Microsoft-Windows-Dwm-Core

334 events across 1 channel

Event	Title	Channel	Sample
1	SCHEDULE_FRAMEINFO	Diagnostic	Y
2	SCHEDULE_TIME	Diagnostic	Y
6	SCHEDULE_WFVB	Diagnostic	Y
7	SCHEDULE_WFVB	Diagnostic	Y
8	SCHEDULE_WFW	Diagnostic	Y
9	SCHEDULE_WFW	Diagnostic	Y
10	SCHEDULE_PROCESS_FRAME	Diagnostic	Y
11	SCHEDULE_PROCESS_FRAME	Diagnostic	Y
12	SCHEDULE_PROCESS_FRAME	Diagnostic	Y
13	SCHEDULE_RENDER	Diagnostic	Y
14	SCHEDULE_RENDER	Diagnostic	Y
15	SCHEDULE_PRESENT	Diagnostic	Y
16	SCHEDULE_PRESENT	Diagnostic	Y
19	SCHEDULE_GETPRESENTSTATS	Diagnostic	Y
21	SCHEDULE_GETPRESENTSTATS	Diagnostic	Y
24	SCHEDULE_GLITCH	Diagnostic	Y
25	SCHEDULE_GLITCH_RECOVERY_ATTEMPT	Diagnostic	N
26	SCHEDULE_RESETStart	Diagnostic	N
27	SCHEDULE_RESETStop	Diagnostic	N
29	ETWGUID_PUSH_INTERNAL_LAYER_EVENTStart	Diagnostic	N
30	ETWGUID_PUSH_INTERNAL_LAYER_EVENTStop	Diagnostic	N
31	ETWGUID_POP_INTERNAL_LAYER_EVENTStart	Diagnostic	N
32	ETWGUID_POP_INTERNAL_LAYER_EVENTStop	Diagnostic	N
33	ETWGUID_BITMAPCOPYEVENT	Diagnostic	Y
34	ETWGUID_COPYFRONTTOBACKBUFFEREVENT	Diagnostic	Y
35	ETWGUID_COPYFRONTTOBACKBUFFEREVENT	Diagnostic	Y
40	ETWGUID_CLEAREVENT	Diagnostic	Y
41	ETWGUID_CLEAREVENT	Diagnostic	Y
42	ETWGUID_DIRTYREGIONEVENT	Diagnostic	Y
43	ETWGUID_OCCLUSIONEVENT	Diagnostic	Y
44	ETWGUID_OCCLUSIONEVENT	Diagnostic	Y
45	ETWGUID_OCCLUSIONEVENT	Diagnostic	Y
46	ETWGUID_DWMUPDATEWINDOW	Diagnostic	Y
49	ETWGUID_DRAWEVENT	Diagnostic	Y
50	ETWGUID_DRAWEVENT	Diagnostic	N
51	ETWGUID_DRAWEVENT	Diagnostic	Y
54	MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT	Diagnostic	Y
55	MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT	Diagnostic	Y
56	MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT	Diagnostic	Y
57	MILEVENT_MEDIA_UCE_PRECOMPUTEEVENT	Diagnostic	Y
58	MILEVENT_MEDIA_UCE_PRECOMPUTEEVENT	Diagnostic	Y
59	MILEVENT_MEDIA_UCE_RENDEREVENT	Diagnostic	Y
60	MILEVENT_MEDIA_UCE_RENDEREVENT	Diagnostic	Y
61	MILEVENT_MEDIA_UCE_PRESENTEVENT	Diagnostic	Y
62	MILEVENT_MEDIA_UCE_PRESENTEVENT	Diagnostic	Y
63	MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY	Diagnostic	Y
64	MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY_GetPresentHistory	Diagnostic	Y
65	MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY	Diagnostic	Y
66	MILEVENT_MEDIA_UCE_CHECKDEVICESTATE	Diagnostic	Y
67	MILEVENT_MEDIA_UCE_CHECKDEVICESTATE	Diagnostic	Y
68	MILEVENT_MEDIA_UCE_CHECKDEVICESTATE	Diagnostic	Y
79	SCHEDULE_VBLANK_LOOP	Diagnostic	Y
80	SCHEDULE_VBLANK_LOOP	Diagnostic	Y
83	GDISPRITE_LOGICALSURFACE_ASSOCIATION	Diagnostic	Y
84	WINDOWNODE_GDISPRITE_ASSOCIATION	Diagnostic	Y
85	SCHEDULE_ROUNDTRIPREQUEST_STATE	Diagnostic	Y
87	SCHEDULE_PRESENTHISTORYTOKEN_GDI	Diagnostic	Y
88	SCHEDULE_PRESENTHISTORYTOKEN_GDISYSMEM	Diagnostic	N
91	SCHEDULE_PRESENTHISTORYTOKEN_BLT	Diagnostic	N
94	MILEVENT_MEDIA_UCE_PROCESSDEFERREDTOKENSStart	Diagnostic	N
95	MILEVENT_MEDIA_UCE_PROCESSDEFERREDTOKENSStop	Diagnostic	N
96	ETWGUID_MAGNIFIERRENDERTARGET_CAPTUREBITSStart	Diagnostic	N
97	ETWGUID_MAGNIFIERRENDERTARGET_CAPTUREBITSStop	Diagnostic	N
100	BIND_GDISPRITEBITMAP_FIRST_TOKEN	Diagnostic	N
110	SCHEDULE_UPDATE_TIMES	Diagnostic	Y
111	SCHEDULE_UPDATE_TIMES	Diagnostic	Y
112	UCE_PROCESSANIMATERESOURCES	Diagnostic	Y
113	UCE_PROCESSANIMATERESOURCES	Diagnostic	Y
114	SCHEDULE_UPDATE_FRAME_INDEXES	Diagnostic	Y
133	DCOMPEVENT_RESOURCE	Diagnostic	Y
134	DCOMPEVENT_ANIMATION_INITIAL_VALUE	Diagnostic	N
135	DCOMPEVENT_ANIMATION_UPDATE_VALUE	Diagnostic	N
136	DCOMPEVENT_END_ANIMATION	Diagnostic	N
137	SCHEDULE_NEW_EFFECTIVE_REFRESH_PERIOD_DELTAS	Diagnostic	Y
138	SCHEDULE_NEW_EFFECTIVE_REFRESH_PERIOD	Diagnostic	Y
139	SCHEDULE_DXGI_STATUS_OCCLUDED	Diagnostic	N
140	SCHEDULE_DXGI_OCCLUSION_EVENT	Diagnostic	N
141	SCHEDULE_DXGI_PRESENT_SUCCEEDED	Diagnostic	Y
144	ETWGUID_DIRECTFLIP_TRANSITIONEVENT	Diagnostic	N
145	ETWGUID_DIRECTFLIP_PRESENTEVENT	Diagnostic	N
146	ETWGUID_DIRECTFLIP_SUPPORTEVENT	Diagnostic	N
147	ETWGUID_DIRECTFLIP_PINEVENT	Diagnostic	N
148	ETWGUID_DIRECTFLIP_UNPINEVENT	Diagnostic	N
151	ETWGUID_RENDEROPT_DISCARDRESOURCEEVENT	Diagnostic	N
152	ETWGUID_RENDEROPT_TILEABLECOPYEVENT	Diagnostic	N
153	OPEN_SHARED_TEXTURE_EVENT	Diagnostic	Y
154	OPEN_SHARED_TEXTURE_EVENT	Diagnostic	Y
157	PROCESS_COMPOSITION_SURFACE_UPDATE_EVENTStart	Diagnostic	N
158	PROCESS_COMPOSITION_SURFACE_UPDATE_EVENTStop	Diagnostic	N
163	ETWGUID_PUSH_EXTERNAL_LAYER_EVENTStart	Diagnostic	N
164	ETWGUID_PUSH_EXTERNAL_LAYER_EVENTStop	Diagnostic	N
165	ETWGUID_POP_EXTERNAL_LAYER_EVENTStart	Diagnostic	N
166	ETWGUID_POP_EXTERNAL_LAYER_EVENTStop	Diagnostic	N
168	ANIMATION_ANALYSIS_DEBUG_EVENT	Diagnostic	Y
169	SCHEDULE_RENDERTIME	Diagnostic	Y
172	SCHEDULE_GLITCH_DETECTED	Diagnostic	N
173	TOUCH_FIRST_FRAME_EVENT_V1	Diagnostic	N
175	TOUCH_LAST_FRAME_EVENT_V3	Diagnostic	N
180	ETWGUID_DRAWING_CONTEXT_FRAME	Diagnostic	Y
181	ETWGUID_DRAWING_CONTEXT_FRAME	Diagnostic	Y
182	ETWGUID_DRAWING_CONTEXT_STATE	Diagnostic	Y
183	ETWGUID_COMPOSITION_SURFACE_DRAW	Diagnostic	N
185	ETWGUID_CVI_UPDATE	Diagnostic	Y
186	ETWGUID_DIRECTFLIP_CANDIDATERECORDEVENT	Diagnostic	N
187	ETWGUID_DIRECTFLIP_CANDIDATEOVERWRITEVENT	Diagnostic	N
189	SCHEDULE_TIMEADJUSTED_BETWEENFRAMES	Diagnostic	N
192	SCHEDULE_CLEAR_D2D_CACHES	Diagnostic	Y
193	SCHEDULE_CLEAR_D2D_CACHES	Diagnostic	Y
194	MILEVENT_MEDIA_UCE_PROCESSSURFACEUPDATES	Diagnostic	Y
195	MILEVENT_MEDIA_UCE_PROCESSSURFACEUPDATES	Diagnostic	Y
196	SCHEDULE_SURFACEUPDATE	Diagnostic	Y
197	ETWGUID_RENDEROPT_DISCARDVIEWEVENT	Diagnostic	Y
201	SCHEDULE_DERIVEDISPLAYSET	Diagnostic	N
202	SCHEDULE_RETIREFRAME	Diagnostic	Y
203	SCHEDULE_GETPRESENTSTATS1	Diagnostic	Y
204	SCHEDULE_PRESENT_STATS_DELTAS	Diagnostic	Y
205	RENDER_CVIPASS	Diagnostic	Y
206	RENDER_CVIPASS	Diagnostic	Y
208	HIT_TEST	Diagnostic	Y
209	HIT_TEST	Diagnostic	Y
210	HIT_TEST_TREE_WALK	Diagnostic	Y
211	HIT_TEST_TREE_WALK	Diagnostic	Y
212	INPUT_SINK	Diagnostic	N
214	DETECT_TOPLEVELWINDOW_DESTROY	Diagnostic	N
215	OVERLAY_GETCAPS	Diagnostic	N
216	OVERLAY_RECORDCANDIDATE	Diagnostic	N
217	OVERLAY_CHECKOCCLUSION	Diagnostic	N
218	OVERLAY_CHECKSUPPORTStart	Diagnostic	N
219	OVERLAY_CHECKSUPPORT	Diagnostic	N
220	OVERLAY_CHECKSUPPORTStop	Diagnostic	N
221	OVERLAY_CANDIDATECOLLECTION	Diagnostic	Y
222	OVERLAY_CANDIDATECOLLECTION	Diagnostic	Y
223	OVERLAY_PRESENTStart	Diagnostic	N
224	OVERLAY_PRESENT	Diagnostic	N
225	OVERLAY_PRESENTStop	Diagnostic	N
230	DETECT_REMOTEAPPMODE_SWITCH	Diagnostic	N
231	DETECT_DESKTOP_ENDOFUPDATES	Diagnostic	N
235	ETWGUID_PRIMITIVE_GROUP_DRAW	Diagnostic	N
236	ETWGUID_D2DLAYERCREATEREASON	Diagnostic	N
237	TELEMETRY_ANIMATION_PERFORMANCE_ANALYSIS_EVENT	Diagnostic	Y
238	ANIMATION_FIRST_FRAME_EVENT	Diagnostic	Y
239	ANIMATION_LAST_FRAME_EVENT	Diagnostic	Y
240	TELEMETRY_AGGREGATED_VSYNC_ANALYSIS_EVENT_V2	Diagnostic	N
246	DEBUG_FRAME_COUNTER_V1	Diagnostic	N
247	ETWGUID_SETINDEPENDENTFLIPINFO	Diagnostic	N
248	ETWGUID_PRIMITIVE_GROUP_SELF_OCCLUSION_INFO	Diagnostic	N
249	INPUT_SINK_TRANSFORM_UPDATE	Diagnostic	N
253	ETWGUID_RTCAPTUREStart	Diagnostic	N
254	ETWGUID_RTCAPTUREStop	Diagnostic	N
255	ETWGUID_RTCAPTURE_GETBITS	Diagnostic	N
259	TELEMETRY_ANIMATION_TTFF_ANALYSIS_EVENT_V1	Diagnostic	N
260	TELEMETRY_AGGREGATED_TTFF_ANALYSIS_EVENT_V1	Diagnostic	N
265	DCOMPEVENT_PRIMITIVEGROUP_UPDATE_V1	Diagnostic	N
266	MANIPULATION_THREAD_STARTUP	Diagnostic	N
267	MANIPULATION_THREAD_CLEANUP	Diagnostic	N
268	MANIPULATION_FRAME_RECEIVED	Diagnostic	N
269	MANIPULATION_FRAME_QUEUED	Diagnostic	N
270	MANIPULATION_FRAME_DEQUEUED	Diagnostic	N
271	INTERACTION_CREATED	Diagnostic	N
272	INTERACTION_VISUAL_UPDATE	Diagnostic	N
273	INTERACTION_TOUCH_CONFIGURATION_CHANGED	Diagnostic	N
274	INTERACTION_DESTROYED	Diagnostic	N
275	MANIPULATION_CONTEXT_CREATED	Diagnostic	N
276	MANIPULATION_CONTEXT_DESTROYED	Diagnostic	N
277	MANIPULATION_CONTEXT_NEW_CONTACT	Diagnostic	N
278	MANIPULATION_CONTEXT_CONTACT_DEPARTED	Diagnostic	N
284	ADVANCED_DIRECTFLIP_RECORDCANDIDATE	Diagnostic	N
285	ADVANCED_DIRECTFLIP_CREATERESTOREBUFFER	Diagnostic	N
286	ADVANCED_DIRECTFLIP_SAVECONTENT	Diagnostic	N
287	ADVANCED_DIRECTFLIP_RESTORECONTENT	Diagnostic	N
288	ADVANCED_DIRECTFLIP_CANCEL	Diagnostic	N
289	DISPLAYSURFACE_SWAPCHAINCANDIDATE	Diagnostic	N
290	DISPLAYSURFACE_REJECTCANDIDATE	Diagnostic	N
291	DISPLAYSURFACE_CANDIDATEATTRIBUTES	Diagnostic	N
292	MANIPULATION_POINTER_BUFFERED	Diagnostic	N
293	ETWGUID_PUBLISH_SEB_NOTIFICATION	Diagnostic	N
294	MIDMANIPULATION_UPDATE_INTERACTION_ADDITION	Diagnostic	N
295	MIDMANIPULATION_UPDATE_INTERACTION_REMOVAL	Diagnostic	N
296	MIDMANIPULATION_UPDATE_VISUAL_ADDITION	Diagnostic	N
297	MIDMANIPULATION_UPDATE_VISUAL_REMOVAL	Diagnostic	N
298	MIDMANIPULATION_UPDATE_VISUAL_PROP	Diagnostic	N
299	MIDMANIPULATION_UPDATE_CAPTURE_CONTACT	Diagnostic	N
300	INTERACTION_TOUCHPAD_CONFIGURATION_CHANGED	Diagnostic	N
301	INTERACTION_PEN_CONFIGURATION_CHANGED	Diagnostic	N
302	INTERACTION_MOUSE_CONFIGURATION_CHANGED	Diagnostic	N
303	SCHEDULE_FRAME_VSYNCDEADLINES	Diagnostic	Y
304	ETWGUID_PRESENT	Diagnostic	Y
309	SCHEDULE_NEW_NOMINAL_REFRESH_PERIOD	Diagnostic	N
310	ETWGUID_HW_PROTECTION_TEMPDISABLE	Diagnostic	N
311	ENDFRAME_DRAWLIST_BATCH_STATS	Diagnostic	Y
313	ENDFRAME_PRIMITIVE_GROUP_STATS	Diagnostic	Y
314	ENDFRAME_TESSELLATED_PRIMITIVES_STATS	Diagnostic	Y
315	ENDFRAME_HW_DRAWLIST_CACHE_STATS	Diagnostic	Y
316	ENDFRAME_WARP_DRAWLIST_CACHE_STATS	Diagnostic	Y
317	PROCESS_EXPRESSIONS	Diagnostic	Y
318	PROCESS_EXPRESSIONS	Diagnostic	Y
319	EXPRESSION_OUTPUTVALUEStart	Diagnostic	N
320	EXPRESSION_OUTPUTVALUEStop	Diagnostic	N
321	MIDMANIPULATION_UPDATE_CAPTURE_MANIPULATION	Diagnostic	N
322	CHANNELANIMATIONS_ACTIVE	Diagnostic	N
323	CHANNELBATCHES_PROCESSED	Diagnostic	Y
324	ETWGUID_HW_PROTECTED_ENTITY_CHANGE	Diagnostic	N
333	ETWGUID_VISUAL_RENDERCONTENT	Diagnostic	Y
334	ETWGUID_DIRTY_ADDRECT	Diagnostic	Y
335	ETWGUID_VISUAL_RENDERCONTENT335	Diagnostic	N
336	ADVANCED_DIRECTFLIP_NORESTORE_RECORDCANDIDATE	Diagnostic	N
342	HOLOGRAPHICCLIENT_TEXTUREUPDATECOUNT	Diagnostic	N
343	HOLOGRAPHICCLIENT_TEXTUREUPDATEWAITFAILED	Diagnostic	N
344	HOLOGRAPHICINTEROPTARGET_RENDER	Diagnostic	N
345	HOLOGRAPHICINTEROPTARGET_WAITONINCOMINGFAILED	Diagnostic	N
346	HOLOGRAPHICINTEROPTARGET_SYNCPOSTED	Diagnostic	N
347	HOLOGRAPHICINTEROPTARGET_RENDERCOMPLETE	Diagnostic	N
348	HOLOGRAPHICINTEROPTARGET_TIMEINQUEUE	Diagnostic	N
349	SHADERS_EFFECT_COMPILEStart	Diagnostic	N
350	SHADERS_EFFECT_COMPILEStop	Diagnostic	N
351	SHADERS_D3DSHADER_LINKStart	Diagnostic	N
352	SHADERS_D3DSHADER_LINKStop	Diagnostic	N
353	SHADERS_D3DSHADER_LINK_INFO	Diagnostic	N
354	SHADERS_D3DSHADER_CREATEStart	Diagnostic	N
355	SHADERS_D3DSHADER_CREATEStop	Diagnostic	N
356	SHADERS_EFFECT_COMPILE_INFO	Diagnostic	N
363	COMPUTESCRIBBLE_FRAMESCHEDULED	Diagnostic	N
364	COMPUTESCRIBBLE_FRAMECOMPLETED	Diagnostic	N
365	COMPUTESCRIBBLE_FRAMEDISPATCHStart	Diagnostic	N
366	COMPUTESCRIBBLE_FRAMEDISPATCHStop	Diagnostic	N
367	COMPUTESCRIBBLE_FRAMEDISPATCHCANCELED	Diagnostic	N
368	COMPUTESCRIBBLE_WAKEUPEVENTCREATED	Diagnostic	N
371	COMMANDS_COUNT	Diagnostic	Y
373	BRUSH_DRAW	Diagnostic	N
374	BRUSH_DRAW374	Diagnostic	N
375	BRUSH_DRAW375	Diagnostic	N
376	BRUSH_DRAW376	Diagnostic	N
377	COMPUTESCRIBBLE_FRAMEDROPPED	Diagnostic	N
378	INTERACTION_MOUSEWHEEL_CONFIGURATION_CHANGED	Diagnostic	N
379	COMPUTESCRIBBLE_PRERENDER	Diagnostic	N
380	COMPUTESCRIBBLE_PRESCHEDULE	Diagnostic	N
381	COMPUTESCRIBBLE_THREADWAKEUP	Diagnostic	N
382	COMPUTESCRIBBLE_WORKERHANG	Diagnostic	N
383	COMPUTESCRIBBLE_INCOMPATIBLE	Diagnostic	N
385	SCHEDULED_COMPOSITION_REASON	Diagnostic	Y
386	UNPRESENTED_FRAME	Diagnostic	Y
387	PROCESS_ATTRIBUTION	Diagnostic	Y
388	COMMAND_PROCESSED_ONBEHALF	Diagnostic	Y
389	CHANNEL_OPENED_FOR_PROCESS	Diagnostic	N
390	CHANNEL_CLOSED_FOR_PROCESS	Diagnostic	N
391	COMPUTESCRIBBLE_GPUFINISHED	Diagnostic	N
392	COMPUTESCRIBBLE_DRAWINFO	Diagnostic	N
393	COMPUTESCRIBBLE_TELEMETRYDROPPED	Diagnostic	N
394	P3D_BUILDING_BSPTREEStart	Diagnostic	N
395	P3D_BUILDING_BSPTREEStop	Diagnostic	N
396	P3D_BUILDING_POLYGONLISTStart	Diagnostic	N
397	P3D_BUILDING_POLYGONLISTStop	Diagnostic	N
398	P3D_RENDERINGStart	Diagnostic	N
399	P3D_RENDERINGStop	Diagnostic	N
400	DIAGTRACK_TRIGGER	Diagnostic	N
401	COMPUTESCRIBBLE_RENDERBLOCKEDStart	Diagnostic	N
402	COMPUTESCRIBBLE_RENDERBLOCKEDStop	Diagnostic	N
403	COMPUTESCRIBBLE_SCRIBBLEBLOCKEDStart	Diagnostic	N
404	COMPUTESCRIBBLE_SCRIBBLEBLOCKEDStop	Diagnostic	N
405	DCOMPEVENT_RESOURCE_OPEN	Diagnostic	Y
406	VISUAL_SET_INTERACTION	Diagnostic	N
409	HWDEVICEStart	Diagnostic	N
410	HWDEVICEStop	Diagnostic	N
411	COMPUTESCRIBBLE_EARLYCOPY	Diagnostic	N
412	COMPUTESCRIBBLE_ACTIVEStart	Diagnostic	N
413	COMPUTESCRIBBLE_ACTIVEStop	Diagnostic	N
414	LEGACYSWAPCHAIN_BUFFERFLIP	Diagnostic	Y
415	REGISTER_VAIL_STROKE_ON_HOST	Diagnostic	N
416	UNREGISTER_VAIL_STROKE_ON_HOST	Diagnostic	N
417	ENQUEUE_SCRIBBLE_ON_HOST	Diagnostic	N
418	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA	Diagnostic	N
419	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_REUSE	Diagnostic	N
420	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_NEW_FROM_GUEST	Diagnostic	N
421	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_FOUND_ON_NEW	Diagnostic	N
422	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_USE_FIRST	Diagnostic	N
423	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_NOT_FOUND_REUSE	Diagnostic	N
424	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_CLEANUP	Diagnostic	N
425	SYNCHRONOUSSUPERWETINK_CREATED	Diagnostic	N
426	SYNCHRONOUSSUPERWETINK_SUCCESSFULLY_REGISTERED	Diagnostic	N
427	SYNCHRONOUSSUPERWETINK_DESTROYED	Diagnostic	N
428	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_DROPED_FROM_GUEST	Diagnostic	N
429	CUSTOMDURATION_REJECT_MONITORCONFIGURATION	Diagnostic	N
430	CUSTOMDURATION_REJECT_PLANEFULLSCREENTEST	Diagnostic	N
431	CUSTOMDURATION_REJECT_DESKTOPPLANEENABLEDTEST	Diagnostic	N
432	CUSTOMDURATION_PERIOD_CHECKDRIVERSUPPORT	Diagnostic	N
433	CUSTOMDURATION_PERIOD_UTILIZECACHEDDURATION	Diagnostic	N
434	COMPUTESCRIBBLE_FENCEWAIT	Diagnostic	N
435	COMPUTESCRIBBLE_FENCESIGNAL	Diagnostic	N
436	COMPUTESCRIBBLE_POSTRENDER	Diagnostic	N
437	COMPUTESCRIBBLE_WAKEUPEVENTREADY	Diagnostic	N
438	COMPUTESCRIBBLE_BUFFERDECISION	Diagnostic	N
439	COMPUTESCRIBBLE_SOURCEACTIVE	Diagnostic	N
440	COMPUTESCRIBBLE_DROPSOURCE	Diagnostic	N
441	COMPUTESCRIBBLE_SOURCEUPDATE	Diagnostic	N
442	SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_NON_EXACT	Diagnostic	N
443	COMPUTESCRIBBLE_THREADWAKEUP_RAW	Diagnostic	N
444	COMPUTESCRIBBLE_DRAWSKIPPED	Diagnostic	N
445	COMPUTESCRIBBLE_DRAWASWETINKStart	Diagnostic	N
446	COMPUTESCRIBBLE_DRAWASWETINKStop	Diagnostic	N
447	SCHEDULE_VSYNC_QPC_SMOOTHING	Diagnostic	N
448	SCHEDULE_VSYNC_QPC_SMOOTHING_RESET	Diagnostic	N
449	SCHEDULE_VSYNC_QPC_SMOOTHING_UPDATE	Diagnostic	N
450	RENDERTARGET_RENDERSKIPPED	Diagnostic	N
451	CurrentFrameId	Diagnostic	Y
452	Pinning_AdvanceUnpin	Diagnostic	N
453	Pinning_D3DPinStart	Diagnostic	N
454	Pinning_D3DPinStop	Diagnostic	N
455	Pinning_D3DUnpinStart	Diagnostic	N
456	Pinning_D3DUnpinStop	Diagnostic	N
457	Pinning_OutstandingUnpinCount	Diagnostic	N
458	CompSurfInfo_BindingStart	Diagnostic	N
459	CompSurfInfo_BindingStop	Diagnostic	N
460	CompSurfInfo_ForceUpdateRealizationStart	Diagnostic	N
461	CompSurfInfo_ForceUpdateRealizationStop	Diagnostic	N
462	CustomDurationIterationResultStop	Diagnostic	N
463	CompSurfInfo_ScanoutIncompatible	Diagnostic	N
464	CompositionSwapchain_CommitFrameStatistics	Diagnostic	N
465	CompSurfInfo_ReuseRealization	Diagnostic	N
466	Windowed_Dx_Blt_Consumed	Diagnostic	N
467	Windowed_Dx_Flip_Consumed	Diagnostic	N
468	Dx_Flip_Consumed	Diagnostic	N
469	DELEGATEDINKCANVAS_TIMESTAMPUPDATE	Diagnostic	N
470	DELEGATEDINKCANVAS_CONSUMETIPPOINTS	Diagnostic	N
471	DELEGATEDINKCANVAS_CORRELATIONID	Diagnostic	N
472	CHANNELANIMATIONS_REPEATFOREVER_KEYFRAMEANIMATION	Diagnostic	N
473	CompositionSwapchain_NewFrameStatisticsInstance	Diagnostic	N
474	DCOMPEVENT_BEGIN_DUPLICATE	Diagnostic	Y
475	VISUALTREEREMOTING_SKIP_RENDER_ON_SERVER	Diagnostic	N
476	Dx_DirectFlip_Consumed	Diagnostic	N
477	CompSurfInfo_NotifyWaitForFlipAway	Diagnostic	N
478	FlipAwayFenceCreate	Diagnostic	N
479	FlipAwayFenceDestroy	Diagnostic	N
480	IssuePlaneFlipAwaySignal	Diagnostic	N
481	D2DBitmapFastCrossAdapterCopy	Diagnostic	N

Event ID 1: SCHEDULE_FRAMEINFO

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_FRAMEINFO
Opcode: win:Info

Fields #

Name	Description
`IndexFrame` UInt32
`cFrame` UInt64
`cDXPresent` UInt32
`tFrame` UInt64
`qpcFrame` UInt64
`cSyncRefreshFrame` UInt64
`cRefreshesPerFrame` UInt32
`cRefreshFrame` UInt64
`cRefreshPresent` UInt64
`tPresentAfter` UInt64
`cRefresh` UInt64
`cDXRefresh` UInt32
`tRefresh` UInt64
`qpcRefresh` UInt64
`cRefreshDelta` UInt64
`tBegin` UInt64
`qpcBegin` UInt64
`tEnd` UInt64
`tElapsed` UInt64
`tAvailable` UInt64
`tDelta` UInt64
`tVBlankLatency` UInt64
`fRendered` UInt32
`fPresented` UInt32
`fParallelMode` UInt32
`qpcPresented` UInt64
`fConfirmed` UInt32
`qpcConfirmed` UInt64
`tEarly` UInt64
`tBudget` UInt64
`tGlitch` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 0,
    "keywords": "0x0000000000000002",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "IndexFrame": 4,
    "cDXPresent": 8436,
    "cDXRefresh;": 2138931,
    "cFrame": 0,
    "cRefresh": 2138136,
    "cRefreshDelta": 764,
    "cRefreshFrame": 0,
    "cRefreshPresent": 18446744073709551615,
    "cRefreshesPerFrame": 1,
    "cSyncRefreshFrame": 0,
    "fConfirmed": 0,
    "fParallelMode": 0,
    "fPresented": 0,
    "fRendered": 0,
    "qpcBegin": 334208120885,
    "qpcConfirmed": 0,
    "qpcFrame": 334123281250,
    "qpcPresented": 0,
    "qpcRefresh": 334207968750,
    "tAvailable": 4115,
    "tBegin": 334208120885,
    "tBudget": 0,
    "tDelta": 119375000,
    "tEarly": 0,
    "tElapsed": 18446743739501430731,
    "tEnd": 0,
    "tFrame": 334123281250,
    "tGlitch": 0,
    "tPresentAfter": 334123125000,
    "tRefresh": 334207968750,
    "tVBlankLatency": 152135
  },
  "message": "SCHEDULE_FRAMEINFO"
}

Event ID 2: SCHEDULE_TIME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_TIME
Opcode: win:Info

Fields #

Name	Description
`m_tCurrent` UInt64
`m_tElapsed` UInt64
`m_qpcCurrent` UInt64
`m_qpcLast` UInt64
`m_cFramesRendered` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "m_cFramesRendered": 8516,
    "m_qpcCurrent": 334208124550,
    "m_qpcLast": 334208120885,
    "m_tCurrent": 334208124550,
    "m_tElapsed": 334099241950
  },
  "message": "SCHEDULE_TIME"
}

Event ID 6: SCHEDULE_WFVB

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_WFVB
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 1,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:56.595+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_WFVB"
}

Event ID 7: SCHEDULE_WFVB

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_WFVB
Opcode: Stop

Fields #

Name	Description
`fUseSleep` UInt32
`dwSleep` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 7,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 2,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwSleep": 0,
    "fUseSleep": 0
  },
  "message": "SCHEDULE_WFVB"
}

Event ID 8: SCHEDULE_WFW

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_WFW
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 8,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 1,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_WFW"
}

Event ID 9: SCHEDULE_WFW

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_WFW
Opcode: Stop

Fields #

Name	Description
`returnedWorkType` UInt32
`Work` UInt32
`SurfaceManager` UInt32
`DelayedComposition` UInt32
`Occlusion` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 2,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:56.595+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DelayedComposition": 258,
    "Occlusion": 258,
    "SurfaceManager": 258,
    "Work": 258,
    "returnedWorkType": 0
  },
  "message": "SCHEDULE_WFW"
}

Event ID 10: SCHEDULE_PROCESS_FRAME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_PROCESS_FRAME
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 4,
    "task": 11,
    "opcode": 1,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_PROCESS_FRAME"
}

Event ID 11: SCHEDULE_PROCESS_FRAME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_PROCESS_FRAME
Opcode: win:Info

Fields #

Name	Description
`fRenderTime` UInt32
`fPresented` UInt32
`dwOutstandingPresents` UInt32
`dwMaxOutstandingFrames` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 4,
    "task": 11,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwMaxOutstandingFrames": 0,
    "dwOutstandingPresents": 0,
    "fPresented": 0,
    "fRenderTime": 1
  },
  "message": "SCHEDULE_PROCESS_FRAME"
}

Event ID 12: SCHEDULE_PROCESS_FRAME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_PROCESS_FRAME
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 4,
    "task": 11,
    "opcode": 2,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_PROCESS_FRAME"
}

Event ID 13: SCHEDULE_RENDER

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_RENDER
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 13,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 1,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_RENDER"
}

Event ID 14: SCHEDULE_RENDER

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_RENDER
Opcode: Stop

Fields #

Name	Description
`fPresentNeeded` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 2,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fPresentNeeded": 0
  },
  "message": "SCHEDULE_RENDER"
}

Event ID 15: SCHEDULE_PRESENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_PRESENT
Opcode: Start

Fields #

Name	Description
`tCurrent` UInt64
`tPresent` UInt64
`cRefreshCurrent` UInt64
`cRefreshPresent` UInt64
`fForce` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 13,
    "opcode": 1,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cRefreshCurrent": 2138141,
    "cRefreshPresent": 2138141,
    "fForce": 0,
    "tCurrent": 334208908040,
    "tPresent": 334208750000
  },
  "message": "SCHEDULE_PRESENT"
}

Event ID 16: SCHEDULE_PRESENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_PRESENT
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 13,
    "opcode": 2,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_PRESENT"
}

Event ID 19: SCHEDULE_GETPRESENTSTATS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_GETPRESENTSTATS
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 19,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 1,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_GETPRESENTSTATS"
}

Event ID 21: SCHEDULE_GETPRESENTSTATS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_GETPRESENTSTATS
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 21,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 2,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_GETPRESENTSTATS"
}

Event ID 24: SCHEDULE_GLITCH

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_GLITCH
Opcode: win:Info

Fields #

Name	Description
`cFrame` UInt64
`tVSyncLatency` UInt64
`tElapsed` UInt64
`Induced` Boolean
`qpcPresented` UInt64
`qpcConfirmed` UInt64
`tPresentLatency` UInt64
`qpcFrame` UInt64
`cSyncRefreshFrame` UInt64
`tGlitch` UInt64
`qpcFrequency` UInt64
`qpcPeriod` UInt64
`cMonitors` UInt32
`rgcDXRefresh` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 24,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T04:52:56.807+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Induced": false,
    "cFrame": 2138148,
    "cMonitors": 1,
    "cSyncRefreshFrame": 2138943,
    "qpcConfirmed": 334210000000,
    "qpcFrame": 334209843750,
    "qpcFrequency": 10000000,
    "qpcPeriod": 156250,
    "qpcPresented": 334209849165,
    "rgcDXRefresh": "3FA3200040A32000208624FDB7010000010000000000000040A320000000000080E477D04D00000000000000000000000100000000000000000000000000000005000000B70100005A620200000000008096980000000000060000100401090040FBC7A43A000000C8AB23FDB7010000F520000040A32000B82A49F5F97F0000",
    "tElapsed": 1018,
    "tGlitch": 15625,
    "tPresentLatency": 15083,
    "tVSyncLatency": 15148
  },
  "message": "SCHEDULE_GLITCH"
}

Event ID 25: SCHEDULE_GLITCH_RECOVERY_ATTEMPT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_GLITCH_RECOVERY_ATTEMPT

Fields #

Name	Description
`cRefreshFrame` UInt64

Event ID 26: SCHEDULE_RESETStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_RESET
Opcode: Start

Event ID 27: SCHEDULE_RESETStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_RESET
Opcode: Stop

Event ID 29: ETWGUID_PUSH_INTERNAL_LAYER_EVENTStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_PUSH_INTERNAL_LAYER_EVENT
Opcode: Start

Fields #

Name	Description
`left` UInt32
`top` UInt32
`right` UInt32
`bottom` UInt32

Event ID 30: ETWGUID_PUSH_INTERNAL_LAYER_EVENTStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_PUSH_INTERNAL_LAYER_EVENT
Opcode: Stop

Fields #

Name	Description
`left` UInt32
`top` UInt32
`right` UInt32
`bottom` UInt32

Event ID 31: ETWGUID_POP_INTERNAL_LAYER_EVENTStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_POP_INTERNAL_LAYER_EVENT
Opcode: Start

Event ID 32: ETWGUID_POP_INTERNAL_LAYER_EVENTStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_POP_INTERNAL_LAYER_EVENT
Opcode: Stop

Event ID 33: ETWGUID_BITMAPCOPYEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ETWGUID_BITMAPCOPYEVENT
Opcode: win:Info

Fields #

Name	Description
`width` UInt32
`height` UInt32
`dxgiFormat` UInt32
`pixelSize` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 33,
    "version": 0,
    "level": 4,
    "task": 22,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.854+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dxgiFormat": 88,
    "height": 15,
    "pixelSize": 4,
    "width": 169
  },
  "message": "ETWGUID_BITMAPCOPYEVENT"
}

Event ID 34: ETWGUID_COPYFRONTTOBACKBUFFEREVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Verbose
Task: ETWGUID_COPYFRONTTOBACKBUFFEREVENT
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 34,
    "version": 0,
    "level": 5,
    "task": 23,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.776+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ETWGUID_COPYFRONTTOBACKBUFFEREVENT"
}

Event ID 35: ETWGUID_COPYFRONTTOBACKBUFFEREVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_COPYFRONTTOBACKBUFFEREVENT
Opcode: Stop

Fields #

Name	Description
`invalidRegions` UInt32
`pixelsCopied` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 35,
    "version": 0,
    "level": 5,
    "task": 23,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.776+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "invalidRegions": 2,
    "pixelsCopied": 7032
  },
  "message": "ETWGUID_COPYFRONTTOBACKBUFFEREVENT"
}

Event ID 40: ETWGUID_CLEAREVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_CLEAREVENT
Opcode: Start

Fields #

Name	Description
`left` Float
`top` Float
`right` Float
`bottom` Float

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 40,
    "version": 0,
    "level": 5,
    "task": 27,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.854+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "bottom": 519.0,
    "left": 0.0,
    "right": 993.0,
    "top": 0.0
  },
  "message": "ETWGUID_CLEAREVENT"
}

Event ID 41: ETWGUID_CLEAREVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Verbose
Task: ETWGUID_CLEAREVENT
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 41,
    "version": 0,
    "level": 5,
    "task": 27,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.854+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ETWGUID_CLEAREVENT"
}

Event ID 42: ETWGUID_DIRTYREGIONEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ETWGUID_DIRTYREGIONEVENT
Opcode: win:Info

Fields #

Name	Description
`Id` UInt32
`Z` Int32
`left` Float
`top` Float
`right` Float
`bottom` Float

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 42,
    "version": 0,
    "level": 4,
    "task": 28,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Id": 0,
    "Z": 0,
    "bottom": 85.0,
    "left": 0.0,
    "right": 88.0,
    "top": 0.0
  },
  "message": "ETWGUID_DIRTYREGIONEVENT"
}

Event ID 43: ETWGUID_OCCLUSIONEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ETWGUID_OCCLUSIONEVENT
Opcode: Start

Fields #

Name	Description
`data` UInt64
`Id` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 43,
    "version": 0,
    "level": 4,
    "task": 29,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Id": 0,
    "data": 1887691079424
  },
  "message": "ETWGUID_OCCLUSIONEVENT"
}

Event ID 44: ETWGUID_OCCLUSIONEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_OCCLUSIONEVENT
Opcode: win:Info

Fields #

Name	Description
`Z` Int32
`left` Float
`top` Float
`right` Float
`bottom` Float
`rectType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 44,
    "version": 0,
    "level": 5,
    "task": 29,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Z": 40,
    "bottom": 768.0,
    "left": 0.0,
    "rectType": 0,
    "right": 1024.0,
    "top": 0.0
  },
  "message": "ETWGUID_OCCLUSIONEVENT"
}

Event ID 45: ETWGUID_OCCLUSIONEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ETWGUID_OCCLUSIONEVENT
Opcode: Stop

Fields #

Name	Description
`data` UInt64
`Id` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 45,
    "version": 0,
    "level": 4,
    "task": 29,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Id": 0,
    "data": 1887691079424
  },
  "message": "ETWGUID_OCCLUSIONEVENT"
}

Event ID 46: ETWGUID_DWMUPDATEWINDOW

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ETWGUID_DWMUPDATEWINDOW
Opcode: Info

Fields #

Name	Description
`hWnd` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 46,
    "version": 0,
    "level": 4,
    "task": 30,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "hWnd": 65712,
    "rcDirty": "00000000000000005800000055000000",
    "rcWindow": "00000000000000000004000000030000"
  },
  "message": "ETWGUID_DWMUPDATEWINDOW"
}

Event ID 49: ETWGUID_DRAWEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_DRAWEVENT
Opcode: Start

Fields #

Name	Description
`type` UInt32
`Z` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 49,
    "version": 0,
    "level": 5,
    "task": 32,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Z": 0,
    "type": 16
  },
  "message": "ETWGUID_DRAWEVENT"
}

Event ID 50: ETWGUID_DRAWEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_DRAWEVENT

Fields #

Name	Description
`left` Float
`top` Float
`right` Float
`bottom` Float

Event ID 51: ETWGUID_DRAWEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_DRAWEVENT
Opcode: Stop

Fields #

Name	Description
`type` UInt32
`Z` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 51,
    "version": 0,
    "level": 5,
    "task": 32,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Z": 0,
    "type": 16
  },
  "message": "ETWGUID_DRAWEVENT"
}

Event ID 54: MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT
Opcode: Start

Fields #

Name	Description
`pThis` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 54,
    "version": 0,
    "level": 5,
    "task": 34,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "pThis": 1889737720144
  },
  "message": "MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT"
}

Event ID 55: MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT
Opcode: win:Info

Fields #

Name	Description
`pThis` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 55,
    "version": 0,
    "level": 5,
    "task": 34,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "pThis": 148
  },
  "message": "MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT"
}

Event ID 56: MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT
Opcode: Stop

Fields #

Name	Description
`pThis` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 56,
    "version": 0,
    "level": 5,
    "task": 34,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "pThis": 1889737720144
  },
  "message": "MILEVENT_MEDIA_UCE_PROCESSQUEUEEVENT"
}

Event ID 57: MILEVENT_MEDIA_UCE_PRECOMPUTEEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: MILEVENT_MEDIA_UCE_PRECOMPUTEEVENT
Opcode: Start

Fields #

Name	Description
`pThis` UInt64
`Flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 57,
    "version": 0,
    "level": 4,
    "task": 35,
    "opcode": 1,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Flags": 1,
    "pThis": 1887691079424
  },
  "message": "MILEVENT_MEDIA_UCE_PRECOMPUTEEVENT"
}

Event ID 58: MILEVENT_MEDIA_UCE_PRECOMPUTEEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: MILEVENT_MEDIA_UCE_PRECOMPUTEEVENT
Opcode: Stop

Fields #

Name	Description
`pThis` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 58,
    "version": 0,
    "level": 4,
    "task": 35,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "pThis": 1887691079424
  },
  "message": "MILEVENT_MEDIA_UCE_PRECOMPUTEEVENT"
}

Event ID 59: MILEVENT_MEDIA_UCE_RENDEREVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: MILEVENT_MEDIA_UCE_RENDEREVENT
Opcode: Start

Fields #

Name	Description
`pThis` UInt64
`FullRender` UInt32
`dirtyRegionCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 59,
    "version": 0,
    "level": 4,
    "task": 36,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FullRender": 0,
    "dirtyRegionCount": 1,
    "pThis": 1889737756624
  },
  "message": "MILEVENT_MEDIA_UCE_RENDEREVENT"
}

Event ID 60: MILEVENT_MEDIA_UCE_RENDEREVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: MILEVENT_MEDIA_UCE_RENDEREVENT
Opcode: Stop

Fields #

Name	Description
`pThis` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 60,
    "version": 0,
    "level": 4,
    "task": 36,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "pThis": 1889737756624
  },
  "message": "MILEVENT_MEDIA_UCE_RENDEREVENT"
}

Event ID 61: MILEVENT_MEDIA_UCE_PRESENTEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: MILEVENT_MEDIA_UCE_PRESENTEVENT
Opcode: Start

Fields #

Name	Description
`composition` UInt64
`qpcCurrentTime` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 61,
    "version": 0,
    "level": 4,
    "task": 37,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "composition": 1889737720144,
    "qpcCurrentTime": 334208908063
  },
  "message": "MILEVENT_MEDIA_UCE_PRESENTEVENT"
}

Event ID 62: MILEVENT_MEDIA_UCE_PRESENTEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: MILEVENT_MEDIA_UCE_PRESENTEVENT
Opcode: Stop

Fields #

Name	Description
`composition` UInt64
`qpcCurrentTime` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 62,
    "version": 0,
    "level": 4,
    "task": 37,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "composition": 1889737720144,
    "qpcCurrentTime": 334208910992
  },
  "message": "MILEVENT_MEDIA_UCE_PRESENTEVENT"
}

Event ID 63: MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Verbose
Task: MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 63,
    "version": 0,
    "level": 5,
    "task": 38,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY"
}

Event ID 64: MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY_GetPresentHistory

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY_GetPresentHistory
Opcode: win:Info

Fields #

Name	Description
`hr` UInt32
`cTokenCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 64,
    "version": 0,
    "level": 5,
    "task": 63,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cTokenCount": 0,
    "hr": 0
  },
  "message": "MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY_GetPresentHistory"
}

Event ID 65: MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY
Opcode: Stop

Fields #

Name	Description
`cTotalTokenCount` UInt32
`cIterationCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 65,
    "version": 0,
    "level": 5,
    "task": 38,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cIterationCount": 0,
    "cTotalTokenCount": 0
  },
  "message": "MILEVENT_MEDIA_UCE_PROCESSPRESENTHISTORY"
}

Event ID 66: MILEVENT_MEDIA_UCE_CHECKDEVICESTATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: MILEVENT_MEDIA_UCE_CHECKDEVICESTATE
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 66,
    "version": 0,
    "level": 4,
    "task": 39,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "MILEVENT_MEDIA_UCE_CHECKDEVICESTATE"
}

Event ID 67: MILEVENT_MEDIA_UCE_CHECKDEVICESTATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: MILEVENT_MEDIA_UCE_CHECKDEVICESTATE
Opcode: win:Info

Fields #

Name	Description
`hwnd` UInt64
`hr` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 67,
    "version": 0,
    "level": 4,
    "task": 39,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "hr": 0,
    "hwnd": 0
  },
  "message": "MILEVENT_MEDIA_UCE_CHECKDEVICESTATE"
}

Event ID 68: MILEVENT_MEDIA_UCE_CHECKDEVICESTATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: MILEVENT_MEDIA_UCE_CHECKDEVICESTATE
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 68,
    "version": 0,
    "level": 4,
    "task": 39,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "MILEVENT_MEDIA_UCE_CHECKDEVICESTATE"
}

Event ID 79: SCHEDULE_VBLANK_LOOP

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_VBLANK_LOOP
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 79,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_VBLANK_LOOP"
}

Event ID 80: SCHEDULE_VBLANK_LOOP

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_VBLANK_LOOP
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 80,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_VBLANK_LOOP"
}

Event ID 83: GDISPRITE_LOGICALSURFACE_ASSOCIATION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: GDISPRITE_LOGICALSURFACE_ASSOCIATION
Opcode: win:Info

Fields #

Name	Description
`GdiSpritePointer` UInt64
`logicalSurfaceHandle` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 83,
    "version": 0,
    "level": 4,
    "task": 49,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.650+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "GdiSpritePointer": 1887703088864,
    "logicalSurfaceHandle": 18446744071781358557
  },
  "message": "GDISPRITE_LOGICALSURFACE_ASSOCIATION"
}

Event ID 84: WINDOWNODE_GDISPRITE_ASSOCIATION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: WINDOWNODE_GDISPRITE_ASSOCIATION
Opcode: win:Info

Fields #

Name	Description
`windowHandle` UInt64
`spriteHandle` UInt64
`GdiSpritePointer` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 84,
    "version": 0,
    "level": 4,
    "task": 50,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.775+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "GdiSpritePointer": 1887703088984,
    "spriteHandle": 18446744073374997507,
    "windowHandle": 3081766
  },
  "message": "WINDOWNODE_GDISPRITE_ASSOCIATION"
}

Event ID 85: SCHEDULE_ROUNDTRIPREQUEST_STATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_ROUNDTRIPREQUEST_STATE
Opcode: win:Info

Fields #

Name	Description
`NextState` UInt32
`RequestId` UInt32
`FrameToWaitFor` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 85,
    "version": 0,
    "level": 4,
    "task": 51,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.775+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FrameToWaitFor": 0,
    "NextState": 1,
    "RequestId": 43
  },
  "message": "SCHEDULE_ROUNDTRIPREQUEST_STATE"
}

Event ID 87: SCHEDULE_PRESENTHISTORYTOKEN_GDI

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_PRESENTHISTORYTOKEN_GDI
Opcode: win:Info

Fields #

Name	Description
`hLogicalSurface` UInt64
`hDxSharedSurface` UInt64
`NumRects` UInt32
`DirtyRegions` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 87,
    "version": 0,
    "level": 4,
    "task": 53,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DirtyRegions": "0000000000000000E1030000070200000000000000000000E103000007020000",
    "NumRects": 2,
    "hDxSharedSurface": 1073744962,
    "hLogicalSurface": 18446744071781358557
  },
  "message": "SCHEDULE_PRESENTHISTORYTOKEN_GDI"
}

Event ID 88: SCHEDULE_PRESENTHISTORYTOKEN_GDISYSMEM

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_PRESENTHISTORYTOKEN_GDISYSMEM

Fields #

Name	Description
`hlsurf` UInt64
`uiCookie` UInt64
`dwDirtyFlags` UInt32

Event ID 91: SCHEDULE_PRESENTHISTORYTOKEN_BLT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_PRESENTHISTORYTOKEN_BLT

Fields #

Name	Description
`hLogicalSurface` UInt64
`hDxSharedSurface` UInt64
`EventId` UInt64
`NumRects` UInt32
`DirtyRegions` Int16

Event ID 94: MILEVENT_MEDIA_UCE_PROCESSDEFERREDTOKENSStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MILEVENT_MEDIA_UCE_PROCESSDEFERREDTOKENS
Opcode: Start

Event ID 95: MILEVENT_MEDIA_UCE_PROCESSDEFERREDTOKENSStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MILEVENT_MEDIA_UCE_PROCESSDEFERREDTOKENS
Opcode: Stop

Event ID 96: ETWGUID_MAGNIFIERRENDERTARGET_CAPTUREBITSStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_MAGNIFIERRENDERTARGET_CAPTUREBITS
Opcode: Start

Fields #

Name	Description
`hwndLensContext` UInt64
`UpdateId` UInt64
`OffsetX` Int32
`OffsetY` Int32
`S_11` Float
`S_22` Float
`DX` Float
`DY` Float

Event ID 97: ETWGUID_MAGNIFIERRENDERTARGET_CAPTUREBITSStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_MAGNIFIERRENDERTARGET_CAPTUREBITS
Opcode: Stop

Fields #

Name	Description
`hwndLensContext` UInt64
`UpdateId` UInt64
`hr` UInt32

Event ID 100: BIND_GDISPRITEBITMAP_FIRST_TOKEN

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: BIND_GDISPRITEBITMAP_FIRST_TOKEN

Fields #

Name	Description
`logicalSurfaceImagePointer` UInt64
`hDxSharedSurface` UInt64
`windowNodePointer` UInt64
`windowNodeParentPointer` UInt64
`logicalSurfaceImageLHandle` UInt64

Event ID 110: SCHEDULE_UPDATE_TIMES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_UPDATE_TIMES
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 110,
    "version": 0,
    "level": 4,
    "task": 66,
    "opcode": 1,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_UPDATE_TIMES"
}

Event ID 111: SCHEDULE_UPDATE_TIMES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_UPDATE_TIMES
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 111,
    "version": 0,
    "level": 4,
    "task": 66,
    "opcode": 2,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_UPDATE_TIMES"
}

Event ID 112: UCE_PROCESSANIMATERESOURCES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: UCE_PROCESSANIMATERESOURCES
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 112,
    "version": 0,
    "level": 4,
    "task": 67,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UCE_PROCESSANIMATERESOURCES"
}

Event ID 113: UCE_PROCESSANIMATERESOURCES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: UCE_PROCESSANIMATERESOURCES
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 113,
    "version": 0,
    "level": 4,
    "task": 67,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UCE_PROCESSANIMATERESOURCES"
}

Event ID 114: SCHEDULE_UPDATE_FRAME_INDEXES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_UPDATE_FRAME_INDEXES
Opcode: win:Info

Fields #

Name	Description
`Previous` UInt32
`Current` UInt32
`Confirmed` UInt32
`Presented` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 114,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Confirmed": 3,
    "Current": 5,
    "Presented": 4,
    "Previous": 4
  },
  "message": "SCHEDULE_UPDATE_FRAME_INDEXES"
}

Event ID 133: DCOMPEVENT_RESOURCE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: DCOMPEVENT_RESOURCE
Opcode: win:Info

Fields #

Name	Description
`channelHandle` UInt32
`resourceHandle` UInt32
`resourceInternalHandleAndChannel` UInt64
`resourceType` UInt32
`resourcePointer` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 133,
    "version": 0,
    "level": 5,
    "task": 81,
    "opcode": 0,
    "keywords": "0x0000000000210000",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "channelHandle": 10,
    "resourceHandle": 629,
    "resourceInternalHandleAndChannel": 42949673589,
    "resourcePointer": 1887727284160,
    "resourceType": 205
  },
  "message": "DCOMPEVENT_RESOURCE"
}

Event ID 134: DCOMPEVENT_ANIMATION_INITIAL_VALUE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DCOMPEVENT_ANIMATION_INITIAL_VALUE

Fields #

Name	Description
`animationPointer` UInt64
`resourcePointer` UInt64
`propertyId` UInt32
`initialValue` Float

Event ID 135: DCOMPEVENT_ANIMATION_UPDATE_VALUE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DCOMPEVENT_ANIMATION_UPDATE_VALUE

Fields #

Name	Description
`expectedFramePresentTime` UInt64
`animationPointer` UInt64
`resourcePointer` UInt64
`propertyId` UInt32
`propertyValue` Float

Event ID 136: DCOMPEVENT_END_ANIMATION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DCOMPEVENT_END_ANIMATION

Fields #

Name	Description
`animationPointer` UInt64

Event ID 137: SCHEDULE_NEW_EFFECTIVE_REFRESH_PERIOD_DELTAS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_NEW_EFFECTIVE_REFRESH_PERIOD_DELTAS
Opcode: win:Info

Fields #

Name	Description
`DisplayID` UInt32
`SyncRefreshCountDelta` UInt64
`SyncRefreshCountDeltaExpected` UInt64
`SyncTimeDeltaMS` Float
`SyncPeriodMS` Float

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 137,
    "version": 0,
    "level": 4,
    "task": 85,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DisplayID": 0,
    "SyncPeriodMS": 15.625,
    "SyncRefreshCountDelta": 764,
    "SyncRefreshCountDeltaExpected": 764,
    "SyncTimeDeltaMS": 11937.5
  },
  "message": "SCHEDULE_NEW_EFFECTIVE_REFRESH_PERIOD_DELTAS"
}

Event ID 138: SCHEDULE_NEW_EFFECTIVE_REFRESH_PERIOD

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_NEW_EFFECTIVE_REFRESH_PERIOD
Opcode: win:Info

Fields #

Name	Description
`DisplayID` UInt32
`OldEffectivePeriod` Float
`NewEffectivePeriod` Float

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 138,
    "version": 0,
    "level": 4,
    "task": 86,
    "opcode": 0,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DisplayID": 0,
    "NewEffectivePeriod": 15.625,
    "OldEffectivePeriod": 15.625
  },
  "message": "SCHEDULE_NEW_EFFECTIVE_REFRESH_PERIOD"
}

Event ID 139: SCHEDULE_DXGI_STATUS_OCCLUDED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_DXGI_STATUS_OCCLUDED

Event ID 140: SCHEDULE_DXGI_OCCLUSION_EVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_DXGI_OCCLUSION_EVENT

Event ID 141: SCHEDULE_DXGI_PRESENT_SUCCEEDED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: SCHEDULE_DXGI_PRESENT_SUCCEEDED
Opcode: win:Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 141,
    "version": 0,
    "level": 4,
    "task": 89,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SCHEDULE_DXGI_PRESENT_SUCCEEDED"
}

Event ID 144: ETWGUID_DIRECTFLIP_TRANSITIONEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_DIRECTFLIP_TRANSITIONEVENT

Fields #

Name	Description
`hmon` UInt64
`fDirectFlip` UInt32

Event ID 145: ETWGUID_DIRECTFLIP_PRESENTEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_DIRECTFLIP_PRESENTEVENT

Fields #

Name	Description
`hmon` UInt64

Event ID 146: ETWGUID_DIRECTFLIP_SUPPORTEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_DIRECTFLIP_SUPPORTEVENT

Fields #

Name	Description
`hCompSurf` UInt64
`fSupported` UInt32
`fDirectFlipEnabledSurface` UInt32
`rotation` UInt32
`alphaMode` UInt32
`fStereoContent` UInt32
`fMonitorSpecificContent` UInt32
`surfaceWidth` UInt32
`surfaceHeight` UInt32

Event ID 147: ETWGUID_DIRECTFLIP_PINEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Pinning_CompSurfInfoPin

Fields #

Name	Description
`hCompSurf` UInt64
`cBuffers` UInt64

Event ID 148: ETWGUID_DIRECTFLIP_UNPINEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Pinning_CompSurfInfoUnpin

Fields #

Name	Description
`hCompSurf` UInt64
`cBuffers` UInt64

Event ID 151: ETWGUID_RENDEROPT_DISCARDRESOURCEEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_RENDEROPT_DISCARDRESOURCEEVENT

Fields #

Name	Description
`pResource` UInt64

Event ID 152: ETWGUID_RENDEROPT_TILEABLECOPYEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_RENDEROPT_TILEABLECOPYEVENT

Fields #

Name	Description
`pSrcResource` UInt64
`pDstResource` UInt64
`SrcLeft` Int32
`SrcTop` Int32
`SrcRight` Int32
`SrcBottom` Int32
`DstX` Int32
`DstY` Int32

Event ID 153: OPEN_SHARED_TEXTURE_EVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: OPEN_SHARED_TEXTURE_EVENT
Opcode: Start

Fields #

Name	Description
`dxSharedHandle` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 153,
    "version": 0,
    "level": 5,
    "task": 101,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.650+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dxSharedHandle": 1073744962
  },
  "message": "OPEN_SHARED_TEXTURE_EVENT"
}

Event ID 154: OPEN_SHARED_TEXTURE_EVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Verbose
Task: OPEN_SHARED_TEXTURE_EVENT
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 154,
    "version": 0,
    "level": 5,
    "task": 101,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.650+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "OPEN_SHARED_TEXTURE_EVENT"
}

Event ID 157: PROCESS_COMPOSITION_SURFACE_UPDATE_EVENTStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: PROCESS_COMPOSITION_SURFACE_UPDATE_EVENT
Opcode: Start

Event ID 158: PROCESS_COMPOSITION_SURFACE_UPDATE_EVENTStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: PROCESS_COMPOSITION_SURFACE_UPDATE_EVENT
Opcode: Stop

Event ID 163: ETWGUID_PUSH_EXTERNAL_LAYER_EVENTStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_PUSH_EXTERNAL_LAYER_EVENT
Opcode: Start

Fields #

Name	Description
`left` UInt32
`top` UInt32
`right` UInt32
`bottom` UInt32

Event ID 164: ETWGUID_PUSH_EXTERNAL_LAYER_EVENTStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_PUSH_EXTERNAL_LAYER_EVENT
Opcode: Stop

Fields #

Name	Description
`left` UInt32
`top` UInt32
`right` UInt32
`bottom` UInt32

Event ID 165: ETWGUID_POP_EXTERNAL_LAYER_EVENTStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_POP_EXTERNAL_LAYER_EVENT
Opcode: Start

Event ID 166: ETWGUID_POP_EXTERNAL_LAYER_EVENTStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_POP_EXTERNAL_LAYER_EVENT
Opcode: Stop

Event ID 168: ANIMATION_ANALYSIS_DEBUG_EVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ANIMATION_ANALYSIS_DEBUG_EVENT
Opcode: win:Info

Fields #

Name	Description
`AnimationScenario` UnicodeString
`ReferenceCount` UInt32
`VSyncs` UInt32
`GlitchesRecorded` UInt32
`ScenarioIndex` UInt32
`UniqueKey` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 168,
    "version": 1,
    "level": 5,
    "task": 108,
    "opcode": 0,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T04:52:56.775+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AnimationScenario": "Window Open",
    "GlitchesRecorded": 0,
    "ReferenceCount": 1,
    "ScenarioIndex": 48,
    "UniqueKey": 15060039041628949472,
    "VSyncs": 0
  },
  "message": "ANIMATION_ANALYSIS_DEBUG_EVENT"
}

Event ID 169: SCHEDULE_RENDERTIME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_RENDERTIME
Opcode: win:Info

Fields #

Name	Description
`pFrame` UInt64
`fRenderTime` UInt32
`cFramesOutstanding` UInt32
`cMaxFramesOutstanding` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 169,
    "version": 0,
    "level": 4,
    "task": 109,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cFramesOutstanding": 0,
    "cMaxFramesOutstanding": 0,
    "fRenderTime": 1,
    "pFrame": 1889737671952
  },
  "message": "SCHEDULE_RENDERTIME"
}

Event ID 172: SCHEDULE_GLITCH_DETECTED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_GLITCH_DETECTED

Fields #

Name	Description
`Induced` Boolean

Event ID 173: TOUCH_FIRST_FRAME_EVENT_V1

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: TOUCH_FIRST_FRAME_EVENT

Fields #

Name	Description
`UniqueKey` UInt64
`SurfaceWidth` UInt16
`SurfaceHeight` UInt16
`DwmFrame` UInt64
`MonitorCount` UInt32
`PrimaryAdapterLuid` Int64
`PrimaryAdapterIsWarp` Boolean
`InParallelMode` Boolean
`AppUserModelId` UnicodeString

Event ID 175: TOUCH_LAST_FRAME_EVENT_V3

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: TOUCH_LAST_FRAME_EVENT

Fields #

Name	Description
`UniqueKey` UInt64
`ScenarioPointer` UInt64
`InputType` UInt32
`InteractionType` UInt32
`InteractionContext` UInt32
`SurfaceWidth` UInt16
`SurfaceHeight` UInt16
`ScenarioDurationMs` UInt32
`cFrames` UInt32
`StartFrame` UInt64
`EndFrame` UInt64
`MonitorCount` UInt32
`PrimaryAdapterLuid` GUID
`PrimaryAdapterIsWarp` Boolean
`AppUserModelId` UnicodeString

Event ID 180: ETWGUID_DRAWING_CONTEXT_FRAME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_DRAWING_CONTEXT_FRAME
Opcode: Start

Fields #

Name	Description
`DrawingContext` Pointer
`RenderTarget` Pointer
`RTLeft` Float
`RTTop` Float
`RTRight` Float
`RTBottom` Float
`DeviceTransformLength` UInt8
`DeviceTransform` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 180,
    "version": 0,
    "level": 5,
    "task": 114,
    "opcode": 1,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceTransform": "",
    "DeviceTransformLength": 0,
    "DrawingContext": "0x1B7FD25CFD0",
    "RTBottom": 768.0,
    "RTLeft": 0.0,
    "RTRight": 1024.0,
    "RTTop": 0.0,
    "RenderTarget": "0x1B78325CDA8"
  },
  "message": "ETWGUID_DRAWING_CONTEXT_FRAME"
}

Event ID 181: ETWGUID_DRAWING_CONTEXT_FRAME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Verbose
Task: ETWGUID_DRAWING_CONTEXT_FRAME
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 181,
    "version": 0,
    "level": 5,
    "task": 114,
    "opcode": 2,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ETWGUID_DRAWING_CONTEXT_FRAME"
}

Event ID 182: ETWGUID_DRAWING_CONTEXT_STATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_DRAWING_CONTEXT_STATE
Opcode: win:Info

Fields #

Name	Description
`DrawingContext` Pointer
`Visual` Pointer
`ClipLeft` Float
`ClipTop` Float
`ClipRight` Float
`ClipBottom` Float
`TransformMatrixLength` UInt8
`TransformMatrix` Binary
`AttributedProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 182,
    "version": 0,
    "level": 5,
    "task": 115,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AttributedProcessId": 4304,
    "ClipBottom": 85.0,
    "ClipLeft": 0.0,
    "ClipRight": 88.0,
    "ClipTop": 0.0,
    "DrawingContext": "0x1B7FD25CFD0",
    "TransformMatrix": "0000803F000000000000000000000000000000000000803F000000000000000000000000000000000000803F000000000000000000000000000000000000803F55170000",
    "TransformMatrixLength": 68,
    "Visual": "0x1B783ECE040"
  },
  "message": "ETWGUID_DRAWING_CONTEXT_STATE"
}

Event ID 183: ETWGUID_COMPOSITION_SURFACE_DRAW

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_COMPOSITION_SURFACE_DRAW

Fields #

Name	Description
`Visual` Pointer
`Surface` Pointer
`Source` Pointer
`VisualLeft` Float
`VisualTop` Float
`VisualRight` Float
`VisualBottom` Float

Event ID 185: ETWGUID_CVI_UPDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_CVI_UPDATE
Opcode: win:Info

Fields #

Name	Description
`CVI` Pointer
`SourceVisual` Pointer
`ViewboxLeft` Float
`ViewboxTop` Float
`ViewboxWidth` Float
`ViewboxHeight` Float
`SurfaceWidth` Int32
`SurfaceHeight` Int32
`IsBackdrop` Boolean
`IsVisualSurface` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 185,
    "version": 0,
    "level": 5,
    "task": 118,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.854+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CVI": "0x1B7FF7D6490",
    "IsBackdrop": false,
    "IsVisualSurface": false,
    "SourceVisual": "0x1B783EB08E0",
    "SurfaceHeight": 519,
    "SurfaceWidth": 993,
    "ViewboxHeight": 519.0,
    "ViewboxLeft": 0.0,
    "ViewboxTop": 0.0,
    "ViewboxWidth": 993.0
  },
  "message": "ETWGUID_CVI_UPDATE"
}

Event ID 186: ETWGUID_DIRECTFLIP_CANDIDATERECORDEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_DIRECTFLIP_CANDIDATERECORDEVENT

Fields #

Name	Description
`hCompSurf` UInt64

Event ID 187: ETWGUID_DIRECTFLIP_CANDIDATEOVERWRITEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_DIRECTFLIP_CANDIDATEOVERWRITEVENT

Fields #

Name	Description
`hCompSurf` UInt64
`nodeType` UInt32
`nodeContentType` UInt32
`nodeBoundsLeft` Int32
`nodeBoundsTop` Int32
`nodeBoundsRight` Int32
`nodeBoundsBottom` Int32

Event ID 189: SCHEDULE_TIMEADJUSTED_BETWEENFRAMES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_TIMEADJUSTED_BETWEENFRAMES

Fields #

Name	Description
`qpcDelta` UInt64

Event ID 192: SCHEDULE_CLEAR_D2D_CACHES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_CLEAR_D2D_CACHES
Opcode: Start

Fields #

Name	Description
`PreviousWaitTimeoutMS` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 192,
    "version": 0,
    "level": 4,
    "task": 125,
    "opcode": 1,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PreviousWaitTimeoutMS": 2000
  },
  "message": "SCHEDULE_CLEAR_D2D_CACHES"
}

Event ID 193: SCHEDULE_CLEAR_D2D_CACHES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_CLEAR_D2D_CACHES
Opcode: Stop

Fields #

Name	Description
`fAllCachesReachMinimum` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 193,
    "version": 0,
    "level": 4,
    "task": 125,
    "opcode": 2,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fAllCachesReachMinimum": 0
  },
  "message": "SCHEDULE_CLEAR_D2D_CACHES"
}

Event ID 194: MILEVENT_MEDIA_UCE_PROCESSSURFACEUPDATES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Verbose
Task: MILEVENT_MEDIA_UCE_PROCESSSURFACEUPDATES
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 194,
    "version": 0,
    "level": 5,
    "task": 126,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "MILEVENT_MEDIA_UCE_PROCESSSURFACEUPDATES"
}

Event ID 195: MILEVENT_MEDIA_UCE_PROCESSSURFACEUPDATES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: MILEVENT_MEDIA_UCE_PROCESSSURFACEUPDATES
Opcode: Stop

Fields #

Name	Description
`cTotalTokenCount` UInt32
`cIterationCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 195,
    "version": 0,
    "level": 5,
    "task": 126,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cIterationCount": 0,
    "cTotalTokenCount": 0
  },
  "message": "MILEVENT_MEDIA_UCE_PROCESSSURFACEUPDATES"
}

Event ID 196: SCHEDULE_SURFACEUPDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_SURFACEUPDATE
Opcode: win:Info

Fields #

Name	Description
`luidSurface` FILETIME
`bindId` UInt64
`PresentCount` UInt64
`fenceValue` UInt64
`bDirectFlip` UInt32
`DXGI_ALPHA_MODE` UInt32
`hmonAssociation` UInt64
`bStereoPreferRight` UInt32
`bTemporaryMono` UInt32
`bSwapPool` UInt32
`BufferContentType` UInt32
`bIndependentFlip` UInt32
`uPesentDuration` UInt32
`BufferRealizationType` UInt32
`uRealizationIndex` UInt32
`bEnableScanout` Boolean
`hDxSurface` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 196,
    "version": 0,
    "level": 4,
    "task": 127,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T05:49:35.575+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BufferContentType": 0,
    "BufferRealizationType": 0,
    "DXGI_ALPHA_MODE": 3,
    "PresentCount": 54020,
    "bDirectFlip": 0,
    "bEnableScanout": true,
    "bIndependentFlip": 0,
    "bStereoPreferRight": 0,
    "bSwapPool": 0,
    "bTemporaryMono": 0,
    "bindId": 1,
    "fenceValue": 0,
    "hDxSurface": 0,
    "hmonAssociation": 0,
    "luidSurface": "1601-01-01 00:00:00.572Z",
    "uPesentDuration": 0,
    "uRealizationIndex": 1
  },
  "message": "SCHEDULE_SURFACEUPDATE"
}

Event ID 197: ETWGUID_RENDEROPT_DISCARDVIEWEVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_RENDEROPT_DISCARDVIEWEVENT
Opcode: win:Info

Fields #

Name	Description
`pView` UInt64
`NumRects` UInt32
`FirstRectLeft` Int32
`FirstRectTop` Int32
`FirstRectRight` Int32
`FirstRectBottom` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 197,
    "version": 0,
    "level": 5,
    "task": 128,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FirstRectBottom": 85,
    "FirstRectLeft": 0,
    "FirstRectRight": 88,
    "FirstRectTop": 0,
    "NumRects": 1,
    "pView": 1887695219576
  },
  "message": "ETWGUID_RENDEROPT_DISCARDVIEWEVENT"
}

Event ID 201: SCHEDULE_DERIVEDISPLAYSET

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_DERIVEDISPLAYSET

Fields #

Name	Description
`fSucceeded` UInt32
`nrOfAttempts` UInt32
`driverUpdateStatus` UInt32

Event ID 202: SCHEDULE_RETIREFRAME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_RETIREFRAME
Opcode: win:Info

Fields #

Name	Description
`cFrame` UInt64
`nrOutput` UInt32
`cSyncRefreshRetired` UInt64
`qpcConfirmed` UInt64
`fTimedOut` UInt32
`fParallelMode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 202,
    "version": 0,
    "level": 4,
    "task": 132,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.712+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cFrame": 2138142,
    "cSyncRefreshRetired": 2138937,
    "fParallelMode": 1,
    "fTimedOut": 0,
    "nrOutput": 0,
    "qpcConfirmed": 334208908041
  },
  "message": "SCHEDULE_RETIREFRAME"
}

Event ID 203: SCHEDULE_GETPRESENTSTATS1

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_GETPRESENTSTATS1
Opcode: win:Info

Fields #

Name	Description
`cDisplays` UInt32
`rgDXPresentStats` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 203,
    "version": 0,
    "level": 4,
    "task": 133,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cDisplays": 1,
    "rgDXPresentStats": " \u0000\u00008 \u0000=M\u0000\u0000\u00003 \u0000\u0000\u0000\u0000\u0000XM"
  },
  "message": "SCHEDULE_GETPRESENTSTATS1"
}

Event ID 204: SCHEDULE_PRESENT_STATS_DELTAS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_PRESENT_STATS_DELTAS
Opcode: win:Info

Fields #

Name	Description
`DisplayID` UInt64
`SyncRefreshCountDelta` UInt64
`SyncTimeDeltaMS` Float

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 204,
    "version": 0,
    "level": 4,
    "task": 134,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DisplayID": 1,
    "SyncRefreshCountDelta": 763,
    "SyncTimeDeltaMS": 11921.875
  },
  "message": "SCHEDULE_PRESENT_STATS_DELTAS"
}

Event ID 205: RENDER_CVIPASS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: RENDER_CVIPASS
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 205,
    "version": 0,
    "level": 4,
    "task": 135,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "RENDER_CVIPASS"
}

Event ID 206: RENDER_CVIPASS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: RENDER_CVIPASS
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 206,
    "version": 0,
    "level": 4,
    "task": 135,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "RENDER_CVIPASS"
}

Event ID 208: HIT_TEST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: HIT_TEST
Opcode: Start

Fields #

Name	Description
`X` UInt32
`Y` UInt32
`InputSpaceId` UInt64
`WorkspaceId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 208,
    "version": 0,
    "level": 4,
    "task": 137,
    "opcode": 1,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1768
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "InputSpaceId": 18446744065119617024,
    "WorkspaceId": 0,
    "X": 512,
    "Y": 384
  },
  "message": "HIT_TEST"
}

Event ID 209: HIT_TEST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: HIT_TEST
Opcode: Stop

Fields #

Name	Description
`X` UInt32
`Y` UInt32
`hWnd` Pointer
`inputSinkHandle` Pointer
`inputSinkLuid` UInt64
`_11` Float
`_12` Float
`_13` Float
`_14` Float
`_21` Float
`_22` Float
`_23` Float
`_24` Float
`_31` Float
`_32` Float
`_33` Float
`_34` Float
`_41` Float
`_42` Float
`_43` Float
`_44` Float

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 209,
    "version": 0,
    "level": 4,
    "task": 137,
    "opcode": 2,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1768
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "X": 512,
    "Y": 384,
    "_11": 1.0,
    "_12": 0.0,
    "_13": 0.0,
    "_14": 0.0,
    "_21": 0.0,
    "_22": 1.0,
    "_23": 0.0,
    "_24": 0.0,
    "_31": 0.0,
    "_32": 0.0,
    "_33": 1.0,
    "_34": 0.0,
    "_41": 0.0,
    "_42": 0.0,
    "_43": 0.0,
    "_44": 1.0,
    "hWnd": "0x100B0",
    "inputSinkHandle": "0x0",
    "inputSinkLuid": 0
  },
  "message": "HIT_TEST"
}

Event ID 210: HIT_TEST_TREE_WALK

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: HIT_TEST_TREE_WALK
Opcode: Start

Fields #

Name	Description
`X` UInt32
`Y` UInt32
`RootVisual` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 210,
    "version": 0,
    "level": 4,
    "task": 138,
    "opcode": 1,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1768
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "RootVisual": "0x1B7832814E0",
    "X": 512,
    "Y": 384
  },
  "message": "HIT_TEST_TREE_WALK"
}

Event ID 211: HIT_TEST_TREE_WALK

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: HIT_TEST_TREE_WALK
Opcode: Stop

Fields #

Name	Description
`X` UInt32
`Y` UInt32
`HitTestedVisual` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 211,
    "version": 0,
    "level": 4,
    "task": 138,
    "opcode": 2,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1768
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HitTestedVisual": "0x1B783ECE040",
    "X": 512,
    "Y": 384
  },
  "message": "HIT_TEST_TREE_WALK"
}

Event ID 212: INPUT_SINK

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INPUT_SINK

Fields #

Name	Description
`InteractionPointer` Pointer
`inputSinkHandle` Pointer

Event ID 214: DETECT_TOPLEVELWINDOW_DESTROY

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DETECT_TOPLEVELWINDOW_DESTROY

Fields #

Name	Description
`hWnd` UInt64
`pCollector` UInt64
`nMetaDataCount` UInt64

Event ID 215: OVERLAY_GETCAPS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_GETCAPS

Fields #

Name	Description
`MaxPlanes` UInt32
`OverlayCaps` UInt32

Event ID 216: OVERLAY_RECORDCANDIDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_RECORDCANDIDATE

Fields #

Name	Description
`hCompSurf` UInt64
`SurfaceWidth` Int32
`SurfaceHeight` Int32
`PixelFormat` UInt32
`Flags` UInt32
`SrcRectLeft` Int32
`SrcRectTop` Int32
`SrcRectRight` Int32
`SrcRectBottom` Int32
`DstRectLeft` Int32
`DstRectTop` Int32
`DstRectRight` Int32
`DstRectBottom` Int32
`ClipRectLeft` Int32
`ClipRectTop` Int32
`ClipRectRight` Int32
`ClipRectBottom` Int32
`Rotation` UInt32
`Blend` UInt32
`ColorSpace` UInt32

Event ID 217: OVERLAY_CHECKOCCLUSION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_CHECKOCCLUSION

Fields #

Name	Description
`hCompSurf` UInt64
`fOccluded` Int32

Event ID 218: OVERLAY_CHECKSUPPORTStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_CHECKSUPPORT
Opcode: Start

Fields #

Name	Description
`fHardwareCheck` Int32
`NumPlanes` Int32

Event ID 219: OVERLAY_CHECKSUPPORT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_CHECKSUPPORT

Fields #

Name	Description
`hResource` UInt64
`Flags` UInt32
`SrcRectLeft` Int32
`SrcRectTop` Int32
`SrcRectRight` Int32
`SrcRectBottom` Int32
`DstRectLeft` Int32
`DstRectTop` Int32
`DstRectRight` Int32
`DstRectBottom` Int32
`ClipRectLeft` Int32
`ClipRectTop` Int32
`ClipRectRight` Int32
`ClipRectBottom` Int32
`Rotation` UInt32
`Blend` UInt32
`ColorSpace` UInt32

Event ID 220: OVERLAY_CHECKSUPPORTStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_CHECKSUPPORT
Opcode: Stop

Fields #

Name	Description
`fSupported` Int32

Event ID 221: OVERLAY_CANDIDATECOLLECTION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: OVERLAY_CANDIDATECOLLECTION
Opcode: Start

Fields #

Name	Description
`fOverlayEnabled` Int32
`fHardwareCursorEnabled` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 221,
    "version": 0,
    "level": 5,
    "task": 146,
    "opcode": 1,
    "keywords": "0x0000000000000200",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fHardwareCursorEnabled": 1,
    "fOverlayEnabled": 1
  },
  "message": "OVERLAY_CANDIDATECOLLECTION"
}

Event ID 222: OVERLAY_CANDIDATECOLLECTION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: OVERLAY_CANDIDATECOLLECTION
Opcode: Stop

Fields #

Name	Description
`fNeedFullRender` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 222,
    "version": 0,
    "level": 5,
    "task": 146,
    "opcode": 2,
    "keywords": "0x0000000000000200",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fNeedFullRender": 0
  },
  "message": "OVERLAY_CANDIDATECOLLECTION"
}

Event ID 223: OVERLAY_PRESENTStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_PRESENT
Opcode: Start

Fields #

Name	Description
`cPlanes` Int32

Event ID 224: OVERLAY_PRESENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_PRESENT

Fields #

Name	Description
`hResource` UInt64
`Enabled` UInt32
`PlaneIndex` UInt32
`Flags` UInt32
`SrcRectLeft` Int32
`SrcRectTop` Int32
`SrcRectRight` Int32
`SrcRectBottom` Int32
`DstRectLeft` Int32
`DstRectTop` Int32
`DstRectRight` Int32
`DstRectBottom` Int32
`ClipRectLeft` Int32
`ClipRectTop` Int32
`ClipRectRight` Int32
`ClipRectBottom` Int32
`Rotation` UInt32
`Blend` UInt32
`ColorSpace` UInt32

Event ID 225: OVERLAY_PRESENTStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: OVERLAY_PRESENT
Opcode: Stop

Event ID 230: DETECT_REMOTEAPPMODE_SWITCH

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DETECT_REMOTEAPPMODE_SWITCH

Fields #

Name	Description
`bIsFullScreenRemoting` UInt32
`bIsModeHiDef` UInt32
`IsModeDesktopBitmapRemoting` UInt32

Event ID 231: DETECT_DESKTOP_ENDOFUPDATES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DETECT_DESKTOP_ENDOFUPDATES

Event ID 235: ETWGUID_PRIMITIVE_GROUP_DRAW

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_PRIMITIVE_GROUP_DRAW

Fields #

Name	Description
`Visual` Pointer
`PrimitiveGroup` Pointer
`VisualLeft` Float
`VisualTop` Float
`VisualRight` Float
`VisualBottom` Float

Event ID 236: ETWGUID_D2DLAYERCREATEREASON

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_D2DLAYERCREATEREASON

Fields #

Name	Description
`layerCreateBitFlags` UInt32

Event ID 237: TELEMETRY_ANIMATION_PERFORMANCE_ANALYSIS_EVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: TELEMETRY_ANIMATION_PERFORMANCE_ANALYSIS_EVENT
Opcode: win:Info

Fields #

Name	Description
`cFrameStart` UInt64
`cFrameStop` UInt64
`PercentVsyncsMissed` UInt32
`metrics1` UInt32
`metrics2` UInt32
`AnimationScenario` UnicodeString
`ApplicationId` UnicodeString
`ScenarioIndex` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 237,
    "version": 1,
    "level": 4,
    "task": 157,
    "opcode": 0,
    "keywords": "0x0001000000020000",
    "time_created": "2026-06-02T04:52:57.150+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AnimationScenario": "Window Open",
    "ApplicationId": "",
    "PercentVsyncsMissed": 8,
    "ScenarioIndex": 48,
    "cFrameStart": 2138148,
    "cFrameStop": 2138170,
    "metrics1": 61079575,
    "metrics2": 4158
  },
  "message": "TELEMETRY_ANIMATION_PERFORMANCE_ANALYSIS_EVENT"
}

Event ID 238: ANIMATION_FIRST_FRAME_EVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ANIMATION_FIRST_FRAME_EVENT
Opcode: win:Info

Fields #

Name	Description
`cFrameStart` UInt64
`AnimationScenario` UnicodeString
`cFramesSinceCreate` UInt32
`ScenarioIndex` UInt32
`ScenarioDetailsHash` UInt32
`ScenarioDetails` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 238,
    "version": 0,
    "level": 5,
    "task": 158,
    "opcode": 0,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T04:52:56.775+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AnimationScenario": "Window Open",
    "ScenarioDetails": "{1e7bd553-19dd-45e6-8e20-2d49f1de3c91}",
    "ScenarioDetailsHash": 0,
    "ScenarioIndex": 48,
    "cFrameStart": 2138148,
    "cFramesSinceCreate": 0
  },
  "message": "ANIMATION_FIRST_FRAME_EVENT"
}

Event ID 239: ANIMATION_LAST_FRAME_EVENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ANIMATION_LAST_FRAME_EVENT
Opcode: win:Info

Fields #

Name	Description
`cFrameStart` UInt64
`cFrameStop` UInt64
`PercentVsyncsMissed` UInt32
`VsyncCount` UInt32
`VsyncCadenceInHz` UInt64
`FrameRateInFps` UInt64
`MaxFramePeriodInMS` UInt32
`AnimationScenario` UnicodeString
`ScenarioIndex` UInt32
`MaxVsyncsMissed` UInt32
`TimeToFirstFrameInMS` UInt32
`TimeFromInputToFirstFrameInMS` UInt32
`IntendedDurationInMS` UInt32
`ScenarioDetailsHash` UInt32
`ScenarioDetails` UnicodeString
`ApplicationId` UnicodeString
`FrameGlitchesCount` UInt32
`TotalVsyncsMissed` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 239,
    "version": 0,
    "level": 5,
    "task": 159,
    "opcode": 0,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T04:52:57.150+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AnimationScenario": "Window Open",
    "ApplicationId": "",
    "FrameGlitchesCount": 2,
    "FrameRateInFps": 58,
    "IntendedDurationInMS": 0,
    "MaxFramePeriodInMS": 62,
    "MaxVsyncsMissed": 1,
    "PercentVsyncsMissed": 8,
    "ScenarioDetails": "{1e7bd553-19dd-45e6-8e20-2d49f1de3c91}",
    "ScenarioDetailsHash": 0,
    "ScenarioIndex": 48,
    "TimeFromInputToFirstFrameInMS": 0,
    "TimeToFirstFrameInMS": 32,
    "TotalVsyncsMissed": 2,
    "VsyncCadenceInHz": 64,
    "VsyncCount": 23,
    "cFrameStart": 2138148,
    "cFrameStop": 2138170
  },
  "message": "ANIMATION_LAST_FRAME_EVENT"
}

Event ID 240: TELEMETRY_AGGREGATED_VSYNC_ANALYSIS_EVENT_V2

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: TELEMETRY_AGGREGATED_VSYNC_ANALYSIS_EVENT

Fields #

Name	Description
`AnimationScenario` UnicodeString
`TotalHits` UInt32
`metrics1` UInt32
`metrics2` UInt32
`metrics3` UInt32
`FPS` UInt32

Event ID 246: DEBUG_FRAME_COUNTER_V1

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DEBUG_FRAME_COUNTER

Fields #

Name	Description
`FramePerSecond` UInt32
`CPUTimePerFrame` UInt64

Event ID 247: ETWGUID_SETINDEPENDENTFLIPINFO

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_SETINDEPENDENTFLIPINFO

Fields #

Name	Description
`hCompSurf` UInt64
`bindId` UInt64
`uPlaneIndex` UInt32
`bIndependentFlipEnabled` UInt32
`bNotifySurfaceUpdates` UInt32
`uPresentDuration` UInt32
`confirmedIndependentFlipEntry` UInt32

Event ID 248: ETWGUID_PRIMITIVE_GROUP_SELF_OCCLUSION_INFO

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_PRIMITIVE_GROUP_SELF_OCCLUSION_INFO

Fields #

Name	Description
`PrimitiveGroup` Pointer
`OccluderCommandIndex` UInt32

Event ID 249: INPUT_SINK_TRANSFORM_UPDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INPUT_SINK_TRANSFORM_UPDATE

Fields #

Name	Description
`inputSinkHandle` Pointer
`inputSinkLuid` UInt64
`_11` Float
`_12` Float
`_13` Float
`_14` Float
`_21` Float
`_22` Float
`_23` Float
`_24` Float
`_31` Float
`_32` Float
`_33` Float
`_34` Float
`_41` Float
`_42` Float
`_43` Float
`_44` Float

Event ID 253: ETWGUID_RTCAPTUREStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_RTCAPTURE
Opcode: Start

Event ID 254: ETWGUID_RTCAPTUREStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_RTCAPTURE
Opcode: Stop

Event ID 255: ETWGUID_RTCAPTURE_GETBITS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_RTCAPTURE_GETBITS

Event ID 259: TELEMETRY_ANIMATION_TTFF_ANALYSIS_EVENT_V1

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: TELEMETRY_ANIMATION_TTFF_ANALYSIS_EVENT

Fields #

Name	Description
`TimeToFirstFrameInMs` UInt32
`metrics1` UInt32
`metrics2` UInt32
`AnimationScenario` UnicodeString
`ApplicationId` UnicodeString
`ScenarioIndex` UInt32

Event ID 260: TELEMETRY_AGGREGATED_TTFF_ANALYSIS_EVENT_V1

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: TELEMETRY_AGGREGATED_TTFF_ANALYSIS_EVENT

Fields #

Name	Description
`AnimationScenario` UnicodeString
`TotalHits` UInt32
`metrics1` UInt32
`metrics2` UInt32
`metrics3` UInt32

Event ID 265: DCOMPEVENT_PRIMITIVEGROUP_UPDATE_V1

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DCOMPEVENT_PRIMITIVEGROUP_UPDATE

Fields #

Name	Description
`channelHandle` UInt32
`resourcePointer` UInt64
`resourceHandle` UInt32
`memoryHandle` UInt32

Event ID 266: MANIPULATION_THREAD_STARTUP

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_THREAD_STARTUP

Event ID 267: MANIPULATION_THREAD_CLEANUP

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_THREAD_CLEANUP

Event ID 268: MANIPULATION_FRAME_RECEIVED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_FRAME_RECEIVED

Fields #

Name	Description
`frameId` UInt32
`contactCount` UInt32

Event ID 269: MANIPULATION_FRAME_QUEUED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_FRAME_QUEUED

Fields #

Name	Description
`frameId` UInt32
`contactCount` UInt32

Event ID 270: MANIPULATION_FRAME_DEQUEUED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_FRAME_DEQUEUED

Fields #

Name	Description
`frameId` UInt32
`contactCount` UInt32

Event ID 271: INTERACTION_CREATED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INTERACTION_CREATED

Fields #

Name	Description
`Interaction` Pointer
`Resource` Pointer
`HitTestHandle` UInt32

Event ID 272: INTERACTION_VISUAL_UPDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INTERACTION_VISUAL_UPDATE

Fields #

Name	Description
`Interaction` Pointer
`Visual` Pointer

Event ID 273: INTERACTION_TOUCH_CONFIGURATION_CHANGED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INTERACTION_TOUCH_CONFIGURATION_CHANGED

Fields #

Name	Description
`Interaction` Pointer
`updateType` UInt32
`configurationCount` UInt32
`configurations` UInt8

Event ID 274: INTERACTION_DESTROYED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INTERACTION_DESTROYED

Fields #

Name	Description
`Interaction` Pointer
`Resource` Pointer
`HitTestHandle` UInt32

Event ID 275: MANIPULATION_CONTEXT_CREATED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_CONTEXT_CREATED

Fields #

Name	Description
`manipulationContextPointer` Pointer
`pointerId` UInt32

Event ID 276: MANIPULATION_CONTEXT_DESTROYED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_CONTEXT_DESTROYED

Fields #

Name	Description
`manipulationContextPointer` Pointer
`pointerId` UInt32

Event ID 277: MANIPULATION_CONTEXT_NEW_CONTACT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_CONTEXT_NEW_CONTACT

Fields #

Name	Description
`manipulationContextPointer` Pointer
`pointerId` UInt32

Event ID 278: MANIPULATION_CONTEXT_CONTACT_DEPARTED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_CONTEXT_CONTACT_DEPARTED

Fields #

Name	Description
`manipulationContextPointer` Pointer
`pointerId` UInt32

Event ID 284: ADVANCED_DIRECTFLIP_RECORDCANDIDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ADVANCED_DIRECTFLIP_RECORDCANDIDATE

Fields #

Name	Description
`surfaceLuid` UInt64
`OverdrawRectangleCount` Int32
`OverdrawBoundsLeft` Int32
`OverdrawBoundsTop` Int32
`OverdrawBoundsRight` Int32
`OverdrawBoundsBottom` Int32

Event ID 285: ADVANCED_DIRECTFLIP_CREATERESTOREBUFFER

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ADVANCED_DIRECTFLIP_CREATERESTOREBUFFER

Fields #

Name	Description
`surfaceLuid` UInt64

Event ID 286: ADVANCED_DIRECTFLIP_SAVECONTENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ADVANCED_DIRECTFLIP_SAVECONTENT

Fields #

Name	Description
`surfaceLuid` UInt64
`OverdrawRectangleCount` Int32
`OverdrawBoundsLeft` Int32
`OverdrawBoundsTop` Int32
`OverdrawBoundsRight` Int32
`OverdrawBoundsBottom` Int32

Event ID 287: ADVANCED_DIRECTFLIP_RESTORECONTENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ADVANCED_DIRECTFLIP_RESTORECONTENT

Fields #

Name	Description
`surfaceLuid` UInt64
`RestoreRectangleCount` Int32
`RestoreBoundsLeft` Int32
`RestoreBoundsTop` Int32
`RestoreBoundsRight` Int32
`RestoreBoundsBottom` Int32

Event ID 288: ADVANCED_DIRECTFLIP_CANCEL

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ADVANCED_DIRECTFLIP_CANCEL

Fields #

Name	Description
`surfaceLuid` UInt64
`CancelReason` UInt32

Event ID 289: DISPLAYSURFACE_SWAPCHAINCANDIDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DISPLAYSURFACE_SWAPCHAINCANDIDATE

Fields #

Name	Description
`surfaceLuid` UInt64
`IsDirectFlipCompatible` Int32
`IsAdvancedDirectFlipCompatible` Int32
`IsOverlayCompatible` Int32
`IsOverlayRequired` Int32
`BoundsLeft` Int32
`BoundsTop` Int32
`BoundsRight` Int32
`BoundsBottom` Int32

Event ID 290: DISPLAYSURFACE_REJECTCANDIDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DISPLAYSURFACE_REJECTCANDIDATE

Fields #

Name	Description
`surfaceLuid` UInt64
`RejectReason` UInt32

Event ID 291: DISPLAYSURFACE_CANDIDATEATTRIBUTES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DISPLAYSURFACE_CANDIDATEATTRIBUTES

Fields #

Name	Description
`surfaceLuid` UInt64
`IsDirectFlipCompatible` Int32
`IsAdvancedDirectFlipCompatible` Int32
`IsOverlayCompatible` Int32
`IsOverlayRequired` Int32
`fNoOverlappingContent` Int32
`SurfaceWidth` Int32
`SurfaceHeight` Int32
`PixelFormat` UInt32
`Flags` UInt32
`SrcRectLeft` Int32
`SrcRectTop` Int32
`SrcRectRight` Int32
`SrcRectBottom` Int32
`DstRectLeft` Int32
`DstRectTop` Int32
`DstRectRight` Int32
`DstRectBottom` Int32
`ClipRectLeft` Int32
`ClipRectTop` Int32
`ClipRectRight` Int32
`ClipRectBottom` Int32
`Rotation` UInt32
`Blend` UInt32
`ColorSpace` UInt32

Event ID 292: MANIPULATION_POINTER_BUFFERED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MANIPULATION_POINTER_BUFFERED

Fields #

Name	Description
`frameId` UInt32
`pointerId` UInt32

Event ID 293: ETWGUID_PUBLISH_SEB_NOTIFICATION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_PUBLISH_SEB_NOTIFICATION

Fields #

Name	Description
`Scenario` UnicodeString
`Enable` Boolean
`HDR` Boolean
`NtStatus` UInt32

Event ID 294: MIDMANIPULATION_UPDATE_INTERACTION_ADDITION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MIDMANIPULATION_UPDATE_INTERACTION_ADDITION

Fields #

Name	Description
`Interaction` Pointer
`Visual` Pointer

Event ID 295: MIDMANIPULATION_UPDATE_INTERACTION_REMOVAL

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MIDMANIPULATION_UPDATE_INTERACTION_REMOVAL

Fields #

Name	Description
`Interaction` Pointer
`Visual` Pointer

Event ID 296: MIDMANIPULATION_UPDATE_VISUAL_ADDITION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MIDMANIPULATION_UPDATE_VISUAL_ADDITION

Fields #

Name	Description
`Visual` Pointer

Event ID 297: MIDMANIPULATION_UPDATE_VISUAL_REMOVAL

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MIDMANIPULATION_UPDATE_VISUAL_REMOVAL

Fields #

Name	Description
`Visual` Pointer

Event ID 298: MIDMANIPULATION_UPDATE_VISUAL_PROP

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MIDMANIPULATION_UPDATE_VISUAL_PROP

Fields #

Name	Description
`Visual` Pointer

Event ID 299: MIDMANIPULATION_UPDATE_CAPTURE_CONTACT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MIDMANIPULATION_UPDATE_CAPTURE_CONTACT

Fields #

Name	Description
`Interaction` Pointer
`Visual` Pointer
`pointerId` UInt32

Event ID 300: INTERACTION_TOUCHPAD_CONFIGURATION_CHANGED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INTERACTION_TOUCHPAD_CONFIGURATION_CHANGED

Fields #

Name	Description
`Interaction` Pointer
`updateType` UInt32
`configurationCount` UInt32
`configurations` UInt8

Event ID 301: INTERACTION_PEN_CONFIGURATION_CHANGED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INTERACTION_PEN_CONFIGURATION_CHANGED

Fields #

Name	Description
`Interaction` Pointer
`updateType` UInt32
`configurationCount` UInt32
`configurations` UInt8

Event ID 302: INTERACTION_MOUSE_CONFIGURATION_CHANGED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INTERACTION_MOUSE_CONFIGURATION_CHANGED

Fields #

Name	Description
`Interaction` Pointer
`updateType` UInt32
`configurationCount` UInt32
`configurations` UInt8

Event ID 303: SCHEDULE_FRAME_VSYNCDEADLINES

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULE_FRAME_VSYNCDEADLINES
Opcode: win:Info

Fields #

Name	Description
`cDisplays` UInt32
`rgcDXRefresh` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 303,
    "version": 0,
    "level": 4,
    "task": 219,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cDisplays": 1,
    "rgcDXRefresh": "3 \u00004 \u0000Zb\u0002"
  },
  "message": "SCHEDULE_FRAME_VSYNCDEADLINES"
}

Event ID 304: ETWGUID_PRESENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ETWGUID_PRESENT
Opcode: win:Info

Fields #

Name	Description
`vSyncTarget` UInt32
`bIsFollowUpPresent` UInt32
`flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 304,
    "version": 0,
    "level": 4,
    "task": 220,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "bIsFollowUpPresent": 0,
    "flags": 0,
    "vSyncTarget": 2138938
  },
  "message": "ETWGUID_PRESENT"
}

Event ID 309: SCHEDULE_NEW_NOMINAL_REFRESH_PERIOD

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_NEW_NOMINAL_REFRESH_PERIOD

Fields #

Name	Description
`DisplayID` UInt32
`OldPeriodMS` Float
`NewPeriodMS` Float

Event ID 310: ETWGUID_HW_PROTECTION_TEMPDISABLE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_HW_PROTECTION_TEMPDISABLE

Fields #

Name	Description
`fTemporaryDisable` UInt32

Event ID 311: ENDFRAME_DRAWLIST_BATCH_STATS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ENDFRAME_DRAWLIST_BATCH_STATS
Opcode: win:Info

Fields #

Name	Description
`NoAAFixupVertices` UInt32
`AAFixup2DVertices` UInt32
`AAFixup3DVertices` UInt32
`HWDrawCallsProcessed` UInt32
`WarpDrawCallsProcessed` UInt32
`HwMegaRectsAdded` UInt32
`DrawListBatchesProcessed` UInt32
`DrawListEntriesProcessed` UInt32
`DrawListEntryGroupsProcessed` UInt32
`GroupedDrawListEntriesProcessed` UInt32
`RenderingDrawListEntriesProcessed` UInt32
`StateSettingDrawListEntriesCreated` UInt32
`StateSettingDrawListEntriesOptimizedAway` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 311,
    "version": 0,
    "level": 4,
    "task": 226,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AAFixup2DVertices": 0,
    "AAFixup3DVertices": 0,
    "DrawListBatchesProcessed": 0,
    "DrawListEntriesProcessed": 0,
    "DrawListEntryGroupsProcessed": 0,
    "GroupedDrawListEntriesProcessed": 0,
    "HWDrawCallsProcessed": 0,
    "HwMegaRectsAdded": 0,
    "NoAAFixupVertices": 0,
    "RenderingDrawListEntriesProcessed": 0,
    "StateSettingDrawListEntriesCreated": 0,
    "StateSettingDrawListEntriesOptimizedAway": 0,
    "WarpDrawCallsProcessed": 0
  },
  "message": "ENDFRAME_DRAWLIST_BATCH_STATS"
}

Event ID 313: ENDFRAME_PRIMITIVE_GROUP_STATS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ENDFRAME_PRIMITIVE_GROUP_STATS
Opcode: win:Info

Fields #

Name	Description
`PrimitiveGroupToDrawListGeneratorCreated` UInt32
`PrimitiveGroupToDrawListGeneratorCacheUpdated` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 313,
    "version": 0,
    "level": 4,
    "task": 228,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PrimitiveGroupToDrawListGeneratorCacheUpdated": 0,
    "PrimitiveGroupToDrawListGeneratorCreated": 0
  },
  "message": "ENDFRAME_PRIMITIVE_GROUP_STATS"
}

Event ID 314: ENDFRAME_TESSELLATED_PRIMITIVES_STATS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ENDFRAME_TESSELLATED_PRIMITIVES_STATS
Opcode: win:Info

Fields #

Name	Description
`TessellatedRect_UnClipped` UInt32
`TessellatedRect_AxisAlignedRectClip` UInt32
`TessellatedRect_GeneralClip` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 314,
    "version": 0,
    "level": 4,
    "task": 229,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "TessellatedRect_AxisAlignedRectClip": 0,
    "TessellatedRect_GeneralClip": 0,
    "TessellatedRect_UnClipped": 0
  },
  "message": "ENDFRAME_TESSELLATED_PRIMITIVES_STATS"
}

Event ID 315: ENDFRAME_HW_DRAWLIST_CACHE_STATS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ENDFRAME_HW_DRAWLIST_CACHE_STATS
Opcode: win:Info

Fields #

Name	Description
`HwDrawListCachesInvalidated` UInt32
`HwDrawListCachesUpdated` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 315,
    "version": 0,
    "level": 4,
    "task": 230,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HwDrawListCachesInvalidated": 0,
    "HwDrawListCachesUpdated": 0
  },
  "message": "ENDFRAME_HW_DRAWLIST_CACHE_STATS"
}

Event ID 316: ENDFRAME_WARP_DRAWLIST_CACHE_STATS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ENDFRAME_WARP_DRAWLIST_CACHE_STATS
Opcode: win:Info

Fields #

Name	Description
`WarpDrawListCachesInvalidated` UInt32
`WarpDrawListCachesUpdated` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 316,
    "version": 0,
    "level": 4,
    "task": 231,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "WarpDrawListCachesInvalidated": 0,
    "WarpDrawListCachesUpdated": 0
  },
  "message": "ENDFRAME_WARP_DRAWLIST_CACHE_STATS"
}

Event ID 317: PROCESS_EXPRESSIONS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: PROCESS_EXPRESSIONS
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 317,
    "version": 0,
    "level": 4,
    "task": 232,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "PROCESS_EXPRESSIONS"
}

Event ID 318: PROCESS_EXPRESSIONS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: PROCESS_EXPRESSIONS
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 318,
    "version": 0,
    "level": 4,
    "task": 232,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "PROCESS_EXPRESSIONS"
}

Event ID 319: EXPRESSION_OUTPUTVALUEStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: EXPRESSION_OUTPUTVALUE
Opcode: Start

Fields #

Name	Description
`Resource` Pointer

Event ID 320: EXPRESSION_OUTPUTVALUEStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: EXPRESSION_OUTPUTVALUE
Opcode: Stop

Fields #

Name	Description
`Resource` Pointer

Event ID 321: MIDMANIPULATION_UPDATE_CAPTURE_MANIPULATION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: MIDMANIPULATION_UPDATE_CAPTURE_MANIPULATION

Fields #

Name	Description
`Interaction` Pointer
`Visual` Pointer
`pointerId` UInt32
`pointerTimeStamp` UInt64

Event ID 322: CHANNELANIMATIONS_ACTIVE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CHANNELANIMATIONS_ACTIVE

Fields #

Name	Description
`channelHandle` UInt32
`processId` UInt32
`numberOfDCompAnimationsActive` UInt64
`numberOfWinRTAnimationsActive` UInt64

Event ID 323: CHANNELBATCHES_PROCESSED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: CHANNELBATCHES_PROCESSED
Opcode: win:Info

Fields #

Name	Description
`channelHandle` UInt32
`processId` UInt32
`numberOfBatchesProcessed` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 323,
    "version": 0,
    "level": 4,
    "task": 236,
    "opcode": 0,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "channelHandle": 10,
    "numberOfBatchesProcessed": 3,
    "processId": 1648
  },
  "message": "CHANNELBATCHES_PROCESSED"
}

Event ID 324: ETWGUID_HW_PROTECTED_ENTITY_CHANGE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_HW_PROTECTED_ENTITY_CHANGE

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 333: ETWGUID_VISUAL_RENDERCONTENT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_VISUAL_RENDERCONTENT
Opcode: win:Info

Fields #

Name	Description
`Visual` Pointer
`Left` Float
`Top` Float
`Right` Float
`Bottom` Float
`VisualType` AnsiString
`ContentType` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 333,
    "version": 0,
    "level": 5,
    "task": 243,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Bottom": 768.0,
    "ContentType": "",
    "Left": 0.0,
    "Right": 1024.0,
    "Top": 0.0,
    "Visual": "0x1B783ECE040",
    "VisualType": "Window"
  },
  "message": "ETWGUID_VISUAL_RENDERCONTENT"
}

Event ID 334: ETWGUID_DIRTY_ADDRECT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: ETWGUID_DIRTY_ADDRECT
Opcode: win:Info

Fields #

Name	Description
`Visual` Pointer
`Z` Int32
`left` Float
`top` Float
`right` Float
`bottom` Float

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 334,
    "version": 0,
    "level": 5,
    "task": 244,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T04:52:56.681+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Visual": "0x1B783ECE040",
    "Z": 1,
    "bottom": 85.0,
    "left": 0.0,
    "right": 88.0,
    "top": 0.0
  },
  "message": "ETWGUID_DIRTY_ADDRECT"
}

Event ID 335: ETWGUID_VISUAL_RENDERCONTENT335

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ETWGUID_VISUAL_RENDERCONTENT

Event ID 336: ADVANCED_DIRECTFLIP_NORESTORE_RECORDCANDIDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ADVANCED_DIRECTFLIP_NORESTORE_RECORDCANDIDATE

Fields #

Name	Description
`surfaceLuid` UInt64
`OverdrawRectangleCount` Int32
`OverdrawBoundsLeft` Int32
`OverdrawBoundsTop` Int32
`OverdrawBoundsRight` Int32
`OverdrawBoundsBottom` Int32

Event ID 342: HOLOGRAPHICCLIENT_TEXTUREUPDATECOUNT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HOLOGRAPHICCLIENT_TEXTUREUPDATECOUNT

Fields #

Name	Description
`TotalUpdateCount` UInt64
`SuccessfulUpdateCount` UInt64
`SuccessfulTotalGap` UInt64
`PendingCount` UInt64

Event ID 343: HOLOGRAPHICCLIENT_TEXTUREUPDATEWAITFAILED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HOLOGRAPHICCLIENT_TEXTUREUPDATEWAITFAILED

Fields #

Name	Description
`TotalUpdateCount` UInt64
`SuccessCount` UInt64
`PendingCount` UInt64
`WaitResult` UInt32

Event ID 344: HOLOGRAPHICINTEROPTARGET_RENDER

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HOLOGRAPHICINTEROPTARGET_RENDER

Fields #

Name	Description
`TotalRenderCount` UInt64
`TotalPostCount` UInt64

Event ID 345: HOLOGRAPHICINTEROPTARGET_WAITONINCOMINGFAILED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HOLOGRAPHICINTEROPTARGET_WAITONINCOMINGFAILED

Fields #

Name	Description
`TotalRenderCount` UInt64
`TotalPostCount` UInt64
`WaitIndex` UInt64

Event ID 346: HOLOGRAPHICINTEROPTARGET_SYNCPOSTED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HOLOGRAPHICINTEROPTARGET_SYNCPOSTED

Event ID 347: HOLOGRAPHICINTEROPTARGET_RENDERCOMPLETE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HOLOGRAPHICINTEROPTARGET_RENDERCOMPLETE

Fields #

Name	Description
`TotalRenderCount` UInt64
`TotalPosts` UInt64
`RenderPostGap` UInt64
`PendingImageCount` UInt64

Event ID 348: HOLOGRAPHICINTEROPTARGET_TIMEINQUEUE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HOLOGRAPHICINTEROPTARGET_TIMEINQUEUE

Fields #

Name	Description
`TimeInQueue` Float

Event ID 349: SHADERS_EFFECT_COMPILEStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SHADERS_EFFECT_COMPILE
Opcode: Start

Fields #

Name	Description
`pCompilationTask` Pointer

Event ID 350: SHADERS_EFFECT_COMPILEStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SHADERS_EFFECT_COMPILE
Opcode: Stop

Fields #

Name	Description
`pCompilationTask` Pointer

Event ID 351: SHADERS_D3DSHADER_LINKStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SHADERS_D3DSHADER_LINK
Opcode: Start

Event ID 352: SHADERS_D3DSHADER_LINKStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SHADERS_D3DSHADER_LINK
Opcode: Stop

Event ID 353: SHADERS_D3DSHADER_LINK_INFO

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SHADERS_D3DSHADER_LINK

Fields #

Name	Description
`Info` AnsiString

Event ID 354: SHADERS_D3DSHADER_CREATEStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SHADERS_D3DSHADER_CREATE
Opcode: Start

Fields #

Name	Description
`Type` UInt32

Event ID 355: SHADERS_D3DSHADER_CREATEStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SHADERS_D3DSHADER_CREATE
Opcode: Stop

Fields #

Name	Description
`Type` UInt32

Event ID 356: SHADERS_EFFECT_COMPILE_INFO

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SHADERS_EFFECT_COMPILE

Fields #

Name	Description
`pCompilationTask` Pointer
`SubmitterID` Int32
`GraphNodes` AnsiString
`NodeCount` Int32
`SubgraphCount` Int32
`FoundInCache` Boolean

Event ID 363: COMPUTESCRIBBLE_FRAMESCHEDULED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_FRAMESCHEDULED

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32
`TimeBeforeVBlank` Float

Event ID 364: COMPUTESCRIBBLE_FRAMECOMPLETED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_FRAMECOMPLETED

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 365: COMPUTESCRIBBLE_FRAMEDISPATCHStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_FRAMEDISPATCH
Opcode: Start

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 366: COMPUTESCRIBBLE_FRAMEDISPATCHStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_FRAMEDISPATCH
Opcode: Stop

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 367: COMPUTESCRIBBLE_FRAMEDISPATCHCANCELED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_FRAMEDISPATCHCANCELED

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 368: COMPUTESCRIBBLE_WAKEUPEVENTCREATED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_WAKEUPEVENTCREATED

Fields #

Name	Description
`FrameID` UInt64
`TimeBeforeVBlank` Float

Event ID 371: COMMANDS_COUNT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: COMMANDS_COUNT
Opcode: win:Info

Fields #

Name	Description
`Commands` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 371,
    "version": 0,
    "level": 5,
    "task": 272,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Commands": 14
  },
  "message": "COMMANDS_COUNT"
}

Event ID 373: BRUSH_DRAW

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: BRUSH_DRAW

Fields #

Name	Description
`hresult` UInt32

Event ID 374: BRUSH_DRAW374

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: BRUSH_DRAW

Fields #

Name	Description
`hresult` UInt32

Event ID 375: BRUSH_DRAW375

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: BRUSH_DRAW

Event ID 376: BRUSH_DRAW376

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: BRUSH_DRAW

Fields #

Name	Description
`hresult` UInt32

Event ID 377: COMPUTESCRIBBLE_FRAMEDROPPED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_FRAMEDROPPED

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 378: INTERACTION_MOUSEWHEEL_CONFIGURATION_CHANGED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: INTERACTION_MOUSEWHEEL_CONFIGURATION_CHANGED

Fields #

Name	Description
`Interaction` Pointer
`updateType` UInt32
`configurationCount` UInt32
`configurations` UInt8

Event ID 379: COMPUTESCRIBBLE_PRERENDER

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_PRERENDER

Fields #

Name	Description
`FrameID` UInt64
`FlipCount` UInt32
`LastPresentCount` UInt32
`FrameStatsPresentCount` UInt32
`CurrentSyncRefreshCount` UInt32
`InParallelMode` Boolean

Event ID 380: COMPUTESCRIBBLE_PRESCHEDULE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_PRESCHEDULE

Fields #

Name	Description
`FrameID` UInt64
`FlipCount` UInt32
`LastPresentCount` UInt32
`FrameStatsPresentCount` UInt32
`CurrentSyncRefreshCount` UInt32
`InParallelMode` Boolean

Event ID 381: COMPUTESCRIBBLE_THREADWAKEUP

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_THREADWAKEUP

Fields #

Name	Description
`FenceValue` UInt64

Event ID 382: COMPUTESCRIBBLE_WORKERHANG

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_WORKERHANG

Fields #

Name	Description
`FrameID` UInt64
`TargetSyncCount` UInt32
`LastWakeupSyncCount` UInt32

Event ID 383: COMPUTESCRIBBLE_INCOMPATIBLE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_INCOMPATIBLE

Fields #

Name	Description
`Reason` UInt32

Event ID 385: SCHEDULED_COMPOSITION_REASON

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SCHEDULED_COMPOSITION_REASON
Opcode: win:Info

Fields #

Name	Description
`Reasons` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 385,
    "version": 0,
    "level": 4,
    "task": 283,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Reasons": 4
  },
  "message": "SCHEDULED_COMPOSITION_REASON"
}

Event ID 386: UNPRESENTED_FRAME

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Level: Informational
Task: UNPRESENTED_FRAME
Opcode: win:Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 386,
    "version": 0,
    "level": 4,
    "task": 284,
    "opcode": 0,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UNPRESENTED_FRAME"
}

Event ID 387: PROCESS_ATTRIBUTION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: PROCESS_ATTRIBUTION
Opcode: win:Info

Fields #

Name	Description
`DirtyPropagatedCount` UInt32
`DirtyPropagated` UInt32
`DirtyGeneratedCount` UInt32
`DirtyGenerated` UInt32
`CompositorRenderedCount` UInt32
`CompositorRendered` UInt32
`BatchesProcessedCount` UInt32
`BatchesProcessed` UInt32
`KeyframeAnimationsCalculatedCount` UInt32
`KeyframeAnimationsCalculated` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 387,
    "version": 0,
    "level": 4,
    "task": 285,
    "opcode": 0,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T05:49:35.577+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BatchesProcessed": 0,
    "BatchesProcessedCount": 0,
    "CompositorRendered": 9144,
    "CompositorRenderedCount": 1,
    "DirtyGenerated": 9144,
    "DirtyGeneratedCount": 1168,
    "DirtyPropagated": 780,
    "DirtyPropagatedCount": 3,
    "KeyframeAnimationsCalculatedCount": 0
  },
  "message": "PROCESS_ATTRIBUTION"
}

Event ID 388: COMMAND_PROCESSED_ONBEHALF

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: COMMAND_PROCESSED_ONBEHALF
Opcode: win:Info

Fields #

Name	Description
`ProcessId` UInt32
`CommandId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 388,
    "version": 0,
    "level": 5,
    "task": 286,
    "opcode": 0,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T04:52:56.603+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CommandId": 44,
    "ProcessId": 1648
  },
  "message": "COMMAND_PROCESSED_ONBEHALF"
}

Event ID 389: CHANNEL_OPENED_FOR_PROCESS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CHANNEL_OPENED_FOR_PROCESS

Fields #

Name	Description
`ProcessId` UInt32

Event ID 390: CHANNEL_CLOSED_FOR_PROCESS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CHANNEL_CLOSED_FOR_PROCESS

Fields #

Name	Description
`ProcessId` UInt32

Event ID 391: COMPUTESCRIBBLE_GPUFINISHED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_GPUFINISHED

Fields #

Name	Description
`FrameID` UInt64
`CpuStartTime` UInt64
`GpuEndTime` UInt64
`ElapsedTimeMicroseconds` UInt32

Event ID 392: COMPUTESCRIBBLE_DRAWINFO

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_DRAWINFO

Fields #

Name	Description
`PointerID` UInt32
`FirstFrameID` UInt32
`LastFrameID` UInt32
`BeginQPC` UInt64
`EndQPC` UInt64

Event ID 393: COMPUTESCRIBBLE_TELEMETRYDROPPED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_TELEMETRYDROPPED

Fields #

Name	Description
`FirstPointerFrameID` UInt32
`LastPointerFrameID` UInt32
`RenderStartQPC` UInt64
`RenderStopQPC` UInt64

Event ID 394: P3D_BUILDING_BSPTREEStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: P3D_BUILDING_BSPTREE
Opcode: Start

Event ID 395: P3D_BUILDING_BSPTREEStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: P3D_BUILDING_BSPTREE
Opcode: Stop

Event ID 396: P3D_BUILDING_POLYGONLISTStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: P3D_BUILDING_POLYGONLIST
Opcode: Start

Event ID 397: P3D_BUILDING_POLYGONLISTStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: P3D_BUILDING_POLYGONLIST
Opcode: Stop

Event ID 398: P3D_RENDERINGStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: P3D_RENDERING
Opcode: Start

Event ID 399: P3D_RENDERINGStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: P3D_RENDERING
Opcode: Stop

Event ID 400: DIAGTRACK_TRIGGER

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DIAGTRACK_TRIGGER

Fields #

Name	Description
`TriggerId` UInt64
`Version` UInt32

Event ID 401: COMPUTESCRIBBLE_RENDERBLOCKEDStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_RENDERBLOCKED
Opcode: Start

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 402: COMPUTESCRIBBLE_RENDERBLOCKEDStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_RENDERBLOCKED
Opcode: Stop

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 403: COMPUTESCRIBBLE_SCRIBBLEBLOCKEDStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_SCRIBBLEBLOCKED
Opcode: Start

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 404: COMPUTESCRIBBLE_SCRIBBLEBLOCKEDStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_SCRIBBLEBLOCKED
Opcode: Stop

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 405: DCOMPEVENT_RESOURCE_OPEN

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: DCOMPEVENT_COMPLETE_DUPLICATE
Opcode: win:Info

Fields #

Name	Description
`targetChannelHandle` UInt32
`targetResourceHandle` UInt32
`targetInternalHandleAndChannel` UInt64
`resourceType` UInt32
`resourcePointer` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 405,
    "version": 0,
    "level": 5,
    "task": 298,
    "opcode": 0,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T04:52:56.650+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "resourcePointer": 1887703860784,
    "resourceType": 196,
    "sourceChannelHandle": 1,
    "sourceInternalHandleAndChannel": 4294967370,
    "sourceResourceHandle": 74,
    "targetChannelHandle": 10,
    "targetInternalHandleAndChannel": 42949673591,
    "targetResourceHandle": 631
  },
  "message": "DCOMPEVENT_RESOURCE_OPEN"
}

Event ID 406: VISUAL_SET_INTERACTION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: VISUAL_SET_INTERACTION

Fields #

Name	Description
`Channel` UInt32
`visualHandle` UInt32
`interactionHandle` UInt32
`visualInternalHandleAndChannel` UInt64
`interactionInternalHandleAndChannel` UInt64
`resourcePointer` Pointer
`interactionPointer` Pointer

Event ID 409: HWDEVICEStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HWDEVICE
Opcode: Start

Fields #

Name	Description
`CD3DDeviceLevel1` Pointer
`FeatureLevel` UInt32
`AdapterLuid` UInt8
`AdapterDescription` UnicodeString

Event ID 410: HWDEVICEStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: HWDEVICE
Opcode: Stop

Fields #

Name	Description
`CD3DDeviceLevel1` Pointer

Event ID 411: COMPUTESCRIBBLE_EARLYCOPY

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_EARLYCOPY

Fields #

Name	Description
`FrameId` UInt64
`BackBufferIndex` UInt32

Event ID 412: COMPUTESCRIBBLE_ACTIVEStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_ACTIVE
Opcode: Start

Fields #

Name	Description
`FrameId` UInt64

Event ID 413: COMPUTESCRIBBLE_ACTIVEStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_ACTIVE
Opcode: Stop

Fields #

Name	Description
`FrameId` UInt64

Event ID 414: LEGACYSWAPCHAIN_BUFFERFLIP

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: LEGACYSWAPCHAIN_BUFFERFLIP
Opcode: win:Info

Fields #

Name	Description
`NewBackBufferIndex` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 414,
    "version": 0,
    "level": 4,
    "task": 304,
    "opcode": 0,
    "keywords": "0x0000000000000040",
    "time_created": "2026-06-02T04:52:56.682+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "NewBackBufferIndex": 0
  },
  "message": "LEGACYSWAPCHAIN_BUFFERFLIP"
}

Event ID 415: REGISTER_VAIL_STROKE_ON_HOST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: REGISTER_VAIL_STROKE_ON_HOST

Fields #

Name	Description
`StrokeId` Pointer
`HWND` UInt64

Event ID 416: UNREGISTER_VAIL_STROKE_ON_HOST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: UNREGISTER_VAIL_STROKE_ON_HOST

Fields #

Name	Description
`StrokeId` Pointer
`HWND` UInt64

Event ID 417: ENQUEUE_SCRIBBLE_ON_HOST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: ENQUEUE_SCRIBBLE_ON_HOST

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64
`StartTipPointId` UInt32
`TranslatePointsToRenderTargetOrigin` Boolean
`SerializedStrokeSize` UInt32

Event ID 418: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64

Event ID 419: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_REUSE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_REUSE

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64

Event ID 420: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_NEW_FROM_GUEST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_NEW_FROM_GUEST

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64

Event ID 421: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_FOUND_ON_NEW

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_FOUND_ON_NEW

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64

Event ID 422: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_USE_FIRST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_USE_FIRST

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64

Event ID 423: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_NOT_FOUND_REUSE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_NOT_FOUND_REUSE

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64

Event ID 424: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_CLEANUP

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_CLEANUP

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64

Event ID 425: SYNCHRONOUSSUPERWETINK_CREATED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_CREATED

Fields #

Name	Description
`StrokeId` Pointer

Event ID 426: SYNCHRONOUSSUPERWETINK_SUCCESSFULLY_REGISTERED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_SUCCESSFULLY_REGISTERED

Fields #

Name	Description
`StrokeId` Pointer
`CompositionSurfaceBitmapId` Pointer

Event ID 427: SYNCHRONOUSSUPERWETINK_DESTROYED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_DESTROYED

Fields #

Name	Description
`StrokeId` Pointer

Event ID 428: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_DROPED_FROM_GUEST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_DROPED_FROM_GUEST

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64
`IsCurrentOrIncomming` Boolean
`IsBeginStroke` Boolean
`IsValid` Boolean

Event ID 429: CUSTOMDURATION_REJECT_MONITORCONFIGURATION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CustomDurationRejectMonitorConfiguration

Fields #

Name	Description
`SingleMonitor` Boolean
`OverlayPlaneCount` UInt8

Event ID 430: CUSTOMDURATION_REJECT_PLANEFULLSCREENTEST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CustomDurationRejectPlaneFullscreenTest

Fields #

Name	Description
`planeClipLeft` UInt32
`planeClipTop` UInt32
`planeClipRight` UInt32
`planeClipBottom` UInt32

Event ID 431: CUSTOMDURATION_REJECT_DESKTOPPLANEENABLEDTEST

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CustomDurationRejectDesktopPlaneEnabledTest

Event ID 432: CUSTOMDURATION_PERIOD_CHECKDRIVERSUPPORT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CustomDurationComputeSupportedDuration

Fields #

Name	Description
`requestedDuration` UInt32
`durationTolerance` UInt32
`approvedDuration` UInt32

Event ID 433: CUSTOMDURATION_PERIOD_UTILIZECACHEDDURATION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CustomDurationUseCachedDuration

Fields #

Name	Description
`requestedDuration` UInt32
`durationTolerance` UInt32
`approvedDuration` UInt32

Event ID 434: COMPUTESCRIBBLE_FENCEWAIT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_FENCEWAIT

Fields #

Name	Description
`BufferId` UInt32
`Value` UInt64

Event ID 435: COMPUTESCRIBBLE_FENCESIGNAL

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_FENCESIGNAL

Fields #

Name	Description
`BufferId` UInt32
`Value` UInt64

Event ID 436: COMPUTESCRIBBLE_POSTRENDER

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_POSTRENDER

Fields #

Name	Description
`FrameID` UInt64
`Framebuffer` UInt32

Event ID 437: COMPUTESCRIBBLE_WAKEUPEVENTREADY

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_WAKEUPEVENTREADY

Fields #

Name	Description
`TargetRefreshSyncCount` UInt64

Event ID 438: COMPUTESCRIBBLE_BUFFERDECISION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_BUFFERDECISION

Fields #

Name	Description
`BackbufferIndex` UInt32
`DispatchedBuffer` UInt32
`ScheduledBuffer` UInt32
`FrontbufferOffset` Float
`FrontbufferWakeupTime` Float

Event ID 439: COMPUTESCRIBBLE_SOURCEACTIVE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_SOURCEACTIVE

Fields #

Name	Description
`NewSource` Pointer
`OldSource` Pointer

Event ID 440: COMPUTESCRIBBLE_DROPSOURCE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_DROPSOURCE

Fields #

Name	Description
`SourceDropped` Pointer

Event ID 441: COMPUTESCRIBBLE_SOURCEUPDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_SOURCEUPDATE

Fields #

Name	Description
`Source` Pointer
`FrameId` UInt64
`IsBeginStroke` Boolean

Event ID 442: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_NON_EXACT

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SYNCHRONOUSSUPERWETINK_LOOKUPPERFRAMEDATA_FILLED_NON_EXACT

Fields #

Name	Description
`StrokeId` Pointer
`PresentCallCount` UInt64

Event ID 443: COMPUTESCRIBBLE_THREADWAKEUP_RAW

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_THREADWAKEUP_RAW

Event ID 444: COMPUTESCRIBBLE_DRAWSKIPPED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_DRAWSKIPPED

Fields #

Name	Description
`SuperWetSource` Pointer

Event ID 445: COMPUTESCRIBBLE_DRAWASWETINKStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_DRAWASWETINK
Opcode: Start

Event ID 446: COMPUTESCRIBBLE_DRAWASWETINKStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: COMPUTESCRIBBLE_DRAWASWETINK
Opcode: Stop

Fields #

Name	Description
`DirtyRectLeft` Float
`DirtyRectTop` Float
`DirtyRectRight` Float
`DirtyRectBottom` Float

Event ID 447: SCHEDULE_VSYNC_QPC_SMOOTHING

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_VSYNC_QPC_SMOOTHING

Fields #

Name	Description
`refreshCount` UInt64
`reportedTimeHns` UInt64
`smoothedTimeHns` UInt64
`differenceTimeHns` Int64
`averageTimeHns` Int64
`numDataPoints` Int32

Event ID 448: SCHEDULE_VSYNC_QPC_SMOOTHING_RESET

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_VSYNC_QPC_SMOOTHING_RESET

Event ID 449: SCHEDULE_VSYNC_QPC_SMOOTHING_UPDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: SCHEDULE_VSYNC_QPC_SMOOTHING_UPDATE

Fields #

Name	Description
`refreshCount` UInt64
`qpcTime` UInt64

Event ID 450: RENDERTARGET_RENDERSKIPPED

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: RENDERTARGET_RENDERSKIPPED

Fields #

Name	Description
`outstandingPresents` UInt32

Event ID 451: CurrentFrameId

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: CurrentFrameId
Opcode: win:Info

Fields #

Name	Description
`FrameId` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 451,
    "version": 0,
    "level": 4,
    "task": 340,
    "opcode": 0,
    "keywords": "0x0000000000000009",
    "time_created": "2026-06-02T05:49:35.551+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FrameId": 392747
  },
  "message": "CurrentFrameId"
}

Event ID 452: Pinning_AdvanceUnpin

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Pinning_AdvanceUnpin

Fields #

Name	Description
`displayAdapterLuid` UInt64
`VidPnSourceId` UInt32
`ForceUnpin` Boolean

Event ID 453: Pinning_D3DPinStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Pinning_D3DPin
Opcode: Start

Fields #

Name	Description
`BufferCount` UInt32

Event ID 454: Pinning_D3DPinStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Pinning_D3DPin
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 455: Pinning_D3DUnpinStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Pinning_D3DUnpin
Opcode: Start

Fields #

Name	Description
`BufferCount` UInt32

Event ID 456: Pinning_D3DUnpinStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Pinning_D3DUnpin
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 457: Pinning_OutstandingUnpinCount

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Pinning_OutstandingUnpinCount

Fields #

Name	Description
`surfaceLuid` UInt64
`count` UInt32

Event ID 458: CompSurfInfo_BindingStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompSurfInfo_Binding
Opcode: Start

Fields #

Name	Description
`surfaceLuid` UInt64
`bindId` UInt64

Event ID 459: CompSurfInfo_BindingStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompSurfInfo_Binding
Opcode: Stop

Fields #

Name	Description
`BindingType` UInt32
`BufferCount` UInt32
`homogeneous` Boolean

Event ID 460: CompSurfInfo_ForceUpdateRealizationStart

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompSurfInfo_ForceUpdateRealization
Opcode: Start

Fields #

Name	Description
`surfaceLuid` UInt64
`bindId` UInt64
`flipIndex` UInt32

Event ID 461: CompSurfInfo_ForceUpdateRealizationStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompSurfInfo_ForceUpdateRealization
Opcode: Stop

Fields #

Name	Description
`applied` Boolean

Event ID 462: CustomDurationIterationResultStop

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CustomDurationIterationResult
Opcode: Stop

Fields #

Name	Description
`IterationDuration` UInt32
`AcceptableError` UInt32
`ClosestSmallerDuration` UInt32
`ClosestLargerDuration` UInt32

Event ID 463: CompSurfInfo_ScanoutIncompatible

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompSurfInfo_ScanoutIncompatible

Fields #

Name	Description
`Reason` UInt32

Event ID 464: CompositionSwapchain_CommitFrameStatistics

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompositionSwapchain_CommitFrameStatistics

Fields #

Name	Description
`flipConsumer` Pointer
`contentId` UInt64
`CompositionFrameId` UInt64
`PresentId` UInt64
`NumComposedInstances` UInt32
`NumOverlayInstances` UInt32
`NumOffscreenInstances` UInt32

Event ID 465: CompSurfInfo_ReuseRealization

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompSurfInfo_ReuseRealization

Fields #

Name	Description
`UniqueId` UInt64

Event ID 466: Windowed_Dx_Blt_Consumed

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Windowed_Dx_Blt_Consumed

Fields #

Name	Description
`hWnd` UInt64
`displayAdapterLuid` UInt64
`renderAdapterLuid` UInt64
`vidPnSourceId` UInt32
`vidPnTargetId` UInt32
`uniqueId` UInt32
`bltRect` Int32

Event ID 467: Windowed_Dx_Flip_Consumed

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Windowed_Dx_Flip_Consumed

Fields #

Name	Description
`hWnd` UInt64
`displayAdapterLuid` UInt64
`renderAdapterLuid` UInt64
`vidPnSourceId` UInt32
`vidPnTargetId` UInt32
`uniqueId` UInt32
`surfaceLuid` UInt64
`bindId` UInt64
`presentCount` UInt32
`flipRect` UInt64

Event ID 468: Dx_Flip_Consumed

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Dx_Flip_Consumed

Fields #

Name	Description
`displayAdapterLuid` UInt64
`renderAdapterLuid` UInt64
`vidPnSourceId` UInt32
`vidPnTargetId` UInt32
`uniqueId` UInt32
`surfaceLuid` UInt64
`bindId` UInt64
`presentCount` UInt32
`flipRect` Int64

Event ID 469: DELEGATEDINKCANVAS_TIMESTAMPUPDATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DELEGATEDINKCANVAS_TIMESTAMPUPDATE

Fields #

Name	Description
`Timestamp` UInt64

Event ID 470: DELEGATEDINKCANVAS_CONSUMETIPPOINTS

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DELEGATEDINKCANVAS_CONSUMETIPPOINTS

Fields #

Name	Description
`Timestamp` UInt64
`NumberOfPointsPulled` UInt64

Event ID 471: DELEGATEDINKCANVAS_CORRELATIONID

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: DELEGATEDINKCANVAS_CORRELATIONID

Fields #

Name	Description
`CorrelationId` UInt64

Event ID 472: CHANNELANIMATIONS_REPEATFOREVER_KEYFRAMEANIMATION

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CHANNELANIMATIONS_REPEATFOREVER_KEYFRAMEANIMATION

Fields #

Name	Description
`channelHandle` UInt32
`processId` UInt32
`KeyframeAnimation` Pointer
`DurationMs` UInt32

Event ID 473: CompositionSwapchain_NewFrameStatisticsInstance

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompositionSwapchain_NewFrameStatisticsInstance

Fields #

Name	Description
`flipConsumer` Pointer
`contentId` UInt64
`CompositionFrameId` UInt64
`PresentId` UInt64
`InstanceType` UInt32

Event ID 474: DCOMPEVENT_BEGIN_DUPLICATE

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Verbose
Task: DCOMPEVENT_BEGIN_DUPLICATE
Opcode: win:Info

Fields #

Name	Description
`sourceChannel` UInt32
`sourceResource` UInt32
`destChannel` UInt32
`resourceType` UInt32
`sourceResourcePointer` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Core",
    "guid": "{9E9BBA3C-2E38-40CB-99F4-9E8281425164}",
    "event_source_name": "",
    "event_id": 474,
    "version": 0,
    "level": 5,
    "task": 298,
    "opcode": 0,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T05:49:35.767+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "destChannel": 3,
    "resourceType": 182,
    "sourceChannel": 1,
    "sourceResource": 76,
    "sourceResourcePointer": 1886866450032
  },
  "message": "DCOMPEVENT_BEGIN_DUPLICATE"
}

Event ID 475: VISUALTREEREMOTING_SKIP_RENDER_ON_SERVER

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: VISUALTREEREMOTING_SKIP_RENDER_ON_SERVER

Event ID 476: Dx_DirectFlip_Consumed

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: Dx_DirectFlip_Consumed

Fields #

Name	Description
`displayAdapterLuid` UInt64
`renderAdapterLuid` UInt64
`vidPnSourceId` UInt32
`vidPnTargetId` UInt32
`uniqueId` UInt32
`surfaceLuid` UInt64
`bindId` UInt64
`presentCount` UInt32
`DirectFlipMode` UInt32
`presentFlags` UInt32
`syncInterval` UInt32

Event ID 477: CompSurfInfo_NotifyWaitForFlipAway

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: CompSurfInfo_NotifyWaitForFlipAway

Fields #

Name	Description
`surfaceLuid` UInt64

Event ID 478: FlipAwayFenceCreate

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: FlipAwayFenceCreate

Fields #

Name	Description
`fenceId` UInt64
`displayAdapterLuid` UInt64
`vidPnSourceId` UInt32
`planeIndex` UInt32

Event ID 479: FlipAwayFenceDestroy

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: FlipAwayFenceDestroy

Fields #

Name	Description
`fenceId` UInt64

Event ID 480: IssuePlaneFlipAwaySignal

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: IssuePlaneFlipAwaySignal

Fields #

Name	Description
`planeIndex` UInt32
`fenceId` UInt64
`signalValue` UInt64

Event ID 481: D2DBitmapFastCrossAdapterCopy

Provider: Microsoft-Windows-Dwm-Core
Channel: Diagnostic
Task: D2DBitmapFastCrossAdapterCopy

Fields #

Name	Description
`UpdateLeft` UInt32
`UpdateTop` UInt32
`UpdateRight` UInt32
`UpdateBottom` UInt32
`sourceAdapterLuid` UInt64
`destAdapterLuid` UInt64

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {9E9BBA3C-2E38-40CB-99F4-9E8281425164}

Defined in dwmcore.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.2849, captured 2026-06-02
Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.5074, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)