Microsoft-Windows-AppModel-MessagingDataModel

54 events across 1 channel

Event	Title	Channel	Sample
1	Error: HRESULT: {P1_HResult} Location: {P2_String} Line Number: {P3_UInt32}.	Operational	N
2	Error Propagated: HRESULT: {P1_HResult} Location: {P2_String} Line Number: …	Operational	N
100	[MessagingDataModel] CSmMessage::WriteMessageInternal() done.	Operational	N
101	[MessagingDataModel] Writing message to database with pending download set and …	Operational	N
102	[MessagingDataModel] Setting pending download to {Prop_Bool}.	Operational	N
104	[Messaging] {Prop_UnicodeString}.	Operational	N
105	[Messaging] {Prop_UnicodeString}.	Operational	N
106	[Messaging] {Prop_Description_UnicodeString}; DWORD = {Prop_Data_UInt32}.	Operational	N
107	[Messaging] MapiAdviseSink::OnNotify extended; event is …	Operational	N
108	[Messaging] MapiAdviseSink::OnNotify; Event type: {Prop_EventType}; Object type: …	Operational	N
109	[Messaging] MapiAdviseSink::_OnMessageNotify; Event type: {Prop_EventType}.	Operational	N
110	[Messaging] CSmMessage::WriteMessageInternal - Status: {Prop_ReadStatusType}.	Operational	N
111	[Messaging] CSmMessage::SetUnread - Setting status to: {Prop_ReadStatusType}.	Operational	N
116	[IMTransport] Error: Invalid Recipient Contact Type for IM	Operational	N
117	[IMTransport] Error: Missing IMMRI for recipient; using User ID: …	Operational	N
118	[IMTransport] Error: Missing IMMRI and User ID for recipient; skipping	Operational	N
119	[ProviderManager] Number of slots: {Prop_Data_UInt32}.	Operational	N
120	[MessagingDataModel] SlideAccessor::_CreateXmlReaderForSmilParsing: XmlReader …	Operational	N
121	[MessagingDataModel] SlideAccessor::_BuildSlideFromSmil: …	Operational	N
122	[MessagingDataModel] Unexpected media type {Prop_Data_UInt32}.	Operational	N
123	[MessagingDataModel] Processing async deletions: Conversation Index = …	Operational	N
124	[MessagingDataModel] Processing async deletion for a conversation: Batch Count = …	Operational	N
125	[MessagingDataModel] MapiAdviseSink::_OnNewMessage()	Operational	N
126	[MessagingDataModel] Calling notificationSink.	Operational	N
127	[MessagingDataModel] returned from notificationSink.	Operational	N
128	[MessagingDataModel] ResetNewMessageCountByProviders()	Operational	N
129	[MessagingDataModel] CSmStore::SetProviderUnseenCount	Operational	N
130	[Threading] Found contact [.	Operational	N
131	[Threading] Found conversation for contact	Operational	N
132	[Threading] Found better conversation	Operational	N
133	[Threading] Looking for contact number hash = {Prop_Data_UInt32}.	Operational	N
134	[Threading] Creating new conversation for contact [.	Operational	N
135	[MessagingDataModel] Conversation::GetLeadingMessageId - Message not found	Operational	N
136	[MessagingDataModel] Conversation::GetLeadingMessageId - Query results found.	Operational	N
138	[MessagingDataModel] Conversation::GetLeadingMessageId - Query results found.	Operational	N
139	[MessagingDataModel] CSmStore::FindConversationById - Conversation not found!	Operational	N
1001	[MessagingCloudServices] ChatService REST API response failure: StatusCode = [.	Operational	N
1002	[MessagingCloudServices] AsyncMediaService REST API response failure: StatusCode …	Operational	N
1003	[MessagingCloudServices] CloudServiceController sync state transition [.	Operational	N
1004	[MessagingCloudServices] CloudServiceTransaction HTTP request URI = [.	Operational	N
1005	[MessagingCloudServices] CloudServiceTransaction HTTP success: StatusCode = [.	Operational	N
1006	[MessagingCloudServices] CloudServiceTransaction HTTP failure: StatusCode = [.	Operational	N
1007	[MessagingCloudServices] CloudServiceSync iteration started: current iteration = …	Operational	N
1008	[MessagingCloudServices] CloudServiceSync iteration finished: current iteration …	Operational	N
1009	[MessagingCloudServices] CloudServiceSync sync timer: current iteration = [.	Operational	N
1010	[MessagingCloudServices] CloudServiceSync sync failure: current iteration = [.	Operational	N
1501	[MessagingNotifications] New message notification received	Operational	N
1502	[MessagingNotifications] Notification item initialized - type = [.	Operational	N
1503	[MessagingNotifications] Notification item started - type = [.	Operational	N
1504	[MessagingNotifications] Notification item finished - type = [.	Operational	N
1505	[MessagingNotifications] Notified messaging apps - actions = [.	Operational	N
1506	[MessagingNotifications] Notification handled by provider [.	Operational	N
1507	[MessagingNotifications] Notification suppressed - type = [.	Operational	N
1508	[MessagingNotifications] No notification was queued/needed	Operational	N

