detection.wiki

Microsoft-Windows-DNS-Client-DiagTrack

EventTitleChannelSampleRule
3021Collecting trace for DoH query QueryName and type QueryType which failed with …OperationalNN
3022Finished collecting trace for DoH query QueryName and type QueryType.OperationalNN

Event ID 3021: Collecting trace for DoH query QueryName and type QueryType which failed with response status QueryStatus.

#
Channel
Operational

Message #

Collecting trace for DoH query %1 and type %2 which failed with response status %3

Fields #

NameDescription
QueryName UnicodeString
QueryType UInt16
QueryStatus UInt32

Event ID 3022: Finished collecting trace for DoH query QueryName and type QueryType.

#
Channel
Operational

Description

Finished collecting trace for DoH query QueryName and type QueryType. Retry status code is: QueryStatus.

Message #

Finished collecting trace for DoH query %1 and type %2. Retry status code is: %3

Fields #

NameDescription
QueryName UnicodeString
QueryType UInt16
QueryStatus UInt32

Provenance

ETW provider GUID 80e30bfe-62cf-5c77-5dc4-425d2c7734a3

Defined in dnsapi.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB