Microsoft-Windows-FailoverClustering-ClusBflt-Diagnostic

Event	Title	Channel	Sample	Rule
1	Event ID 1	Operational	N	N
1	Disk DeviceId has arrived.	Operational	Y	N
2	Event ID 2	Operational	N	N
2	Disk DeviceId is claimed by clusbflt.	Operational	N	N
3	Event ID 3	Operational	N	N
3	Disk DeviceId is not claimed by clusbflt, Status Status.	Operational	Y	N
8	Event ID 8	Operational	N	N
8	Disk DeviceId was removed.	Operational	N	N
51	Event ID 51	Operational	N	N
51	Enclosure arrived	Operational	N	N
52	Event ID 52	Operational	N	N
52	Enclosure removed	Operational	N	N
101	Event ID 101	Operational	N	N
101	Path PathId (attributes=Attributes, type=PathType) was created for device …	Operational	Y	N
102	Event ID 102	Operational	N	N
102	Path PathId (attributes=Attributes, type=PathType) was removed for device …	Operational	N	N
103	Event ID 103	Operational	N	N
103	Path PathId (attributes=Attributes, down path=DownPathId) was paused for device …	Operational	N	N
104	Event ID 104	Operational	N	N
104	Path PathId (attributes=Attributes, down path=DownPathId) was resumed for device …	Operational	N	N
105	Event ID 105	Operational	N	N
105	Path PathId (attributes=Attributes, down path=DownPathId) was resumed on timeout …	Operational	N	N
151	Event ID 151	Operational	N	N
151	Received request to update membership to Membership, flags = Flags.	Connectivity	N	N
152	Event ID 152	Operational	N	N
152	Completed request to update membership to Membership, flags = Flags, status …	Connectivity	N	N
153	Event ID 153	Operational	N	N
153	Completed request to set registration key to RegistrationKey, status Status.	Connectivity	N	N
154	Event ID 154	Operational	N	N
154	Client cluster with Id ClusterId and instance id InstanceId registered.	Connectivity	N	N
155	Event ID 155	Operational	N	N
155	Client cluster with Id ClusterId and instance id InstanceId unregistered on …	Connectivity	N	N
156	Event ID 156	Operational	N	N
156	Client cluster with Id ClusterId and instance id InstanceId unregistered because …	Connectivity	N	N
157	Event ID 157	Operational	N	N
157	Received client cluster membership update from node id NodeId.	Connectivity	N	N
158	Event ID 158	Operational	N	N
158	Applied client cluster membership update from node id NodeId.	Connectivity	N	N
159	Event ID 159	Operational	N	N
159	Target create for cluster node id NodeId for path PathId with cluster Id …	Connectivity	Y	N
160	Event ID 160	Operational	N	N
160	Target create request rejected from cluster node id NodeId for path PathId with …	Connectivity	N	N
201	Event ID 201	Operational	N	N
201	Node NodeId connected to path PathId device DeviceId.	Connectivity	N	N
202	Event ID 202	Operational	N	N
202	Node NodeId disconnected from path PathId device DeviceId.	Connectivity	N	N
251	Event ID 251	Operational	N	N
251	Remove all partitions from device DeviceGuid (DeviceId), Status=Status.	Operational	N	N
252	Event ID 252	Operational	N	N
252	Trim device DeviceGuid (DeviceId), Status=Status.	Operational	N	N
253	Event ID 253	Operational	N	N
253	Create Hdd Cache partition on device DeviceGuid (DeviceId), Status=Status.	Operational	N	N
254	Event ID 254	Operational	N	N
254	Initialize Hdd Cache partition on device DeviceGuid (DeviceId), Status=Status.	Operational	N	N
255	Event ID 255	Operational	N	N
255	Initialize Ssd Cache Store partition on device DeviceGuid (DeviceId), …	Operational	N	N
256	Event ID 256	Operational	N	N
256	Create Ssd Cache Store partition on device DeviceGuid (DeviceId), Reserve …	Operational	N	N
257	Event ID 257	Operational	N	N
257	Bind Hdd device DeviceGuid (DeviceId) to Cache Store Partition …	Operational	N	N
258	Event ID 258	Operational	N	N
258	UnBind Hdd device DeviceGuid (DeviceId), Options Options, …	Operational	N	N
259	Event ID 259	Operational	N	N
259	Disable Binding on Sdd device DeviceGuid (DeviceId), Partition Id …	Operational	N	N
260	Event ID 260	Operational	N	N
260	Set Binding Attributes on device DeviceGuid (DeviceId), Partition Id …	Operational	N	N
261	Event ID 261	Operational	N	N
261	Disabled Read and Write Cache on Ssd Cache Store partition on device DeviceGuid …	Operational	N	N
301	Event ID 301	Operational	N	N
301	Runtime error in Function@LineNumber, Status=Status.	Operational	Y	N
351	Event ID 351	Operational	N	N
351	Starting to load Cache Store on device DeviceGuid (DeviceId), PartitionId …	Operational	N	N
352	Event ID 352	Operational	N	N
352	Loaded Cache Store on device DeviceGuid (DeviceId), PartitionId …	Operational	N	N
353	Event ID 353	Operational	N	N
353	Failed to load Cache Store on device DeviceGuid (DeviceId), PartitionId …	Operational	N	N
401	Event ID 401	Operational	N	N
401	Data mismatch detected at bottom layer.	Operational	N	N
402	Event ID 402	Operational	N	N
402	Data mismatch detected at top layer.	Operational	N	N
403	Event ID 403	Operational	N	N
403	Data mismatch detected at standby.	Operational	N	N
404	Event ID 404	Operational	N	N
404	Bad IO completion at bottom layer.	Operational	N	N
405	Event ID 405	Operational	N	N
405	Bad IO completion at top layer.	Operational	N	N
406	Event ID 406	Operational	N	N
406	Overlapping IOs detected	Operational	N	N
407	Event ID 407	Operational	N	N
407	Prohibited IOCTL was rejected.	Operational	N	N

Event ID 1

Channel: Operational
Task: DiskActivity

Description

Disk has arrived.

Fields #

Name	Description
`DeviceId` Int32

Event ID 1: Disk DeviceId has arrived.

Channel: Operational
Level: Informational
Task: DiskActivity

Message #

Disk %1 has arrived

Fields #

Name	Description
`DeviceId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-ClusBflt-Diagnostic",
    "guid": "{923BCB94-58D2-42BE-BBA9-B1315F363838}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T03:12:00.2164233+00:00",
    "event_record_id": 5,
    "correlation": {
      "ActivityID": "{14429F51-EFE2-000A-529F-4214E2EFDC01}"
    },
    "execution": {
      "process_id": 4,
      "thread_id": 440
    },
    "channel": "Microsoft-Windows-FailoverClustering-ClusBflt/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceId": "0"
  },
  "message": "Disk 0 has arrived"
}

Event ID 2

Channel: Operational
Task: DiskActivity

Description

Disk is claimed by clusbflt.

Fields #

Name	Description
`DeviceId` Int32

Event ID 2: Disk DeviceId is claimed by clusbflt.

Channel: Operational
Task: DiskActivity

Message #

Disk %1 is claimed by clusbflt

Fields #

Name	Description
`DeviceId` Int32

Event ID 3

Channel: Operational
Task: DiskActivity

Description

Disk is not claimed by clusbflt, Status.

Fields #

Name	Description
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 3: Disk DeviceId is not claimed by clusbflt, Status Status.

Channel: Operational
Level: Informational
Task: DiskActivity

Message #

Disk %1 is not claimed by clusbflt, Status %2

Fields #

Name	Description
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-ClusBflt-Diagnostic",
    "guid": "{923BCB94-58D2-42BE-BBA9-B1315F363838}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T03:12:00.2164770+00:00",
    "event_record_id": 6,
    "correlation": {
      "ActivityID": "{14429F51-EFE2-000A-529F-4214E2EFDC01}"
    },
    "execution": {
      "process_id": 4,
      "thread_id": 440
    },
    "channel": "Microsoft-Windows-FailoverClustering-ClusBflt/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceId": "0",
    "Status": "0xc0000174"
  },
  "message": "Disk 0 is not claimed by clusbflt, Status Tape partition information could not be found when loading a tape."
}

Event ID 8

Channel: Operational
Task: DiskActivity

Description

Disk was removed.

Fields #

Name	Description
`DeviceId` Int32

Event ID 8: Disk DeviceId was removed.

Channel: Operational
Task: DiskActivity

Message #

Disk %1 was removed

Fields #

Name	Description
`DeviceId` Int32

Event ID 51

Channel: Operational
Task: EnclosureActivity

Description

Enclosure arrived.

Event ID 51: Enclosure arrived

Channel: Operational
Task: EnclosureActivity

Event ID 52

Channel: Operational
Task: EnclosureActivity

Description

Enclosure removed.

Event ID 52: Enclosure removed

Channel: Operational
Task: EnclosureActivity

Event ID 101

Channel: Operational
Task: PathActivity

Description

Path (attributes=, type=) was created for device.

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`PathType` HexInt32

Event ID 101: Path PathId (attributes=Attributes, type=PathType) was created for device DeviceId.

Channel: Operational
Level: Informational
Task: PathActivity

Message #

Path %1 (attributes=%3, type=%4) was created for device %2

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`PathType` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-ClusBflt-Diagnostic",
    "guid": "{923BCB94-58D2-42BE-BBA9-B1315F363838}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T02:33:58.0651744+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-ClusBflt/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PathId": "1",
    "DeviceId": "-1",
    "Attributes": "0x0",
    "PathType": "0x0"
  },
  "message": "Path 1 (attributes=0x0, type=0x0) was created for device -1"
}

Event ID 102

Channel: Operational
Task: PathActivity

Description

Path (attributes=, type=) was removed for device.

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`PathType` HexInt32

Event ID 102: Path PathId (attributes=Attributes, type=PathType) was removed for device DeviceId.

Channel: Operational
Task: PathActivity

Message #

Path %1 (attributes=%3, type=%4) was removed for device %2

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`PathType` HexInt32

Event ID 103

Channel: Operational
Task: PathActivity

Description

Path (attributes=, down path=) was paused for device.

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`DownPathId` Int32

Event ID 103: Path PathId (attributes=Attributes, down path=DownPathId) was paused for device DeviceId.

Channel: Operational
Task: PathActivity

Message #

Path %1 (attributes=%3, down path=%4) was paused for device %2

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`DownPathId` Int32

Event ID 104

Channel: Operational
Task: PathActivity

Description

Path (attributes=, down path=) was resumed for device.

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`DownPathId` Int32

Event ID 104: Path PathId (attributes=Attributes, down path=DownPathId) was resumed for device DeviceId.

Channel: Operational
Task: PathActivity

Message #

Path %1 (attributes=%3, down path=%4) was resumed for device %2

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`DownPathId` Int32

Event ID 105

Channel: Operational
Task: PathActivity

Description

Path (attributes=, down path=) was resumed on timeout for device.

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`DownPathId` Int32

Event ID 105: Path PathId (attributes=Attributes, down path=DownPathId) was resumed on timeout for device DeviceId.

Channel: Operational
Task: PathActivity

Message #

Path %1 (attributes=%3, down path=%4) was resumed on timeout for device %2

Fields #

Name	Description
`PathId` Int32
`DeviceId` Int32
`Attributes` HexInt32
`DownPathId` Int32

Event ID 151

Channel: Operational
Task: ClusterActivity

Description

Received request to update membership to , flags =.

Fields #

Name	Description
`Membership` HexInt64
`Flags` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 151: Received request to update membership to Membership, flags = Flags.

Channel: Connectivity
Task: ClusterActivity

Message #

Received request to update membership to %1, flags = %2

Fields #

Name	Description
`Membership` HexInt64
`Flags` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 152

Channel: Operational
Task: ClusterActivity

Description

Completed request to update membership to , flags = , status.

Fields #

Name	Description
`Membership` HexInt64
`Flags` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 152: Completed request to update membership to Membership, flags = Flags, status Status.

Channel: Connectivity
Task: ClusterActivity

Message #

Completed request to update membership to %1, flags = %2, status %3

Fields #

Name	Description
`Membership` HexInt64
`Flags` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 153

Channel: Operational
Task: ClusterActivity

Description

Completed request to set registration key to , status.

Fields #

Name	Description
`RegistrationKey` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 153: Completed request to set registration key to RegistrationKey, status Status.

Channel: Connectivity
Task: ClusterActivity

Message #

Completed request to set registration key to %1, status %2

Fields #

Name	Description
`RegistrationKey` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 154

Channel: Operational
Task: ClusterActivity

Description

Client cluster with Id and instance id registered.

Fields #

Name	Description
`ClusterId` GUID
`InstanceId` GUID

Event ID 154: Client cluster with Id ClusterId and instance id InstanceId registered.

Channel: Connectivity
Task: ClusterActivity

Message #

Client cluster with Id %1 and instance id %2 registered.

Fields #

Name	Description
`ClusterId` GUID
`InstanceId` GUID

Event ID 155

Channel: Operational
Task: ClusterActivity

Description

Client cluster with Id and instance id unregistered on client request.

Fields #

Name	Description
`ClusterId` GUID
`InstanceId` GUID

Event ID 155: Client cluster with Id ClusterId and instance id InstanceId unregistered on client request.

Channel: Connectivity
Task: ClusterActivity

Message #

Client cluster with Id %1 and instance id %2 unregistered on client request.

Fields #

Name	Description
`ClusterId` GUID
`InstanceId` GUID

Event ID 156

Channel: Operational
Task: ClusterActivity

Description

Client cluster with Id and instance id unregistered because no hearbeat was received for 1 minute.

Fields #

Name	Description
`ClusterId` GUID
`InstanceId` GUID

Event ID 156: Client cluster with Id ClusterId and instance id InstanceId unregistered because no hearbeat was received for 1 minute.

Channel: Connectivity
Task: ClusterActivity

Message #

Client cluster with Id %1 and instance id %2 unregistered because no hearbeat was received for 1 minute.

Fields #

Name	Description
`ClusterId` GUID
`InstanceId` GUID

Event ID 157

Channel: Operational
Task: ClusterActivity

Description

Received client cluster membership update from node id . Cluster Id , instance id , membership sequence , nodeset mask . Existing cluster id , instance id , membership sequence , nodeset mask.

Fields #

Name	Description
`NodeId` Int32
`ClusterId` GUID
`InstanceId` GUID
`SequenceNumber` HexInt32
`MembershipMask` HexInt64
`CurrentClusterId` GUID
`CurrentInstanceId` GUID
`CurrentSequenceNumber` HexInt32
`CurrentMembershipMask` HexInt64

Event ID 157: Received client cluster membership update from node id NodeId.

Channel: Connectivity
Task: ClusterActivity

Description

Received client cluster membership update from node id . Cluster Id , instance id , membership sequence , nodeset mask . Existing cluster id , instance id , membership sequence , nodeset mask.

Message #

Received client cluster membership update from node id %1. Cluster Id %2, instance id %3, membership sequence %4, nodeset mask %5. Existing cluster id %6, instance id %7, membership sequence %8, nodeset mask %9

Fields #

Name	Description
`NodeId` Int32
`ClusterId` GUID
`InstanceId` GUID
`SequenceNumber` HexInt32
`MembershipMask` HexInt64
`CurrentClusterId` GUID
`CurrentInstanceId` GUID
`CurrentSequenceNumber` HexInt32
`CurrentMembershipMask` HexInt64

Event ID 158

Channel: Operational
Task: ClusterActivity

Description

Applied client cluster membership update from node id . Cluster Id , instance id , membership sequence , nodeset mask .

Fields #

Name	Description
`NodeId` Int32
`ClusterId` GUID
`InstanceId` GUID
`SequenceNumber` HexInt32
`MembershipMask` HexInt64

Event ID 158: Applied client cluster membership update from node id NodeId.

Channel: Connectivity
Task: ClusterActivity

Description

Applied client cluster membership update from node id NodeId. Cluster Id ClusterId, instance id InstanceId, membership sequence SequenceNumber, nodeset mask MembershipMask.

Message #

Applied client cluster membership update from node id %1. Cluster Id %2, instance id %3, membership sequence %4, nodeset mask %5.

Fields #

Name	Description
`NodeId` Int32
`ClusterId` GUID
`InstanceId` GUID
`SequenceNumber` HexInt32
`MembershipMask` HexInt64

Event ID 159

Channel: Operational
Task: ClusterActivity

Description

Target create for cluster node id for path with cluster Id , instance id . Existing cluster id , instance id . Status=.

Fields #

Name	Description
`NodeId` Int32
`PathId` Int32
`ClusterId` GUID
`InstanceId` GUID
`CurrentClusterId` GUID
`CurrentInstanceId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 159: Target create for cluster node id NodeId for path PathId with cluster Id ClusterId, instance id InstanceId.

Channel: Connectivity
Level: Informational
Task: ClusterActivity

Description

Target create for cluster node id NodeId for path PathId with cluster Id ClusterId, instance id InstanceId. Existing cluster id CurrentClusterId, instance id CurrentInstanceId. Status=Status.

Message #

Target create for cluster node id %1 for path %2 with cluster Id %3, instance id %4. Existing cluster id %5, instance id %6. Status=%7

Fields #

Name	Description
`NodeId` Int32
`PathId` Int32
`ClusterId` GUID
`InstanceId` GUID
`CurrentClusterId` GUID
`CurrentInstanceId` GUID
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-ClusBflt-Diagnostic",
    "guid": "{923BCB94-58D2-42BE-BBA9-B1315F363838}",
    "event_source_name": "",
    "event_id": 159,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2026-05-30T02:33:58.1358814+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5276
    },
    "channel": "Microsoft-Windows-FailoverClustering-ClusBflt/Connectivity",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NodeId": "0",
    "PathId": "1",
    "ClusterId": "{00000000-0000-0000-0000-000000000000}",
    "InstanceId": "{00000000-0000-0000-0000-000000000000}",
    "CurrentClusterId": "{00000000-0000-0000-0000-000000000000}",
    "CurrentInstanceId": "{00000000-0000-0000-0000-000000000000}",
    "Status": "0x0"
  },
  "message": "Target create for cluster node id 0 for path 1 with cluster Id {00000000-0000-0000-0000-000000000000}, instance id {00000000-0000-0000-0000-000000000000}. Existing cluster id {00000000-0000-0000-0000-000000000000}, instance id {00000000-0000-0000-0000-000000000000}. Status=STATUS_SUCCESS"
}

Event ID 160

Channel: Operational
Task: ClusterActivity

Description

Target create request rejected from cluster node id for path with cluster Id , instance id . Existing cluster id , instance id .

Fields #

Name	Description
`NodeId` Int32
`PathId` Int32
`ClusterId` GUID
`InstanceId` GUID
`CurrentClusterId` GUID
`CurrentInstanceId` GUID

Event ID 160: Target create request rejected from cluster node id NodeId for path PathId with cluster Id ClusterId, instance id InstanceId.

Channel: Connectivity
Task: ClusterActivity

Description

Target create request rejected from cluster node id NodeId for path PathId with cluster Id ClusterId, instance id InstanceId. Existing cluster id CurrentClusterId, instance id CurrentInstanceId.

Message #

Target create request rejected from cluster node id %1 for path %2 with cluster Id %3, instance id %4. Existing cluster id %5, instance id %6.

Fields #

Name	Description
`NodeId` Int32
`PathId` Int32
`ClusterId` GUID
`InstanceId` GUID
`CurrentClusterId` GUID
`CurrentInstanceId` GUID

Event ID 201

Channel: Operational
Task: NodeActivity

Description

Node connected to path device.

Fields #

Name	Description
`NodeId` Int32
`PathId` Int32
`DeviceId` Int32

Event ID 201: Node NodeId connected to path PathId device DeviceId.

