

Name	Description
`ClosedCount` Int32
`TotalCount` Int32
`AppDomain` UnicodeString

Event ID 301: Name:'Name', Reference:'HostReference', Payload:Payload.

Channel: Analytic
Opcode: Info

Message #

Name:'%1', Reference:'%2', Payload:%3

Fields #

Name	Description
`Name` UnicodeString
`HostReference` UnicodeString
`Payload` UnicodeString

Event ID 302: Name:'Name', Reference:'HostReference', Payload:Payload.

Channel: Analytic
Opcode: Info

Message #

Name:'%1', Reference:'%2', Payload:%3

Fields #

Name	Description
`Name` UnicodeString
`HostReference` UnicodeString
`Payload` UnicodeString

Event ID 303: Name:'Name', Reference:'HostReference', Payload:Payload.

Channel: Analytic
Opcode: Info

Message #

Name:'%1', Reference:'%2', Payload:%3

Fields #

Name	Description
`Name` UnicodeString
`HostReference` UnicodeString
`Payload` UnicodeString

Event ID 401: Activity boundary.

Channel: Analytic
Task: Signpost
Opcode: Stop

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 402: Activity boundary.

Channel: Analytic
Task: Signpost
Opcode: Start

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 403: Activity boundary.

Channel: Analytic
Task: Signpost
Opcode: Suspend

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 404: Activity boundary.

Channel: Analytic
Task: Signpost
Opcode: Resume

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 440: Activity boundary.

Channel: Analytic
Task: Signpost
Opcode: Start

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 441: Activity boundary.

Channel: Analytic
Task: Signpost
Opcode: Stop

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 451: data1.

Channel: Analytic
Opcode: Info

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 452: data1.

Channel: Analytic
Opcode: Info

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 499: Transfer event emitted.

Channel: Analytic
Opcode: Info

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 501: Begin compilation

Channel: Debug
Task: ServiceHostCompilation
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 502: End compilation

Channel: Debug
Task: ServiceHostCompilation
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 503: ServiceHostFactory begin creation

Channel: Debug
Task: ServiceHostFactoryCreation
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 504: ServiceHostFactory end creation

Channel: Debug
Task: ServiceHostFactoryCreation
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 505: Begin CreateServiceHost

Channel: Debug
Task: ServiceHostCreate
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 506: End CreateServiceHost

Channel: Debug
Task: ServiceHostCreate
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 507: HostedTransportConfigurationManager begin configuration initialization

Channel: Debug
Task: HostedTransportConfigurationManagerConfigInit
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 508: HostedTransportConfigurationManager end configuration initialization

Channel: Debug
Task: HostedTransportConfigurationManagerConfigInit
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 509: ServiceHost Open started.

Channel: Analytic
Task: ServiceHostOpen
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 510: ServiceHost Open completed.

Channel: Analytic
Task: ServiceHostOpen
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 513: Received request with virtual path 'VirtualPath' from the AppDomain 'AppDomainFriendlyName'.

Channel: Debug
Task: WebHostRequest
Opcode: Start

Message #

Received request with virtual path '%2' from the AppDomain '%1'.

Fields #

Name	Description
`AppDomainFriendlyName` UnicodeString
`VirtualPath` UnicodeString
`AppDomain` UnicodeString

Event ID 514: WebHostRequest stop.

Channel: Debug
Task: WebHostRequest
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 601: Processed ServiceActivation Element Relative Address:'RelativeAddress', Normalized Relative Address 'NormalizedAddress' .

Channel: Debug
Opcode: Info

Message #

Processed ServiceActivation Element Relative Address:'%1', Normalized Relative Address '%2' .

Fields #

Name	Description
`RelativeAddress` UnicodeString
`NormalizedAddress` UnicodeString
`AppDomain` UnicodeString

Event ID 602: Incoming request matches a ServiceActivation element with address 'IncomingAddress'.

Channel: Debug
Opcode: Info

Message #

Incoming request matches a ServiceActivation element with address '%1'.

Fields #

Name	Description
`IncomingAddress` UnicodeString
`AppDomain` UnicodeString

Event ID 603: Incoming request matches a WCF Service defined in Asp.

Channel: Debug
Opcode: Info

Description

Incoming request matches a WCF Service defined in Asp.Net route with address IncomingAddress.

Message #

Incoming request matches a WCF Service defined in Asp.Net route with address %1.

Fields #

Name	Description
`IncomingAddress` UnicodeString
`AppDomain` UnicodeString

Event ID 604: A new Asp.

Channel: Debug
Opcode: Info

Description

A new Asp.Net route 'AspNetRoutePrefix' with serviceType 'ServiceType' and serviceHostFactoryType 'ServiceHostFactoryType' is added.

Message #

A new Asp.Net route '%1' with serviceType '%2' and serviceHostFactoryType '%3' is added.

Fields #

Name	Description
`AspNetRoutePrefix` UnicodeString
`ServiceType` UnicodeString	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`ServiceHostFactoryType` UnicodeString
`AppDomain` UnicodeString

Event ID 605: IncrementBusyCount called.

Channel: Debug
Task: WebHostRequest

Description

IncrementBusyCount called. Source : IncrementBusyCount_called_Source.

Message #

IncrementBusyCount called. Source : %1

Fields #

Name	Description
`Data` UnicodeString
`AppDomain` UnicodeString

Event ID 606: DecrementBusyCount called.

Channel: Debug
Task: WebHostRequest
Opcode: Stop

Description

DecrementBusyCount called. Source : DecrementBusyCount_called_Source.

Message #

DecrementBusyCount called. Source : %1

Fields #

Name	Description
`Data` UnicodeString
`AppDomain` UnicodeString

Event ID 701: ServiceChannelOpen started.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: ServiceChannelOpen
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "701",
    "version": "0",
    "level": "4",
    "task": "2577",
    "opcode": "1",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.494289900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{fcff2a0b-f8d0-44a1-9ab2-8fe8ebc88bf4}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 702: ServiceChannelOpen completed.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: ServiceChannelOpen
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "702",
    "version": "0",
    "level": "4",
    "task": "2577",
    "opcode": "2",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.494292400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{fcff2a0b-f8d0-44a1-9ab2-8fe8ebc88bf4}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 703: ServiceChannelCall started.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: ServiceChannelCall
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "703",
    "version": "0",
    "level": "4",
    "task": "2576",
    "opcode": "1",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.483733900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{d0302fac-41f0-4eb2-9a47-143bb68642d5}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 704: ServiceChannel asynchronous calls started.

Channel: Analytic
Task: ServiceChannelCall
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 706: Http Send Request Start.

Channel: Debug
Task: TransportSend
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 707: Http Send Request Stop.

Channel: Debug
Task: TransportSend
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 708: Message received from http transport.

Channel: Analytic
Task: TransportReceive
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 709: Message dispatching started.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: DispatchStart

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "709",
    "version": "0",
    "level": "4",
    "task": "2533",
    "opcode": "49",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.494301700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 710: Start authentication for message dispatching

Channel: Analytic
Task: TransportReceive
Opcode: BeforeAuthentication

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 711: Start authorization for message dispatching

Channel: Analytic
Level: Verbose
Task: DispatchMessage
Opcode: BeforeAuthorization

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "711",
    "version": "0",
    "level": "5",
    "task": "2533",
    "opcode": "48",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.494332600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 712: Message dispatching completed

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: DispatchStop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "712",
    "version": "0",
    "level": "4",
    "task": "2533",
    "opcode": "50",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.498184700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 715: ServiceChannel Open Start.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: ClientRuntime
Opcode: ClientChannelOpenStart

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "715",
    "version": "0",
    "level": "4",
    "task": "2514",
    "opcode": "14",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.483833400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{aca24a28-f099-40ed-bfed-5272eec6c576}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 716: ServiceChannel Open Stop.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: ClientRuntime
Opcode: ClientChannelOpenStop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "716",
    "version": "0",
    "level": "4",
    "task": "2514",
    "opcode": "15",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.493346800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{aca24a28-f099-40ed-bfed-5272eec6c576}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 717: Http Send streamed message started.

Channel: Analytic
Task: TransportSend
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 1001: WorkflowInstance Id: 'data1' has completed in the Closed state.

Channel: Debug
Task: WFApplicationStateChange
Opcode: Completed

Message #

WorkflowInstance Id: '%1' has completed in the Closed state.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1002: WorkflowApplication Id: 'data1' was terminated.

Channel: Debug
Task: WFApplicationStateChange
Opcode: Terminated

Description

WorkflowApplication Id: 'data1' was terminated. It has completed in the Faulted state with an exception.

Message #

WorkflowApplication Id: '%1' was terminated. It has completed in the Faulted state with an exception.

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 1003: WorkflowInstance Id: 'data1' has completed in the Canceled state.

Channel: Debug
Task: WFApplicationStateChange
Opcode: InstanceCanceled

Message #

WorkflowInstance Id: '%1' has completed in the Canceled state.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1004: WorkflowInstance Id: 'data1' was aborted with an exception.

Channel: Debug
Task: WFApplicationStateChange
Opcode: InstanceAborted

Message #

WorkflowInstance Id: '%1' was aborted with an exception.

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 1005: WorkflowApplication Id: 'data1' went idle.

Channel: Debug
Task: WFApplicationStateChange
Opcode: Idled

Message #

WorkflowApplication Id: '%1' went idle.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1006: WorkflowInstance Id: 'data1' has encountered an unhandled exception.

Channel: Debug
Task: WFApplicationStateChange
Opcode: UnhandledException

Description

WorkflowInstance Id: 'data1' has encountered an unhandled exception. The exception originated from Activity 'data2', DisplayName: 'data3'. The following action will be taken: data4.

Message #

WorkflowInstance Id: '%1' has encountered an unhandled exception.  The exception originated from Activity '%2', DisplayName: '%3'.  The following action will be taken: %4.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 1007: WorkflowApplication Id: 'data1' was Persisted.

Channel: Debug
Task: WFApplicationStateChange
Opcode: Persisted

Message #

WorkflowApplication Id: '%1' was Persisted.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1008: WorkflowInstance Id: 'data1' was Unloaded.

Channel: Debug
Task: WFApplicationStateChange
Opcode: Unloaded

Message #

WorkflowInstance Id: '%1' was Unloaded.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1009: Parent Activity 'data1', DisplayName: 'data2', InstanceId: 'data3' scheduled child Activity 'data4', DisplayName: 'data5', InstanceId: 'data6'.

Channel: Debug
Task: ScheduleActivity

Message #

Parent Activity '%1', DisplayName: '%2', InstanceId: '%3' scheduled child Activity '%4', DisplayName: '%5', InstanceId: '%6'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`data6` UnicodeString
`AppDomain` UnicodeString

Event ID 1010: Activity 'data1', DisplayName: 'data2', InstanceId: 'data3' has completed in the 'data4' state.

Channel: Debug
Task: CompleteActivity

Message #

Activity '%1', DisplayName: '%2', InstanceId: '%3' has completed in the '%4' state.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`AppDomain` UnicodeString

Event ID 1011: An ExecuteActivityWorkItem has been scheduled for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: ScheduleWorkItem
Opcode: ScheduleExecuteActivity

Message #

An ExecuteActivityWorkItem has been scheduled for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1012: Starting execution of an ExecuteActivityWorkItem for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: StartWorkItem
Opcode: StartExecuteActivity

Message #

Starting execution of an ExecuteActivityWorkItem for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1013: An ExecuteActivityWorkItem has completed for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: CompleteWorkItem
Opcode: CompleteExecuteActivity

Message #

An ExecuteActivityWorkItem has completed for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1014: A CompletionWorkItem has been scheduled for parent Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: ScheduleWorkItem
Opcode: ScheduleCompletion

Description

A CompletionWorkItem has been scheduled for parent Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'. Completed Activity 'data4', DisplayName: 'data5', InstanceId: 'data6'.

Message #

A CompletionWorkItem has been scheduled for parent Activity '%1', DisplayName: '%2', InstanceId: '%3'.  Completed Activity '%4', DisplayName: '%5', InstanceId: '%6'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`data6` UnicodeString
`AppDomain` UnicodeString

Event ID 1015: Starting execution of a CompletionWorkItem for parent Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: StartWorkItem
Opcode: StartCompletion

Description

Starting execution of a CompletionWorkItem for parent Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'. Completed Activity 'data4', DisplayName: 'data5', InstanceId: 'data6'.

Message #

Starting execution of a CompletionWorkItem for parent Activity '%1', DisplayName: '%2', InstanceId: '%3'. Completed Activity '%4', DisplayName: '%5', InstanceId: '%6'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`data6` UnicodeString
`AppDomain` UnicodeString

Event ID 1016: A CompletionWorkItem has completed for parent Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: CompleteWorkItem
Opcode: CompleteCompletion

Description

A CompletionWorkItem has completed for parent Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'. Completed Activity 'data4', DisplayName: 'data5', InstanceId: 'data6'.

Message #

A CompletionWorkItem has completed for parent Activity '%1', DisplayName: '%2', InstanceId: '%3'. Completed Activity '%4', DisplayName: '%5', InstanceId: '%6'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`data6` UnicodeString
`AppDomain` UnicodeString

Event ID 1017: A CancelActivityWorkItem has been scheduled for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: ScheduleWorkItem
Opcode: ScheduleCancelActivity

Message #

A CancelActivityWorkItem has been scheduled for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1018: Starting execution of a CancelActivityWorkItem for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: StartWorkItem
Opcode: StartCancelActivity

Message #

Starting execution of a CancelActivityWorkItem for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1019: A CancelActivityWorkItem has completed for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: CompleteWorkItem
Opcode: CompleteCancelActivity

Message #

A CancelActivityWorkItem has completed for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1020: A Bookmark has been created for Activity 'BookmarkScope', DisplayName: 'data1', InstanceId: 'data2'.

Channel: Debug
Task: CreateBookmark

Description

A Bookmark has been created for Activity 'BookmarkScope', DisplayName: 'data1', InstanceId: 'data2'. BookmarkName: data3, BookmarkScope: data4.

Message #

A Bookmark has been created for Activity '%1', DisplayName: '%2', InstanceId: '%3'.  BookmarkName: %4, BookmarkScope: %5.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`AppDomain` UnicodeString

Event ID 1021: A BookmarkWorkItem has been scheduled for Activity 'BookmarkScope', DisplayName: 'data1', InstanceId: 'data2'.

Channel: Debug
Task: ScheduleWorkItem
Opcode: ScheduleBookmark

Description

A BookmarkWorkItem has been scheduled for Activity 'BookmarkScope', DisplayName: 'data1', InstanceId: 'data2'. BookmarkName: data3, BookmarkScope: data4.

Message #

A BookmarkWorkItem has been scheduled for Activity '%1', DisplayName: '%2', InstanceId: '%3'.  BookmarkName: %4, BookmarkScope: %5.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`AppDomain` UnicodeString

Event ID 1022: Starting execution of a BookmarkWorkItem for Activity 'BookmarkScope', DisplayName: 'data1', InstanceId: 'data2'.

Channel: Debug
Task: StartWorkItem
Opcode: StartBookmark

Description

Starting execution of a BookmarkWorkItem for Activity 'BookmarkScope', DisplayName: 'data1', InstanceId: 'data2'. BookmarkName: data3, BookmarkScope: data4.

Message #

Starting execution of a BookmarkWorkItem for Activity '%1', DisplayName: '%2', InstanceId: '%3'.  BookmarkName: %4, BookmarkScope: %5.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`AppDomain` UnicodeString

Event ID 1023: A BookmarkWorkItem has completed for Activity 'BookmarkScope', DisplayName: 'data1', InstanceId: 'data2'.

Channel: Debug
Task: CompleteWorkItem
Opcode: CompleteBookmark

Description

A BookmarkWorkItem has completed for Activity 'BookmarkScope', DisplayName: 'data1', InstanceId: 'data2'. BookmarkName: data3, BookmarkScope: data4.

Message #

A BookmarkWorkItem has completed for Activity '%1', DisplayName: '%2', InstanceId: '%3'. BookmarkName: %4, BookmarkScope: %5.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`AppDomain` UnicodeString

Event ID 1024: A BookmarkScope has been created: data1.

Channel: Debug
Task: CreateBookmark

Message #

A BookmarkScope has been created: %1.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1025: The BookmarkScope that had TemporaryId: 'data1' has been initialized with Id: 'data2'.

Channel: Debug
Task: InitializeBookmarkScope

Message #

The BookmarkScope that had TemporaryId: '%1' has been initialized with Id: '%2'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 1026: A TransactionContextWorkItem has been scheduled for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: ScheduleWorkItem
Opcode: ScheduleTransactionContext

Message #

A TransactionContextWorkItem has been scheduled for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1027: Starting execution of a TransactionContextWorkItem for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: StartWorkItem
Opcode: StartTransactionContext

Message #

Starting execution of a TransactionContextWorkItem for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1028: A TransactionContextWorkItem has completed for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: CompleteWorkItem
Opcode: CompleteTransactionContext

Message #

A TransactionContextWorkItem has completed for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1029: A FaultWorkItem has been scheduled for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: ScheduleWorkItem
Opcode: ScheduleFault

Description

A FaultWorkItem has been scheduled for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'. The exception was propagated from Activity 'data4', DisplayName: 'data5', InstanceId: 'data6'.

Message #

A FaultWorkItem has been scheduled for Activity '%1', DisplayName: '%2', InstanceId: '%3'.  The exception was propagated from Activity '%4', DisplayName: '%5', InstanceId: '%6'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`data6` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 1030: Starting execution of a FaultWorkItem for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: StartWorkItem
Opcode: StartFault

Description

Starting execution of a FaultWorkItem for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'. The exception was propagated from Activity 'data4', DisplayName: 'data5', InstanceId: 'data6'.

Message #

Starting execution of a FaultWorkItem for Activity '%1', DisplayName: '%2', InstanceId: '%3'.  The exception was propagated from Activity '%4', DisplayName: '%5', InstanceId: '%6'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`data6` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 1031: A FaultWorkItem has completed for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: CompleteWorkItem
Opcode: CompleteFault

Description

A FaultWorkItem has completed for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'. The exception was propagated from Activity 'data4', DisplayName: 'data5', InstanceId: 'data6'.

Message #

A FaultWorkItem has completed for Activity '%1', DisplayName: '%2', InstanceId: '%3'. The exception was propagated from Activity '%4', DisplayName: '%5', InstanceId: '%6'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`data6` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 1032: A runtime work item has been scheduled for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: ScheduleWorkItem
Opcode: ScheduleRuntime

Message #

A runtime work item has been scheduled for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1033: Starting execution of a runtime work item for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: StartWorkItem
Opcode: StartRuntime

Message #

Starting execution of a runtime work item for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1034: A runtime work item has completed for Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: CompleteWorkItem
Opcode: CompleteRuntime

Message #

A runtime work item has completed for Activity '%1', DisplayName: '%2', InstanceId: '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1035: The runtime transaction has been set by Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'.

Channel: Debug
Task: RuntimeTransaction
Opcode: Set

Description

The runtime transaction has been set by Activity 'data1', DisplayName: 'data2', InstanceId: 'data3'. Execution isolated to Activity 'data4', DisplayName: 'data5', InstanceId: 'data6'.

Message #

The runtime transaction has been set by Activity '%1', DisplayName: '%2', InstanceId: '%3'.  Execution isolated to Activity '%4', DisplayName: '%5', InstanceId: '%6'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`data6` UnicodeString
`AppDomain` UnicodeString

Event ID 1036: Activity 'data1', DisplayName: 'data2', InstanceId: 'data3' has scheduled completion of the runtime transaction.

Channel: Debug
Task: RuntimeTransaction
Opcode: CompletionRequested

Message #

Activity '%1', DisplayName: '%2', InstanceId: '%3' has scheduled completion of the runtime transaction.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1037: The runtime transaction has completed with the state 'data1'.

Channel: Debug
Task: RuntimeTransaction
Opcode: Complete

Message #

The runtime transaction has completed with the state '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1038: Entering a no persist block.

Channel: Debug
Task: NoPersistBlock

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 1039: Exiting a no persist block.

Channel: Debug
Task: NoPersistBlock

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 1040: In argument 'data1' on Activity 'data2', DisplayName: 'data3', InstanceId: 'data4' has been bound with value: data5.

Channel: Debug
Task: ExecuteActivity

Message #

In argument '%1' on Activity '%2', DisplayName: '%3', InstanceId: '%4' has been bound with value: %5.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`data5` UnicodeString
`AppDomain` UnicodeString

Event ID 1041: WorkflowApplication Id: 'data1' is idle and persistable.

Channel: Debug
Task: WFApplicationStateChange
Opcode: PersistableIdle

Description

WorkflowApplication Id: 'data1' is idle and persistable. The following action will be taken: data2.

Message #

WorkflowApplication Id: '%1' is idle and persistable.  The following action will be taken: %2.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 1101: WorkflowInstance Id: 'Id' E2E Activity.

Channel: Debug
Task: WorkflowActivity
Opcode: Start

Message #

WorkflowInstance Id: '%1' E2E Activity

Fields #

Name	Description
`Id` GUID
`AppDomain` UnicodeString

Event ID 1102: WorkflowInstance Id: 'Id' E2E Activity.

Channel: Debug
Task: WorkflowActivity
Opcode: Stop

Message #

WorkflowInstance Id: '%1' E2E Activity

Fields #

Name	Description
`Id` GUID
`AppDomain` UnicodeString

Event ID 1103: WorkflowInstance Id: 'Id' E2E Activity.

Channel: Debug
Task: WorkflowActivity
Opcode: Suspend

Message #

WorkflowInstance Id: '%1' E2E Activity

Fields #

Name	Description
`Id` GUID
`AppDomain` UnicodeString

Event ID 1104: WorkflowInstance Id: 'Id' E2E Activity.

Channel: Debug
Task: WorkflowActivity
Opcode: Resume

Message #

WorkflowInstance Id: '%1' E2E Activity

Fields #

Name	Description
`Id` GUID
`AppDomain` UnicodeString

Event ID 1124: InvokeMethod 'data1' - method is Static.

Channel: Debug
Task: InvokeMethod
Opcode: IsStatic

Message #

InvokeMethod '%1' - method is Static.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1125: InvokeMethod 'data1' - method is not Static.

Channel: Debug
Task: InvokeMethod
Opcode: IsNotStatic

Message #

InvokeMethod '%1' - method is not Static.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1126: An exception was thrown in the method called by the activity 'data1'.

Channel: Debug
Task: InvokeMethod
Opcode: ThrewException

Description

An exception was thrown in the method called by the activity 'data1'. data2.

Message #

An exception was thrown in the method called by the activity '%1'. %2

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 1131: InvokeMethod 'data1' - method uses asynchronous pattern of 'data2' and 'data3'.

Channel: Debug
Task: InvokeMethod
Opcode: UseAsyncPattern

Message #

InvokeMethod '%1' - method uses asynchronous pattern of '%2' and '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 1132: InvokeMethod 'data1' - method does not use asynchronous pattern.

Channel: Debug
Task: InvokeMethod
Opcode: DoesNotUseAsyncPattern

Message #

InvokeMethod '%1' - method does not use asynchronous pattern.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1140: Flowchart 'data1' - Start has been scheduled.

Channel: Debug
Task: ExecuteFlowchart
Opcode: Begin

Message #

Flowchart '%1' - Start has been scheduled.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1141: Flowchart 'data1' - was executed with no Nodes.

Channel: Debug
Task: ExecuteFlowchart
Opcode: Empty

Message #

Flowchart '%1' - was executed with no Nodes.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1143: Flowchart 'data1'/FlowStep - Next node is null.

Channel: Debug
Task: ExecuteFlowchart
Opcode: NextNull

Description

Flowchart 'data1'/FlowStep - Next node is null. Flowchart execution will end.

Message #

Flowchart '%1'/FlowStep - Next node is null. Flowchart execution will end.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1146: Flowchart 'data1'/FlowSwitch - Case 'data2' was selected.

Channel: Debug
Task: ExecuteFlowchart
Opcode: SwitchCase

Message #

Flowchart '%1'/FlowSwitch - Case '%2' was selected.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 1147: Flowchart 'data1'/FlowSwitch - Default Case was selected.

Channel: Debug
Task: ExecuteFlowchart
Opcode: SwitchDefault

Message #

Flowchart '%1'/FlowSwitch - Default Case was selected.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1148: Flowchart 'data1'/FlowSwitch - could find neither a Case activity nor a Default Case matching the Expression result.

Channel: Debug
Task: ExecuteFlowchart
Opcode: SwitchCaseNotFound

Description

Flowchart 'data1'/FlowSwitch - could find neither a Case activity nor a Default Case matching the Expression result. Flowchart execution will end.

Message #

Flowchart '%1'/FlowSwitch - could find neither a Case activity nor a Default Case matching the Expression result. Flowchart execution will end.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1150: CompensableActivity 'data1' is in the 'data2' state.

Channel: Debug
Task: CompensationState

Message #

CompensableActivity '%1' is in the '%2' state.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 1223: The Switch activity 'data1' could not find a Case activity matching the Expression result.

Channel: Debug
Task: ExecuteActivity

Message #

The Switch activity '%1' could not find a Case activity matching the Expression result.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1400: data1.

Channel: Analytic
Level: Error
Task: TimeoutException

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "1400",
    "version": "0",
    "level": "2",
    "task": "2596",
    "opcode": "0",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:32:51.515060000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f3bc138c-5a6a-4c0b-96a0-fb45a3d794a5}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14132"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "data1": "A newly accepted connection did not receive initialization data from the sender within the configured ChannelInitializationTimeout (00:00:30).  As a result, the connection will be aborted.  If you are on a highly congested network, or your sending machine is heavily loaded, consider increasing this value or load-balancing your server.",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 1401: data1.

Channel: Analytic
Task: TimeoutException

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1402: msg Connection pool key: key.

Channel: Analytic
Level: Error
Task: TimeoutException

Message #

%1 Connection pool key: %2

Fields #

Name	Description
`msg` UnicodeString
`key` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "1402",
    "version": "0",
    "level": "2",
    "task": "2596",
    "opcode": "0",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.483892800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f2b7ffc9-ec9a-496e-aa19-4c35d3b3e1f3}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "msg": "A connection has exceeded the idle timeout of this connection pool (00:02:00) and been closed.",
    "key": "[LOCALHOST, 1500]",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 1403: msg Connection pool key: key.

Channel: Analytic
Task: TimeoutException

Message #

%1 Connection pool key: %2

Fields #

Name	Description
`msg` UnicodeString
`key` UnicodeString
`AppDomain` UnicodeString

Event ID 1405: data1.

Channel: Analytic
Task: TimeoutException

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1406: data1.

Channel: Analytic
Task: TimeoutException

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1407: data1.

Channel: Analytic
Task: TimeoutException

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1409: data1.

Channel: Analytic
Task: TimeoutException

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1416: data1.

Channel: Analytic
Task: Quotas

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1417: data1.

Channel: Analytic
Task: Quotas

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1418: data1.

Channel: Debug
Task: Quotas

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1419: data1.

Channel: Debug
Task: Quotas

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1420: data1.

Channel: Analytic
Task: Quotas

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1422: msg.

Channel: Analytic
Task: Quotas

Message #

%1

Fields #

Name	Description
`msg` UnicodeString
`AppDomain` UnicodeString

Event ID 1423: Negotiate token authenticator state cache ratio: cur/max.

Channel: Debug
Task: Quotas

Message #

Negotiate token authenticator state cache ratio: %1/%2

Fields #

Name	Description
`cur` Int32
`max` Int32
`AppDomain` UnicodeString

Event ID 1424: Security session ratio: Security_session_ratio/cur.

Channel: Debug
Task: Quotas

Message #

Security session ratio: %1/%2

Fields #

Name	Description
`cur` Int32
`max` Int32
`AppDomain` UnicodeString

Event ID 1430: Pending connections ratio: cur/max.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Quotas

Message #

Pending connections ratio: %1/%2

Fields #

Name	Description
`cur` Int32
`max` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "1430",
    "version": "0",
    "level": "5",
    "task": "2560",
    "opcode": "0",
    "keywords": 2305843009217888256,
    "time_created": "2026-03-15T23:29:50.489050700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{a4cd1ab9-04c0-43f1-ba00-237da5991559}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "8452"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cur": "1",
    "max": "168",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 1431: Concurrent calls ratio: cur/max.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Quotas

Message #

Concurrent calls ratio: %1/%2

Fields #

Name	Description
`cur` Int32
`max` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "1431",
    "version": "0",
    "level": "5",
    "task": "2560",
    "opcode": "0",
    "keywords": 2305843009217888256,
    "time_created": "2026-03-15T23:29:50.494175100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5ab13fb1-eddd-4703-b6a8-cc26fc39c8e5}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cur": "1",
    "max": "3136",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 1432: Concurrent sessions ratio: cur/max.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Quotas

Message #

Concurrent sessions ratio: %1/%2

Fields #

Name	Description
`cur` Int32
`max` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "1432",
    "version": "0",
    "level": "5",
    "task": "2560",
    "opcode": "0",
    "keywords": 2305843009217888256,
    "time_created": "2026-03-15T23:29:50.489387400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "7796"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cur": "1",
    "max": "19600",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 1433: Outbound connections per endpoint ratio: cur/max.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Quotas

Message #

Outbound connections per endpoint ratio: %1/%2

Fields #

Name	Description
`cur` Int32
`max` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "1433",
    "version": "0",
    "level": "5",
    "task": "2560",
    "opcode": "0",
    "keywords": 2305843009217888256,
    "time_created": "2026-03-15T23:29:50.483853300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f2b7ffc9-ec9a-496e-aa19-4c35d3b3e1f3}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cur": "0",
    "max": "10",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 1436: Pending messages per channel ratio: Pending_messages_per_channel_ratio/cur.

