Microsoft-Windows-ClusterAwareUpdating-Management

Event	Title	Channel	Sample	Rule
1001	Cluster updating has exceeded the warning timeout of timeoutValue.	Admin	N	N
1001	Event ID 1001	Operational	N	N
1002	Cluster updating has exceeded the StopAfter timeout of timeoutValue.	Admin	N	N
1002	Event ID 1002	Operational	N	N
1003	Starting CAU run runIdentifier on cluster clusterName.	Admin	N	N
1003	Event ID 1003	Operational	N	N
1004	CAU run runIdentifier on cluster clusterName completed successfully.	Admin	N	N
1004	Event ID 1004	Operational	N	N
1005	CAU run runIdentifier on cluster clusterName was canceled.	Admin	N	N
1005	Event ID 1005	Operational	N	N
1006	CAU run runIdentifier on cluster clusterName failed partially.	Admin	N	N
1006	Event ID 1006	Operational	N	N
1007	CAU run runIdentifier on cluster clusterName failed.	Admin	N	N
1007	Event ID 1007	Operational	N	N
1008	Node clusterNodeName entered node maintenance mode.	Admin	N	N
1008	Event ID 1008	Operational	N	N
1009	Node clusterNodeName exited node maintenance mode.	Admin	N	N
1009	Event ID 1009	Operational	N	N
1010	Rebooting node clusterNodeName.	Admin	N	N
1010	Event ID 1010	Operational	N	N
1011	Node clusterNodeName has rebooted successfully.	Admin	N	N
1011	Event ID 1011	Operational	N	N
1012	Failed to reboot node clusterNodeName.	Admin	N	N
1012	Event ID 1012	Operational	N	N
1013	CAU run failed on node clusterNodeName.	Admin	N	N
1013	Event ID 1013	Operational	N	N
1014	Recovering the cluster clusterName from previous CAU run.	Admin	N	N
1014	Event ID 1014	Operational	N	N
1015	Failed to acquire lock on node clusterNodeName.	Admin	N	N
1015	Event ID 1015	Operational	N	N
1016	Failed to put node clusterNodeName in node maintenance mode.	Admin	N	N
1016	Event ID 1016	Operational	N	N
1017	Failed to resume node clusterNodeName from node maintenance mode.	Admin	N	N
1017	Event ID 1017	Operational	N	N
1018	Canceling CAU run as rebooting node clusterNodeName will compromise cluster …	Admin	N	N
1018	Event ID 1018	Operational	N	N
1019	Canceling CAU run as patching failed on nodeCount (MaxFailedNodes) nodes.	Admin	N	N
1019	Event ID 1019	Operational	N	N
1020	Canceling CAU run as all nodes are required to be online.	Admin	N	N
1020	Event ID 1020	Operational	N	N
1021	User canceled CAU run runIdentifier on cluster clusterName.	Admin	N	N
1021	Event ID 1021	Operational	N	N
1022	Failed to save CAU report.	Admin	N	N
1022	Event ID 1022	Operational	N	N
1023	Failed to get CAU report.	Admin	N	N
1023	Event ID 1023	Operational	N	N

Event ID 1001: Cluster updating has exceeded the warning timeout of timeoutValue.

Channel: Admin
Opcode: InstallingUpdates

Message #

Cluster updating has exceeded the warning timeout of %1.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1001

Channel: Operational
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the warning timeout of .

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1002: Cluster updating has exceeded the StopAfter timeout of timeoutValue.

Channel: Admin
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the StopAfter timeout of timeoutValue. Stopping updating run.

Message #

Cluster updating has exceeded the StopAfter timeout of %1. Stopping updating run.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1002

Channel: Operational
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the StopAfter timeout of . Stopping updating run.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1003: Starting CAU run runIdentifier on cluster clusterName.

Channel: Admin
Opcode: InstallingUpdates

Message #

Starting CAU run %1 on cluster %2.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1003

Channel: Operational
Opcode: InstallingUpdates

Description

Starting CAU run on cluster .

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1004: CAU run runIdentifier on cluster clusterName completed successfully.

Channel: Admin
Opcode: InstallingUpdates

Message #

CAU run %1 on cluster %2 completed successfully.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1004

Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster completed successfully.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1005: CAU run runIdentifier on cluster clusterName was canceled.

Channel: Admin
Opcode: InstallingUpdates

Message #

CAU run %1 on cluster %2 was canceled.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1005

Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster was canceled.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1006: CAU run runIdentifier on cluster clusterName failed partially.

Channel: Admin
Opcode: InstallingUpdates

Message #

CAU run %1 on cluster %2 failed partially.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1006

Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster failed partially.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1007: CAU run runIdentifier on cluster clusterName failed.

Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName failed. Error Message:errorMessage Error Code:errorCode Stack:stackTrace.

Message #

CAU run %1 on cluster %2 failed. Error Message:%3 Error Code:%4 Stack:%5

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString
`errorMessage` UnicodeString
`errorCode` Int32
`stackTrace` UnicodeString

Event ID 1007

Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster failed. Error Message: Error Code: Stack.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString
`errorMessage` UnicodeString
`errorCode` Int32
`stackTrace` UnicodeString

Event ID 1008: Node clusterNodeName entered node maintenance mode.