Event ID 1: Error: HRESULT: {P1_HResult} Location: {P2_String} Line Number: {P3_UInt32}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

Error: HRESULT: {P1_HResult} Location: {P2_String} Line Number: {P3_UInt32}.

Message #

Error: HRESULT: {P1_HResult} Location: {P2_String} Line Number: {P3_UInt32}

Fields #

Name	Description
`P1_HResult`
`P2_String`
`P3_UInt32`

Event ID 2: Error Propagated: HRESULT: {P1_HResult} Location: {P2_String} Line Number: {P3_UInt32}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

Error Propagated: HRESULT: {P1_HResult} Location: {P2_String} Line Number: {P3_UInt32}.

Message #

Error Propagated: HRESULT: {P1_HResult} Location: {P2_String} Line Number: {P3_UInt32}

Fields #

Name	Description
`P1_HResult`
`P2_String`
`P3_UInt32`

Event ID 100: [MessagingDataModel] CSmMessage::WriteMessageInternal() done.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] CSmMessage::WriteMessageInternal() done.

Message #

[MessagingDataModel] CSmMessage::WriteMessageInternal() done.

Event ID 101: [MessagingDataModel] Writing message to database with pending download set and status succeeded

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] Writing message to database with pending download set and status succeeded.

Message #

[MessagingDataModel] Writing message to database with pending download set and status succeeded

Event ID 102: [MessagingDataModel] Setting pending download to {Prop_Bool}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] Setting pending download to {Prop_Bool}.

Message #

[MessagingDataModel] Setting pending download to {Prop_Bool}

Fields #

Name	Description
`Prop_Bool`

Event ID 104: [Messaging] {Prop_UnicodeString}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Messaging] {Prop_UnicodeString}.

Message #

[Messaging] {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 105: [Messaging] {Prop_UnicodeString}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Messaging] {Prop_UnicodeString}.

Message #

[Messaging] {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 106: [Messaging] {Prop_Description_UnicodeString}; DWORD = {Prop_Data_UInt32}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Messaging] {Prop_Description_UnicodeString}; DWORD = {Prop_Data_UInt32}.

Message #

[Messaging] {Prop_Description_UnicodeString}; DWORD = {Prop_Data_UInt32}

Fields #

Name	Description
`Prop_Description_UnicodeString`
`Prop_Data_UInt32`

Event ID 107: [Messaging] MapiAdviseSink::OnNotify extended; event is {Prop_ExtendedEventType}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Messaging] MapiAdviseSink::OnNotify extended; event is {Prop_ExtendedEventType}.

Message #

[Messaging] MapiAdviseSink::OnNotify extended; event is {Prop_ExtendedEventType}

Fields #

Name	Description
`Prop_ExtendedEventType`

Event ID 108: [Messaging] MapiAdviseSink::OnNotify; Event type: {Prop_EventType}; Object type: {Prop_ObjectType}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Messaging] MapiAdviseSink::OnNotify; Event type: {Prop_EventType}; Object type: {Prop_ObjectType}.

Message #

[Messaging] MapiAdviseSink::OnNotify; Event type: {Prop_EventType}; Object type: {Prop_ObjectType}

Fields #

Name	Description
`Prop_EventType`
`Prop_ObjectType`

Event ID 109: [Messaging] MapiAdviseSink::_OnMessageNotify; Event type: {Prop_EventType}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Messaging] MapiAdviseSink::_OnMessageNotify; Event type: {Prop_EventType}.

Message #

[Messaging] MapiAdviseSink::_OnMessageNotify; Event type: {Prop_EventType}

Fields #

Name	Description
`Prop_EventType`

Event ID 110: [Messaging] CSmMessage::WriteMessageInternal - Status: {Prop_ReadStatusType}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Messaging] CSmMessage::WriteMessageInternal - Status: {Prop_ReadStatusType}.

Message #

[Messaging] CSmMessage::WriteMessageInternal - Status: {Prop_ReadStatusType}

Fields #

Name	Description
`Prop_ReadStatusType`

Event ID 111: [Messaging] CSmMessage::SetUnread - Setting status to: {Prop_ReadStatusType}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Messaging] CSmMessage::SetUnread - Setting status to: {Prop_ReadStatusType}.

Message #

[Messaging] CSmMessage::SetUnread - Setting status to: {Prop_ReadStatusType}

Fields #

Name	Description
`Prop_ReadStatusType`

Event ID 116: [IMTransport] Error: Invalid Recipient Contact Type for IM

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[IMTransport] Error: Invalid Recipient Contact Type for IM.

Message #

[IMTransport] Error: Invalid Recipient Contact Type for IM

Event ID 117: [IMTransport] Error: Missing IMMRI for recipient; using User ID: {Prop_UnicodeString}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[IMTransport] Error: Missing IMMRI for recipient; using User ID: {Prop_UnicodeString}.

Message #

[IMTransport] Error: Missing IMMRI for recipient; using User ID: {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 118: [IMTransport] Error: Missing IMMRI and User ID for recipient; skipping

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[IMTransport] Error: Missing IMMRI and User ID for recipient; skipping.

Message #

[IMTransport] Error: Missing IMMRI and User ID for recipient; skipping

Event ID 119: [ProviderManager] Number of slots: {Prop_Data_UInt32}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[ProviderManager] Number of slots: {Prop_Data_UInt32}.

Message #

[ProviderManager] Number of slots: {Prop_Data_UInt32}

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 120: [MessagingDataModel] SlideAccessor::_CreateXmlReaderForSmilParsing: XmlReader SetInput failed with hr=.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] SlideAccessor::_CreateXmlReaderForSmilParsing: XmlReader SetInput failed with hr={Prop_Data_UInt32}.

Message #

[MessagingDataModel] SlideAccessor::_CreateXmlReaderForSmilParsing: XmlReader SetInput failed with hr={Prop_Data_UInt32}

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 121: [MessagingDataModel] SlideAccessor::_BuildSlideFromSmil: _CreateXmlReaderForSmilParsing failed with hr=.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] SlideAccessor::_BuildSlideFromSmil: _CreateXmlReaderForSmilParsing failed with hr={Prop_Data_UInt32}.

Message #

[MessagingDataModel] SlideAccessor::_BuildSlideFromSmil: _CreateXmlReaderForSmilParsing failed with hr={Prop_Data_UInt32}

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 122: [MessagingDataModel] Unexpected media type {Prop_Data_UInt32}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] Unexpected media type {Prop_Data_UInt32}.

Message #

[MessagingDataModel] Unexpected media type {Prop_Data_UInt32}

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 123: [MessagingDataModel] Processing async deletions: Conversation Index = {Prop_Data_UInt32}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] Processing async deletions: Conversation Index = {Prop_Data_UInt32}.

Message #

[MessagingDataModel] Processing async deletions: Conversation Index = {Prop_Data_UInt32}

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 124: [MessagingDataModel] Processing async deletion for a conversation: Batch Count = {Prop_Data_UInt32}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] Processing async deletion for a conversation: Batch Count = {Prop_Data_UInt32}.

Message #

[MessagingDataModel] Processing async deletion for a conversation: Batch Count = {Prop_Data_UInt32}

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 125: [MessagingDataModel] MapiAdviseSink::_OnNewMessage()

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] MapiAdviseSink::_OnNewMessage().

Message #

[MessagingDataModel] MapiAdviseSink::_OnNewMessage()

Event ID 126: [MessagingDataModel] Calling notificationSink.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] Calling notificationSink.pSink->OnNewMessage.

Message #

[MessagingDataModel] Calling notificationSink.pSink->OnNewMessage

Event ID 127: [MessagingDataModel] returned from notificationSink.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] returned from notificationSink.pSink->OnNewMessage.

Message #

[MessagingDataModel] returned from notificationSink.pSink->OnNewMessage

Event ID 128: [MessagingDataModel] ResetNewMessageCountByProviders()

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] ResetNewMessageCountByProviders().

Message #

[MessagingDataModel] ResetNewMessageCountByProviders()

Event ID 129: [MessagingDataModel] CSmStore::SetProviderUnseenCount

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] CSmStore::SetProviderUnseenCount.

Message #

[MessagingDataModel] CSmStore::SetProviderUnseenCount

Event ID 130: [Threading] Found contact [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Threading] Found contact [{Prop_Data1_UInt32}] [{Prop_Data2_UInt32}] [{Prop_Data3_UInt32}].

Message #

[Threading] Found contact [{Prop_Data1_UInt32}] [{Prop_Data2_UInt32}] [{Prop_Data3_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`
`Prop_Data3_UInt32`

Event ID 131: [Threading] Found conversation for contact

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Threading] Found conversation for contact.

Message #

[Threading] Found conversation for contact

Event ID 132: [Threading] Found better conversation

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Threading] Found better conversation.

Message #

[Threading] Found better conversation

Event ID 133: [Threading] Looking for contact number hash = {Prop_Data_UInt32}.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Threading] Looking for contact number hash = {Prop_Data_UInt32}.

Message #

[Threading] Looking for contact number hash = {Prop_Data_UInt32}

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 134: [Threading] Creating new conversation for contact [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[Threading] Creating new conversation for contact [{Prop_Data1_UInt32}] [{Prop_Data2_UInt32}] [{Prop_Data3_UInt32}].

Message #

[Threading] Creating new conversation for contact [{Prop_Data1_UInt32}] [{Prop_Data2_UInt32}] [{Prop_Data3_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`
`Prop_Data3_UInt32`

Event ID 135: [MessagingDataModel] Conversation::GetLeadingMessageId - Message not found

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] Conversation::GetLeadingMessageId - Message not found.

Message #

[MessagingDataModel] Conversation::GetLeadingMessageId - Message not found

Event ID 136: [MessagingDataModel] Conversation::GetLeadingMessageId - Query results found.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Message #

[MessagingDataModel] Conversation::GetLeadingMessageId - Query results found. ConversationId: [{Prop_Description_UnicodeString1}] MessageId: [{Prop_Description_UnicodeString2}] MessageType: [{Prop_Data_DWORD}] IterationCount: [{Prop_Data_UInt32}]

Fields #

Name	Description
`Prop_Description_UnicodeString1`
`Prop_Description_UnicodeString2`
`Prop_Data_DWORD`
`Prop_Data_UInt32`

Event ID 138: [MessagingDataModel] Conversation::GetLeadingMessageId - Query results found.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Message #

