Microsoft-Windows-Audio

142 events across 7 channels

Event	Title	Channel	Sample
0	Windows Audio encountered an error while processing a device event.	Operational	N
1	Windows Audio encountered an error while processing a device event.	Operational	N
2	Windows Audio failed during a call to SetServiceStatus.	Application	N
3	Windows Audio failed to start the szSubsystemName subsystem.	Operational	N
4	The Windows Audio Device Graph Isolation process.	Operational	N
5	The Windows Audio Device Graph Isolation process.	Operational	N
10	The Capture Monitor has failed to restart the capture monitor between …	CaptureMonitor	N
11	StreamFlags dwAudioSrvStreamFlags.	Operational	N
12	AudioPerf_Task_LaunchAudioDGStart	Performance	N
13	AudioPerf_Task_LaunchAudioDGStop	Performance	N
14	AudioPerf_Task_EndpointVolumeStart	Performance	N
15	AudioPerf_Task_EndpointVolumeStop	Performance	N
16	AudioPerf_Task_SessionAPIStart	Performance	N
17	AudioPerf_Task_SessionAPIStop	Performance	N
18	Windows Audio Device Graph glitch threshold count exceeded.	Operational	N
19	Windows Audio Device Graph glitch threshold count exceeded.	Performance	N
20	Format: Format Sampling rate: Sampling_rateHz Offloaded: Offloaded.	PlaybackManager	N
21	Sound level for application [AppId] changed to [SoundLevel].	PlaybackManager	N
22	Suspended: Suspended.	PlaybackManager	N
23	Released exclusive mode resource bExclusiveModeStream.	PlaybackManager	N
24	Stream started.	PlaybackManager	Y
25	Stream stopped.	PlaybackManager	Y
26	Capture Monitor Render Glitch: pCMonitor=[pCMonitor], …	GlitchDetection	N
27	Capture Monitor Capture Glitch: pCMonitor=[pCMonitor], …	GlitchDetection	N
28	APO Glitch: Format Converter INF detected: …	GlitchDetection	N
29	Engine Glitch: CP Client Input Endpoint - …	GlitchDetection	N
30	Engine Glitch: CP Client Input Endpoint - …	GlitchDetection	N
31	Engine Glitch: CP Client Output Endpoint - Server Overread: …	GlitchDetection	N
32	Engine Glitch: CP Client Output Endpoint - Read Pointer Overwrite: …	GlitchDetection	N
33	Engine Glitch: CP Server Input Endpoint - Starvation: …	GlitchDetection	N
34	Engine Glitch: CP Server Output Endpoint - Queue Full Packet Drop: …	GlitchDetection	N
35	Engine Glitch: CP Server Output Endpoint - Read Pointer Overwrite: …	GlitchDetection	N
36	KS Endpoint Glitch: IOMGR No Outstanding Packets: pOwner=[pOwner] …	GlitchDetection	N
37	KS Endpoint Glitch: IOMGR Ioctl Time Limit Exceeded: pOwner=[pOwner] …	GlitchDetection	N
38	KS Endpoint Glitch: BASE Output Unexpected Buffer Completed: …	GlitchDetection	N
39	KS Endpoint Glitch: BASE Input Null Last Buffer with LockedData !	GlitchDetection	N
40	KS Endpoint Glitch: BASE Input Buffer Index Mismatch: …	GlitchDetection	N
41	KS Endpoint Glitch: BASE End Glitch: pCAudioBasePin=[pCAudioBasePin] …	GlitchDetection	N
42	KS Endpoint Glitch: RTCAP StreamPos Ahead of HW Pos: …	GlitchDetection	N
43	KS Endpoint Glitch: RTCAP StreamPos Too Far Behind: …	GlitchDetection	N
44	KS Endpoint Glitch: RTREN WritePos Exceeds TotalPos: …	GlitchDetection	N
45	KS Endpoint Glitch: STCAP Capture Ahead: …	GlitchDetection	N
46	KS Endpoint Glitch: STCAP Capture Behind: …	GlitchDetection	N
47	KS Endpoint Glitch: STCAP Device Starved: …	GlitchDetection	N
48	KS Endpoint Glitch: STREN Device Starved: …	GlitchDetection	N
49	KS Endpoint Glitch: STREN EXCL PULL Invalid Buffer Count: …	GlitchDetection	N
50	System effect initialized: CLSID=[APOCLSID] …	Informational	N
51	Volume limit event signalled to audiosrv enter	Informational	N
52	Volume limit event signalled to audiosrv exit	Informational	N
53	AudioSrv published AVLC state	Informational	N
54	AudioSrv calls PdcActivationClientRegister	Informational	N
55	AudioSrv calls PdcActivationClientUnregister	Informational	N
56	AudioSrv calls PdcActivationClientTakeTimerReference	Informational	N
57	AudioSrv calls PdcActivationClientReleaseTimerReference	Informational	N
58	MMDevAPI: Default device changed triggered	Informational	N
59	MMDevAPI: OnMediaNotification Enter	Informational	N
60	MMDevAPI: OnMediaNotification Exit	Informational	N
61	MMDevAPI: DeviceStateChanged callback	Informational	N
62	MMDevAPI: DeviceAdded callback	Informational	N
63	MMDevAPI: DeviceRemoved callback	Informational	N
64	MMDevAPI: DefaultDeviceChanged callback	Informational	N
65	MMDevAPI: Audio device state changed	Operational	N
101	MidiRT: Application Suspension Handler	Informational	N
102	MidiRT: Application Resume Handler	Informational	N
103	MidiRT: Application Entering CS Handler	Informational	N
104	MidiRT: Application Resuming from CS Handler	Informational	N
105	MidiRT: Device Removal Handler	Informational	N
106	MidiRT: Cleanup and release device handle	Informational	N
107	MidiRT: Close handle to MIDI Device	Informational	N
108	MidiRT: Begin binding to DeviceId: DeviceId.	Informational	N
109	MidiRT: Done binding to device interface	Informational	N
110	MidiRT: Create new MidiPortDeviceIoControl	Informational	N
111	MidiRT: Beginning Synchronous I/O	Informational	N
112	MidiRT: Done with synchronous I/O	Informational	N
113	MidiRT: Beginning Asynchronous I/O	Informational	N
114	MidiRT: Done with Asynchronous I/O	Informational	N
115	CrossProcess packet added	Informational	N
116	Pump: setting deadline	Performance	N
117	Pump: cancelling deadline	Performance	N
118	Pump: missed deadline!	Performance	N
119	Pump: Start - setting MultimediMode to AVRT_MULTIMEDIA_MODE_BUFFERING	Performance	N
120	Pump: Stop - setting MultimediMode to AVRT_MULTIMEDIA_MODE_IDLE	Performance	N
121	Discovering EndpointCharacteristics for [Endpoint Id].	Performance	N
122	Discovered EndpointCharacteristics for [Endpoint Id] (hr = hr).	Performance	N
123	GetMixFormat starting on endpoint [Endpoint Id] (category=category, raw=Raw, …	Performance	N
124	GetMixFormat ended	Performance	N
125	IsFormatSupported starting on endpoint [Endpoint Id] (category=category, …	Performance	N
126	IsFormatSupported ended	Performance	N
127	Vadserver_CreateStream starting on endpoint [Endpoint Id] (category=category, …	Performance	N
128	Vadserver_CreateStream ended	Performance	N
129	Derived stream settings for stream	Performance	N
130	Created StreamGroup and stream	Performance	N
131	Created SaDevice	Performance	N
132	Connected StreamGroup to SaDevice	Performance	N
133	CreateDeviceEndpointInstance starting on endpoint [Endpoint Id] …	Performance	N
134	CreateDeviceEndpointInstance ended	Performance	N
135	Pump: Correct Position	Performance	N
136	Pump: Start - Yield start	Performance	N
137	Pump: Stop - Yield stop	Performance	N
138	Pump: Start - Process start	Performance	N
139	Pump: Stop - Process stop	Performance	N
140	Pump: ProcPassDuration	Performance	N
141	AE Object	Informational	N
142	AE Glitch	Informational	N
143	AE Drop	Informational	N
144	AE CPU Usage	Informational	N
145	AE Control	Informational	N
146	AE Position	Informational	N
147	AE Security	Informational	N
148	AE Data	Informational	N
149	AE IRP	Informational	N
150	AE Endpoint	Informational	N
151	AE Interpolator	Informational	N
152	AE Timestamp	Informational	N
153	AE Performance	Informational	N
154	AE Generic	Informational	N
155	AE Memory	Informational	Y
156	AE Memory	Informational	N
157	AE Memory	Informational	N
158	SetCurrentTimeStamp	Informational	N
159	Writing history packet	Informational	N
160	Signal pump pass completion	Informational	N
161	Pump: Processing pass skipped	Informational	N
162	Pump: GetCurrentPadding Start	Performance	N
163	Pump: GetCurrentPadding Stop	Performance	N
164	AE APO CalcInputFrames	Informational	N
165	AE APO CalcInputFrames	Informational	N
166	AE APO Process	Informational	N
167	AE APO Process	Informational	N
168	Pump: Start - skipping setting MultimediMode to AVRT_MULTIMEDIA_MODE_BUFFERING	Performance	N
169	Pump: Stop - skipping setting MultimediMode to AVRT_MULTIMEDIA_MODE_IDLE	Performance	N
170	Pump: TimedSpin Start	Performance	N
171	Pump: TimedSpin Stop	Performance	N
172	Pump: Attach to MMCSS Start	Performance	N
173	Pump: Attach to MMCSS Stop	Performance	N
174	Pump: Init RTMode	Performance	N
175	Pump: CreateLocalWorkQueue RTMode	Performance	N
176	Pump: GetAPOWorkqueue	Performance	N
177	Received console locked notification	Operational	N
178	Global user presence detected	Operational	Y
179	Received session display notification	Operational	Y
180	Received Po AudioStandby request	Operational	Y

Event ID 0: Windows Audio encountered an error while processing a device event.