Channel: Admin
Opcode: InstallingUpdates

Message #

Node %1 entered node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1008

Channel: Operational
Opcode: InstallingUpdates

Description

Node entered node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1009: Node clusterNodeName exited node maintenance mode.

Channel: Admin
Opcode: InstallingUpdates

Message #

Node %1 exited node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1009

Channel: Operational
Opcode: InstallingUpdates

Description

Node exited node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1010: Rebooting node clusterNodeName.

Channel: Admin
Opcode: InstallingUpdates

Message #

Rebooting node %1.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1010

Channel: Operational
Opcode: InstallingUpdates

Description

Rebooting node .

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1011: Node clusterNodeName has rebooted successfully.

Channel: Admin
Opcode: InstallingUpdates

Message #

Node %1 has rebooted successfully.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1011

Channel: Operational
Opcode: InstallingUpdates

Description

Node has rebooted successfully.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1012: Failed to reboot node clusterNodeName.

Channel: Admin
Opcode: InstallingUpdates

Description

Failed to reboot node clusterNodeName. Details: errorMessage.

Message #

Failed to reboot node %1. Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1012

Channel: Operational
Opcode: InstallingUpdates

Description

Failed to reboot node . Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1013: CAU run failed on node clusterNodeName.

Channel: Admin
Opcode: InstallingUpdates

Description

CAU run failed on node clusterNodeName. Details: errorMessage.

Message #

CAU run failed on node %1. Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1013

Channel: Operational
Opcode: InstallingUpdates

Description

CAU run failed on node . Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1014: Recovering the cluster clusterName from previous CAU run.

Channel: Admin
Opcode: InstallingUpdates

Message #

Recovering the cluster %1 from previous CAU run.

Fields #

Name	Description
`clusterName` UnicodeString

Event ID 1014

Channel: Operational
Opcode: InstallingUpdates

Description

Recovering the cluster from previous CAU run.

Fields #

Name	Description
`clusterName` UnicodeString

Event ID 1015: Failed to acquire lock on node clusterNodeName.

Channel: Admin
Opcode: InstallingUpdates

Description

Failed to acquire lock on node clusterNodeName. This could be due to a different instance of orchestrator that owns the lock on this node.

Message #

Failed to acquire lock on node %1. This could be due to a different instance of orchestrator that owns the lock on this node.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1015

Channel: Operational
Opcode: InstallingUpdates

Description

Failed to acquire lock on node . This could be due to a different instance of orchestrator that owns the lock on this node.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1016: Failed to put node clusterNodeName in node maintenance mode.

Channel: Admin
Opcode: InstallingUpdates

Description

Failed to put node clusterNodeName in node maintenance mode. Details: errorMessage.

Message #

Failed to put node %1 in node maintenance mode.  Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1016

Channel: Operational
Opcode: InstallingUpdates

Description

Failed to put node in node maintenance mode. Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1017: Failed to resume node clusterNodeName from node maintenance mode.

Channel: Admin
Opcode: InstallingUpdates

Description

Failed to resume node clusterNodeName from node maintenance mode. Details: errorMessage.

Message #

Failed to resume node %1 from node maintenance mode.  Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1017

Channel: Operational
Opcode: InstallingUpdates

Description

Failed to resume node from node maintenance mode. Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1018: Canceling CAU run as rebooting node clusterNodeName will compromise cluster quorum.

Channel: Admin
Opcode: InstallingUpdates

Message #

Canceling CAU run as rebooting node %1 will compromise cluster quorum.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1018

Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as rebooting node will compromise cluster quorum.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1019: Canceling CAU run as patching failed on nodeCount (MaxFailedNodes) nodes.

Channel: Admin
Opcode: InstallingUpdates

Message #

Canceling CAU run as patching failed on %1 (MaxFailedNodes) nodes.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1019

Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as patching failed on (MaxFailedNodes) nodes.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1020: Canceling CAU run as all nodes are required to be online.

Channel: Admin
Opcode: InstallingUpdates

Description

Canceling CAU run as all nodes are required to be online. nodeCount nodes are currently offline.

Message #

Canceling CAU run as all nodes are required to be online. %1 nodes are currently offline.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1020

Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as all nodes are required to be online. nodes are currently offline.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1021: User canceled CAU run runIdentifier on cluster clusterName.

Channel: Admin
Opcode: InstallingUpdates

Message #

User canceled CAU run %1 on cluster %2.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1021

Channel: Operational
Opcode: InstallingUpdates

Description

User canceled CAU run on cluster .

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1022: Failed to save CAU report.

Channel: Admin
Opcode: Reports

Description

Failed to save CAU report. Details:errorMessage.

Message #

Failed to save CAU report. Details:%1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1022

Channel: Operational
Opcode: Reports

Description

Failed to save CAU report. Details.

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1023: Failed to get CAU report.

Channel: Admin
Opcode: Reports

Description

Failed to get CAU report. Details:errorMessage.

Message #

Failed to get CAU report. Details:%1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1023

Channel: Operational
Opcode: Reports

Description

Failed to get CAU report. Details.

Fields #

Name	Description
`errorMessage` UnicodeString

Provenance

ETW provider GUID 9b9e93d6-5569-4179-8c8a-5201cb2b9536

Defined in ClusterAwareUpdatingNative.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB