Microsoft-Windows-ATAPort
41 events across 4 channels
Event ID 0: Entering Partial state.
#Event ID 1: Entering Slumber state.
#Event ID 100: Device Enumeration Starts.
#Event ID 101: Device Enumeration Completes.
#Event ID 102: Transfer Mode Changed.
#Event ID 103: Request is Completed.
#Description
Request is Completed.
Message #
Fields #
| Name | Description |
|---|---|
DeviceAddress UInt32 | |
RequestSequence UInt32 | |
QueueTime UInt64 | |
DeviceTime UInt64 | |
MasterIRP Pointer | |
ActiveRequestCount UInt32 | |
IRBFunction UInt16 | |
DeviceCommand UInt8 | |
IRBStatus UInt8 | |
ATAStatus UInt8 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ATAPort",
"guid": "{CB587AD1-CC35-4EF1-AD93-36CC82A2D319}",
"event_source_name": "",
"event_id": 103,
"version": 0,
"level": 5,
"task": 2,
"opcode": 13,
"keywords": "0x4000000000000001",
"time_created": "2026-06-02T05:08:45.428+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 12504,
"thread_id": 16348
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"ATAStatus": 65,
"ActiveRequestCount": 0,
"DeviceAddress": 0,
"DeviceCommand": 0,
"DeviceTime": 2568,
"IRBFunction": 512,
"IRBStatus": 35,
"MasterIRP": "0x0",
"QueueTime": 30,
"RequestSequence": 36473
},
"message": "ATAPORT_TASK_GENERAL"
}
Event ID 104: Request Timed Out.
#Event ID 105: Request Failed because of Transportation Error.
#Event ID 106: Device Lost.
#Event ID 107: Channel Reset Starts.
#Event ID 108: Channel Reset Complets.
#Event ID 109: Device Reset Starts.
#Event ID 110: Device Reset Complets.
#Event ID 113: Getting device and driver telemetry begins.
#Event ID 113: Indicates device failure and the reason for it.
#Description
Indicates device failure and the reason for it.
Message #
Fields #
| Name | Description |
|---|---|
PortNumber UInt8 | |
BusNumber UInt8 | |
TargetId UInt8 | |
LUN UInt8 | |
FailureReason UInt32 | Known values
|
Event ID 114: Getting device and driver telemetry completes.
#Event ID 114: IO Transfer mode transition (either from DMA to PIO or vice versa).
#Event ID 200: Request servicing time taken by target device.
#Event ID 201: Request servicing time taken by lower driver stack(s).
#Event ID 202: Dispatching a read request.
#Event ID 203: Dispatching a write request.
#Event ID 204: Dispatching a read request.
#Event ID 205: Dispatching a write request.
#Event ID 206: Dispatching a read request.
#Event ID 207: Dispatching a write request.
#Event ID 208: Completing an IO (read/write) request.
#Description
Completing an IO (read/write) request.
Message #
Fields #
| Name | Description |
|---|---|
Irp Pointer | |
NTStatus HexInt32 | NTSTATUS reference |
SrbStatus UInt8 | |
ScsiStatus UInt8 | |
SenseKey UInt8 | |
AddSense UInt8 | |
AddSenseQ UInt8 | |
OriginalIrp Pointer |
Event ID 209: Retrying an IO (read/write) request.
#Event ID 210: Flush request.
#Event ID 211: Flush request.
#Description
Flush request.
Message #
Fields #
| Name | Description |
|---|---|
Irp Pointer | |
NTStatus HexInt32 | NTSTATUS reference |
SrbStatus UInt8 | |
ScsiStatus UInt8 | |
SenseKey UInt8 | |
AddSense UInt8 | |
AddSenseQ UInt8 | |
OriginalIrp Pointer |
Event ID 212: Dispatching an IOCTL.
#Event ID 213: Dispatching a WMI request.
#Event ID 214: Completing a non-read/write request.
#Description
Completing a non-read/write request.
Message #
Fields #
| Name | Description |
|---|---|
Irp Pointer | |
Status HexInt32 | NTSTATUS reference |
Event ID 215: Dispatching a power request.
#Event ID 216: Completing a power request.
#Description
Completing a power request.
Message #
Fields #
| Name | Description |
|---|---|
Irp Pointer | |
Status HexInt32 | NTSTATUS reference |
Event ID 217: Dispatching a PnP request.
#Event ID 218: Completing a PnP request.
#Description
Completing a PnP request.
Message #
Fields #
| Name | Description |
|---|---|
Irp Pointer | |
Status HexInt32 | NTSTATUS reference |
Event ID 219: Completing a PnP enumeration request.
#Description
Completing a PnP enumeration request.
Message #
Fields #
| Name | Description |
|---|---|
Irp Pointer | |
NumberOfChildren UInt32 | |
Status HexInt32 | NTSTATUS reference |
Event ID 220: Performing a queue-related operation.
#Description
Performing a queue-related operation.
Message #
Fields #
| Name | Description |
|---|---|
QueueTag HexInt32 | |
Operation UInt8 | Known values
|
Status HexInt32 | NTSTATUS reference |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ATAPort",
"guid": "{CB587AD1-CC35-4EF1-AD93-36CC82A2D319}",
"event_source_name": "",
"event_id": 220,
"version": 1,
"level": 4,
"task": 201,
"opcode": 106,
"keywords": "0x2000000800000000",
"time_created": "2026-06-02T05:08:45.427+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4,
"thread_id": 3380
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"Operation": 1,
"QueueTag": "02000000",
"Status": "00000000"
},
"message": "Port"
}
Event ID 221: Dispatching a PassThrough request.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID {CB587AD1-CC35-4EF1-AD93-36CC82A2D319}
Defined in ataport.sys, the binary that emits these events.
Observed on:
- WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02