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: AudioServer_Fail_Service_Device

Description

Windows Audio encountered an error while processing a device event.

Message #

Windows Audio encountered an error while processing a device event.
                    Event ID     : 0x%1 (%2) 
                    Failure Code : 0x%3

Fields #

Name	Description
`Event` UInt32
`EventName` UnicodeString
`hr` UInt32

Event ID 1: Windows Audio encountered an error while processing a device event.

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: AudioServer_Fail_Device_Event_Worker

Description

Windows Audio encountered an error while processing a device event.

Message #

Windows Audio encountered an error while processing a device event.
                    DeviceEventType : 0x%1 (%2) 
                    Failure Code    : 0x%3

Fields #

Name	Description
`DeviceEventType` UInt32
`DeviceEventTypeName` UnicodeString
`hr` UInt32

Event ID 2: Windows Audio failed during a call to SetServiceStatus.

Provider: Microsoft-Windows-Audio
Channel: Application
Task: AudioServer_Fail_Set_Service_Status

Description

Windows Audio failed during a call to SetServiceStatus.

Message #

Windows Audio failed during a call to SetServiceStatus.
                    Service Type               : 0x%1 
                    Current State              : 0x%2 
                    Controls Accepted          : 0x%3 
                    Win32 Exit Code            : 0x%4 
                    Service Specific Exit Code : 0x%5 
                    Check Point                : 0x%6 
                    Wait Hint                  : 0x%7

Fields #

Name	Description
`dwServiceType` UInt32
`dwCurrentState` UInt32
`dwControlsAccepted` UInt32
`dwWin32ExitCode` UInt32
`dwServiceSpecificExitCode` UInt32
`dwCheckPoint` UInt32
`dwWaitHint` UInt32

Event ID 3: Windows Audio failed to start the szSubsystemName subsystem.

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: AudioServer_Fail_Subsystem_Startup

Description

Windows Audio failed to start the szSubsystemName subsystem.

Message #

Windows Audio failed to start the %1 subsystem.
                    Subsystem Failure Code     : 0x%2

Fields #

Name	Description
`szSubsystemName` UnicodeString
`dwSubsystemFailureCode` UInt32

Event ID 4: The Windows Audio Device Graph Isolation process.

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: AudioServer_Fail_AudioDG_Crashed

Description

The Windows Audio Device Graph Isolation process (audiodg.exe) has terminated unexpectedly.

Message #

The Windows Audio Device Graph Isolation process (audiodg.exe) has terminated unexpectedly.
                    Process Exit Code     : 0x%1

Fields #

Name	Description
`dwAudioDgTerminationCode` UInt32

Event ID 5: The Windows Audio Device Graph Isolation process.

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: AudioServer_Fail_AudioDG_Failed_Startup

Description

The Windows Audio Device Graph Isolation process (audiodg.exe) could not be started.

Message #

The Windows Audio Device Graph Isolation process (audiodg.exe) could not be started.
                    Error Code     : 0x%1

Fields #

Name	Description
`dwAudioDgStartupFailureCode` UInt32

Event ID 10: The Capture Monitor has failed to restart the capture monitor between szInputEndpointName and szOutputEndpointName dwRestartCount times.

Provider: Microsoft-Windows-Audio
Channel: CaptureMonitor
Task: CaptureMonitor_Monitor_Restart_Limit_Hit

Description

The Capture Monitor has failed to restart the capture monitor between szInputEndpointName and szOutputEndpointName dwRestartCount times.

Message #

The Capture Monitor has failed to restart the capture monitor between %2 and %3  %1 times.  
                 The capture monitor will no longer attempt to start this monitor.

Fields #

Name	Description
`dwRestartCount` UInt32
`szInputEndpointName` UnicodeString
`szOutputEndpointName` UnicodeString

Event ID 11: StreamFlags dwAudioSrvStreamFlags.

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: AudioServer_Stream_Flags

Description

StreamFlags dwAudioSrvStreamFlags.

Message #

StreamFlags %1

Fields #

Name	Description
`dwAudioSrvStreamFlags` UInt32

Event ID 12: AudioPerf_Task_LaunchAudioDGStart

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: AudioPerf_Task_LaunchAudioDG
Opcode: Start

Fields #

Name	Description
`Object` UInt32

Event ID 13: AudioPerf_Task_LaunchAudioDGStop

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: AudioPerf_Task_LaunchAudioDG
Opcode: Stop

Fields #

Name	Description
`Object` UInt32

Event ID 14: AudioPerf_Task_EndpointVolumeStart

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: AudioPerf_Task_EndpointVolume
Opcode: Start

Event ID 15: AudioPerf_Task_EndpointVolumeStop

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: AudioPerf_Task_EndpointVolume
Opcode: Stop

Event ID 16: AudioPerf_Task_SessionAPIStart

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: AudioPerf_Task_SessionAPI
Opcode: Start

Event ID 17: AudioPerf_Task_SessionAPIStop

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: AudioPerf_Task_SessionAPI
Opcode: Stop

Event ID 18: Windows Audio Device Graph glitch threshold count exceeded.

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: AudioDG_Glitch_Threshold_Exceeded

Description

Windows Audio Device Graph glitch threshold count exceeded.

Message #

Windows Audio Device Graph glitch threshold count exceeded 
                              Count   : 0x%1

Fields #

Name	Description
`dwAudioDgTerminationCode` UInt32

Event ID 19: Windows Audio Device Graph glitch threshold count exceeded.

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: AudioPerf_Task_GlitchCounter

Description

Windows Audio Device Graph glitch threshold count exceeded.

Message #

Windows Audio Device Graph glitch threshold count exceeded 
                              Count   : 0x%1

Fields #

Name	Description
`dwGlitchCount` UInt32
`hnsTimeWindow` UInt64

Event ID 20: Format: Format Sampling rate: Sampling_rateHz Offloaded: Offloaded.

Provider: Microsoft-Windows-Audio
Channel: PlaybackManager
Task: AudioSession_Stream_Resource_Type

Description

Format: Format Sampling rate: SamplingRateHz Offloaded: bAudioSrvStreamResourceType

Message #

Format: %1
Sampling rate: %2Hz
Offloaded: %3

Fields #

Name	Description
`Format` UInt32
`SamplingRate` UInt32
`bAudioSrvStreamResourceType` Boolean

Event ID 21: Sound level for application [AppId] changed to [SoundLevel].

Provider: Microsoft-Windows-Audio
Channel: PlaybackManager
Task: AudioServer_Sound_Level_Changed

Description

Sound level for application [AppId] changed to [SoundLevel].

Message #

Sound level for application [%1] changed to [%2]

Fields #

Name	Description
`AppId` UnicodeString
`SoundLevel` UInt32

Event ID 22: Suspended: Suspended.

Provider: Microsoft-Windows-Audio
Channel: PlaybackManager
Task: AudioSession_Client_Suspended

Description

Suspended: Suspended.

Message #

Suspended: %1

Fields #

Name	Description
`bIsSuspended` Boolean

Event ID 23: Released exclusive mode resource bExclusiveModeStream.

Provider: Microsoft-Windows-Audio
Channel: PlaybackManager
Task: AudioSession_Release_Client_Resource

Description

Released exclusive mode resource bExclusiveModeStream.

Message #

Released exclusive mode resource %1
Released offload mode resource %2

Fields #

Name	Description
`bExclusiveModeStream` Boolean
`bOffloadStream` Boolean

Event ID 24: Stream started.

Provider: Microsoft-Windows-Audio
Channel: PlaybackManager
Level: Informational
Task: PBM_StreamStarted

Description

Stream started.

Message #

Stream started.
App Id: %1
PID: %2
Audio Stream Category: %3

Fields #

Name	Description
`AppId` UnicodeString
`PID` UInt32
`Category` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Audio",
    "event_id": 24,
    "level": 4,
    "task": 120,
    "opcode": 0,
    "time_created": "2026-04-18T02:46:19.5992023+00:00",
    "computer": "DESKTOP-FF3N5XK",
    "channel": "Microsoft-Windows-Audio"
  },
  "event_data": {
    "AppId": "Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App",
    "PID": "6112",
    "Category": "5"
  }
}

Event ID 25: Stream stopped.

Provider: Microsoft-Windows-Audio
Channel: PlaybackManager
Level: Informational
Task: PBM_StreamStopped

Description

Stream stopped.

Message #

Stream stopped.
App Id: %1
PID: %2
Audio Stream Category: %3

Fields #

Name	Description
`AppId` UnicodeString
`PID` UInt32
`Category` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Audio",
    "event_id": 25,
    "level": 4,
    "task": 122,
    "opcode": 0,
    "time_created": "2026-04-18T02:46:21.0095682+00:00",
    "computer": "DESKTOP-FF3N5XK",
    "channel": "Microsoft-Windows-Audio"
  },
  "event_data": {
    "AppId": "Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App",
    "PID": "6112",
    "Category": "5"
  }
}

Event ID 26: Capture Monitor Render Glitch: pCMonitor=[pCMonitor], DevicePosition=[DevicePosition], QPCPosition=[QPCPosition].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CaptureMonitorRenderGlitch

Description

Capture Monitor Render Glitch: pCMonitor=[pCMonitor], DevicePosition=[DevicePosition], QPCPosition=[QPCPosition].

Message #

Capture Monitor Render Glitch: pCMonitor=[%1], DevicePosition=[%2], QPCPosition=[%3]

Fields #

Name	Description
`pCMonitor` Pointer
`DevicePosition` UInt64
`QPCPosition` UInt64

Event ID 27: Capture Monitor Capture Glitch: pCMonitor=[pCMonitor], DevicePosition=[DevicePosition], QPCPosition=[QPCPosition].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CaptureMonitorCaptureGlitch

Description

Capture Monitor Capture Glitch: pCMonitor=[pCMonitor], DevicePosition=[DevicePosition], QPCPosition=[QPCPosition].

Message #

Capture Monitor Capture Glitch: pCMonitor=[%1], DevicePosition=[%2], QPCPosition=[%3]

Fields #

Name	Description
`pCMonitor` Pointer
`DevicePosition` UInt64
`QPCPosition` UInt64

Event ID 28: APO Glitch: Format Converter INF detected: pCAudioFormatConvert=[pCAudioFormatConvert], [ConverstionType].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: FormatConverterINFdetected

Description

APO Glitch: Format Converter INF detected: pCAudioFormatConvert=[pCAudioFormatConvert], [ConverstionType].

Message #

APO Glitch: Format Converter INF detected: pCAudioFormatConvert=[%1], [%2]

Fields #

Name	Description
`pCAudioFormatConvert` Pointer
`ConverstionType` UInt32

Event ID 29: Engine Glitch: CP Client Input Endpoint - pCCrossProcessClientInputEndpoint=[pCCrossProcessClientInputEndpoint] No Messages in queue.

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CPClientInputEndpoint_NoMessagesinqueue

Description

Engine Glitch: CP Client Input Endpoint - pCCrossProcessClientInputEndpoint=[pCCrossProcessClientInputEndpoint] No Messages in queue.

Message #

Engine Glitch: CP Client Input Endpoint - pCCrossProcessClientInputEndpoint=[%1] No Messages in queue

Fields #

Name	Description
`pCCrossProcessClientInputEndpoint` Pointer
`Unused` UInt32

Event ID 30: Engine Glitch: CP Client Input Endpoint - pCCrossProcessClientInputEndpoint=[pCCrossProcessClientInputEndpoint] Queue item does not match requested size.

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CPClientInputEndpoint_Queueitemdoesnotmatchrequestedsize

Description

Engine Glitch: CP Client Input Endpoint - pCCrossProcessClientInputEndpoint=[pCCrossProcessClientInputEndpoint] Queue item does not match requested size.

Message #

Engine Glitch: CP Client Input Endpoint - pCCrossProcessClientInputEndpoint=[%1] Queue item does not match requested size

Fields #

Name	Description
`pCCrossProcessClientInputEndpoint` Pointer
`Unused` UInt32

Event ID 31: Engine Glitch: CP Client Output Endpoint - Server Overread: pCCrossProcessClientOutputEndpoint=[pCCrossProcessClientOutputEndpoint] WritePos=[WriteBytePos] ReadPos=[ReadBytePos] BytesToWrite=[Bytes...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CPClientOutputEndpoint_ServerOverread

Description

Engine Glitch: CP Client Output Endpoint - Server Overread: pCCrossProcessClientOutputEndpoint=[pCCrossProcessClientOutputEndpoint] WritePos=[WriteBytePos] ReadPos=[ReadBytePos] BytesToWrite=[BytesToWrite].

Message #

Engine Glitch: CP Client Output Endpoint - Server Overread: pCCrossProcessClientOutputEndpoint=[%1] WritePos=[%2] ReadPos=[%3] BytesToWrite=[%4]

Fields #

Name	Description
`pCCrossProcessClientOutputEndpoint` Pointer
`WriteBytePos` UInt64
`ReadBytePos` UInt64
`BytesToWrite` UInt32

Event ID 32: Engine Glitch: CP Client Output Endpoint - Read Pointer Overwrite: pCCrossProcessClientOutputEndpoint=[pCCrossProcessClientOutputEndpoint] WriteOffset=[WriteOffset] ReadOffset=[ReadOffset] BytesTo...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CPClientOutputEndpoint_ReadPointerOverwrite

Description

Engine Glitch: CP Client Output Endpoint - Read Pointer Overwrite: pCCrossProcessClientOutputEndpoint=[pCCrossProcessClientOutputEndpoint] WriteOffset=[WriteOffset] ReadOffset=[ReadOffset] BytesToWrite=[BytesToWrite] EndOfDataOffset=[EndOfDataOffset].

Message #

Engine Glitch: CP Client Output Endpoint - Read Pointer Overwrite: pCCrossProcessClientOutputEndpoint=[%1] WriteOffset=[%2] ReadOffset=[%3] BytesToWrite=[%4] EndOfDataOffset=[%5]

Fields #

Name	Description
`pCCrossProcessClientOutputEndpoint` Pointer
`WriteOffset` UInt32
`ReadOffset` UInt32
`BytesToWrite` UInt32
`EndOfDataOffset` UInt32

Event ID 33: Engine Glitch: CP Server Input Endpoint - Starvation: pCCrossProcessServerInputEndpoint=[pCCrossProcessServerInputEndpoint] WriteOffset=[WriteOffset] ReadOffset=[ReadOffset] BufferSize=[BufferSize]...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CPServerInputEndpoint_Starvation

Description

Engine Glitch: CP Server Input Endpoint - Starvation: pCCrossProcessServerInputEndpoint=[pCCrossProcessServerInputEndpoint] WriteOffset=[WriteOffset] ReadOffset=[ReadOffset] BufferSize=[BufferSize] BytesAvail=[BytesAvailable].

Message #

Engine Glitch: CP Server Input Endpoint - Starvation: pCCrossProcessServerInputEndpoint=[%1] WriteOffset=[%2] ReadOffset=[%3] BufferSize=[%4] BytesAvail=[%5]

Fields #

Name	Description
`pCCrossProcessServerInputEndpoint` Pointer
`WriteOffset` UInt32
`ReadOffset` UInt32
`BufferSize` UInt32
`BytesAvailable` UInt32

Event ID 34: Engine Glitch: CP Server Output Endpoint - Queue Full Packet Drop: pCCrossProcessServerOutputEndpoint=[pCCrossProcessServerOutputEndpoint] WritePos=[WriteBytePos] DroppedBytes=[DroppedBytes] ReadPo...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CPServerOutputEndpoint_QueueFullPacketDrop

Description

Engine Glitch: CP Server Output Endpoint - Queue Full Packet Drop: pCCrossProcessServerOutputEndpoint=[pCCrossProcessServerOutputEndpoint] WritePos=[WriteBytePos] DroppedBytes=[DroppedBytes] ReadPos=[ReadBytePos] BytesToWrite=[BytesToWrite].

Message #

Engine Glitch: CP Server Output Endpoint - Queue Full Packet Drop: pCCrossProcessServerOutputEndpoint=[%1] WritePos=[%2] DroppedBytes=[%3] ReadPos=[%4] BytesToWrite=[%5]

Fields #

Name	Description
`pCCrossProcessServerOutputEndpoint` Pointer
`WriteBytePos` UInt64
`DroppedBytes` UInt32
`ReadBytePos` UInt64
`BytesToWrite` UInt32

Event ID 35: Engine Glitch: CP Server Output Endpoint - Read Pointer Overwrite: pCCrossProcessServerOutputEndpoint=[pCCrossProcessServerOutputEndpoint] WriteOffset=[WriteOffset] ReadOffset=[ReadOffset] BytesTo...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: CPServerOutputEndpoint_ReadPointerOverwrite

Description

Engine Glitch: CP Server Output Endpoint - Read Pointer Overwrite: pCCrossProcessServerOutputEndpoint=[pCCrossProcessServerOutputEndpoint] WriteOffset=[WriteOffset] ReadOffset=[ReadOffset] BytesToWrite=[BytesToWrite].

