Microsoft-Windows-Deduplication-Change

76 events across 1 channel

Event	Title	Channel	Sample
16384	Create chunk container.	Operational	N
16385	Create chunk container completed CompletionStatus.	Operational	N
16386	Copy chunk container.	Operational	N
16387	Copy chunk container completed CompletionStatus.	Operational	N
16388	Delete chunk container.	Operational	N
16389	Delete chunk container completed CompletionStatus.	Operational	N
16390	Rename chunk container.	Operational	N
16391	Rename chunk container completed CompletionStatus.	Operational	N
16392	Flush chunk container.	Operational	N
16393	Flush chunk container completed CompletionStatus.	Operational	N
16394	Rollback chunk container.	Operational	N
16395	Rollback chunk container completed CompletionStatus.	Operational	N
16396	Mark chunk container.	Operational	N
16397	Mark chunk container read-only completed CompletionStatus.	Operational	N
16398	Write chunk container.	Operational	N
16399	Write chunk container redirection table completed CompletionStatus.	Operational	N
16400	Write chunk container.	Operational	N
16401	Write chunk container header completed CompletionStatus.	Operational	N
16402	Insert data chunk header to chunk container.	Operational	N
16403	Insert data chunk header completed CompletionStatus.	Operational	N
16404	Insert data chunk body to chunk container.	Operational	N
16405	Insert data chunk body completed CompletionStatus with ChunkId ChunkId.	Operational	N
16408	Write delete log.	Operational	N
16409	Write delete log header completed CompletionStatus.	Operational	N
16410	Append delete log.	Operational	N
16411	Append delete log entries completed CompletionStatus.	Operational	N
16412	Delete delete log.	Operational	N
16413	Delete delete log completed CompletionStatus.	Operational	N
16414	Rename delete log.	Operational	N
16415	Rename delete log completed CompletionStatus.	Operational	N
16416	Write chunk container bitmap (ChunkStoreType - FileName) for chunk container.	Operational	N
16417	Write chunk container bitmap completed CompletionStatus.	Operational	N
16418	Delete chunk container bitmap (ChunkStoreType - FileName) for chunk container.	Operational	N
16419	Delete chunk container bitmap completed CompletionStatus.	Operational	N
16420	Write merge log.	Operational	N
16421	Write merge log header completed CompletionStatus.	Operational	N
16422	Insert hotspot chunk header to chunk container.	Operational	N
16423	Insert hotspot chunk header completed CompletionStatus.	Operational	N
16424	Insert hotspot chunk body to chunk container.	Operational	N
16425	Insert hotspot chunk body completed CompletionStatus with ChunkId ChunkId.	Operational	N
16426	Insert stream map chunk header to chunk container.	Operational	N
16427	Insert stream map chunk header completed CompletionStatus.	Operational	N
16428	Insert stream map chunk body to chunk container.	Operational	N
16429	Insert stream map chunk body completed CompletionStatus with ChunkId ChunkId.	Operational	N
16430	Append merge log.	Operational	N
16431	Append merge log entries completed CompletionStatus.	Operational	N
16432	Delete merge log.	Operational	N
16433	Delete merge log completed CompletionStatus.	Operational	N
16434	Flush merge log.	Operational	N
16435	Flush merge log completed CompletionStatus.	Operational	N
16436	Update file list entries (Remove: Update_file_list_entries_Remove, Add: Add).	Operational	N
16437	Update file list entries completed CompletionStatus.	Operational	N
16438	Set dedup reparse point on FilePath (FileId FileId) (ReparsePoint: …	Operational	N
16439	Set dedup reparse point completed CompletionStatus (ReparsePointSet).	Operational	N
16440	Set dedup zero data on FilePath (FileId FileId).	Operational	N
16441	Set dedup zero data completed CompletionStatus.	Operational	N
16442	Flush reparse point files	Operational	N
16443	Flush reparse point files completed CompletionStatus.	Operational	N
16444	Set sparse on file id FileId.	Operational	N
16445	Set sparse completed CompletionStatus.	Operational	N
16446	FSCTL_SET_ZERO_DATA on file id FileId at offset Offset and BeyondFinalZero …	Operational	N
16447	FSCTL_SET_ZERO_DATA completed CompletionStatus.	Operational	N
16448	Rename chunk container bitmap (ChunkStoreType - FileName) for chunk container.	Operational	N
16449	Rename chunk container bitmap completed CompletionStatus.	Operational	N
16450	Insert padding chunk header to chunk container.	Operational	N
16451	Insert padding chunk header completed CompletionStatus.	Operational	N
16452	Insert padding chunk body to chunk container.	Operational	N
16453	Insert padding chunk body completed CompletionStatus with ChunkId ChunkId.	Operational	N
16454	Insert batch of chunks to chunk container.	Operational	N
16455	Insert batch of chunks completed CompletionStatus.	Operational	N
16456	Write chunk container directory (ChunkStoreType - FileName) for chunk container.	Operational	N
16457	Write chunk container directory completed CompletionStatus.	Operational	N
16458	Delete chunk container directory (ChunkStoreType - FileName) for chunk …	Operational	N
16459	Delete chunk container directory completed CompletionStatus.	Operational	N
16460	Rename chunk container directory (ChunkStoreType - FileName) for chunk …	Operational	N
16461	Rename chunk container directory completed CompletionStatus.	Operational	N

Event ID 16384: Create chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Create chunk container (ChunkStoreType - ContainerId.Generation.ccc).

Message #

Create chunk container (%1 - %2.%3.ccc)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32

Event ID 16385: Create chunk container completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Create chunk container completed CompletionStatus.

Message #

Create chunk container completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16386: Copy chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Copy chunk container (ChunkStoreType - ContainerId.Generation.ccc).

Message #

Copy chunk container (%1 - %2.%3.ccc)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32

Event ID 16387: Copy chunk container completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Copy chunk container completed CompletionStatus.

Message #

Copy chunk container completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16388: Delete chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete chunk container (ChunkStoreType - ContainerId.Generation.ccc).

Message #

Delete chunk container (%1 - %2.%3.ccc)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32

Event ID 16389: Delete chunk container completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete chunk container completed CompletionStatus.

Message #

Delete chunk container completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16390: Rename chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rename chunk container (ChunkStoreType - ContainerId.Generation.cccInvalidFileName).

Message #

Rename chunk container (%1 - %2.%3.ccc%4)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`InvalidFileName` UnicodeString

Event ID 16391: Rename chunk container completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rename chunk container completed CompletionStatus.

Message #

Rename chunk container completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16392: Flush chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Flush chunk container (ChunkStoreType - ContainerId.Generation.ccc).

Message #

Flush chunk container (%1 - %2.%3.ccc)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32

Event ID 16393: Flush chunk container completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Flush chunk container completed CompletionStatus.

Message #

Flush chunk container completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16394: Rollback chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rollback chunk container (ChunkStoreType - ContainerId.Generation.ccc).

Message #

Rollback chunk container (%1 - %2.%3.ccc)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32

Event ID 16395: Rollback chunk container completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rollback chunk container completed CompletionStatus.

Message #

Rollback chunk container completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16396: Mark chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Mark chunk container (ChunkStoreType - ContainerId.Generation.ccc) read-only.

Message #

Mark chunk container (%1 - %2.%3.ccc) read-only

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32

Event ID 16397: Mark chunk container read-only completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Mark chunk container read-only completed CompletionStatus.

Message #

Mark chunk container read-only completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16398: Write chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write chunk container (ChunkStoreType - ContainerId.Generation.ccc) redirection table at offset ContainerOffset (Entries: StartIndex StartIndex, Count EntryCount).

Message #

Write chunk container (%1 - %2.%3.ccc) redirection table at offset %4 (Entries: StartIndex %5, Count %6)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`ContainerOffset` UInt32
`StartIndex` UInt32
`EntryCount` UInt32
`Entries` Int32

Event ID 16399: Write chunk container redirection table completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write chunk container redirection table completed CompletionStatus.

Message #

Write chunk container redirection table completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16400: Write chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write chunk container ( - ..ccc) header at offset (Header: USN , VDL , #Chunk , NextLocalId , Flags , LastAppendTime , BackupRedirectionTableOfset , LastReconciliationLocalId ).

Message #

Write chunk container (%5 - %6.%7.ccc) header at offset %8 (Header: USN %9, VDL %10, #Chunk %11, NextLocalId %12, Flags %13, LastAppendTime %14, BackupRedirectionTableOfset %15, LastReconciliationLocalId %16)

Fields #

Name	Description
`Signature` UInt32
`MajorVersion` UInt8
`MinorVersion` UInt8
`VersionChecksum` UInt16
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`ContainerOffset` UInt32
`UpdateSequenceNumber` UInt64
`ValidDataLength` UInt32
`ChunkCount` UInt32
`NextLocalId` UInt32
`Flags` UInt32
`LastAppendTime` UInt64
`BackupRedirectionTableOffset` UInt32
`LastReconciliationLocalId` UInt32
`Checksum` UInt64

Event ID 16401: Write chunk container header completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write chunk container header completed CompletionStatus.

Message #

Write chunk container header completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16402: Insert data chunk header to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert data chunk header to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (Chunk: IsBatched IsBatched IsCorupted IsCorrupted, DataSize DataSize).

Message #

Insert data chunk header to chunk container (%1 - %2.%3.ccc) at offset %4 (Chunk: IsBatched %5 IsCorupted %6, DataSize %7)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`IsBatched` Boolean
`IsCorrupted` Boolean
`DataSize` UInt32
`Header` UInt32

Event ID 16403: Insert data chunk header completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert data chunk header completed CompletionStatus.

Message #

Insert data chunk header completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16404: Insert data chunk body to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert data chunk body to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (Chunk: IsBatched IsBatched IsCorrupted IsCorrupted, DataSize DataSize).

Message #

Insert data chunk body to chunk container (%1 - %2.%3.ccc) at offset %4 (Chunk: IsBatched %5 IsCorrupted %6, DataSize %7)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`IsBatched` Boolean
`IsCorrupted` Boolean
`DataSize` UInt32

Event ID 16405: Insert data chunk body completed CompletionStatus with ChunkId ChunkId.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert data chunk body completed CompletionStatus with ChunkId ChunkId.

Message #

Insert data chunk body completed %1 with ChunkId %2

Fields #

Name	Description
`CompletionStatus` UInt32
`ChunkId` Binary

Event ID 16408: Write delete log.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write delete log (ChunkStoreType - ContainerId.LogNumber.delete.log) header.

Message #

Write delete log (%5 - %6.%7.delete.log) header

Fields #

Name	Description
`Signature` UInt32
`MajorVersion` UInt8
`MinorVersion` UInt8
`VersionChecksum` UInt16
`ChunkStoreType` UInt8
`ContainerId` UInt32
`LogNumber` UInt32
`Checksum` UInt32
`FileExtension` UnicodeString

Event ID 16409: Write delete log header completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write delete log header completed CompletionStatus.

Message #

Write delete log header completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16410: Append delete log.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Append delete log (ChunkStoreType - ContainerId.LogNumber.delete.log) entries at offset FileExtension (Entries: StartIndex DeleteLogOffset, Count StartIndex).

Message #

Append delete log (%1 - %2.%3.delete.log) entries at offset %4 (Entries: StartIndex %5, Count %6)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`LogNumber` UInt32
`FileExtension` UnicodeString
`DeleteLogOffset` UInt32
`StartIndex` UInt32
`EntryCount` UInt32
`Entries` UInt32

Event ID 16411: Append delete log entries completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Append delete log entries completed CompletionStatus.

Message #

Append delete log entries completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16412: Delete delete log.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete delete log (ChunkStoreType - ContainerId.LogNumber.delete.log).

Message #

Delete delete log (%1 - %2.%3.delete.log)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`LogNumber` UInt32
`FileExtension` UnicodeString

Event ID 16413: Delete delete log completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete delete log completed CompletionStatus.

Message #

Delete delete log completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16414: Rename delete log.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rename delete log (ChunkStoreType - ContainerId.LogNumber.delete.log).

Message #

Rename delete log (%1 - %2.%3.delete.log)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`LogNumber` UInt32
`FileExtension` UnicodeString

Event ID 16415: Rename delete log completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rename delete log completed CompletionStatus.

Message #

Rename delete log completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16416: Write chunk container bitmap (ChunkStoreType - FileName) for chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write chunk container bitmap (ChunkStoreType - FileName) for chunk container (ChunkStoreType - ContainerId.Generation) (Bitmap: BitLength BitLength, StartIndex StartIndex, Count EntryCount).

Message #

Write chunk container bitmap (%1 - %2) for chunk container (%1 - %3.%4) (Bitmap: BitLength %5, StartIndex %6, Count %7)

Fields #

Name	Description
`ChunkStoreType` UInt8
`FileName` UnicodeString
`ContainerId` UInt32
`Generation` UInt32
`BitLength` UInt32
`StartIndex` UInt32
`EntryCount` UInt32
`Entries` Binary

Event ID 16417: Write chunk container bitmap completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write chunk container bitmap completed CompletionStatus.

Message #

Write chunk container bitmap completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16418: Delete chunk container bitmap (ChunkStoreType - FileName) for chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete chunk container bitmap (ChunkStoreType - FileName) for chunk container (ChunkStoreType - ContainerId.Generation).

Message #

Delete chunk container bitmap (%1 - %2) for chunk container (%1 - %3.%4)

Fields #

Name	Description
`ChunkStoreType` UInt8
`FileName` UnicodeString
`ContainerId` UInt32
`Generation` UInt32

Event ID 16419: Delete chunk container bitmap completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete chunk container bitmap completed CompletionStatus.

Message #

Delete chunk container bitmap completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16420: Write merge log.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write merge log (ChunkStoreType - ContainerId.LogNumber.merge.log) header.

Message #

Write merge log (%5 - %6.%7.merge.log) header

Fields #

Name	Description
`Signature` UInt32
`MajorVersion` UInt8
`MinorVersion` UInt8
`VersionChecksum` UInt16
`ChunkStoreType` UInt8
`ContainerId` UInt32
`LogNumber` UInt32
`Checksum` UInt32

Event ID 16421: Write merge log header completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write merge log header completed CompletionStatus.

Message #

Write merge log header completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16422: Insert hotspot chunk header to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert hotspot chunk header to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (Chunk: IsBatched IsBatched IsCorrupted IsCorrupted, DataSize DataSize).

Message #

Insert hotspot chunk header to chunk container (%1 - %2.%3.ccc) at offset %4 (Chunk: IsBatched %5 IsCorrupted %6, DataSize %7)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`IsBatched` Boolean
`IsCorrupted` Boolean
`DataSize` UInt32
`Header` UInt32

Event ID 16423: Insert hotspot chunk header completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert hotspot chunk header completed CompletionStatus.

Message #

Insert hotspot chunk header completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16424: Insert hotspot chunk body to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert hotspot chunk body to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (Chunk: IsBatched IsBatched IsCorrupted IsCorrupted, DataSize DataSize).

Message #

Insert hotspot chunk body to chunk container (%1 - %2.%3.ccc) at offset %4 (Chunk: IsBatched %5 IsCorrupted %6, DataSize %7)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`IsBatched` Boolean
`IsCorrupted` Boolean
`DataSize` UInt32

Event ID 16425: Insert hotspot chunk body completed CompletionStatus with ChunkId ChunkId.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert hotspot chunk body completed CompletionStatus with ChunkId ChunkId.

Message #

Insert hotspot chunk body completed %1 with ChunkId %2

Fields #

Name	Description
`CompletionStatus` UInt32
`ChunkId` Binary

Event ID 16426: Insert stream map chunk header to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert stream map chunk header to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (Chunk: IsBatched IsBatched IsCorrupted IsCorrupted, DataSize DataSize).

Message #

Insert stream map chunk header to chunk container (%1 - %2.%3.ccc) at offset %4 (Chunk: IsBatched %5 IsCorrupted %6, DataSize %7)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`IsBatched` Boolean
`IsCorrupted` Boolean
`DataSize` UInt32
`Header` UInt32

Event ID 16427: Insert stream map chunk header completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert stream map chunk header completed CompletionStatus.

Message #

Insert stream map chunk header completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16428: Insert stream map chunk body to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert stream map chunk body to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (Chunk: IsBatched IsBatched IsCorrupted IsCorrupted, DataSize DataSize) (Entries: StartIndex StartIndex, Count EntryCount).

Message #

Insert stream map chunk body to chunk container (%1 - %2.%3.ccc) at offset %4 (Chunk: IsBatched %5 IsCorrupted %6, DataSize %7) (Entries: StartIndex %8, Count %9)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`IsBatched` Boolean
`IsCorrupted` Boolean
`DataSize` UInt32
`StartIndex` UInt32
`EntryCount` UInt32
`Entries` UInt64

Event ID 16429: Insert stream map chunk body completed CompletionStatus with ChunkId ChunkId.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert stream map chunk body completed CompletionStatus with ChunkId ChunkId.

Message #

Insert stream map chunk body completed %1 with ChunkId %2

Fields #

Name	Description
`CompletionStatus` UInt32
`ChunkId` Binary

Event ID 16430: Append merge log.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Append merge log (ChunkStoreType - ContainerId.LogNumber.merge.log) entries at offset MergeLogOffset (Entries: StartIndex StartIndex, Count EntryCount).

Message #

Append merge log (%1 - %2.%3.merge.log) entries at offset %4 (Entries: StartIndex %5, Count %6)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`LogNumber` UInt32
`MergeLogOffset` UInt32
`StartIndex` UInt32
`EntryCount` UInt32
`Entries` Int32

Event ID 16431: Append merge log entries completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Append merge log entries completed CompletionStatus.

Message #

Append merge log entries completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16432: Delete merge log.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete merge log (ChunkStoreType - ContainerId.LogNumber.merge.log).

Message #

Delete merge log (%1 - %2.%3.merge.log)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`LogNumber` UInt32

Event ID 16433: Delete merge log completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete merge log completed CompletionStatus.

Message #

Delete merge log completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16434: Flush merge log.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Flush merge log (ChunkStoreType - ContainerId.LogNumber.merge.log).

Message #

Flush merge log (%1 - %2.%3.merge.log)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`LogNumber` UInt32

Event ID 16435: Flush merge log completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Flush merge log completed CompletionStatus.

Message #

Flush merge log completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16436: Update file list entries (Remove: Update_file_list_entries_Remove, Add: Add).

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Update file list entries (Remove: Update_file_list_entries_Remove, Add: Add).

Message #

Update file list entries (Remove: %1, Add: %2)

Fields #

Name	Description
`EntryToRemove` UnicodeString
`EntryToAdd` UnicodeString

Event ID 16437: Update file list entries completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Update file list entries completed CompletionStatus.

Message #

Update file list entries completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16438: Set dedup reparse point on FilePath (FileId FileId) (ReparsePoint: SizeBackedByChunkStore SizeBackedByChunkStore, StreamMapInfoSize StreamMapInfoSize, StreamMapInfo StreamMapInfo).

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Set dedup reparse point on FilePath (FileId FileId) (ReparsePoint: SizeBackedByChunkStore SizeBackedByChunkStore, StreamMapInfoSize StreamMapInfoSize, StreamMapInfo StreamMapInfo).

Message #

Set dedup reparse point on %2 (FileId %1) (ReparsePoint: SizeBackedByChunkStore %3, StreamMapInfoSize %4, StreamMapInfo %5)

Fields #

Name	Description
`FileId` UInt64
`FilePath` UnicodeString
`SizeBackedByChunkStore` UInt64
`StreamMapInfoSize` UInt16
`StreamMapInfo` Binary

Event ID 16439: Set dedup reparse point completed CompletionStatus (ReparsePointSet).

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Set dedup reparse point completed CompletionStatus (ReparsePointSet).

Message #

Set dedup reparse point completed %1 (%2)

Fields #

Name	Description
`CompletionStatus` UInt32
`ReparsePointSet` Boolean

Event ID 16440: Set dedup zero data on FilePath (FileId FileId).

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Set dedup zero data on FilePath (FileId FileId).

Message #

Set dedup zero data on %2 (FileId %1)

Fields #

Name	Description
`FileId` UInt64
`FilePath` UnicodeString

Event ID 16441: Set dedup zero data completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Set dedup zero data completed CompletionStatus.

Message #

Set dedup zero data completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16442: Flush reparse point files

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Flush reparse point files.

Message #

Flush reparse point files

Event ID 16443: Flush reparse point files completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Flush reparse point files completed CompletionStatus.

Message #

Flush reparse point files completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16444: Set sparse on file id FileId.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Set sparse on file id FileId.

Message #

Set sparse on file id %1

Fields #

Name	Description
`FileId` UInt64

Event ID 16445: Set sparse completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Set sparse completed CompletionStatus.

Message #

Set sparse completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16446: FSCTL_SET_ZERO_DATA on file id FileId at offset Offset and BeyondFinalZero BeyondFinalZero.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

FSCTL_SET_ZERO_DATA on file id FileId at offset Offset and BeyondFinalZero BeyondFinalZero.

Message #

FSCTL_SET_ZERO_DATA on file id %1 at offset %2 and BeyondFinalZero %3

Fields #

Name	Description
`FileId` UInt64
`Offset` UInt64
`BeyondFinalZero` UInt64

Event ID 16447: FSCTL_SET_ZERO_DATA completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

FSCTL_SET_ZERO_DATA completed CompletionStatus.

Message #

FSCTL_SET_ZERO_DATA completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16448: Rename chunk container bitmap (ChunkStoreType - FileName) for chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rename chunk container bitmap (ChunkStoreType - FileName) for chunk container (ChunkStoreType - ContainerId.Generation).

Message #

Rename chunk container bitmap (%1 - %2) for chunk container (%1 - %3.%4)

Fields #

Name	Description
`ChunkStoreType` UInt8
`FileName` UnicodeString
`ContainerId` UInt32
`Generation` UInt32

Event ID 16449: Rename chunk container bitmap completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rename chunk container bitmap completed CompletionStatus.

Message #

Rename chunk container bitmap completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16450: Insert padding chunk header to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert padding chunk header to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (Chunk: IsBatched IsBatched IsCorupted IsCorrupted, DataSize DataSize).

Message #

Insert padding chunk header to chunk container (%1 - %2.%3.ccc) at offset %4 (Chunk: IsBatched %5 IsCorupted %6, DataSize %7)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`IsBatched` Boolean
`IsCorrupted` Boolean
`DataSize` UInt32
`Header` UInt32

Event ID 16451: Insert padding chunk header completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert padding chunk header completed CompletionStatus.

Message #

Insert padding chunk header completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16452: Insert padding chunk body to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert padding chunk body to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (Chunk: IsBatched IsBatched IsCorrupted IsCorrupted, DataSize DataSize).

Message #

Insert padding chunk body to chunk container (%1 - %2.%3.ccc) at offset %4 (Chunk: IsBatched %5 IsCorrupted %6, DataSize %7)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`IsBatched` Boolean
`IsCorrupted` Boolean
`DataSize` UInt32

Event ID 16453: Insert padding chunk body completed CompletionStatus with ChunkId ChunkId.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert padding chunk body completed CompletionStatus with ChunkId ChunkId.

Message #

Insert padding chunk body completed %1 with ChunkId %2

Fields #

Name	Description
`CompletionStatus` UInt32
`ChunkId` Binary

Event ID 16454: Insert batch of chunks to chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert batch of chunks to chunk container (ChunkStoreType - ContainerId.Generation.ccc) at offset WriteOffset (BatchChunkCount BatchChunkCount, BatchDataSize BatchDataSize).

Message #

Insert batch of chunks to chunk container (%1 - %2.%3.ccc) at offset %4 (BatchChunkCount %5, BatchDataSize %6)

Fields #

Name	Description
`ChunkStoreType` UInt8
`ContainerId` UInt32
`Generation` UInt32
`WriteOffset` UInt64
`BatchChunkCount` UInt32
`BatchDataSize` UInt32

Event ID 16455: Insert batch of chunks completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Insert batch of chunks completed CompletionStatus.

Message #

Insert batch of chunks completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16456: Write chunk container directory (ChunkStoreType - FileName) for chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write chunk container directory (ChunkStoreType - FileName) for chunk container (ChunkStoreType - ContainerId.Generation) (Directory: EntryCount FileCopyLevel).

Message #

Write chunk container directory (%1 - %2) for chunk container (%1 - %3.%4) (Directory: EntryCount %5)

Fields #

Name	Description
`ChunkStoreType` UInt8
`FileName` UnicodeString
`ContainerId` UInt32
`Generation` UInt32
`FileCopyLevel` UInt32
`TotalEntryCount` UInt32
`StartIndex` UInt32
`EntryCount` UInt32
`Entries` Int64

Event ID 16457: Write chunk container directory completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Write chunk container directory completed CompletionStatus.

Message #

Write chunk container directory completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16458: Delete chunk container directory (ChunkStoreType - FileName) for chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete chunk container directory (ChunkStoreType - FileName) for chunk container (ChunkStoreType - ContainerId.Generation).

Message #

Delete chunk container directory (%1 - %2) for chunk container (%1 - %3.%4)

Fields #

Name	Description
`ChunkStoreType` UInt8
`FileName` UnicodeString
`ContainerId` UInt32
`Generation` UInt32
`FileCopyLevel` UInt32

Event ID 16459: Delete chunk container directory completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Delete chunk container directory completed CompletionStatus.

Message #

Delete chunk container directory completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Event ID 16460: Rename chunk container directory (ChunkStoreType - FileName) for chunk container.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rename chunk container directory (ChunkStoreType - FileName) for chunk container (ChunkStoreType - ContainerId.Generation).

Message #

Rename chunk container directory (%1 - %2) for chunk container (%1 - %3.%4)

Fields #

Name	Description
`ChunkStoreType` UInt8
`FileName` UnicodeString
`ContainerId` UInt32
`Generation` UInt32
`FileCopyLevel` UInt32

Event ID 16461: Rename chunk container directory completed CompletionStatus.

Provider: Microsoft-Windows-Deduplication-Change
Channel: Operational

Description

Rename chunk container directory completed CompletionStatus.

Message #

Rename chunk container directory completed %1

Fields #

Name	Description
`CompletionStatus` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 1d5e499d-739c-45a6-a3e1-8cbe0a352beb

Defined in ddputils.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)