[MessagingDataModel] Conversation::GetLeadingMessageId - Query results found. ConversationId: [{Prop_Description_UnicodeString1}] MessageId: [{Prop_Description_UnicodeString2}] MessageType: [{Prop_Data_DWORD}] ProviderId: [{Prop_Data_UInt64}] IterationCount: [{Prop_Data_UInt32}]

Fields #

Name	Description
`Prop_Description_UnicodeString1`
`Prop_Description_UnicodeString2`
`Prop_Data_DWORD`
`Prop_Data_UInt64`
`Prop_Data_UInt32`

Event ID 139: [MessagingDataModel] CSmStore::FindConversationById - Conversation not found!

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingDataModel] CSmStore::FindConversationById - Conversation not found! Id:[{Prop_UnicodeString}].

Message #

[MessagingDataModel] CSmStore::FindConversationById - Conversation not found! Id:[{Prop_UnicodeString}]

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1001: [MessagingCloudServices] ChatService REST API response failure: StatusCode = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] ChatService REST API response failure: StatusCode = [{Prop_Data_UInt32}]; ContextId = [{Prop_Description_UnicodeString1}]; Date = [{Prop_Description_UnicodeString2}].

Message #

[MessagingCloudServices] ChatService REST API response failure: StatusCode = [{Prop_Data_UInt32}]; ContextId = [{Prop_Description_UnicodeString1}]; Date = [{Prop_Description_UnicodeString2}]

Fields #

Name	Description
`Prop_Data_UInt32`
`Prop_Description_UnicodeString1`
`Prop_Description_UnicodeString2`

Event ID 1002: [MessagingCloudServices] AsyncMediaService REST API response failure: StatusCode = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] AsyncMediaService REST API response failure: StatusCode = [{Prop_Data_UInt32}].

Message #

[MessagingCloudServices] AsyncMediaService REST API response failure: StatusCode = [{Prop_Data_UInt32}]

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 1003: [MessagingCloudServices] CloudServiceController sync state transition [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] CloudServiceController sync state transition [{Prop_Data1_UInt32}] => [{Prop_Data2_UInt32}].

Message #

[MessagingCloudServices] CloudServiceController sync state transition [{Prop_Data1_UInt32}] => [{Prop_Data2_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`

Event ID 1004: [MessagingCloudServices] CloudServiceTransaction HTTP request URI = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] CloudServiceTransaction HTTP request URI = [{Prop_UnicodeString}].

Message #

[MessagingCloudServices] CloudServiceTransaction HTTP request URI = [{Prop_UnicodeString}]

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1005: [MessagingCloudServices] CloudServiceTransaction HTTP success: StatusCode = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] CloudServiceTransaction HTTP success: StatusCode = [{Prop_Data_UInt32}].

Message #

[MessagingCloudServices] CloudServiceTransaction HTTP success: StatusCode = [{Prop_Data_UInt32}]

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 1006: [MessagingCloudServices] CloudServiceTransaction HTTP failure: StatusCode = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Message #

[MessagingCloudServices] CloudServiceTransaction HTTP failure: StatusCode = [{Prop_Data_UInt32}]; request URI = [{Prop_Description_UnicodeString1}]; response content = [{Prop_Description_UnicodeString2}]

Fields #

Name	Description
`Prop_Data_UInt32`
`Prop_Description_UnicodeString1`
`Prop_Description_UnicodeString2`

Event ID 1007: [MessagingCloudServices] CloudServiceSync iteration started: current iteration = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] CloudServiceSync iteration started: current iteration = [{Prop_Data_UInt32}].

Message #

[MessagingCloudServices] CloudServiceSync iteration started: current iteration = [{Prop_Data_UInt32}]

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 1008: [MessagingCloudServices] CloudServiceSync iteration finished: current iteration = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] CloudServiceSync iteration finished: current iteration = [{Prop_Data1_UInt32}]; current iteration HRESULT = [{Prop_Data2_UInt32}].

Message #

[MessagingCloudServices] CloudServiceSync iteration finished: current iteration = [{Prop_Data1_UInt32}]; current iteration HRESULT = [{Prop_Data2_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`

Event ID 1009: [MessagingCloudServices] CloudServiceSync sync timer: current iteration = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] CloudServiceSync sync timer: current iteration = [{Prop_Data1_UInt32}]; current iteration HRESULT = [{Prop_Data2_UInt32}]; next sync timer interval = [{Prop_Data3_UInt32}].

Message #

[MessagingCloudServices] CloudServiceSync sync timer: current iteration = [{Prop_Data1_UInt32}]; current iteration HRESULT = [{Prop_Data2_UInt32}]; next sync timer interval = [{Prop_Data3_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`
`Prop_Data3_UInt32`

Event ID 1010: [MessagingCloudServices] CloudServiceSync sync failure: current iteration = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingCloudServices] CloudServiceSync sync failure: current iteration = [{Prop_Data1_UInt32}]; current state = [{Prop_Data2_UInt32}].

Message #

[MessagingCloudServices] CloudServiceSync sync failure: current iteration = [{Prop_Data1_UInt32}]; current state = [{Prop_Data2_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`

Event ID 1501: [MessagingNotifications] New message notification received

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingNotifications] New message notification received.

Message #

[MessagingNotifications] New message notification received

Event ID 1502: [MessagingNotifications] Notification item initialized - type = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingNotifications] Notification item initialized - type = [{Prop_Data1_UInt32}]; actions = [{Prop_Data2_UInt32}].

Message #

[MessagingNotifications] Notification item initialized - type = [{Prop_Data1_UInt32}]; actions = [{Prop_Data2_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`

Event ID 1503: [MessagingNotifications] Notification item started - type = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingNotifications] Notification item started - type = [{Prop_Data1_UInt32}]; actions = [{Prop_Data2_UInt32}].

Message #

[MessagingNotifications] Notification item started - type = [{Prop_Data1_UInt32}]; actions = [{Prop_Data2_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`

Event ID 1504: [MessagingNotifications] Notification item finished - type = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingNotifications] Notification item finished - type = [{Prop_Data1_UInt32}]; actions = [{Prop_Data2_UInt32}].

Message #

[MessagingNotifications] Notification item finished - type = [{Prop_Data1_UInt32}]; actions = [{Prop_Data2_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`

Event ID 1505: [MessagingNotifications] Notified messaging apps - actions = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingNotifications] Notified messaging apps - actions = [{Prop_Data1_UInt32}]; handled = [{Prop_Data2_UInt32}].

Message #

[MessagingNotifications] Notified messaging apps - actions = [{Prop_Data1_UInt32}]; handled = [{Prop_Data2_UInt32}]

Fields #

Name	Description
`Prop_Data1_UInt32`
`Prop_Data2_UInt32`

Event ID 1506: [MessagingNotifications] Notification handled by provider [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingNotifications] Notification handled by provider [{Prop_Description_UnicodeString}]; actions = [{Prop_Data_UInt32}].

Message #

[MessagingNotifications] Notification handled by provider [{Prop_Description_UnicodeString}]; actions = [{Prop_Data_UInt32}]

Fields #

Name	Description
`Prop_Description_UnicodeString`
`Prop_Data_UInt32`

Event ID 1507: [MessagingNotifications] Notification suppressed - type = [.

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingNotifications] Notification suppressed - type = [{Prop_Data_UInt32}].

Message #

[MessagingNotifications] Notification suppressed - type = [{Prop_Data_UInt32}]

Fields #

Name	Description
`Prop_Data_UInt32`

Event ID 1508: [MessagingNotifications] No notification was queued/needed

Provider: Microsoft-Windows-AppModel-MessagingDataModel
Channel: Operational

Description

[MessagingNotifications] No notification was queued/needed.

Message #

[MessagingNotifications] No notification was queued/needed

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)