Message #

Engine Glitch: CP Server Output Endpoint - Read Pointer Overwrite: pCCrossProcessServerOutputEndpoint=[%1] WriteOffset=[%2] ReadOffset=[%3] BytesToWrite=[%4]

Fields #

Name	Description
`pCCrossProcessServerOutputEndpoint` Pointer
`WriteOffset` UInt32
`ReadOffset` UInt32
`BytesToWrite` UInt32

Event ID 36: KS Endpoint Glitch: IOMGR No Outstanding Packets: pOwner=[pOwner] NextStreamingPacketToComplete=[NextStreamingPacketToComplete] MaxPacketCount=[MaxPacketCount].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: IOMGRNoOutstandingPackets

Description

KS Endpoint Glitch: IOMGR No Outstanding Packets: pOwner=[pOwner] NextStreamingPacketToComplete=[NextStreamingPacketToComplete] MaxPacketCount=[MaxPacketCount].

Message #

KS Endpoint Glitch: IOMGR No Outstanding Packets: pOwner=[%1] NextStreamingPacketToComplete=[%2] MaxPacketCount=[%3]

Fields #

Name	Description
`pOwner` Pointer
`NextStreamingPacketToComplete` UInt32
`MaxPacketCount` UInt32

Event ID 37: KS Endpoint Glitch: IOMGR Ioctl Time Limit Exceeded: pOwner=[pOwner] DeltaHNS=[IoctlTimeHNS].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: IOMGRIoctlTimeLimitExceeded

Description

KS Endpoint Glitch: IOMGR Ioctl Time Limit Exceeded: pOwner=[pOwner] DeltaHNS=[IoctlTimeHNS].

Message #

KS Endpoint Glitch: IOMGR Ioctl Time Limit Exceeded: pOwner=[%1] DeltaHNS=[%2]

Fields #

Name	Description
`pOwner` Pointer
`IoctlTimeHNS` UInt64

Event ID 38: KS Endpoint Glitch: BASE Output Unexpected Buffer Completed: pCAudioBasePin=[pCAudioBasePin] LockedDataPointer=[pLockedDataPointer] bLockedEqualsUnrolled=[bLockedEqualsUnrolled].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: BASEOutputUnexpectedBufferCompleted

Description

KS Endpoint Glitch: BASE Output Unexpected Buffer Completed: pCAudioBasePin=[pCAudioBasePin] LockedDataPointer=[pLockedDataPointer] bLockedEqualsUnrolled=[bLockedEqualsUnrolled].

Message #

KS Endpoint Glitch: BASE Output Unexpected Buffer Completed: pCAudioBasePin=[%1] LockedDataPointer=[%2] bLockedEqualsUnrolled=[%3]

Fields #

Name	Description
`pCAudioBasePin` Pointer
`pLockedDataPointer` Pointer
`bLockedEqualsUnrolled` Boolean

Event ID 39: KS Endpoint Glitch: BASE Input Null Last Buffer with LockedData !

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: BASEInputNullLastBufferwithLockedData!=LoopedBuffer

Description

KS Endpoint Glitch: BASE Input Null Last Buffer with LockedData != LoopedBuffer: pCAudioBasePin=[pCAudioBasePin] LockedDataPointer=[LockedDataPointer].

Message #

KS Endpoint Glitch: BASE Input Null Last Buffer with LockedData != LoopedBuffer: pCAudioBasePin=[%1] LockedDataPointer=[%2]

Fields #

Name	Description
`pCAudioBasePin` Pointer
`LockedDataPointer` Pointer

Event ID 40: KS Endpoint Glitch: BASE Input Buffer Index Mismatch: pCAudioBasePin=[pCAudioBasePin] LockedDataPointer=[LockedDataPointer].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: BASEInputBufferIndexMismatch

Description

KS Endpoint Glitch: BASE Input Buffer Index Mismatch: pCAudioBasePin=[pCAudioBasePin] LockedDataPointer=[LockedDataPointer].

Message #

KS Endpoint Glitch: BASE Input Buffer Index Mismatch: pCAudioBasePin=[%1] LockedDataPointer=[%2]

Fields #

Name	Description
`pCAudioBasePin` Pointer
`LockedDataPointer` Pointer

Event ID 41: KS Endpoint Glitch: BASE End Glitch: pCAudioBasePin=[pCAudioBasePin] StreamPosition=[GlitchStreamPosition] GlitchDuration=[GlitchDuration].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: BASEEndGlitch

Description

KS Endpoint Glitch: BASE End Glitch: pCAudioBasePin=[pCAudioBasePin] StreamPosition=[GlitchStreamPosition] GlitchDuration=[GlitchDuration].

Message #

KS Endpoint Glitch: BASE End Glitch: pCAudioBasePin=[%1] StreamPosition=[%2] GlitchDuration=[%3]

Fields #

Name	Description
`pCAudioBasePin` Pointer
`GlitchStreamPosition` UInt64
`GlitchDuration` UInt32

Event ID 42: KS Endpoint Glitch: RTCAP StreamPos Ahead of HW Pos: pCAudioCapturePinRealtimeStreaming=[pCAudioCapturePinRealtimeStreaming] WritePos=[WritePosition] PlayPos=[PlayPosition] StreamPos=[StreamPositio...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: RTCAPStreamPosAheadofHWPos

Description

KS Endpoint Glitch: RTCAP StreamPos Ahead of HW Pos: pCAudioCapturePinRealtimeStreaming=[pCAudioCapturePinRealtimeStreaming] WritePos=[WritePosition] PlayPos=[PlayPosition] StreamPos=[StreamPosition] StreamPosMinusReadPos=[StreamPosMinusReadPos].

Message #

KS Endpoint Glitch: RTCAP StreamPos Ahead of HW Pos: pCAudioCapturePinRealtimeStreaming=[%1] WritePos=[%2] PlayPos=[%3] StreamPos=[%4] StreamPosMinusReadPos=[%5]

Fields #

Name	Description
`pCAudioCapturePinRealtimeStreaming` Pointer
`WritePosition` UInt64
`PlayPosition` UInt64
`StreamPosition` UInt64
`StreamPosMinusReadPos` UInt64

Event ID 43: KS Endpoint Glitch: RTCAP StreamPos Too Far Behind: pCAudioCapturePinRealtimeStreaming=[pCAudioCapturePinRealtimeStreaming] WritePos=[WritePosition] PlayPos=[PlayPosition] StreamPos=[StreamPosition...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: RTCAPStreamPosTooFarBehind

Description

KS Endpoint Glitch: RTCAP StreamPos Too Far Behind: pCAudioCapturePinRealtimeStreaming=[pCAudioCapturePinRealtimeStreaming] WritePos=[WritePosition] PlayPos=[PlayPosition] StreamPos=[StreamPosition] ReadPosMinusStreamPos=[ReadPosMinusStreamPos].

Message #

KS Endpoint Glitch: RTCAP StreamPos Too Far Behind: pCAudioCapturePinRealtimeStreaming=[%1] WritePos=[%2] PlayPos=[%3] StreamPos=[%4] ReadPosMinusStreamPos=[%5]

Fields #

Name	Description
`pCAudioCapturePinRealtimeStreaming` Pointer
`WritePosition` UInt64
`PlayPosition` UInt64
`StreamPosition` UInt64
`ReadPosMinusStreamPos` UInt64

Event ID 44: KS Endpoint Glitch: RTREN WritePos Exceeds TotalPos: pCAudioRenderPinRealtimeStreaming=[pCAudioRenderPinRealtimeStreaming] WritePos=[WritePosition] PlayPos=[PlayPosition] TotalPos=[TotalPosition] W...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: RTRENWritePosExceedsTotalPos

Description

KS Endpoint Glitch: RTREN WritePos Exceeds TotalPos: pCAudioRenderPinRealtimeStreaming=[pCAudioRenderPinRealtimeStreaming] WritePos=[WritePosition] PlayPos=[PlayPosition] TotalPos=[TotalPosition] WritePosMinusTotalPos=[WritePosMinusTotalPos].