Channel: Analytic
Task: Quotas

Message #

Pending messages per channel ratio: %1/%2

Fields #

Name	Description
`cur` Int32
`max` Int32
`AppDomain` UnicodeString

Event ID 1438: Concurrent instances ratio: cur/max.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Quotas

Message #

Concurrent instances ratio: %1/%2

Fields #

Name	Description
`cur` Int32
`max` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "1438",
    "version": "0",
    "level": "5",
    "task": "2560",
    "opcode": "0",
    "keywords": 2305843009217888256,
    "time_created": "2026-03-15T23:30:19.363264500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{81bb4176-a5ae-476a-93c3-dd922ce34e3f}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "1108"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cur": "1",
    "max": "532",
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 1439: Zero pending accepts left

Channel: Debug
Task: Quotas

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 1441: data1.

Channel: Analytic
Task: Quotas

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1442: Receive retry count reached on MSMQ message with id 'data1'.

Channel: Analytic
Task: MsmqQuotas

Message #

Receive retry count reached on MSMQ message with id '%1'

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1443: Max retry cycles exceeded on MSMQ message with id 'data1'.

Channel: Analytic
Task: MsmqQuotas

Message #

Max retry cycles exceeded on MSMQ message with id '%1'

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 1445: Created new 'itemTypeName'.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Quotas

Message #

Created new '%1'

Fields #

Name	Description
`itemTypeName` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "1445",
    "version": "0",
    "level": "5",
    "task": "2560",
    "opcode": "0",
    "keywords": 2305843009217888256,
    "time_created": "2026-03-15T23:29:50.498334200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "itemTypeName": "BinaryBufferedMessageData",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 1446: Created new 'itemTypeName'.

Channel: Analytic
Task: Quotas

Message #

Created new '%1'

Fields #

Name	Description
`itemTypeName` UnicodeString
`AppDomain` UnicodeString

Event ID 1449: Message received by workflow

Channel: Debug
Task: WFMessage
Opcode: Receive

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 1450: Message sent from workflow

Channel: Debug
Task: WFMessage
Opcode: Send

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 1451: data1.

Channel: Analytic
Task: Quotas

Message #

%1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 2021: Execute work item start

Channel: Debug
Task: ExecuteWorkItem
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 2022: Execute work item stop

Channel: Debug
Task: ExecuteWorkItem
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 2023: SendMessageChannelCache miss

Channel: Debug
Task: MessageChannelCache
Opcode: Missed

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 2024: InternalCacheMetadata started on activity 'id'.

Channel: Debug
Task: InternalCacheMetadata
Opcode: Start

Message #

InternalCacheMetadata started on activity '%1'.

Fields #

Name	Description
`id` UnicodeString
`AppDomain` UnicodeString

Event ID 2025: InternalCacheMetadata stopped on activity 'id'.

Channel: Debug
Task: InternalCacheMetadata
Opcode: Stop

Message #

InternalCacheMetadata stopped on activity '%1'.

Fields #

Name	Description
`id` UnicodeString
`AppDomain` UnicodeString

Event ID 2026: Compiling VB expression 'expr'.

Channel: Debug
Task: VBExpressionCompile
Opcode: Start

Message #

Compiling VB expression '%1'

Fields #

Name	Description
`expr` UnicodeString
`AppDomain` UnicodeString

Event ID 2027: CacheRootMetadata started on activity 'activityName'.

Channel: Debug
Task: CacheRootMetadata
Opcode: Start

Message #

CacheRootMetadata started on activity '%1'

Fields #

Name	Description
`activityName` UnicodeString
`AppDomain` UnicodeString

Event ID 2028: CacheRootMetadata stopped on activity activityName.

Channel: Debug
Task: CacheRootMetadata
Opcode: Stop

Message #

CacheRootMetadata stopped on activity %1.

Fields #

Name	Description
`activityName` UnicodeString
`AppDomain` UnicodeString

Event ID 2029: Finished compiling VB expression.

Channel: Debug
Task: VBExpressionCompile
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 2576: The TryCatch activity 'data1' has caught an exception of type 'data2'.

Channel: Debug
Task: TryCatchException
Opcode: FromTry

Message #

The TryCatch activity '%1' has caught an exception of type '%2'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 2577: A child activity of the TryCatch activity 'data1' has thrown an exception during cancelation.

Channel: Debug
Task: TryCatchException
Opcode: DuringCancelation

Message #

A child activity of the TryCatch activity '%1' has thrown an exception during cancelation.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 2578: A Catch or Finally activity that is associated with the TryCatch activity 'data1' has thrown an exception.

Channel: Debug
Task: TryCatchException
Opcode: FromCatchOrFinally

Message #

A Catch or Finally activity that is associated with the TryCatch activity '%1' has thrown an exception.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3300: Failed to Complete TypeName.

Channel: Analytic
Opcode: Info

Message #

Failed to Complete %1.

Fields #

Name	Description
`TypeName` UnicodeString
`AppDomain` UnicodeString

Event ID 3301: Failed to Abandon TypeName.

Channel: Debug
Opcode: Info

Message #

Failed to Abandon %1.

Fields #

Name	Description
`TypeName` UnicodeString
`AppDomain` UnicodeString

Event ID 3302: Receive Context faulted.

Channel: Analytic
Task: DispatchMessage

Fields #

Name	Description
`EventSource` UnicodeString
`AppDomain` UnicodeString

Event ID 3303: TypeName was Abandoned with exception ExceptionToString.

Channel: Debug
Opcode: Info

Message #

%1 was Abandoned with exception %2.

Fields #

Name	Description
`TypeName` UnicodeString
`ExceptionToString` UnicodeString
`AppDomain` UnicodeString

Event ID 3305: Number of cached channel factories is: 'Count'.

Channel: Debug
Task: ChannelFactoryCaching

Description

Number of cached channel factories is: 'Count'. At most 'MaxNum' channel factories can be cached.

Message #

Number of cached channel factories is: '%1'.  At most '%2' channel factories can be cached.

Fields #

Name	Description
`Count` Int32
`MaxNum` Int32
`EventSource` UnicodeString
`AppDomain` UnicodeString

Event ID 3306: A channel factory has been aged out of the cache because the cache has reached its limit of 'Count'.

Channel: Debug
Task: ChannelFactoryCaching

Message #

A channel factory has been aged out of the cache because the cache has reached its limit of '%1'.

Fields #

Name	Description
`Count` Int32
`EventSource` UnicodeString
`AppDomain` UnicodeString

Event ID 3307: Used matching channel factory found in cache.

Channel: Debug
Task: ChannelFactoryCaching

Fields #

Name	Description
`EventSource` UnicodeString
`AppDomain` UnicodeString

Event ID 3308: Not using channel factory from cache, i.

Channel: Debug
Level: Informational
Task: ChannelFactoryCaching

Description

Not using channel factory from cache, i.e. caching disabled for instance.

Message #

Not using channel factory from cache, i.e. caching disabled for instance.

Fields #

Name	Description
`EventSource` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3308",
    "version": "0",
    "level": "4",
    "task": "2511",
    "opcode": "0",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.483138500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventSource": "Microsoft.IdentityServer.PolicyModel.Client.PolicyStoreClient/5896758",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3309: Query composition using 'TypeName' was executed on the Request Uri: 'Uri'.

Channel: Debug
Opcode: Info

Message #

Query composition using '%1' was executed on the Request Uri: '%2'.

Fields #

Name	Description
`TypeName` UnicodeString
`Uri` UnicodeString
`EventSource` UnicodeString
`AppDomain` UnicodeString

Event ID 3310: The 'OperationName' operation was dispatched with errors.

Channel: Analytic
Task: DispatchMessage

Message #

The '%1' operation was dispatched with errors.

Fields #

Name	Description
`OperationName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 3311: The 'OperationName' operation was dispatched successfully.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: Stop

Message #

The '%1' operation was dispatched successfully.

Fields #

Name	Description
`OperationName` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3311",
    "version": "0",
    "level": "4",
    "task": "2533",
    "opcode": "2",
    "keywords": 2305843009213693956,
    "time_created": "2026-03-15T23:29:50.498190000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "OperationName": "TryAcquireTaskOwnershipLease",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3312: A message with size 'Size' bytes was read by the encoder.

Channel: Debug
Also via: realtime ETW trace
Level: Informational
Task: MessageDecoding
Opcode: Stop

Message #

A message with size '%1' bytes was read by the encoder.

Fields #

Name	Description
`Size` Int32
`EventSource` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3312",
    "version": "0",
    "level": "4",
    "task": "2555",
    "opcode": "2",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.494139500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Size": "95",
    "EventSource": "System.ServiceModel.Channels.BinaryMessageEncoderFactory+BinaryMessageEncoder/36920218",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3313: A message with size 'Size' bytes was written by the encoder.

Channel: Debug
Also via: realtime ETW trace
Level: Informational
Task: MessageEncoding
Opcode: Stop

Message #

A message with size '%1' bytes was written by the encoder.

Fields #

Name	Description
`Size` Int32
`EventSource` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3313",
    "version": "0",
    "level": "4",
    "task": "2556",
    "opcode": "2",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.493611600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Size": "381",
    "EventSource": "System.ServiceModel.Channels.BinaryMessageEncoderFactory+BinaryMessageEncoder/16754362",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3314: Session aborting for idle channel to uri:'RemoteAddress'.

Channel: Analytic
Task: Timeout

Message #

Session aborting for idle channel to uri:'%1'.

Fields #

Name	Description
`RemoteAddress` UnicodeString
`AppDomain` UnicodeString

Event ID 3319: Connection accept started.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ConnectionAccept
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3319",
    "version": "0",
    "level": "5",
    "task": "2521",
    "opcode": "1",
    "keywords": 1152921504606847488,
    "time_created": "2026-03-15T23:29:50.489056900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{df7d849a-75b7-4340-9cea-e51ef07a2950}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "8452"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3320: ListenerId:ListenerHashCode accepted SocketId:SocketHashCode.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ConnectionAccept
Opcode: Stop

Message #

ListenerId:%1 accepted SocketId:%2.

Fields #

Name	Description
`ListenerHashCode` Int32
`SocketHashCode` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3320",
    "version": "0",
    "level": "5",
    "task": "2521",
    "opcode": "2",
    "keywords": 1152921504606847488,
    "time_created": "2026-03-15T23:29:50.488868900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{a4cd1ab9-04c0-43f1-ba00-237da5991559}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "8452"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ListenerHashCode": "18819585",
    "SocketHashCode": "44246512",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3321: Pool for PoolKey has no available connection and busy busy connections.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ConnectionPooling

Message #

Pool for %1 has no available connection and %2 busy connections.

Fields #

Name	Description
`PoolKey` UnicodeString
`busy` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3321",
    "version": "0",
    "level": "5",
    "task": "2522",
    "opcode": "0",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.488176900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f2b7ffc9-ec9a-496e-aa19-4c35d3b3e1f3}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PoolKey": "[LOCALHOST, 1500]",
    "busy": "1",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3322: Dispatcher started deserialization the request message.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: FormatterDeserializeRequest
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3322",
    "version": "0",
    "level": "5",
    "task": "2540",
    "opcode": "1",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.496440100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3323: Dispatcher completed deserialization the request message.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: FormatterDeserializeRequest
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3323",
    "version": "0",
    "level": "5",
    "task": "2540",
    "opcode": "2",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.496452500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3324: Dispatcher started serialization of the reply message.

Channel: Debug
Level: Verbose
Task: FormatterSerializeReply
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3324",
    "version": "0",
    "level": "5",
    "task": "2541",
    "opcode": "1",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.497908600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3325: Dispatcher completed serialization of the reply message.

Channel: Debug
Level: Verbose
Task: FormatterSerializeReply
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3325",
    "version": "0",
    "level": "5",
    "task": "2541",
    "opcode": "2",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.497930000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3326: Client request serialization started.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: FormatterSerializeRequest
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3326",
    "version": "0",
    "level": "5",
    "task": "2542",
    "opcode": "1",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.483738700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{d0302fac-41f0-4eb2-9a47-143bb68642d5}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3327: Client completed serialization of the request message.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: FormatterSerializeRequest
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3327",
    "version": "0",
    "level": "5",
    "task": "2542",
    "opcode": "2",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.483742500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{d0302fac-41f0-4eb2-9a47-143bb68642d5}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3328: Client started deserializing the reply message.

Channel: Debug
Level: Verbose
Task: FormatterDeserializeReply
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3328",
    "version": "0",
    "level": "5",
    "task": "2539",
    "opcode": "1",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.498396700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3329: Client completed deserializing the reply message.

Channel: Debug
Level: Verbose
Task: FormatterDeserializeReply
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3329",
    "version": "0",
    "level": "5",
    "task": "2539",
    "opcode": "2",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.498404200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3330: Security negotiation started.

Channel: Debug
Task: SecurityNegotiation
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3331: Security negotiation completed.

Channel: Debug
Task: SecurityNegotiation
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3332: SecurityTokenProvider opening completed.

Channel: Debug
Task: SecureMessage
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3333: Outgoing message has been secured.

Channel: Debug
Task: SecureMessage
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3334: Incoming message has been verified.

Channel: Debug
Task: SecurityVerification

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3335: Service instance retrieval started.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ServiceInstance
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3335",
    "version": "0",
    "level": "5",
    "task": "2584",
    "opcode": "1",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.496393300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3336: Service instance retrieved.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ServiceInstance
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3336",
    "version": "0",
    "level": "5",
    "task": "2584",
    "opcode": "2",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.496395100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3337: ChannelHandlerId:ChannelId - Message receive loop started.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ChannelReceive
Opcode: Start

Message #

ChannelHandlerId:%1 - Message receive loop started.

Fields #

Name	Description
`ChannelId` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3337",
    "version": "0",
    "level": "5",
    "task": "2513",
    "opcode": "1",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.493270200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5ab13fb1-eddd-4703-b6a8-cc26fc39c8e5}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "8452"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ChannelId": "9458587",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3338: ChannelHandlerId:ChannelId - Message receive loop stopped.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ChannelReceive
Opcode: Stop

Message #

ChannelHandlerId:%1 - Message receive loop stopped.

Fields #

Name	Description
`ChannelId` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3338",
    "version": "0",
    "level": "5",
    "task": "2513",
    "opcode": "2",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.494166800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5ab13fb1-eddd-4703-b6a8-cc26fc39c8e5}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ChannelId": "9458587",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3339: ChannelFactory created.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ChannelFactoryCreate

Fields #

Name	Description
`EventSource` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3339",
    "version": "0",
    "level": "5",
    "task": "2512",
    "opcode": "0",
    "keywords": 1152921504606846980,
    "time_created": "2026-03-15T23:29:50.483605300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventSource": "System.ServiceModel.ChannelFactory`1[Microsoft.IdentityServer.Protocols.PolicyStore.IPolicyStore]/60375305",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3340: Pipe connection accept started on uri .