Message #

KS Endpoint Glitch: RTREN WritePos Exceeds TotalPos: pCAudioRenderPinRealtimeStreaming=[%1] WritePos=[%2] PlayPos=[%3] TotalPos=[%4] WritePosMinusTotalPos=[%5]

Fields #

Name	Description
`pCAudioRenderPinRealtimeStreaming` Pointer
`WritePosition` UInt64
`PlayPosition` UInt64
`TotalPosition` UInt64
`WritePosMinusTotalPos` UInt64

Event ID 45: KS Endpoint Glitch: STCAP Capture Ahead: pCAudioCapturePinStandardStreaming=[pCAudioCapturePinStandardStreaming] ValidPosEnd=[ValidPositionEnd] ValidPosStart=[ValidPositionStart] StreamPos=[StreamP...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: STCAPCaptureAhead

Description

KS Endpoint Glitch: STCAP Capture Ahead: pCAudioCapturePinStandardStreaming=[pCAudioCapturePinStandardStreaming] ValidPosEnd=[ValidPositionEnd] ValidPosStart=[ValidPositionStart] StreamPos=[StreamPosition] StreamPosMinusValidPosEnd=[StreamPosMinusValidPosEnd].

Message #

KS Endpoint Glitch: STCAP Capture Ahead: pCAudioCapturePinStandardStreaming=[%1] ValidPosEnd=[%2] ValidPosStart=[%3] StreamPos=[%4] StreamPosMinusValidPosEnd=[%5]

Fields #

Name	Description
`pCAudioCapturePinStandardStreaming` Pointer
`ValidPositionEnd` UInt64
`ValidPositionStart` UInt64
`StreamPosition` UInt64
`StreamPosMinusValidPosEnd` UInt64

Event ID 46: KS Endpoint Glitch: STCAP Capture Behind: pCAudioCapturePinStandardStreaming=[pCAudioCapturePinStandardStreaming] ValidPosEnd=[ValidPositionEnd] ValidPosStart=[ValidPositionStart] StreamPos=[Stream...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: STCAPCaptureBehind

Description

KS Endpoint Glitch: STCAP Capture Behind: pCAudioCapturePinStandardStreaming=[pCAudioCapturePinStandardStreaming] ValidPosEnd=[ValidPositionEnd] ValidPosStart=[ValidPositionStart] StreamPos=[StreamPosition] ValidPosStartMinusStreamPos=[ValidPosStartMinusStreamPos].

Message #

KS Endpoint Glitch: STCAP Capture Behind: pCAudioCapturePinStandardStreaming=[%1] ValidPosEnd=[%2] ValidPosStart=[%3] StreamPos=[%4] ValidPosStartMinusStreamPos=[%5]

Fields #

Name	Description
`pCAudioCapturePinStandardStreaming` Pointer
`ValidPositionEnd` UInt64
`ValidPositionStart` UInt64
`StreamPosition` UInt64
`ValidPosStartMinusStreamPos` UInt64

Event ID 47: KS Endpoint Glitch: STCAP Device Starved: pCAudioCapturePinStandardStreaming=[pCAudioCapturePinStandardStreaming] StreamPos=[StreamPosition] FrameCount=[FrameCount].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: STCAPDeviceStarved

Description

KS Endpoint Glitch: STCAP Device Starved: pCAudioCapturePinStandardStreaming=[pCAudioCapturePinStandardStreaming] StreamPos=[StreamPosition] FrameCount=[FrameCount].

Message #

KS Endpoint Glitch: STCAP Device Starved: pCAudioCapturePinStandardStreaming=[%1] StreamPos=[%2] FrameCount=[%3]

Fields #

Name	Description
`pCAudioCapturePinStandardStreaming` Pointer
`StreamPosition` UInt64
`FrameCount` UInt32

Event ID 48: KS Endpoint Glitch: STREN Device Starved: pCAudioRenderPinStandardStreaming=[pCAudioRenderPinStandardStreaming] DevicePos=[DevicePosition] StreamPos=[StreamPosition] AvailFrames=[AvailableFrames].

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: STRENDeviceStarved

Description

KS Endpoint Glitch: STREN Device Starved: pCAudioRenderPinStandardStreaming=[pCAudioRenderPinStandardStreaming] DevicePos=[DevicePosition] StreamPos=[StreamPosition] AvailFrames=[AvailableFrames].

Message #

KS Endpoint Glitch: STREN Device Starved: pCAudioRenderPinStandardStreaming=[%1] DevicePos=[%2] StreamPos=[%3] AvailFrames=[%4]

Fields #

Name	Description
`pCAudioRenderPinStandardStreaming` Pointer
`DevicePosition` UInt64
`StreamPosition` UInt64
`AvailableFrames` UInt32

Event ID 49: KS Endpoint Glitch: STREN EXCL PULL Invalid Buffer Count: pCAudioRenderPinStandardStreaming=[pCAudioRenderPinStandardStreaming] DevicePos=[DevicePosition] StreamPos=[StreamPosition] AvailFrames=[Av...

Provider: Microsoft-Windows-Audio
Channel: GlitchDetection
Task: Audio_Glitch_Detection
Opcode: STRENEXCLPULLInvalidBufferCount

Description

KS Endpoint Glitch: STREN EXCL PULL Invalid Buffer Count: pCAudioRenderPinStandardStreaming=[pCAudioRenderPinStandardStreaming] DevicePos=[DevicePosition] StreamPos=[StreamPosition] AvailFrames=[AvailableFrames].

Message #

KS Endpoint Glitch: STREN EXCL PULL Invalid Buffer Count: pCAudioRenderPinStandardStreaming=[%1] DevicePos=[%2] StreamPos=[%3] AvailFrames=[%4]

Fields #

Name	Description
`pCAudioRenderPinStandardStreaming` Pointer
`DevicePosition` UInt64
`StreamPosition` UInt64
`AvailableFrames` UInt32

Event ID 50: System effect initialized: CLSID=[APOCLSID] AudioSignalProcessingMode=[AudioSignalProcessingMode] InitializeForDiscoveryOnly=[InitializeForDiscoveryOnly].

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: System_Effect_APO_Initialized

Description

System effect initialized: CLSID=[APOCLSID] AudioSignalProcessingMode=[AudioSignalProcessingMode] InitializeForDiscoveryOnly=[InitializeForDiscoveryOnly].

Message #

System effect initialized: CLSID=[%1] AudioSignalProcessingMode=[%2] InitializeForDiscoveryOnly=[%3]

Fields #

Name	Description
`APOCLSID` GUID
`AudioSignalProcessingMode` GUID
`InitializeForDiscoveryOnly` Boolean

Event ID 51: Volume limit event signalled to audiosrv enter

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioSrv_EVT_VOLUME_LIMIT_CHANGED_ENTER

Description

Volume limit event signalled to audiosrv enter.

Message #

Volume limit event signalled to audiosrv enter

Fields #

Name	Description
`objectpointer` Pointer

Event ID 52: Volume limit event signalled to audiosrv exit

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioSrv_EVT_VOLUME_LIMIT_CHANGED_EXIT

Description

Volume limit event signalled to audiosrv exit.

Message #

Volume limit event signalled to audiosrv exit

Fields #

Name	Description
`objectpointer` Pointer
`hr` UInt32

Event ID 53: AudioSrv published AVLC state

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioSrv_EVT_VOLUME_LIMIT_PUBLISH_WNF_AVLC_STATE

Description

AudioSrv published AVLC state.

Message #

AudioSrv published AVLC state

Fields #

Name	Description
`objectpointer` Pointer

Event ID 54: AudioSrv calls PdcActivationClientRegister

Provider: Microsoft-Windows-Audio
Channel: Informational

Description

AudioSrv calls PdcActivationClientRegister.

Message #

AudioSrv calls PdcActivationClientRegister

Event ID 55: AudioSrv calls PdcActivationClientUnregister

Provider: Microsoft-Windows-Audio
Channel: Informational

Description

AudioSrv calls PdcActivationClientUnregister.

Message #

AudioSrv calls PdcActivationClientUnregister

Event ID 56: AudioSrv calls PdcActivationClientTakeTimerReference

Provider: Microsoft-Windows-Audio
Channel: Informational

Description

AudioSrv calls PdcActivationClientTakeTimerReference.

Message #

AudioSrv calls PdcActivationClientTakeTimerReference

Event ID 57: AudioSrv calls PdcActivationClientReleaseTimerReference

Provider: Microsoft-Windows-Audio
Channel: Informational

Description

AudioSrv calls PdcActivationClientReleaseTimerReference.

Message #

AudioSrv calls PdcActivationClientReleaseTimerReference

Event ID 58: MMDevAPI: Default device changed triggered

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MMDevAPI
Opcode: Defaultdevicechangedtriggered

Description

MMDevAPI: Default device changed triggered.

Message #

MMDevAPI: Default device changed triggered

Fields #

Name	Description
`flow` UInt32
`role` UInt32
`TargetProcessId` UInt32	Process ID of the target process.

Event ID 59: MMDevAPI: OnMediaNotification Enter

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MMDevAPI
Opcode: Start

Description

MMDevAPI: OnMediaNotification Enter.

Message #

MMDevAPI: OnMediaNotification Enter

Fields #

Name	Description
`object` Pointer

Event ID 60: MMDevAPI: OnMediaNotification Exit

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MMDevAPI
Opcode: Stop

Description

MMDevAPI: OnMediaNotification Exit.

Message #

MMDevAPI: OnMediaNotification Exit

Fields #

Name	Description
`object` Pointer

Event ID 61: MMDevAPI: DeviceStateChanged callback

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MMDevAPI
Opcode: DeviceStateChangedcallback

Description

MMDevAPI: DeviceStateChanged callback.

Message #

MMDevAPI: DeviceStateChanged callback

Fields #

Name	Description
`object` Pointer
`NewState` UInt32

Event ID 62: MMDevAPI: DeviceAdded callback

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MMDevAPI
Opcode: DeviceAddedcallback

Description

MMDevAPI: DeviceAdded callback.

Message #

MMDevAPI: DeviceAdded callback

Fields #

Name	Description
`object` Pointer

Event ID 63: MMDevAPI: DeviceRemoved callback

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MMDevAPI
Opcode: DeviceRemovedcallback

Description

MMDevAPI: DeviceRemoved callback.

Message #

MMDevAPI: DeviceRemoved callback

Fields #

Name	Description
`object` Pointer

Event ID 64: MMDevAPI: DefaultDeviceChanged callback

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MMDevAPI
Opcode: DefaultDeviceChangedcallback

Description

MMDevAPI: DefaultDeviceChanged callback.

Message #

MMDevAPI: DefaultDeviceChanged callback

Fields #

Name	Description
`object` Pointer
`flow` UInt32
`role` UInt32

Event ID 65: MMDevAPI: Audio device state changed

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: AudioCore_EVT_MMDevAPI
Opcode: Audiodevicestatechanged

Description

MMDevAPI: Audio device state changed.

Message #

MMDevAPI: Audio device state changed

Fields #

Name	Description
`DeviceName` UnicodeString
`DeviceId` UnicodeString
`flow` UInt32
`NewState` UInt32

Event ID 101: MidiRT: Application Suspension Handler

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MidiRT
Opcode: ApplicationSuspensionHandler

Description

MidiRT: Application Suspension Handler.

Message #

MidiRT: Application Suspension Handler

Fields #

Name	Description
`object` Pointer

Event ID 102: MidiRT: Application Resume Handler

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MidiRT
Opcode: ApplicationResumeHandler

Description

MidiRT: Application Resume Handler.

Message #

MidiRT: Application Resume Handler

Fields #

Name	Description
`object` Pointer

Event ID 103: MidiRT: Application Entering CS Handler

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MidiRT
Opcode: ApplicationEnteringCSHandler

Description

MidiRT: Application Entering CS Handler.

Message #

MidiRT: Application Entering CS Handler

Fields #

Name	Description
`object` Pointer

Event ID 104: MidiRT: Application Resuming from CS Handler

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MidiRT
Opcode: ApplicationResumingfromCSHandler

Description

MidiRT: Application Resuming from CS Handler.

Message #

MidiRT: Application Resuming from CS Handler

Fields #

Name	Description
`object` Pointer

Event ID 105: MidiRT: Device Removal Handler

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MidiRT
Opcode: DeviceRemovalHandler

Description

MidiRT: Device Removal Handler.

Message #

MidiRT: Device Removal Handler

Fields #

Name	Description
`object` Pointer

Event ID 106: MidiRT: Cleanup and release device handle

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MidiRT
Opcode: Cleanupandreleasedevicehandle

Description

MidiRT: Cleanup and release device handle.

Message #

MidiRT: Cleanup and release device handle

Fields #

Name	Description
`object` Pointer

Event ID 107: MidiRT: Close handle to MIDI Device

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MidiRT
Opcode: ClosehandletoMIDIDevice

Description

MidiRT: Close handle to MIDI Device.

Message #

MidiRT: Close handle to MIDI Device

Fields #

Name	Description
`object` Pointer

Event ID 108: MidiRT: Begin binding to DeviceId: DeviceId.

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: MidiRT:Trytoopendeviceahandleonthedevice
Opcode: Start

Description

MidiRT: Begin binding to DeviceId: DeviceId.

Message #

MidiRT: Begin binding to DeviceId: %1

Fields #

Name	Description
`DeviceId` UnicodeString
`object` Pointer

Event ID 109: MidiRT: Done binding to device interface

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: MidiRT:Trytoopendeviceahandleonthedevice
Opcode: Stop

Description

MidiRT: Done binding to device interface.

Message #

MidiRT: Done binding to device interface

Fields #

Name	Description
`object` Pointer
`hResult` UInt32

Event ID 110: MidiRT: Create new MidiPortDeviceIoControl

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AudioCore_EVT_MidiRT
Opcode: CreatenewMidiPortDeviceIoControl

Description

MidiRT: Create new MidiPortDeviceIoControl.

Message #

MidiRT: Create new MidiPortDeviceIoControl

Fields #

Name	Description
`DeviceId` UnicodeString
`object` Pointer

Event ID 111: MidiRT: Beginning Synchronous I/O

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: MidiRT:PerformSynchronousI/O
Opcode: Start

Description

MidiRT: Beginning Synchronous I/O.

Message #

MidiRT: Beginning Synchronous I/O

Fields #

Name	Description
`object` Pointer
`ioControlCode` UInt32

Event ID 112: MidiRT: Done with synchronous I/O

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: MidiRT:PerformSynchronousI/O
Opcode: Stop

Description

MidiRT: Done with synchronous I/O.

Message #

MidiRT: Done with synchronous I/O

Fields #

Name	Description
`object` Pointer
`hResult` UInt32

Event ID 113: MidiRT: Beginning Asynchronous I/O

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: MidiRT:PerformAsynchronousI/O
Opcode: Start

Description

MidiRT: Beginning Asynchronous I/O.

Message #

MidiRT: Beginning Asynchronous I/O

Fields #

Name	Description
`object` Pointer
`ioControlCode` UInt32

Event ID 114: MidiRT: Done with Asynchronous I/O

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: MidiRT:PerformAsynchronousI/O
Opcode: Stop

Description

MidiRT: Done with Asynchronous I/O.

Message #

MidiRT: Done with Asynchronous I/O

Fields #

Name	Description
`object` Pointer
`hResult` UInt32

Event ID 115: CrossProcess packet added

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: CrossProcesspacketadded

Description

CrossProcess packet added.

Message #

CrossProcess packet added

Fields #

Name	Description
`CrossProcessInstance` Pointer
`ReadIndex` UInt32
`WriteIndexIndex` UInt32
`FramesInPacket` UInt32
`QPC` UInt64

Event ID 116: Pump: setting deadline

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:settingdeadline

Description

Pump: setting deadline.

Message #

Pump: setting deadline

Fields #

Name	Description
`PumpInstance` Pointer
`TaskGroup` UInt32
`SoftDeadlineHns` Int64
`HardDeadlineHns` Int64
`success` Boolean

Event ID 117: Pump: cancelling deadline

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:cancellingdeadline

Description

Pump: cancelling deadline.

Message #

Pump: cancelling deadline

Fields #

Name	Description
`PumpInstance` Pointer
`TaskGroup` UInt32
`Hns` Int64
`success` Boolean

Event ID 118: Pump: missed deadline!

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:misseddeadline!

Description

Pump: missed deadline!

Message #

Pump: missed deadline!

Fields #

Name	Description
`PumpInstance` Pointer
`TaskGroup` UInt32
`Hns` Int64
`success` Boolean

Event ID 119: Pump: Start - setting MultimediMode to AVRT_MULTIMEDIA_MODE_BUFFERING

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:MultiMediamode
Opcode: Start

Description

Pump: Start - setting MultimediMode to AVRT_MULTIMEDIA_MODE_BUFFERING.

Message #

Pump: Start - setting MultimediMode to AVRT_MULTIMEDIA_MODE_BUFFERING

Fields #

Name	Description
`PumpInstance` Pointer
`TaskGroup` UInt32
`Hns` Int64
`success` Boolean

Event ID 120: Pump: Stop - setting MultimediMode to AVRT_MULTIMEDIA_MODE_IDLE

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:MultiMediamode
Opcode: Stop

Description

Pump: Stop - setting MultimediMode to AVRT_MULTIMEDIA_MODE_IDLE.

Message #

Pump: Stop - setting MultimediMode to AVRT_MULTIMEDIA_MODE_IDLE

Fields #

Name	Description
`PumpInstance` Pointer
`TaskGroup` UInt32
`Hns` Int64
`success` Boolean

Event ID 121: Discovering EndpointCharacteristics for [Endpoint Id].

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: EndpointCharacteristicsDiscovery
Opcode: Start

Description

Discovering EndpointCharacteristics for [Endpoint Id].

Message #

Discovering EndpointCharacteristics for [%1]

Fields #

Name	Description
`EndpointId` UnicodeString

Event ID 122: Discovered EndpointCharacteristics for [Endpoint Id] (hr = hr).

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: EndpointCharacteristicsDiscovery
Opcode: Stop

Description

Discovered EndpointCharacteristics for [Endpoint Id] (hr = hr).

Message #

Discovered EndpointCharacteristics for [%1] (hr = %2)

Fields #

Name	Description
`EndpointId` UnicodeString
`hr` HexInt32

Event ID 123: GetMixFormat starting on endpoint [Endpoint Id] (category=category, raw=Raw, matchformat=MatchFormat, connector=ConnectorType).

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: GetMixFormatevaluation
Opcode: Start

Description

GetMixFormat starting on endpoint [Endpoint Id] (category=category, raw=Raw, matchformat=MatchFormat, connector=ConnectorType).

Message #

GetMixFormat starting on endpoint [%1] (category=%2, raw=%3, matchformat=%4, connector=%5)

Fields #

Name	Description
`EndpointId` UnicodeString
`category` UInt32
`Raw` Boolean
`MatchFormat` Boolean
`ConnectorType` UInt32

Event ID 124: GetMixFormat ended

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: GetMixFormatevaluation
Opcode: Stop

Description

GetMixFormat ended.

Message #

GetMixFormat ended

Event ID 125: IsFormatSupported starting on endpoint [Endpoint Id] (category=category, raw=Raw, matchformat=MatchFormat, connector=ConnectorType).

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: IsFormatSupportedevaluation
Opcode: Start

Description

IsFormatSupported starting on endpoint [Endpoint Id] (category=category, raw=Raw, matchformat=MatchFormat, connector=ConnectorType).

Message #

IsFormatSupported starting on endpoint [%1] (category=%2, raw=%3, matchformat=%4, connector=%5)

Fields #

Name	Description
`EndpointId` UnicodeString
`category` UInt32
`Raw` Boolean
`MatchFormat` Boolean
`ConnectorType` UInt32

Event ID 126: IsFormatSupported ended

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: IsFormatSupportedevaluation
Opcode: Stop

Description

IsFormatSupported ended.

Message #

IsFormatSupported ended

Event ID 127: Vadserver_CreateStream starting on endpoint [Endpoint Id] (category=category, raw=Raw, matchformat=MatchFormat, connector=ConnectorType).

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: StreamCreation
Opcode: Start

Description

Vadserver_CreateStream starting on endpoint [Endpoint Id] (category=category, raw=Raw, matchformat=MatchFormat, connector=ConnectorType).

Message #

Vadserver_CreateStream starting on endpoint [%1] (category=%2, raw=%3, matchformat=%4, connector=%5)

Fields #

Name	Description
`EndpointId` UnicodeString
`category` UInt32
`Raw` Boolean
`MatchFormat` Boolean
`ConnectorType` UInt32

Event ID 128: Vadserver_CreateStream ended

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: StreamCreation
Opcode: Stop

Description

Vadserver_CreateStream ended.

Message #

Vadserver_CreateStream ended

Event ID 129: Derived stream settings for stream

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: StreamCreation
Opcode: Derivedstreamsettingsforstream

Description

Derived stream settings for stream.

Message #

Derived stream settings for stream

Event ID 130: Created StreamGroup and stream

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: StreamCreation
Opcode: CreatedStreamGroupandstream

Description

Created StreamGroup and stream.

Message #

Created StreamGroup and stream

Event ID 131: Created SaDevice

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: StreamCreation
Opcode: CreatedSaDevice

Description

Created SaDevice.

Message #

Created SaDevice

Event ID 132: Connected StreamGroup to SaDevice

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: StreamCreation
Opcode: ConnectedStreamGrouptoSaDevice

Description

Connected StreamGroup to SaDevice.

Message #

Connected StreamGroup to SaDevice

Event ID 133: CreateDeviceEndpointInstance starting on endpoint [Endpoint Id] (connector=ConnectorType).

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: CreateDeviceEndpointInstancetask
Opcode: Start

Description

CreateDeviceEndpointInstance starting on endpoint [Endpoint Id] (connector=ConnectorType).

Message #

CreateDeviceEndpointInstance starting on endpoint [%1] (connector=%2)

Fields #

Name	Description
`EndpointId` UnicodeString
`ConnectorType` UInt32

Event ID 134: CreateDeviceEndpointInstance ended

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: CreateDeviceEndpointInstancetask
Opcode: Stop

Description

CreateDeviceEndpointInstance ended.

Message #

CreateDeviceEndpointInstance ended

Event ID 135: Pump: Correct Position

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:CorrectPosition

Description

Pump: Correct Position.

Message #

Pump: Correct Position

Fields #

Name	Description
`PumpInstance` Pointer
`SampleIndex` UInt64
`OrigProcessingStart` UInt64
`NewProcessingStart` UInt64
`StartCorrection` Int64
`TimeDelta` UInt64
`SampleDelta` UInt32
`DevicePeriod` UInt64
`ActualDevicePeriod` UInt64
`WindowWidth_ms` UInt64

Event ID 136: Pump: Start - Yield start

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:Yield
Opcode: Start

Description

Pump: Start - Yield start.

Message #

Pump: Start - Yield start

Fields #

Name	Description
`PumpInstance` Pointer
`uEventMask` UInt32

Event ID 137: Pump: Stop - Yield stop

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:Yield
Opcode: Stop

Description

Pump: Stop - Yield stop.

Message #

Pump: Stop - Yield stop

Fields #

Name	Description
`PumpInstance` Pointer
`WakeCategory` UInt32
`WakeValue` UInt32

Event ID 138: Pump: Start - Process start

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:Process
Opcode: Start

Description

Pump: Start - Process start.

Message #

Pump: Start - Process start

Fields #

Name	Description
`PumpInstance` Pointer
`Phase` UInt32

Event ID 139: Pump: Stop - Process stop

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:Process
Opcode: Stop

Description

Pump: Stop - Process stop.

Message #

Pump: Stop - Process stop

Fields #

Name	Description
`PumpInstance` Pointer

Event ID 140: Pump: ProcPassDuration

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:ProcPassDuration

Description

Pump: ProcPassDuration.

Message #

Pump: ProcPassDuration

Fields #

Name	Description
`PumpInstance` Pointer
`WorkDuration` Int64
`MaxWorkDuration` Int64

Event ID 141: AE Object

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEObject

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32

Event ID 142: AE Glitch

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEGlitch

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`WritePosition` Int64
`PlayPosition` UInt64
`StreamPosition` UInt64
`GlitchFrameCount` UInt64

Event ID 143: AE Drop

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEDrop

Fields #

Name	Description
`objInstance` Pointer
`SampleTime` UInt64
`u64ByteCount` UInt64

Event ID 144: AE CPU Usage

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AE CPU Usage
Opcode: Info

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32

Event ID 145: AE Control

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEControl

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`ProcessTime` UInt64

Event ID 146: AE Position

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEPosition

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`WritePosition` UInt64
`PlayPosition` UInt64
`StreamPosition` UInt64
`LoopPosition` UInt64

Event ID 147: AE Security

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AESecurity

Fields #

Name	Description
`objInstance` Pointer

Event ID 148: AE Data

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEData

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`Data1` UInt64
`Data2` UInt64
`Data3` UInt64

Event ID 149: AE IRP

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEIRP

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`Index` UInt32
`OutStandingCount` UInt32
`FrameExtent` UInt64

Event ID 150: AE Endpoint

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEEndpoint

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`PinHandle` UInt64
`FormatTag` UInt32
`SampleRate` UInt32
`BitsPerSample` UInt32
`Channels` UInt32
`Period` UInt32
`Latency` UInt32
`BufferSize` UInt32

Event ID 151: AE Interpolator

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEInterpolator

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`InterpolatedPlayPosition` UInt64
`InterpolatedWritePosition` UInt64
`RealPlayPosition` UInt64
`RealWritePosition` UInt64
`SampleRate` Float
`FilteredError` Float

Event ID 152: AE Timestamp

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AETimestamp

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`Flag` UInt64
`Padding` UInt64
`QPCPos` UInt64
`DevPos` UInt64
`StrmPos` UInt64

Event ID 153: AE Performance

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEPerformance

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`Custom1` UInt64
`Custom2` UInt64

Event ID 154: AE Generic

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEGeneric

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`u64Param1` UInt64
`u64Param2` UInt64
`u64Param3` UInt64
`u64Param4` UInt64
`f64Param1` Float
`f64Param2` Float
`f64Param3` Float
`f64Param4` Float

Event ID 155: AE Memory

Provider: Microsoft-Windows-Audio
Channel: Informational
Level: Verbose
Task: AEMemory

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`hHeap` Pointer
`ulInitial` UInt32
`ulMin` UInt32
`ulMax` UInt32
`ulAllocCount` UInt32
`ulExtendCount` UInt32
`ulTotalAlloc` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Audio",
    "guid": "AE4BD3BE-F36F-45B6-8D21-BDD6FB832853",
    "event_source_name": "",
    "event_id": 155,
    "version": 0,
    "level": 5,
    "task": 162,
    "opcode": 0,
    "keywords": 144115188075855872,
    "time_created": "2026-03-13T20:31:02.009926+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 8868,
      "thread_id": 1992
    },
    "channel": "Microsoft-Windows-Audio/Informational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "objInstance": "0x0",
    "ucType": 2,
    "hHeap": "0x2e0",
    "ulInitial": 0,
    "ulMin": 0,
    "ulMax": 0,
    "ulAllocCount": 0,
    "ulExtendCount": 0,
    "ulTotalAlloc": 0
  },
  "message": ""
}

Event ID 156: AE Memory

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEMemory_163

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`u64Param1` UInt64
`u64Param2` UInt64
`u64Param3` UInt64
`u64Param4` UInt64

Event ID 157: AE Memory

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEMemory_164

Fields #

Name	Description
`objInstance` Pointer
`ucType` UInt32
`u64Param1` UInt64
`u64Param2` UInt64
`u64Param3` UInt64
`u64Param4` UInt64

Event ID 158: SetCurrentTimeStamp

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: SetCurrentTimeStamp

Fields #

Name	Description
`objInstance` Pointer
`AEPositionFlag` UInt32
`EndpointFlags` UInt32
`PaddingFrames` UInt64
`Qpc` UInt64
`DevicePosition` UInt64
`StreamPosition` UInt64

Event ID 159: Writing history packet

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: Writinghistorypacket

Fields #

Name	Description
`objInstance` Pointer
`FrameCount` UInt32
`ApoBufferFlags` UInt32
`Qpc` UInt64

Event ID 160: Signal pump pass completion

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: Signalpumppasscompletion

Fields #

Name	Description
`objInstance` Pointer
`ClientProcessId` UInt32
`EventHandle` Pointer

Event ID 161: Pump: Processing pass skipped

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: Pump:Processingpassskipped

Description

Pump: Processing pass skipped.

Message #

Pump: Processing pass skipped

Fields #

Name	Description
`objInstance` Pointer
`DurationToProcess` Int64

Event ID 162: Pump: GetCurrentPadding Start

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:GetCurrentPadding
Opcode: Start

Description

Pump: GetCurrentPadding Start.

Message #

Pump: GetCurrentPadding Start

Fields #

Name	Description
`PumpInstance` Pointer

Event ID 163: Pump: GetCurrentPadding Stop

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:GetCurrentPadding
Opcode: Stop

Description

Pump: GetCurrentPadding Stop.

Message #

Pump: GetCurrentPadding Stop

Fields #

Name	Description
`PumpInstance` Pointer
`CurrentPadding` UInt64
`DurationToProcess` UInt64

Event ID 164: AE APO CalcInputFrames

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEAPOCalcInputFrames
Opcode: Start

Fields #

Name	Description
`objInstance` Pointer
`APO_CLSID` GUID

Event ID 165: AE APO CalcInputFrames

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEAPOCalcInputFrames
Opcode: Stop

Fields #

Name	Description
`objInstance` Pointer
`APO_CLSID` GUID

Event ID 166: AE APO Process

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEAPOProcess
Opcode: Start

Fields #

Name	Description
`objInstance` Pointer
`APO_CLSID` GUID

Event ID 167: AE APO Process

Provider: Microsoft-Windows-Audio
Channel: Informational
Task: AEAPOProcess
Opcode: Stop

Fields #

Name	Description
`objInstance` Pointer
`APO_CLSID` GUID

Event ID 168: Pump: Start - skipping setting MultimediMode to AVRT_MULTIMEDIA_MODE_BUFFERING

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:MultiMediamodeskipped
Opcode: Start

Description

Pump: Start - skipping setting MultimediMode to AVRT_MULTIMEDIA_MODE_BUFFERING.

Message #

Pump: Start - skipping setting MultimediMode to AVRT_MULTIMEDIA_MODE_BUFFERING

Fields #

Name	Description
`PumpInstance` Pointer
`TaskGroup` UInt32
`Hns` Int64
`success` Boolean

Event ID 169: Pump: Stop - skipping setting MultimediMode to AVRT_MULTIMEDIA_MODE_IDLE

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:MultiMediamodeskipped
Opcode: Stop

Description

Pump: Stop - skipping setting MultimediMode to AVRT_MULTIMEDIA_MODE_IDLE.

Message #

Pump: Stop - skipping setting MultimediMode to AVRT_MULTIMEDIA_MODE_IDLE

Fields #

Name	Description
`PumpInstance` Pointer
`TaskGroup` UInt32
`Hns` Int64
`success` Boolean

Event ID 170: Pump: TimedSpin Start

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:TimedSpin
Opcode: Start

Description

Pump: TimedSpin Start.

Message #

Pump: TimedSpin Start

Fields #

Name	Description
`PumpInstance` Pointer
`Duration` UInt32

Event ID 171: Pump: TimedSpin Stop

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:TimedSpin
Opcode: Stop

Description

Pump: TimedSpin Stop.

Message #

Pump: TimedSpin Stop

Fields #

Name	Description
`PumpInstance` Pointer
`Duration` UInt32

Event ID 172: Pump: Attach to MMCSS Start

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:AttachtoMMCSS
Opcode: Start

Description

Pump: Attach to MMCSS Start.

Message #

Pump: Attach to MMCSS Start

Fields #

Name	Description
`TaskGroupID` UInt32
`threadID` UInt32

Event ID 173: Pump: Attach to MMCSS Stop

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:AttachtoMMCSS
Opcode: Stop

Description

Pump: Attach to MMCSS Stop.

Message #

Pump: Attach to MMCSS Stop

Fields #

Name	Description
`TaskGroupID` UInt32
`threadID` UInt32

Event ID 174: Pump: Init RTMode

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:InitRTMode

Description

Pump: Init RTMode.

Message #

Pump: Init RTMode

Fields #

Name	Description
`objInstance` Pointer
`RTMode` UInt32
`ProAudio` Boolean
`PumpQueueID` UInt32
`PumpTaskID` UInt32
`APOQueueID` UInt32
`APOTaskID` UInt32

Event ID 175: Pump: CreateLocalWorkQueue RTMode

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:CreateLocalWorkQueue

Description

Pump: CreateLocalWorkQueue RTMode.

Message #

Pump: CreateLocalWorkQueue RTMode

Fields #

Name	Description
`objInstance` Pointer
`QueueID` UInt32
`TaskID` UInt32

Event ID 176: Pump: GetAPOWorkqueue

Provider: Microsoft-Windows-Audio
Channel: Performance
Task: Pump:GetAPOWorkqueue

Description

Pump: GetAPOWorkqueue.

Message #

Pump: GetAPOWorkqueue

Fields #

Name	Description
`objInstance` Pointer
`RTMode` UInt32
`APOQueueID` UInt32
`APOTaskID` UInt32

Event ID 177: Received console locked notification

Provider: Microsoft-Windows-Audio
Channel: Operational
Task: EVT_Console_Locked_task

Description

Received console locked notification.

Message #

Received console locked notification

Fields #

Name	Description
`SessionId` UInt32
`ConsoleLocked` Boolean
`ChangeInLockStatus` Boolean

Event ID 178: Global user presence detected

Provider: Microsoft-Windows-Audio
Channel: Operational
Level: Informational
Task: EVT_GlobalUser_Presence_task

Description

Global user presence detected.

Message #

Global user presence detected

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Audio",
    "event_id": 178,
    "level": 4,
    "task": 178,
    "opcode": 0,
    "time_created": "2026-05-27T20:01:08.8393680+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Audio"
  },
  "event_data": {
    "SessionId": "1"
  }
}

Event ID 179: Received session display notification

Provider: Microsoft-Windows-Audio
Channel: Operational
Level: Informational
Task: EVT_Session_Display_State_task

Description

Received session display notification.

Message #

Received session display notification

Fields #

Name	Description
`SessionId` UInt32
`SessionDisplayOn` Boolean
`ChangeInSessionDisplayStatus` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Audio",
    "event_id": 179,
    "level": 4,
    "task": 179,
    "opcode": 0,
    "time_created": "2026-05-27T20:01:08.8498129+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Audio"
  },
  "event_data": {
    "SessionDisplayOn": "true",
    "ChangeInSessionDisplayStatus": "false",
    "SessionId": "1"
  }
}

Event ID 180: Received Po AudioStandby request

Provider: Microsoft-Windows-Audio
Channel: Operational
Level: Informational
Task: EVT_Po_AudioStandby_Request_task

Description

Received Po AudioStandby request.

Message #

Received Po AudioStandby request

Fields #

Name	Description
`AudioStandbyPolicy` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Audio",
    "event_id": 180,
    "level": 4,
    "task": 180,
    "opcode": 0,
    "time_created": "2026-05-27T19:31:58.6926818+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Audio"
  },
  "event_data": {
    "AudioStandbyPolicy": "1"
  }
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID ae4bd3be-f36f-45b6-8d21-bdd6fb832853

Defined in audioses.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)