Channel: Debug
Task: ConnectionAccept
Opcode: Start

Message #

Pipe connection accept started on %1 .

Fields #

Name	Description
`uri` UnicodeString
`AppDomain` UnicodeString

Event ID 3341: Pipe connection accepted.

Channel: Debug
Task: ConnectionAccept
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3342: Connection establishment started for Key.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: Connect
Opcode: Start

Message #

Connection establishment started for %1.

Fields #

Name	Description
`Key` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3342",
    "version": "0",
    "level": "5",
    "task": "2519",
    "opcode": "1",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.483837400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f2b7ffc9-ec9a-496e-aa19-4c35d3b3e1f3}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Key": "net.tcp://localhost:1500/policy",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3343: Connection established.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: Connect
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3343",
    "version": "0",
    "level": "5",
    "task": "2519",
    "opcode": "2",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.493342900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f2b7ffc9-ec9a-496e-aa19-4c35d3b3e1f3}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3345: Session preamble for 'Via' understood.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: Connect

Message #

Session preamble for '%1' understood.

Fields #

Name	Description
`Via` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3345",
    "version": "0",
    "level": "5",
    "task": "2519",
    "opcode": "0",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.489342200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "7796"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Via": "net.tcp://localhost:1500/policy",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3346: Connection reader sending fault 'FaultString'.

Channel: Debug
Task: Connect

Message #

Connection reader sending fault '%1'.

Fields #

Name	Description
`FaultString` UnicodeString
`AppDomain` UnicodeString

Event ID 3347: Socket accept closed.

Channel: Debug
Task: ConnectionAccept
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3348: Service host faulted.

Channel: Analytic
Task: ServiceHostFault

Fields #

Name	Description
`EventSource` UnicodeString
`AppDomain` UnicodeString

Event ID 3349: Listener opening for 'Uri'.

Channel: Debug
Task: ListenerOpen
Opcode: Start

Message #

Listener opening for '%1'.

Fields #

Name	Description
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 3350: Listener open completed.

Channel: Debug
Task: ListenerOpen
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3351: Server max pooled connections quota reached.

Channel: Analytic
Task: Quotas

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3352: SocketId:SocketId to remote address Uri timed out.

Channel: Analytic
Task: Connect

Message #

SocketId:%1 to remote address %2 timed out.

Fields #

Name	Description
`SocketId` Int32
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 3353: SocketId:SocketId to remote address Uri had a connection reset error.

Channel: Analytic
Also via: realtime ETW trace
Level: Warning
Task: Connect

Message #

SocketId:%1 to remote address %2 had a connection reset error.

Fields #

Name	Description
`SocketId` Int32
`Uri` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3353",
    "version": "0",
    "level": "3",
    "task": "2519",
    "opcode": "0",
    "keywords": 2305843009213694464,
    "time_created": "2026-03-15T23:29:50.487223900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f2b7ffc9-ec9a-496e-aa19-4c35d3b3e1f3}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SocketId": "49129953",
    "Uri": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3354: Service security negotiation completed.

Channel: Debug
Task: SecurityNegotiation

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3355: Security negotiation processing failed.

Channel: Analytic
Task: SecurityNegotiation

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3356: Security verification succeeded.

Channel: Debug
Task: SecurityVerification

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3357: Security verification failed.

Channel: Analytic
Task: SecurityVerification

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3358: Socket duplicated for Uri.

Channel: Debug
Task: ActivationDuplicateSocket

Message #

Socket duplicated for %1.

Fields #

Name	Description
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 3359: Security impersonation succeeded.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: SecurityImpersonation

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3359",
    "version": "0",
    "level": "5",
    "task": "2572",
    "opcode": "0",
    "keywords": 1152921504606846992,
    "time_created": "2026-03-15T23:30:19.363562100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{11da94e5-a08b-4071-9f06-9cc69bdc3867}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "1108"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 3360: Security impersonation failed.

Channel: Analytic
Task: SecurityImpersonation

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3361: Http channel request aborted.

Channel: Analytic
Task: TransportReceive

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3362: Http channel response aborted.

Channel: Analytic
Task: TransportSend

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3363: Http authentication failed.

Channel: Analytic
Task: SecurityVerification

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3364: SharedListenerProxy registration started for uri 'Uri'.

Channel: Analytic
Task: ActivationListenerOpen
Opcode: Start

Message #

SharedListenerProxy registration started for uri '%1'.

Fields #

Name	Description
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 3365: SharedListenerProxy Register Stop.

Channel: Analytic
Task: ActivationListenerOpen
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3366: SharedListenerProxy register failed with status 'Status'.

Channel: Analytic
Task: ActivationListenerOpen

Message #

SharedListenerProxy register failed with status '%1'.

Fields #

Name	Description
`Status` UnicodeString	NTSTATUS reference
`AppDomain` UnicodeString

Event ID 3367: ConnectionPoolPreambleFailed.

Channel: Analytic
Task: SessionStart

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3368: SslOnAcceptUpgradeStart

Channel: Analytic
Task: SessionUpgrade
Opcode: Initiate

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3369: SslOnAcceptUpgradeStop

Channel: Analytic
Task: SessionUpgrade
Opcode: Accept

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3370: BinaryMessageEncoder started encoding the message.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: MessageEncoding
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3370",
    "version": "0",
    "level": "5",
    "task": "2556",
    "opcode": "1",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.493364200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{1fe3f4e0-acac-428c-ac3c-63cdb7478c5b}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3371: MtomMessageEncoder started encoding the message.

Channel: Debug
Task: MessageEncoding
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3372: TextMessageEncoder started encoding the message.

Channel: Debug
Task: MessageEncoding
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3373: BinaryMessageEncoder started decoding the message.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: MessageDecoding
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3373",
    "version": "0",
    "level": "5",
    "task": "2555",
    "opcode": "1",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.494031200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "14764"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3374: MtomMessageEncoder started decoding the message.

Channel: Debug
Task: MessageDecoding
Opcode: Start

Message #

MtomMessageEncoder started decoding  the message.

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3375: TextMessageEncoder started decoding the message.

Channel: Debug
Task: MessageDecoding
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3376: Http transport started receiving a message.

Channel: Debug
Task: TransportReceive
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3377: SocketId:SocketId read 'Size' bytes read from 'Endpoint'.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: TransportReceive
Opcode: Stop

Message #

SocketId:%1 read '%2' bytes read from '%3'.

Fields #

Name	Description
`SocketId` Int32
`Size` Int32
`Endpoint` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3377",
    "version": "0",
    "level": "5",
    "task": "2599",
    "opcode": "2",
    "keywords": 1152921504606847488,
    "time_created": "2026-03-15T23:29:50.489738400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{6d527f13-9021-4c84-9477-5c2595600833}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SocketId": "10675717",
    "Size": "1",
    "Endpoint": "::1:1500",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3378: SocketId:SocketId read 'Size' bytes read from 'Endpoint'.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: TransportReceive
Opcode: Stop

Message #

SocketId:%1 read '%2' bytes read from '%3'.

Fields #

Name	Description
`SocketId` Int32
`Size` Int32
`Endpoint` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3378",
    "version": "0",
    "level": "5",
    "task": "2599",
    "opcode": "2",
    "keywords": 1152921504606847488,
    "time_created": "2026-03-15T23:29:50.489301600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "7796"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SocketId": "44246512",
    "Size": "63",
    "Endpoint": "::1:51230",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3379: SocketId:SocketId writing 'Size' bytes to 'Endpoint'.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: TransportSend
Opcode: Start

Message #

SocketId:%1 writing '%2' bytes to '%3'.

Fields #

Name	Description
`SocketId` Int32
`Size` Int32
`Endpoint` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3379",
    "version": "0",
    "level": "5",
    "task": "2600",
    "opcode": "1",
    "keywords": 1152921504606847488,
    "time_created": "2026-03-15T23:29:50.488777000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{6d527f13-9021-4c84-9477-5c2595600833}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SocketId": "10675717",
    "Size": "40",
    "Endpoint": "::1:1500",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3380: SocketId:SocketId writing 'Size' bytes to 'Endpoint'.

Channel: Debug
Task: TransportSend
Opcode: Start

Message #

SocketId:%1 writing '%2' bytes to '%3'.

Fields #

Name	Description
`SocketId` Int32
`Size` Int32
`Endpoint` UnicodeString
`AppDomain` UnicodeString

Event ID 3381: SessionId:SessionId acknowledgement sent.

Channel: Debug
Task: ReliableSession
Opcode: SequenceAck

Message #

SessionId:%1 acknowledgement sent.

Fields #

Name	Description
`SessionId` UnicodeString
`AppDomain` UnicodeString

Event ID 3382: SessionId:SessionId reconnecting.

Channel: Debug
Task: ReliableSession
Opcode: Reconnect

Message #

SessionId:%1 reconnecting.

Fields #

Name	Description
`SessionId` UnicodeString
`AppDomain` UnicodeString

Event ID 3383: SessionId:SessionId faulted.

Channel: Debug
Task: ReliableSession
Opcode: Faulted

Message #

SessionId:%1 faulted.

Fields #

Name	Description
`SessionId` UnicodeString
`AppDomain` UnicodeString

Event ID 3384: WindowsStreamSecurity initiating security upgrade.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: SessionUpgrade
Opcode: Initiate

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3384",
    "version": "0",
    "level": "5",
    "task": "2587",
    "opcode": "115",
    "keywords": 2305843009213693968,
    "time_created": "2026-03-15T23:29:50.489746300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{6d527f13-9021-4c84-9477-5c2595600833}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3385: Windows streaming security on accepting upgrade.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: SessionUpgrade
Opcode: Accept

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3385",
    "version": "0",
    "level": "5",
    "task": "2587",
    "opcode": "114",
    "keywords": 2305843009213693968,
    "time_created": "2026-03-15T23:29:50.489756300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{fb0a7822-7b4b-45f4-bf59-3e1c0df8827e}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "8452"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3386: SocketId:SocketId is aborting.

Channel: Analytic
Also via: realtime ETW trace
Level: Warning
Task: ConnectionAbort

Message #

SocketId:%1 is aborting.

Fields #

Name	Description
`SocketId` Int32
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3386",
    "version": "0",
    "level": "3",
    "task": "2520",
    "opcode": "0",
    "keywords": 2305843009213694464,
    "time_created": "2026-03-15T23:29:50.488076600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f2b7ffc9-ec9a-496e-aa19-4c35d3b3e1f3}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SocketId": "49129953",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3388: HttpGetContext start.

Channel: Analytic
Task: TransportReceive
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3389: Client sending preamble start.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ClientSendPreamble
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3389",
    "version": "0",
    "level": "5",
    "task": "2515",
    "opcode": "1",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.488737000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{6d527f13-9021-4c84-9477-5c2595600833}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3390: Client sending preamble stop.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ClientSendPreamble
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "3390",
    "version": "0",
    "level": "5",
    "task": "2515",
    "opcode": "2",
    "keywords": 1152921504606851072,
    "time_created": "2026-03-15T23:29:50.493340500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{6d527f13-9021-4c84-9477-5c2595600833}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "5228"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 3391: Http Message receive failed.

Channel: Analytic
Task: TransportReceive
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3392: TransactionScope is being created with LocalIdentifier:'LocalId' and DistributedIdentifier:'Distributed'.

Channel: Debug
Task: DispatchMessage
Opcode: TransactionScopeCreate

Message #

TransactionScope is being created with LocalIdentifier:'%1' and DistributedIdentifier:'%2'.

Fields #

Name	Description
`LocalId` UnicodeString
`Distributed` GUID
`AppDomain` UnicodeString

Event ID 3393: A streamed message was read by the encoder.

Channel: Debug
Task: MessageDecoding
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3394: A streamed message was written by the encoder.

Channel: Debug
Task: MessageEncoding
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3395: A message was written asynchronously by the encoder.

Channel: Debug
Task: MessageEncoding
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3396: BufferId:BufferId completed writing 'Size' bytes to underlying stream.

Channel: Debug
Task: TransportSend
Opcode: Start

Message #

BufferId:%1 completed writing '%2' bytes to underlying stream.

Fields #

Name	Description
`BufferId` Int32
`Size` Int32
`AppDomain` UnicodeString

Event ID 3397: A message was written asynchronously by the encoder.

Channel: Debug
Task: TransportSend
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3398: Pipe shared memory created at 'sharedMemoryName' .

Channel: Debug
Task: ListenerOpen

Message #

Pipe shared memory created at '%1' .

Fields #

Name	Description
`sharedMemoryName` UnicodeString
`AppDomain` UnicodeString

Event ID 3399: NamedPipe 'pipeName' created.

Channel: Debug
Task: ListenerOpen

Message #

NamedPipe '%1' created.

Fields #

Name	Description
`pipeName` UnicodeString
`AppDomain` UnicodeString

Event ID 3401: Signature verification started.

Channel: Debug
Task: SignatureVerification
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3402: Signature verification succeeded

Channel: Debug
Task: SignatureVerification

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3403: Wrapped key decryption started.

Channel: Debug
Task: WrappedKeyDecryption

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3404: Wrapped key decryption succeeded.

Channel: Debug
Task: WrappedKeyDecryption

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3405: Encrypted data processing started.

Channel: Debug
Task: EncryptedDataProcessing

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3406: Encrypted data processing succeeded.

Channel: Debug
Task: EncryptedDataProcessing

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3407: Http message handler started processing the inbound request.

Channel: Debug
Task: TransportReceive
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3408: Http message handler started processing the inbound request asynchronously.

Channel: Debug
Task: TransportReceive
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3409: Http message handler completed processing an inbound request.

Channel: Debug
Task: TransportReceive
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3410: Http message handler is faulted.

Channel: Analytic
Task: TransportReceive

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3411: WebSocket connection timed out.

Channel: Analytic
Task: Connect

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3412: Http message handler started processing the response.

Channel: Debug
Task: TransportSend
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3413: Http message handler started processing the response asynchronously.

Channel: Debug
Task: TransportSend
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3414: Http message handler completed processing the response.

Channel: Debug
Task: TransportSend
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3415: WebSocket connection request to 'remoteAddress' send start.

Channel: Debug
Task: Connect
Opcode: Start

Message #

WebSocket connection request to '%1' send start.

Fields #

Name	Description
`remoteAddress` UnicodeString
`AppDomain` UnicodeString

Event ID 3416: WebSocketId:WebSocketId connection request sent.

Channel: Debug
Task: Connect
Opcode: Stop

Message #

WebSocketId:%1 connection request sent.

Fields #

Name	Description
`websocketId` Int32
`AppDomain` UnicodeString

Event ID 3417: WebSocket connection accept start.

Channel: Debug
Task: Connect
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3418: WebSocketId:WebSocketId connection accepted.

Channel: Debug
Task: Connect
Opcode: Stop

Message #

WebSocketId:%1 connection accepted.

Fields #

Name	Description
`websocketId` Int32
`AppDomain` UnicodeString

Event ID 3419: WebSocket connection declined with status code 'errorMessage'.

Channel: Analytic
Task: Connect

Message #

WebSocket connection declined with status code '%1'

Fields #

Name	Description
`errorMessage` UnicodeString
`AppDomain` UnicodeString

Event ID 3420: WebSocket connection request failed: 'errorMessage'.

Channel: Analytic
Task: Connect

Message #

WebSocket connection request failed: '%1'

Fields #

Name	Description
`errorMessage` UnicodeString
`AppDomain` UnicodeString

Event ID 3421: WebSocketId:WebSocketId connection is aborted.

Channel: Analytic
Task: Connect

Message #

WebSocketId:%1 connection is aborted.

Fields #

Name	Description
`websocketId` Int32
`AppDomain` UnicodeString

Event ID 3422: WebSocketId:WebSocketId writing 'websocketId' bytes to 'byteCount'.

Channel: Debug
Task: TransportSend
Opcode: Start

Message #

WebSocketId:%1 writing '%2' bytes to '%3'.

Fields #

Name	Description
`websocketId` Int32
`byteCount` Int32
`remoteAddress` UnicodeString
`AppDomain` UnicodeString

Event ID 3423: WebSocketId:WebSocketId asynchronous write stop.

Channel: Debug
Task: TransportSend
Opcode: Stop

Message #

WebSocketId:%1 asynchronous write stop.

Fields #

Name	Description
`websocketId` Int32
`AppDomain` UnicodeString

Event ID 3424: WebSocketId:WebSocketId read start.

Channel: Debug
Task: TransportReceive
Opcode: Start

Message #

WebSocketId:%1 read start.

Fields #

Name	Description
`websocketId` Int32
`AppDomain` UnicodeString

Event ID 3425: WebSocketId:WebSocketId read 'websocketId' bytes from 'byteCount'.

Channel: Debug
Task: TransportReceive
Opcode: Stop

Message #

WebSocketId:%1 read '%2' bytes from '%3'.

Fields #

Name	Description
`websocketId` Int32
`byteCount` Int32
`remoteAddress` UnicodeString
`AppDomain` UnicodeString

Event ID 3426: WebSocketId:WebSocketId sending close message to 'websocketId' with close status 'remoteAddress'.

Channel: Debug
Task: Connect

Message #

WebSocketId:%1 sending close message to '%2' with close status '%3'.

Fields #

Name	Description
`websocketId` Int32
`remoteAddress` UnicodeString
`closeStatus` UnicodeString
`AppDomain` UnicodeString

Event ID 3427: WebSocketId:WebSocketId sending close output message to 'websocketId' with close status 'remoteAddress'.

Channel: Debug
Task: Connect

Message #

WebSocketId:%1 sending close output message to '%2' with close status '%3'.

Fields #

Name	Description
`websocketId` Int32
`remoteAddress` UnicodeString
`closeStatus` UnicodeString
`AppDomain` UnicodeString

Event ID 3428: WebSocketId:WebSocketId connection closed.

Channel: Debug
Task: Connect

Message #

WebSocketId:%1 connection closed.

Fields #

Name	Description
`websocketId` Int32
`AppDomain` UnicodeString

Event ID 3429: WebSocketId:WebSocketId connection close message received with status 'websocketId'.

Channel: Debug
Task: Connect

Message #

WebSocketId:%1 connection close message received with status '%2'.

Fields #

Name	Description
`websocketId` Int32
`closeStatus` UnicodeString
`AppDomain` UnicodeString

Event ID 3430: Using the WebSocketVersion from a client WebSocket factory of type 'clientWebSocketFactoryType'.

Channel: Debug
Task: Connect

Message #

Using the WebSocketVersion from a client WebSocket factory of type '%1'.

Fields #

Name	Description
`clientWebSocketFactoryType` UnicodeString
`AppDomain` UnicodeString

Event ID 3431: Creating the client WebSocket with a factory of type 'clientWebSocketFactoryType'.

Channel: Debug
Task: Connect

Message #

Creating the client WebSocket with a factory of type '%1'.

Fields #

Name	Description
`clientWebSocketFactoryType` UnicodeString
`AppDomain` UnicodeString

Event ID 3501: ContractDescription with Name='data1' and Namespace='data2' has been inferred from WorkflowService.

Channel: Analytic
Task: InferDescription
Opcode: Contract

Message #

ContractDescription with Name='%1' and Namespace='%2' has been inferred from WorkflowService.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 3502: OperationDescription with Name='data1' in contract 'data2' has been inferred from WorkflowService.

Channel: Analytic
Task: InferDescription
Opcode: Operation

Description

OperationDescription with Name='data1' in contract 'data2' has been inferred from WorkflowService. IsOneWay=data3.

Message #

OperationDescription with Name='%1' in contract '%2' has been inferred from WorkflowService. IsOneWay=%3.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 3503: A duplicate CorrelationQuery was found with Where='data1'.

Channel: Analytic
Task: Correlation
Opcode: DuplicateQuery

Description

A duplicate CorrelationQuery was found with Where='data1'. This duplicate query will not be used when calculating correlation.

Message #

A duplicate CorrelationQuery was found with Where='%1'. This duplicate query will not be used when calculating correlation.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3507: A service endpoint has been added for address 'data1', binding 'data2', and contract 'data3'.

Channel: Analytic
Task: AddServiceEndpoint

Message #

A service endpoint has been added for address '%1', binding '%2', and contract '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 3508: TrackingProfile 'TrackingProfile' for the ActivityDefinitionId 'ActivityDefinitionId' not found.

Channel: Analytic
Task: TrackingProfile
Opcode: NotFound

Description

TrackingProfile 'TrackingProfile' for the ActivityDefinitionId 'ActivityDefinitionId' not found. Either the TrackingProfile is not found in the config file or the ActivityDefinitionId does not match.

Message #

TrackingProfile '%1' for the ActivityDefinitionId '%2' not found. Either the TrackingProfile is not found in the config file or the ActivityDefinitionId does not match.

Fields #

Name	Description
`TrackingProfile` UnicodeString
`ActivityDefinitionId` UnicodeString
`AppDomain` UnicodeString

Event ID 3550: Operation 'data1' cannot be performed at this time.

Channel: Analytic
Task: BufferOutOfOrder
Opcode: NoInstance

Description

Operation 'data1' cannot be performed at this time. Another attempt will be made when the service instance is ready to process this particular operation.

Message #

Operation '%1' cannot be performed at this time. Another attempt will be made when the service instance is ready to process this particular operation.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3551: Operation 'data2' on service instance 'data1' cannot be performed at this time.

Channel: Analytic
Task: BufferOutOfOrder
Opcode: NoBookmark

Description

Operation 'data2' on service instance 'data1' cannot be performed at this time. Another attempt will be made when the service instance is ready to process this particular operation.

Message #

Operation '%2' on service instance '%1' cannot be performed at this time. Another attempt will be made when the service instance is ready to process this particular operation.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 3552: The throttle 'MaxPendingMessagesPerChannel' limit of 'limit' was hit.

Channel: Analytic
Task: Quotas

Description

The throttle 'MaxPendingMessagesPerChannel' limit of 'limit' was hit. To increase this limit, adjust the MaxPendingMessagesPerChannel property on BufferedReceiveServiceBehavior.

Message #

The throttle 'MaxPendingMessagesPerChannel' limit of  '%1' was hit. To increase this limit, adjust the MaxPendingMessagesPerChannel property on BufferedReceiveServiceBehavior.

Fields #

Name	Description
`limit` Int32
`AppDomain` UnicodeString

Event ID 3553: XamlServicesLoad start

Channel: Debug
Task: XamlServicesLoad
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3554: XamlServicesLoad Stop

Channel: Debug
Task: XamlServicesLoad
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3555: CreateWorkflowServiceHost start

Channel: Debug
Task: CreateWorkflowServiceHost
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3556: CreateWorkflowServiceHost Stop

Channel: Debug
Task: CreateWorkflowServiceHost
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3557: The call to EndCommit on the CommittableTransaction with id = 'data1' threw a TransactionException with the following message: 'data2'.

Channel: Analytic
Task: RuntimeTransaction

Message #

The call to EndCommit on the CommittableTransaction with id = '%1' threw a TransactionException with the following message: '%2'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 3558: Service activation start

Channel: Analytic
Task: ServiceActivation
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3559: Service activation Stop

Channel: Analytic
Task: ServiceActivation
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3560: Available memory (bytes): Available_memory_bytes.

Channel: Analytic
Task: Quotas

Message #

Available memory (bytes): %1

Fields #

Name	Description
`availableMemoryBytes` UInt64
`AppDomain` UnicodeString

Event ID 3561: The service could not be activated.

Channel: Operational
Opcode: Info

Description

The service could not be activated. Exception details: data1.

Message #

The service could not be activated. Exception details: %1

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 3800: The Routing Service is closing client 'data1'.

Channel: Debug
Task: RoutingServiceClient
Opcode: Closing

Message #

The Routing Service is closing client '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3801: Routing Service client 'data1' has faulted.

Channel: Debug
Task: RoutingServiceClient
Opcode: ChannelFaulted

Message #

Routing Service client '%1' has faulted.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3802: A Routing Service one way message is completing.

Channel: Debug
Task: RoutingServiceMessage
Opcode: CompletingOneWay

Fields #

Name	Description
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 3803: The Routing Service failed while processing a message on the endpoint with address 'data1'.

Channel: Debug
Task: RoutingServiceMessage
Opcode: ProcessingFailure

Message #

The Routing Service failed while processing a message on the endpoint with address '%1'.

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 3804: The Routing Service is creating a client for endpoint: 'data1'.

Channel: Debug
Task: RoutingServiceClient
Opcode: CreatingForEndpoint

Message #

The Routing Service is creating a client for endpoint: '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3805: The Routing Service is configured with RouteOnHeadersOnly: data1, SoapProcessingEnabled: data2, EnsureOrderedDispatch: data3.

Channel: Debug
Task: RoutingServiceMessage

Message #

The Routing Service is configured with RouteOnHeadersOnly: %1, SoapProcessingEnabled: %2, EnsureOrderedDispatch: %3.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 3807: A Routing Service request reply message is completing.

Channel: Debug
Task: RoutingServiceMessage
Opcode: CompletingTwoWay

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3809: The Routing Service routed message with ID: 'data1' to data2 endpoint lists.

Channel: Debug
Task: RoutingServiceMessage
Opcode: RoutedToEndpoints

Message #

The Routing Service routed message with ID: '%1' to %2 endpoint lists.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 3810: A new RoutingConfiguration has been applied to the Routing Service.

Channel: Debug
Task: RoutingService
Opcode: ConfigurationApplied

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3815: The Routing Service is processing a message with ID: 'data1', Action: 'data2', Inbound URL: 'data3' Received in Transaction: data4.

Channel: Debug
Task: RoutingServiceMessage
Opcode: ProcessingMessage

Message #

The Routing Service is processing a message with ID: '%1', Action: '%2', Inbound URL: '%3' Received in Transaction: %4.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`data4` UnicodeString
`AppDomain` UnicodeString

Event ID 3816: The Routing Service is transmitting the message with ID: 'data1' [operation data2] to 'data3'.

Channel: Debug
Task: RoutingServiceMessage
Opcode: TransmittingMessage

Message #

The Routing Service is transmitting the message with ID: '%1' [operation %2] to '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 3817: The Routing Service is committing a transaction with id: 'data1'.

Channel: Debug
Task: RoutingServiceTransaction
Opcode: CommittingTransaction

Message #

The Routing Service is committing a transaction with id: '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3818: Routing Service component data1 encountered a duplex callback exception.

Channel: Debug
Task: RoutingService
Opcode: DuplexCallbackException

Message #

Routing Service component %1 encountered a duplex callback exception.

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 3819: Routing Service message with ID: 'data1' [operation data2] moved to backup endpoint 'data3'.

Channel: Debug
Task: RoutingServiceMessage
Opcode: MovedToBackup

Message #

Routing Service message with ID: '%1' [operation %2] moved to backup endpoint '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 3820: The Routing Service created a new Transaction with id 'data1' for processing message(s).

Channel: Debug
Task: RoutingServiceTransaction
Opcode: Creating

Message #

The Routing Service created a new Transaction with id '%1' for processing message(s).

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3821: The Routing Service failed while closing outbound client 'data1'.

Channel: Debug
Task: RoutingService
Opcode: CloseFailed

Message #

The Routing Service failed while closing outbound client '%1'.

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 3822: The Routing Service is sending back a response message with Action 'data1'.

Channel: Debug
Task: RoutingServiceMessage
Opcode: SendingResponse

Message #

The Routing Service is sending back a response message with Action '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3823: The Routing Service is sending back a Fault response message with Action 'data1'.

Channel: Debug
Task: RoutingServiceMessage
Opcode: SendingFaultResponse

Message #

The Routing Service is sending back a Fault response message with Action '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3824: The Routing Service is calling ReceiveContext.

Channel: Debug
Task: RoutingServiceReceiveContext
Opcode: Completing

Description

The Routing Service is calling ReceiveContext.Complete for Message with ID: 'data1'.

Message #

The Routing Service is calling ReceiveContext.Complete for Message with ID: '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3825: The Routing Service is calling ReceiveContext.

Channel: Debug
Task: RoutingServiceReceiveContext
Opcode: Abandoning

Description

The Routing Service is calling ReceiveContext.Abandon for Message with ID: 'data1'.

Message #

The Routing Service is calling ReceiveContext.Abandon for Message with ID: '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3826: The Routing Service will send messages using existing transaction 'data1'.

Channel: Debug
Task: RoutingServiceTransaction
Opcode: UsingExisting

Message #

The Routing Service will send messages using existing transaction '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3827: The Routing Service failed while sending to 'data1'.

Channel: Debug
Task: RoutingService
Opcode: TransmitFailed

Message #

The Routing Service failed while sending to '%1'.

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 3828: Routing Service MessageFilterTable Match Start.

Channel: Analytic
Task: RoutingServiceFilterTableMatch
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3829: Routing Service MessageFilterTable Match Stop.

Channel: Analytic
Task: RoutingServiceFilterTableMatch
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 3830: The Routing Service is calling abort on channel: 'data1'.

Channel: Debug
Task: RoutingService
Opcode: AbortingChannel

Message #

The Routing Service is calling abort on channel: '%1'.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 3831: The Routing Service has handled an exception.

Channel: Debug
Task: RoutingService
Opcode: HandledException

Fields #

Name	Description
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 3832: The Routing Service successfully transmitted Message with ID: 'data1 [operation data2] to 'data3'.

Channel: Debug
Task: RoutingServiceMessage
Opcode: TransmitSucceeded

Message #

The Routing Service successfully transmitted Message with ID: '%1 [operation %2] to '%3'.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Event ID 4001: Transport listener session received with via 'via'.

Channel: Analytic
Task: ActivationDispatchSession
Opcode: Receive

Message #

Transport listener session received with via '%1'

Fields #

Name	Description
`via` UnicodeString
`AppDomain` UnicodeString

Event ID 4002: FailFastException.

Channel: Analytic
Task: WASActivation

Fields #

Name	Description
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 4003: Service start pipe error.

Channel: Analytic
Task: ActivationServiceStart

Fields #

Name	Description
`Endpoint` UnicodeString
`AppDomain` UnicodeString

Event ID 4008: Session dispatch started.

Channel: Analytic
Task: ActivationDispatchSession
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4010: Session dispatch for 'Uri' failed since pending session queue is full with 'count' pending items.

Channel: Analytic
Task: ActivationDispatchSession

Message #

Session dispatch for '%1' failed since pending session queue is full with '%2' pending items.

Fields #

Name	Description
`Uri` UnicodeString
`count` Int32
`AppDomain` UnicodeString

Event ID 4011: Message queue register start.

Channel: Analytic
Task: MessageQueueRegister
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4012: Message queue registration aborted with status:'Status' for uri:'Uri'.

Channel: Analytic
Task: MessageQueueRegister

Message #

Message queue registration aborted with status:'%1' for uri:'%2'.

Fields #

Name	Description
`Status` UnicodeString	NTSTATUS reference
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 4013: Message queue unregister succeeded for uri:'Uri'.

Channel: Analytic
Task: MessageQueueRegister
Opcode: Stop

Message #

Message queue unregister succeeded for uri:'%1'.

Fields #

Name	Description
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 4014: Message queue registration for uri:'Uri' failed with status:'Status'.

Channel: Analytic
Task: MessageQueueRegister

Message #

Message queue registration for uri:'%1' failed with status:'%2'.

Fields #

Name	Description
`Uri` UnicodeString
`Status` UnicodeString	NTSTATUS reference
`AppDomain` UnicodeString

Event ID 4015: Message queue registration completed for uri 'Uri'.

Channel: Analytic
Task: MessageQueueRegister

Message #

Message queue registration completed for uri '%1'.

Fields #

Name	Description
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 4016: Message queue failed duplicating socket.

Channel: Analytic
Task: ActivationDispatchSession

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4019: MessageQueueDuplicatedSocketComplete

Channel: Analytic
Task: ActivationDispatchSession
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4020: Tcp transport listener starting to listen on uri:'Uri'.

Channel: Analytic
Task: ActivationTcpListenerListening
Opcode: Start

Message #

Tcp transport listener starting to listen on uri:'%1'.

Fields #

Name	Description
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 4021: Tcp transport listener listening.

Channel: Analytic
Task: ActivationTcpListenerListening
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4022: Error Code:Error_Code.

Channel: Analytic
Task: WASActivation

Message #

Error Code:%1

Fields #

Name	Description
`hresult` UnicodeString
`AppDomain` UnicodeString

Event ID 4023: Was closing all listener channel instances completed.

Channel: Analytic
Task: WASActivation
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4024: Error Code:Error_Code.

Channel: Analytic
Task: WASActivation
Opcode: Stop

Message #

Error Code:%1

Fields #

Name	Description
`hresult` UnicodeString
`AppDomain` UnicodeString

Event ID 4025: Error Code:Error_Code.

Channel: Analytic
Task: WASActivation

Message #

Error Code:%1

Fields #

Name	Description
`hresult` UnicodeString
`AppDomain` UnicodeString

Event ID 4026: WAS Connected.

Channel: Analytic
Task: WASActivation
Opcode: Connected

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4027: WAS Disconnected.

Channel: Analytic
Task: WASActivation
Opcode: Disconnect

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4028: Pipe transport listener listening start on uri:Uri.

Channel: Analytic
Task: ActivationPipeListenerListening
Opcode: Start

Message #

Pipe transport listener listening start on uri:%1.

Fields #

Name	Description
`Uri` UnicodeString
`AppDomain` UnicodeString

Event ID 4029: Pipe transport listener listening stop.

Channel: Analytic
Task: ActivationPipeListenerListening
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4030: Session dispatch succeeded.

Channel: Analytic
Task: ActivationDispatchSession
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4031: Session dispatch failed.

Channel: Analytic
Task: ActivationDispatchSession

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4032: WAS connection timed out.

Channel: Analytic
Task: WASActivation

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4033: Routing table lookup started.

Channel: Debug
Task: ActivationRoutingTableLookup
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4034: Routing table lookup completed.

Channel: Debug
Task: ActivationRoutingTableLookup
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4035: Pending session queue ratio: Pending_session_queue_ratio/curr.

Channel: Debug
Task: Quotas

Message #

Pending session queue ratio: %1/%2

Fields #

Name	Description
`curr` Int32
`max` Int32
`AppDomain` UnicodeString

Event ID 4201: End SQL command execution: End_SQL_command_execution.

Channel: Debug
Task: SqlCommandExecute
Opcode: Stop

Message #

End SQL command execution: %1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 4202: Starting SQL command execution: Starting_SQL_command_execution.

Channel: Debug
Task: SqlCommandExecute
Opcode: Start

Message #

Starting SQL command execution: %1

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 4203: Failed to extend lock expiration, lock expiration already passed or the lock owner was deleted.

Channel: Debug
Task: LockWorkflowInstance

Description

Failed to extend lock expiration, lock expiration already passed or the lock owner was deleted. Aborting SqlWorkflowInstanceStore.

Message #

Failed to extend lock expiration, lock expiration already passed or the lock owner was deleted. Aborting SqlWorkflowInstanceStore.

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4205: Command failed: Command_failed.

Channel: Debug
Task: SqlCommandExecute

Message #

Command failed: %1

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 4206: Encountered exception data1 while attempting to unlock instance.

Channel: Debug
Task: LockWorkflowInstance

Message #

Encountered exception %1 while attempting to unlock instance.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 4207: Giving up retrying a SQL command as the maximum number of retries have been performed.

Channel: Debug
Task: SqlCommandExecute

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4208: Retrying a SQL command due to SQL error number data1.

Channel: Debug
Task: SqlCommandExecute

Message #

Retrying a SQL command due to SQL error number %1.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 4209: Timeout trying to open a SQL connection.

Channel: Debug
Task: SqlCommandExecute

Description

Timeout trying to open a SQL connection. The operation did not complete within the allotted timeout of data1. The time allotted to this operation may have been a portion of a longer timeout.

Message #

Timeout trying to open a SQL connection. The operation did not complete within the allotted timeout of %1. The time allotted to this operation may have been a portion of a longer timeout.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 4210: Caught SQL Exception number data1 message data2.

Channel: Debug
Task: SqlCommandExecute

Message #

Caught SQL Exception number %1 message %2.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 4211: Queuing SQL retry with delay data1 milliseconds.

Channel: Debug
Task: LockWorkflowInstance

Message #

Queuing SQL retry with delay %1 milliseconds.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 4212: Timeout trying to acquire the instance lock.

Channel: Debug
Task: SqlCommandExecute

Description

Timeout trying to acquire the instance lock. The operation did not complete within the allotted timeout of data1. The time allotted to this operation may have been a portion of a longer timeout.

Message #

Timeout trying to acquire the instance lock.  The operation did not complete within the allotted timeout of %1. The time allotted to this operation may have been a portion of a longer timeout.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 4213: Detection of runnable instances failed due to the following exception

Channel: Debug
Task: LockWorkflowInstance

Fields #

Name	Description
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 4214: Recovering instance locks failed due to the following exception

Channel: Debug
Task: LockWorkflowInstance

Fields #

Name	Description
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 4600: Message could not be logged as it exceeds the ETW event size

Channel: Debug
Opcode: Info

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4801: The DiscoveryClient created inside DiscoveryClientChannel failed to close and hence has been aborted.

Channel: Debug
Task: DiscoveryClient
Opcode: FailedToClose

Fields #

Name	Description
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 4802: A ProtocolException was suppressed while closing the DiscoveryClient.

Channel: Debug
Task: DiscoveryClient
Opcode: ExceptionSuppressed

Description

A ProtocolException was suppressed while closing the DiscoveryClient. This could be because a DiscoveryService is still trying to send response to the DiscoveryClient.

Message #

A ProtocolException was suppressed while closing the DiscoveryClient. This could be because a DiscoveryService is still trying to send response to the DiscoveryClient.

Fields #

Name	Description
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 4803: The DiscoveryClient received a multicast suppression message from a DiscoveryProxy.

Channel: Debug
Task: DiscoveryClient
Opcode: ReceivedMulticastSuppression

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4804: A discoveryMessageName message with messageId='messageId' was dropped by the DiscoveryClient because the corresponding discoveryOperationName operation was completed.

Channel: Debug
Task: DiscoveryMessage
Opcode: ReceivedAfterOperationCompleted

Message #

A %1 message with messageId='%2' was dropped by the DiscoveryClient because the corresponding %3 operation was completed.

Fields #

Name	Description
`discoveryMessageName` UnicodeString
`messageId` UnicodeString
`discoveryOperationName` UnicodeString
`AppDomain` UnicodeString

Event ID 4805: A messageType message with messageId='messageId' was dropped because it had invalid content.

Channel: Debug
Task: DiscoveryMessage
Opcode: InvalidContent

Message #

A %1 message with messageId='%2' was dropped because it had invalid content.

Fields #

Name	Description
`messageType` UnicodeString
`messageId` UnicodeString
`AppDomain` UnicodeString

Event ID 4806: A discoveryMessageName message with messageId='messageId' and relatesTo='relatesTo' was dropped by the DiscoveryClient because either the corresponding discoveryOperationName operation was complete...

Channel: Debug
Task: DiscoveryMessage
Opcode: InvalidRelatesToOrOperationCompleted

Description

A discoveryMessageName message with messageId='messageId' and relatesTo='relatesTo' was dropped by the DiscoveryClient because either the corresponding discoveryOperationName operation was completed or the relatesTo value is invalid.

Message #

A %1 message with messageId='%2' and relatesTo='%3' was dropped by the DiscoveryClient because either the corresponding %4 operation was completed or the relatesTo value is invalid.

Fields #

Name	Description
`discoveryMessageName` UnicodeString
`messageId` UnicodeString
`relatesTo` UnicodeString
`discoveryOperationName` UnicodeString
`AppDomain` UnicodeString

Event ID 4807: A discovery request message with messageId='messageId' was dropped because it had an invalid ReplyTo address.

Channel: Debug
Task: DiscoveryMessage
Opcode: InvalidReplyTo

Message #

A discovery request message with messageId='%1' was dropped because it had an invalid ReplyTo address.

Fields #

Name	Description
`messageId` UnicodeString
`AppDomain` UnicodeString

Event ID 4808: A messageType message was dropped because it did not have any content.

Channel: Debug
Task: DiscoveryMessage
Opcode: NoContent

Message #

A %1 message was dropped because it did not have any content.

Fields #

Name	Description
`messageType` UnicodeString
`AppDomain` UnicodeString

Event ID 4809: A messageType message was dropped because the message header did not contain the required MessageId property.

Channel: Debug
Task: DiscoveryMessage
Opcode: NullMessageId

Message #

A %1 message was dropped because the message header did not contain the required MessageId property.

Fields #

Name	Description
`messageType` UnicodeString
`AppDomain` UnicodeString

Event ID 4810: A discoveryMessageName message with messageId='messageId' was dropped by the DiscoveryClient because it did not have the DiscoveryMessageSequence property.

Channel: Debug
Task: DiscoveryMessage
Opcode: NullMessageSequence

Message #

A %1 message with messageId='%2' was dropped by the DiscoveryClient because it did not have the DiscoveryMessageSequence property.

Fields #

Name	Description
`discoveryMessageName` UnicodeString
`messageId` UnicodeString
`AppDomain` UnicodeString

Event ID 4811: A discoveryMessageName message with messageId='messageId' was dropped by the DiscoveryClient because the message header did not contain the required RelatesTo property.

Channel: Debug
Task: DiscoveryMessage
Opcode: NullRelatesTo

Message #

A %1 message with messageId='%2' was dropped by the DiscoveryClient because the message header did not contain the required RelatesTo property.

Fields #

Name	Description
`discoveryMessageName` UnicodeString
`messageId` UnicodeString
`AppDomain` UnicodeString

Event ID 4812: A discovery request message with messageId='messageId' was dropped because it did not have a ReplyTo address.

Channel: Debug
Task: DiscoveryMessage
Opcode: NullReplyTo

Message #

A discovery request message with messageId='%1' was dropped because it did not have a ReplyTo address.

Fields #

Name	Description
`messageId` UnicodeString
`AppDomain` UnicodeString

Event ID 4813: A messageType message with messageId='messageId' was dropped because it was a duplicate.

Channel: Debug
Task: DiscoveryMessage
Opcode: Duplicate

Message #

A %1 message with messageId='%2' was dropped because it was a duplicate.

Fields #

Name	Description
`messageType` UnicodeString
`messageId` UnicodeString
`AppDomain` UnicodeString

Event ID 4814: The discoverability of endpoint with EndpointAddress='endpointAddress' and ListenUri='listenUri' has been disabled.

Channel: Debug
Task: EndpointDiscoverability
Opcode: Disabled

Message #

The discoverability of endpoint with EndpointAddress='%1' and ListenUri='%2' has been disabled.

Fields #

Name	Description
`endpointAddress` UnicodeString
`listenUri` UnicodeString
`AppDomain` UnicodeString

Event ID 4815: The discoverability of endpoint with EndpointAddress='endpointAddress' and ListenUri='listenUri' has been enabled.

Channel: Debug
Task: EndpointDiscoverability
Opcode: Enabled

Message #

The discoverability of endpoint with EndpointAddress='%1' and ListenUri='%2' has been enabled.

Fields #

Name	Description
`endpointAddress` UnicodeString
`listenUri` UnicodeString
`AppDomain` UnicodeString

Event ID 4816: A Find operation was initiated in the DiscoveryClientChannel to discover endpoint(s).

Channel: Debug
Task: DiscoveryClientChannel
Opcode: FindInitiated

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 4817: The DiscoveryClientChannel failed to create the channel with a discovered endpoint with EndpointAddress='.

Channel: Debug
Task: DiscoveryClientChannel
Opcode: CreationFailed

Description

The DiscoveryClientChannel failed to create the channel with a discovered endpoint with EndpointAddress='endpointAddress' and Via='via'. The DiscoveryClientChannel will now attempt to use the next available discovered endpoint.

Message #

The DiscoveryClientChannel failed to create the channel with a discovered endpoint with EndpointAddress='%1' and Via='%2'. The DiscoveryClientChannel will now attempt to use the next available discovered endpoint.

Fields #

Name	Description
`endpointAddress` UnicodeString
`via` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 4818: The DiscoveryClientChannel failed to open the channel with a discovered endpoint with EndpointAddress='.

Channel: Debug
Task: DiscoveryClientChannel
Opcode: OpenFailed

Description

The DiscoveryClientChannel failed to open the channel with a discovered endpoint with EndpointAddress='endpointAddress' and Via='via'. The DiscoveryClientChannel will now attempt to use the next available discovered endpoint.

Message #

The DiscoveryClientChannel failed to open the channel with a discovered endpoint with EndpointAddress='%1' and Via='%2'. The DiscoveryClientChannel will now attempt to use the next available discovered endpoint.

Fields #

Name	Description
`endpointAddress` UnicodeString
`via` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 4819: The DiscoveryClientChannel successfully discovered an endpoint and opened the channel using it.

Channel: Debug
Task: DiscoveryClientChannel
Opcode: OpenSucceeded

Description

The DiscoveryClientChannel successfully discovered an endpoint and opened the channel using it. The client is connected to a service using EndpointAddress='endpointAddress' and Via='via'.

Message #

The DiscoveryClientChannel successfully discovered an endpoint and opened the channel using it. The client is connected to a service using EndpointAddress='%1' and Via='%2'.

Fields #

Name	Description
`endpointAddress` UnicodeString
`via` UnicodeString
`AppDomain` UnicodeString

Event ID 4820: The SynchronizationContext has been reset to its original value of synchronizationContextType by DiscoveryClientChannel.

Channel: Debug
Task: DiscoverySynchronizationContext
Opcode: Reset

Message #

The SynchronizationContext has been reset to its original value of %1 by DiscoveryClientChannel.

Fields #

Name	Description
`synchronizationContextType` UnicodeString
`AppDomain` UnicodeString

Event ID 4821: The SynchronizationContext has been set to null by DiscoveryClientChannel before initiating the Find operation.

Channel: Debug
Task: DiscoverySynchronizationContext
Opcode: SetToNull

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 5001: DataContract serialize SurrogateType with surrogates start.

Channel: Debug
Task: SurrogateSerialize
Opcode: Start

Message #

DataContract serialize %1 with surrogates start.

Fields #

Name	Description
`SurrogateType` UnicodeString
`AppDomain` UnicodeString

Event ID 5002: DataContract serialize with surrogates stop.

Channel: Debug
Task: SurrogateSerialize
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 5003: DataContract deserialize SurrogateType with surrogates start.

Channel: Debug
Task: SurrogateDeserialize
Opcode: Start

Message #

DataContract deserialize %1 with surrogates start.

Fields #

Name	Description
`SurrogateType` UnicodeString
`AppDomain` UnicodeString

Event ID 5004: DataContract deserialize with surrogates stop.

Channel: Debug
Task: SurrogateDeserialize
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 5005: ImportKnownTypes start.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ImportKnownType
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "5005",
    "version": "0",
    "level": "5",
    "task": "2547",
    "opcode": "1",
    "keywords": 1152921504606846978,
    "time_created": "2026-03-15T23:30:25.049562700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f76b74ad-e2a7-4365-b905-7714c206fadf}"
    },
    "execution": {
      "process_id": "8484",
      "thread_id": "2808"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "DefaultDomain"
  },
  "message": ""
}

Event ID 5006: ImportKnownTypes stop.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: ImportKnownType
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "5006",
    "version": "0",
    "level": "5",
    "task": "2547",
    "opcode": "2",
    "keywords": 1152921504606846978,
    "time_created": "2026-03-15T23:30:25.051207900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f76b74ad-e2a7-4365-b905-7714c206fadf}"
    },
    "execution": {
      "process_id": "8484",
      "thread_id": "2808"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "DefaultDomain"
  },
  "message": ""
}

Event ID 5007: DataContract resolver resolving TypeName start.

Channel: Debug
Task: DataContractResolver
Opcode: Start

Message #

DataContract resolver resolving %1 start.

Fields #

Name	Description
`TypeName` UnicodeString
`AppDomain` UnicodeString

Event ID 5008: DataContract generate Kind writer for TypeName start.

Channel: Debug
Level: Verbose
Task: GenerateSerializer
Opcode: Start

Message #

DataContract generate %1 writer for %2 start.

Fields #

Name	Description
`Kind` UnicodeString
`TypeName` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "5008",
    "version": "0",
    "level": "5",
    "task": "2544",
    "opcode": "1",
    "keywords": 1152921504606846978,
    "time_created": "2026-03-15T23:30:25.051265600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f76b74ad-e2a7-4365-b905-7714c206fadf}"
    },
    "execution": {
      "process_id": "8484",
      "thread_id": "2808"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Kind": "Collection",
    "TypeName": "System.String[]",
    "AppDomain": "DefaultDomain"
  },
  "message": ""
}

Event ID 5009: DataContract generate writer stop.

Channel: Debug
Level: Verbose
Task: GenerateSerializer
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "5009",
    "version": "0",
    "level": "5",
    "task": "2544",
    "opcode": "2",
    "keywords": 1152921504606846978,
    "time_created": "2026-03-15T23:30:25.054617100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f76b74ad-e2a7-4365-b905-7714c206fadf}"
    },
    "execution": {
      "process_id": "8484",
      "thread_id": "2808"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "DefaultDomain"
  },
  "message": ""
}

Event ID 5010: DataContract generate Kind reader for TypeName start.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: GenerateDeserializer
Opcode: Start

Message #

DataContract generate %1 reader for %2 start.

Fields #

Name	Description
`Kind` UnicodeString
`TypeName` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "5010",
    "version": "0",
    "level": "5",
    "task": "2543",
    "opcode": "1",
    "keywords": 1152921504606846978,
    "time_created": "2026-03-15T23:30:25.187432400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f76b74ad-e2a7-4365-b905-7714c206fadf}"
    },
    "execution": {
      "process_id": "8484",
      "thread_id": "2808"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Kind": "Collection",
    "TypeName": "schemas.microsoft.com._2008._1.ActiveDirectory.CustomActions.ActiveDirectoryDomainController[]",
    "AppDomain": "DefaultDomain"
  },
  "message": ""
}

Event ID 5011: DataContract generation stop.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: GenerateDeserializer
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "5011",
    "version": "0",
    "level": "5",
    "task": "2543",
    "opcode": "2",
    "keywords": 1152921504606846978,
    "time_created": "2026-03-15T23:30:25.199340100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{f76b74ad-e2a7-4365-b905-7714c206fadf}"
    },
    "execution": {
      "process_id": "8484",
      "thread_id": "2808"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomain": "DefaultDomain"
  },
  "message": ""
}

Event ID 5012: Json generate Kind reader for TypeName start.

Channel: Debug
Task: GenerateDeserializer
Opcode: Start

Message #

Json generate %1 reader for %2 start.

Fields #

Name	Description
`Kind` UnicodeString
`TypeName` UnicodeString
`AppDomain` UnicodeString

Event ID 5013: Json reader generation stop.

Channel: Debug
Task: GenerateDeserializer
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 5014: Json generate Kind writer for TypeName start.

Channel: Debug
Task: GenerateSerializer
Opcode: Start

Message #

Json generate %1 writer for %2 start.

Fields #

Name	Description
`Kind` UnicodeString
`TypeName` UnicodeString
`AppDomain` UnicodeString

Event ID 5015: Json generate writer stop.

Channel: Debug
Task: GenerateSerializer
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 5016: Generate Xml serializable for 'DCType' start.

Channel: Debug
Task: GenerateXmlSerializable
Opcode: Start

Message #

Generate Xml serializable for '%1' start.

Fields #

Name	Description
`DCType` UnicodeString
`AppDomain` UnicodeString

Event ID 5017: Generate Xml serializable stop.

Channel: Debug
Task: GenerateXmlSerializable
Opcode: Stop

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 5203: JsonMessageEncoder started decoding the message.

Channel: Debug
Task: MessageDecoding
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 5204: JsonMessageEncoder started encoding the message.

Channel: Debug
Task: MessageEncoding
Opcode: Start

Fields #

Name	Description
`AppDomain` UnicodeString

Event ID 5402: SecurityToken (type 'tokenType' and id 'tokenID') validation started.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: TokenValidation

Message #

SecurityToken (type '%1' and id '%2') validation started.

Fields #

Name	Description
`tokenType` UnicodeString
`tokenID` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "5402",
    "version": "0",
    "level": "5",
    "task": "2612",
    "opcode": "0",
    "keywords": 1152921504606846992,
    "time_created": "2026-03-15T23:29:50.492472600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{fb0a7822-7b4b-45f4-bf59-3e1c0df8827e}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "8452"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "tokenType": "System.IdentityModel.Tokens.WindowsSecurityToken",
    "tokenID": "uuid-d684443e-9e7d-4f56-8a9b-cc2a6b01c173-61",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 5403: SecurityToken (type 'tokenType' and id 'tokenID') validation succeeded.

Channel: Debug
Also via: realtime ETW trace
Level: Verbose
Task: TokenValidation

Message #

SecurityToken (type '%1' and id '%2') validation succeeded.

Fields #

Name	Description
`tokenType` UnicodeString
`tokenID` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "5403",
    "version": "0",
    "level": "5",
    "task": "2612",
    "opcode": "0",
    "keywords": 1152921504606846992,
    "time_created": "2026-03-15T23:29:50.492480800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{fb0a7822-7b4b-45f4-bf59-3e1c0df8827e}"
    },
    "execution": {
      "process_id": "7780",
      "thread_id": "8452"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Debug",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "tokenType": "System.IdentityModel.Tokens.WindowsSecurityToken",
    "tokenID": "uuid-d684443e-9e7d-4f56-8a9b-cc2a6b01c173-61",
    "HostReference": "",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 5404: SecurityToken (type 'tokenType' and id 'tokenID') validation failed.

Channel: Debug
Task: TokenValidation

Description

SecurityToken (type 'tokenType' and id 'tokenID') validation failed. errorMessage.

Message #

SecurityToken (type '%1' and id '%2') validation failed. %3

Fields #

Name	Description
`tokenType` UnicodeString
`tokenID` UnicodeString
`errorMessage` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5405: Retrieval of issuer name:issuerName from tokenId:tokenID succeeded.

Channel: Debug
Task: GetIssuerName

Message #

Retrieval of issuer name:%1 from tokenId:%2 succeeded.

Fields #

Name	Description
`issuerName` UnicodeString
`tokenID` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5406: Retrieval of issuer name from tokenId:tokenID failed.

Channel: Debug
Task: GetIssuerName

Message #

Retrieval of issuer name from tokenId:%1 failed.

Fields #

Name	Description
`tokenID` UnicodeString
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5600: Federation message processing started.

Channel: Debug
Task: FederationMessageProcessing

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5601: Federation message processing succeeded.

Channel: Debug
Task: FederationMessageProcessing

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5602: Creating federation message from form post started.

Channel: Debug
Task: FederationMessageCreation

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5603: Creating federation message from form post succeeded.

Channel: Debug
Task: FederationMessageCreation

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5604: Reading session token from session cookie started.

Channel: Debug
Task: SessionCookieReading

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5605: Reading session token from session cookie succeeded.

Channel: Debug
Task: SessionCookieReading

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5606: Principal setting from session token started.

Channel: Debug
Task: PrincipalSetting

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 5607: Principal setting from session token succeeded.

Channel: Debug
Task: PrincipalSetting

Fields #

Name	Description
`HostReference` UnicodeString
`AppDomain` UnicodeString

Event ID 39456: Size of tracking record RecordNumber exceeds maximum allowed by the ETW session for provider ProviderId.

Channel: Debug
Task: TrackingRecord
Opcode: Dropped

Message #

Size of tracking record %1 exceeds maximum allowed by the ETW session for provider %2

Fields #

Name	Description
`RecordNumber` Int64
`ProviderId` GUID
`AppDomain` UnicodeString

Event ID 39457: Tracking Record data1 raised to data2.

Channel: Debug
Task: TrackingRecord
Opcode: Raised

Message #

Tracking Record %1 raised to %2.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`AppDomain` UnicodeString

Event ID 39458: Truncated tracking record RecordNumber written to ETW session with provider ProviderId.

Channel: Debug
Task: TrackingRecord
Opcode: Truncated

Description

Truncated tracking record RecordNumber written to ETW session with provider ProviderId. Variables/annotations/user data have been removed.

Message #

Truncated tracking record %1 written to ETW session with provider %2. Variables/annotations/user data have been removed

Fields #

Name	Description
`RecordNumber` Int64
`ProviderId` GUID
`AppDomain` UnicodeString

Event ID 39459: Tracking data Data extracted in activity Activity.

Channel: Debug
Task: TrackingProfile

Message #

Tracking data %1 extracted in activity %2.

Fields #

Name	Description
`Data` UnicodeString
`Activity` UnicodeString
`AppDomain` UnicodeString

Event ID 39460: The extracted argument/variable 'name' is not serializable.

Channel: Debug
Task: TrackingProfile

Message #

The extracted argument/variable '%1' is not serializable.

Fields #

Name	Description
`name` UnicodeString
`AppDomain` UnicodeString

Event ID 57393: AppDomain unloading.

Channel: Debug
Opcode: Info

Description

AppDomain unloading. AppDomain.FriendlyName appdomainName, ProcessName processName, ProcessId processId.

Message #

AppDomain unloading. AppDomain.FriendlyName %1, ProcessName %2, ProcessId %3.

Fields #

Name	Description
`appdomainName` UnicodeString
`processName` UnicodeString
`processId` UnicodeString
`AppDomain` UnicodeString

Event ID 57394: Handling an exception.

Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Description

Handling an exception. Exception details: data1.

Message #

Handling an exception.  Exception details: %1

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "57394",
    "version": "0",
    "level": "4",
    "task": "0",
    "opcode": "0",
    "keywords": 2305843009213759488,
    "time_created": "2026-03-15T23:30:27.676114200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bf62ba95-04a7-46ba-8a97-f026ab57ec47}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "1108"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "data1": "System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:02:00'. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)\n   --- End of inner exception stack trace ---\n   at System.ServiceModel.Channels.ConnectionModeReader.GetConnectionMode()\n   at System.ServiceModel.Channels.ConnectionDemuxer.OnConnectionModeKnownCore(ConnectionModeReader modeReader, Boolean isCached)",
    "SerializedException": "<Exception><ExceptionType>System.ServiceModel.CommunicationException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:02:00'.</Message><StackTrace>   at System.ServiceModel.Channels.ConnectionModeReader.GetConnectionMode()\n   at System.ServiceModel.Channels.ConnectionDemuxer.OnConnectionModeKnownCore(ConnectionModeReader modeReader, Boolean isCached)</StackTrace><ExceptionString>System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:02:00'. ---&amp;gt; System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)\n   --- End of inner exception stack trace ---\n   at System.ServiceModel.Channels.ConnectionModeReader.GetConnectionMode()\n   at System.ServiceModel.Channels.ConnectionDemuxer.OnConnectionModeKnownCore(ConnectionModeReader modeReader, Boolean isCached)</ExceptionString><InnerException><Exception><ExceptionType>System.Net.Sockets.SocketException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>An existing connection was forcibly closed by the remote host</Message><StackTrace>   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)</StackTrace><ExceptionString>System.Net.Sockets.SocketException (0x80004005): An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)</ExceptionString><NativeErrorCode>2746</NativeErrorCode></Exception></InnerException></Exception>",
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 57395: An unexpected failure occurred.

Channel: Analytic
Opcode: Info

Description

An unexpected failure occurred. Applications should not attempt to handle this error. For diagnostic purposes, this English message is associated with the failure: data1.

Message #

An unexpected failure occurred. Applications should not attempt to handle this error. For diagnostic purposes, this English message is associated with the failure: %1.

Fields #

Name	Description
`data1` UnicodeString
`AppDomain` UnicodeString

Event ID 57396: Throwing an exception.

Channel: Analytic
Also via: realtime ETW trace
Level: Warning
Opcode: Info

Description

Throwing an exception. Source: data1. Exception details: data2.

Message #

Throwing an exception. Source: %1. Exception details: %2

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "57396",
    "version": "0",
    "level": "3",
    "task": "0",
    "opcode": "0",
    "keywords": 2305843009213759488,
    "time_created": "2026-03-15T23:30:27.675855200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bf62ba95-04a7-46ba-8a97-f026ab57ec47}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "12988"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "data1": "System.Runtime",
    "data2": "System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '10675199.02:48:05.4775807'. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)\n   --- End of inner exception stack trace ---\n   at System.ServiceModel.Channels.SocketConnection.EndRead()\n   at System.ServiceModel.Channels.ConnectionStream.ReadAsyncResult.HandleIO(IConnection connection)\n   at System.ServiceModel.Channels.ConnectionStream.IOAsyncResult.OnAsyncIOComplete(Object state)",
    "SerializedException": "<Exception><ExceptionType>System.ServiceModel.CommunicationException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '10675199.02:48:05.4775807'.</Message><StackTrace>   at System.ServiceModel.Channels.SocketConnection.EndRead()\n   at System.ServiceModel.Channels.ConnectionStream.ReadAsyncResult.HandleIO(IConnection connection)\n   at System.ServiceModel.Channels.ConnectionStream.IOAsyncResult.OnAsyncIOComplete(Object state)</StackTrace><ExceptionString>System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '10675199.02:48:05.4775807'. ---&amp;gt; System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)\n   --- End of inner exception stack trace ---\n   at System.ServiceModel.Channels.SocketConnection.EndRead()\n   at System.ServiceModel.Channels.ConnectionStream.ReadAsyncResult.HandleIO(IConnection connection)\n   at System.ServiceModel.Channels.ConnectionStream.IOAsyncResult.OnAsyncIOComplete(Object state)</ExceptionString><InnerException><Exception><ExceptionType>System.Net.Sockets.SocketException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>An existing connection was forcibly closed by the remote host</Message><StackTrace>   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)</StackTrace><ExceptionString>System.Net.Sockets.SocketException (0x80004005): An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)</ExceptionString><NativeErrorCode>2746</NativeErrorCode></Exception></InnerException></Exception>",
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 57397: Unhandled exception.

Channel: Operational
Opcode: Info

Description

Unhandled exception. Exception details: data1.

Message #

Unhandled exception.  Exception details: %1

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 57398: The system hit the limit set for throttle 'MaxConcurrentInstances'.

Channel: Analytic
Task: Throttles

Description

The system hit the limit set for throttle 'MaxConcurrentInstances'. Limit for this throttle was set to limit. Throttle value can be changed by modifying attribute 'maxConcurrentInstances' in serviceThrottle element or by modifying 'MaxConcurrentInstances' property on behavior ServiceThrottlingBehavior.

Message #

The system hit the limit set for throttle 'MaxConcurrentInstances'. Limit for this throttle was set to %1. Throttle value can be changed by modifying attribute 'maxConcurrentInstances' in serviceThrottle element or by modifying 'MaxConcurrentInstances' property on behavior ServiceThrottlingBehavior.

Fields #

Name	Description
`limit` Int32
`AppDomain` UnicodeString

Event ID 57399: Wrote to the EventLog.

Channel: Debug
Opcode: Info

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 57400: Wrote to the EventLog.

Channel: Debug
Opcode: Info

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 57401: Wrote to the EventLog.

Channel: Debug
Opcode: Info

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 57402: Wrote to the EventLog.

Channel: Debug
Opcode: Info

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 57403: Wrote to the EventLog.

Channel: Debug
Opcode: Info

Fields #

Name	Description
`ExtendedData` UnicodeString
`AppDomain` UnicodeString

Event ID 57404: Handling an exception.

Channel: Analytic
Opcode: Info

Description

Handling an exception. Exception details: data1.

Message #

Handling an exception. Exception details: %1

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 57405: Handling an exception.

Channel: Operational
Level: Error
Opcode: Info

Description

Handling an exception. Exception details: data1.

Message #

Handling an exception. Exception details: %1

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "C651F5F6-1C0D-492E-8AE1-B4EFD7C9D503",
    "event_source_name": "",
    "event_id": 57405,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427453440,
    "time_created": "2026-03-13T23:07:36.849516+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "FCDC6F25-76F3-4BC2-B0EB-7EFEBD19BD6C"
    },
    "execution": {
      "process_id": 9844,
      "thread_id": 11496
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "data1": "Microsoft.IdentityModel.Tokens.FailedAuthenticationFaultException: ID3242: The security token could not be authenticated or authorized.\r\n   at Microsoft.IdentityModel.ExceptionMapper.HandleSecurityTokenProcessingException(Exception ex)\r\n   at Microsoft.IdentityServer.Service.SecurityTokenService.MSISIdentityModelAuthorizationManager.ValidateDelayedTokenHandlers(FederatedServiceCredentials serviceCreds, SecurityToken token)\r\n   at Microsoft.IdentityServer.Service.SecurityTokenService.MSISIdentityModelAuthorizationManager.CheckAccessCore(OperationContext operationContext)\r\n   at System.ServiceModel.Dispatcher.AuthorizationBehavior.Authorize(MessageRpc& rpc)\r\n   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage11(MessageRpc& rpc)\r\n   at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)",
    "SerializedException": "<Exception><ExceptionType>Microsoft.IdentityModel.Tokens.FailedAuthenticationFaultException, Microsoft.IdentityServer.IdentityModel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35</ExceptionType><Message>ID3242: The security token could not be authenticated or authorized.</Message><StackTrace>   at Microsoft.IdentityModel.ExceptionMapper.HandleSecurityTokenProcessingException(Exception ex)\r\n   at Microsoft.IdentityServer.Service.SecurityTokenService.MSISIdentityModelAuthorizationManager.ValidateDelayedTokenHandlers(FederatedServiceCredentials serviceCreds, SecurityToken token)\r\n   at Microsoft.IdentityServer.Service.SecurityTokenService.MSISIdentityModelAuthorizationManager.CheckAccessCore(OperationContext operationContext)\r\n   at System.ServiceModel.Dispatcher.AuthorizationBehavior.Authorize(MessageRpc&amp;amp; rpc)\r\n   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage11(MessageRpc&amp;amp; rpc)\r\n   at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)</StackTrace><ExceptionString>Microsoft.IdentityModel.Tokens.FailedAuthenticationFaultException: ID3242: The security token could not be authenticated or authorized.\r\n   at Microsoft.IdentityModel.ExceptionMapper.HandleSecurityTokenProcessingException(Exception ex)\r\n   at Microsoft.IdentityServer.Service.SecurityTokenService.MSISIdentityModelAuthorizationManager.ValidateDelayedTokenHandlers(FederatedServiceCredentials serviceCreds, SecurityToken token)\r\n   at Microsoft.IdentityServer.Service.SecurityTokenService.MSISIdentityModelAuthorizationManager.CheckAccessCore(OperationContext operationContext)\r\n   at System.ServiceModel.Dispatcher.AuthorizationBehavior.Authorize(MessageRpc&amp;amp; rpc)\r\n   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage11(MessageRpc&amp;amp; rpc)\r\n   at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)</ExceptionString></Exception>",
    "AppDomain": "Microsoft.IdentityServer.ServiceHost.exe"
  },
  "message": ""
}

Event ID 57406: Handling an exception Exception details: data1.

Channel: Analytic
Opcode: Info

Message #

Handling an exception  Exception details: %1

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 57407: Throwing an exception.

Channel: Analytic
Opcode: Info

Description

Throwing an exception. Source: data1. Exception details: data2.

Message #

Throwing an exception. Source: %1. Exception details: %2

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 57408: Unhandled exception.

Channel: Operational
Opcode: Info

Description

Unhandled exception. Exception details: data1.

Message #

Unhandled exception. Exception details: %1

Fields #

Name	Description
`data1` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Event ID 57409: Throwing an exception.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Opcode: Info

Description

Throwing an exception. Source: data1. Exception details: data2.

Message #

Throwing an exception. Source: %1. Exception details: %2

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "57409",
    "version": "0",
    "level": "5",
    "task": "0",
    "opcode": "0",
    "keywords": 2305843009213759488,
    "time_created": "2026-03-15T23:30:27.675853200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bf62ba95-04a7-46ba-8a97-f026ab57ec47}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "1108"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "data1": "System.ServiceModel 4.0.0.0",
    "data2": "System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:02:00'. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)\n   --- End of inner exception stack trace ---\n   at System.ServiceModel.Channels.SocketConnection.EndRead()\n   at System.ServiceModel.Channels.ConnectionModeReader.GetReadResult()\n   at System.ServiceModel.Channels.ConnectionModeReader.ReadCallback(Object state)",
    "SerializedException": "<Exception><ExceptionType>System.ServiceModel.CommunicationException, System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:02:00'.</Message><StackTrace>   at System.ServiceModel.Channels.SocketConnection.EndRead()\n   at System.ServiceModel.Channels.ConnectionModeReader.GetReadResult()\n   at System.ServiceModel.Channels.ConnectionModeReader.ReadCallback(Object state)</StackTrace><ExceptionString>System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:02:00'. ---&amp;gt; System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)\n   --- End of inner exception stack trace ---\n   at System.ServiceModel.Channels.SocketConnection.EndRead()\n   at System.ServiceModel.Channels.ConnectionModeReader.GetReadResult()\n   at System.ServiceModel.Channels.ConnectionModeReader.ReadCallback(Object state)</ExceptionString><InnerException><Exception><ExceptionType>System.Net.Sockets.SocketException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>An existing connection was forcibly closed by the remote host</Message><StackTrace>   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)</StackTrace><ExceptionString>System.Net.Sockets.SocketException (0x80004005): An existing connection was forcibly closed by the remote host\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)</ExceptionString><NativeErrorCode>2746</NativeErrorCode></Exception></InnerException></Exception>",
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 57410: Throwing an exception.

Channel: Analytic
Also via: realtime ETW trace
Level: Warning
Opcode: Info

Description

Throwing an exception. Source: data1. Exception details: data2.

Message #

Throwing an exception. Source: %1. Exception details: %2

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`SerializedException` UnicodeString
`AppDomain` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application Server-Applications",
    "guid": "{c651f5f6-1c0d-492e-8ae1-b4efd7c9d503}",
    "event_source_name": "",
    "event_id": "57410",
    "version": "0",
    "level": "3",
    "task": "0",
    "opcode": "0",
    "keywords": 2305843009213759488,
    "time_created": "2026-03-15T23:30:27.675042300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bf62ba95-04a7-46ba-8a97-f026ab57ec47}"
    },
    "execution": {
      "process_id": "3912",
      "thread_id": "1108"
    },
    "channel": "Microsoft-Windows-Application Server-Applications/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "data1": "System.ServiceModel 4.0.0.0",
    "data2": "System.Net.Sockets.SocketException (0x80004005): An existing connection was forcibly closed by the remote host",
    "SerializedException": "<Exception><ExceptionType>System.Net.Sockets.SocketException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>An existing connection was forcibly closed by the remote host</Message><StackTrace>   at System.Runtime.Diagnostics.EtwDiagnosticTrace.WriteExceptionToTraceString(XmlTextWriter xml, Exception exception, Int32 remainingLength, Int32 remainingAllowedRecursionDepth)\n   at System.Runtime.Diagnostics.EtwDiagnosticTrace.ExceptionToTraceString(Exception exception, Int32 maxTraceStringLength)\n   at System.Runtime.Diagnostics.EtwDiagnosticTrace.GetSerializedPayload(Object source, TraceRecord traceRecord, Exception exception, Boolean getServiceReference)\n   at System.Runtime.TraceCore.ThrowingEtwException(EtwDiagnosticTrace trace, String param0, String param1, Exception exception)\n   at System.ServiceModel.Diagnostics.ExceptionUtility.ThrowHelper(Exception exception, TraceEventType eventType, TraceRecord extendedData)\n   at System.ServiceModel.Channels.SocketConnection.HandleReceiveAsyncCompleted()\n   at System.ServiceModel.Channels.SocketConnection.OnReceiveAsync(Object sender, SocketAsyncEventArgs eventArgs)\n   at System.Net.Sockets.SocketAsyncEventArgs.OnCompleted(SocketAsyncEventArgs e)\n   at System.Net.Sockets.SocketAsyncEventArgs.FinishOperationAsyncFailure(SocketError socketError, Int32 bytesTransferred, SocketFlags flags)\n   at System.Net.Sockets.SocketAsyncEventArgs.CompletionPortCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* nativeOverlapped)\n   at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* pOVERLAP)\n</StackTrace><ExceptionString>System.Net.Sockets.SocketException (0x80004005): An existing connection was forcibly closed by the remote host</ExceptionString><NativeErrorCode>2746</NativeErrorCode></Exception>",
    "AppDomain": "Microsoft.ActiveDirectory.WebServices.exe"
  },
  "message": ""
}

Event ID 62326: The url 'data1' hosts XAML document with root element type 'data2'.

Channel: Debug
Task: CreateWorkflowServiceHost

Description

The url 'data1' hosts XAML document with root element type 'data2'. The HTTP handler type 'data3' is picked to serve all the requests made to this url.

Message #

The url '%1' hosts XAML document with root element type '%2'. The HTTP handler type '%3' is picked to serve all the requests made to this url.

Fields #

Name	Description
`data1` UnicodeString
`data2` UnicodeString
`data3` UnicodeString
`AppDomain` UnicodeString

Provenance

ETW provider GUID {C651F5F6-1C0D-492E-8AE1-B4EFD7C9D503}

Defined in Microsoft.Windows.ApplicationServer.Applications.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 4.8.4161.0 built by: NET48REL1, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 4.8.4161.0, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 4.8.9032.0, captured 2026-06-02