Channel: Connectivity
Task: NodeActivity

Message #

Node %1 connected to path %2 device %3

Fields #

Name	Description
`NodeId` Int32
`PathId` Int32
`DeviceId` Int32

Event ID 202

Channel: Operational
Task: NodeActivity

Description

Node disconnected from path device.

Fields #

Name	Description
`NodeId` Int32
`PathId` Int32
`DeviceId` Int32

Event ID 202: Node NodeId disconnected from path PathId device DeviceId.

Channel: Connectivity
Task: NodeActivity

Message #

Node %1 disconnected from path %2 device %3

Fields #

Name	Description
`NodeId` Int32
`PathId` Int32
`DeviceId` Int32

Event ID 251

Channel: Operational
Task: CacheConfig

Description

Remove all partitions from device (), Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 251: Remove all partitions from device DeviceGuid (DeviceId), Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Remove all partitions from device %1 (%2), Status=%3.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 252

Channel: Operational
Task: CacheConfig

Description

Trim device (), Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 252: Trim device DeviceGuid (DeviceId), Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Trim device %1 (%2), Status=%3.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 253

Channel: Operational
Task: CacheConfig

Description

Create Hdd Cache partition on device (), Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 253: Create Hdd Cache partition on device DeviceGuid (DeviceId), Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Create Hdd Cache partition on device %1 (%2), Status=%3.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 254

Channel: Operational
Task: CacheConfig

Description

Initialize Hdd Cache partition on device (), Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 254: Initialize Hdd Cache partition on device DeviceGuid (DeviceId), Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Initialize Hdd Cache partition on device %1 (%2), Status=%3.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 255

Channel: Operational
Task: CacheConfig

Description

Initialize Ssd Cache Store partition on device (), PartitionId , Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 255: Initialize Ssd Cache Store partition on device DeviceGuid (DeviceId), PartitionId CacheStorePartitionId, Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Initialize Ssd Cache Store partition on device %1 (%2), PartitionId %3, Status=%4.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 256

Channel: Operational
Task: CacheConfig

Description

Create Ssd Cache Store partition on device (), Reserve percent, UnusedSize , Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`ReservePercentage` Int32
`UnusedSize` Int64
`Status` HexInt32	NTSTATUS reference

Event ID 256: Create Ssd Cache Store partition on device DeviceGuid (DeviceId), Reserve ReservePercentage percent, UnusedSize UnusedSize, Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Create Ssd Cache Store partition on device %1 (%2), Reserve %3 percent, UnusedSize %4, Status=%5.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`ReservePercentage` Int32
`UnusedSize` Int64
`Status` HexInt32	NTSTATUS reference

Event ID 257

Channel: Operational
Task: CacheConfig

Description

Bind Hdd device () to Cache Store Partition on device (), Attributes , Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`CacheStoreDeviceGuid` GUID
`CacheStoreDeviceId` Int32
`Attributes` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 257: Bind Hdd device DeviceGuid (DeviceId) to Cache Store Partition CacheStorePartitionId on device CacheStoreDeviceGuid (CacheStoreDeviceId), Attributes Attributes, Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Bind Hdd device %1 (%2) to Cache Store Partition %3 on device %4 (%5), Attributes %6, Status=%7.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`CacheStoreDeviceGuid` GUID
`CacheStoreDeviceId` Int32
`Attributes` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 258

Channel: Operational
Task: CacheConfig

Description

UnBind Hdd device (), Options , AddedMissingPages=, Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Options` HexInt32
`AddedMissingPages` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 258: UnBind Hdd device DeviceGuid (DeviceId), Options Options, AddedMissingPages=AddedMissingPages, Status=Status.

Channel: Operational
Task: CacheConfig

Message #

UnBind Hdd device %1 (%2), Options %3, AddedMissingPages=%4, Status=%5.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`Options` HexInt32
`AddedMissingPages` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 259

Channel: Operational
Task: CacheConfig

Description

Disable Binding on Sdd device (), Partition Id , Binding , Hdd Device , Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`BindingGuid` GUID
`HddDeviceGuid` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 259: Disable Binding on Sdd device DeviceGuid (DeviceId), Partition Id CacheStorePartitionId, Binding BindingGuid, Hdd Device HddDeviceGuid, Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Disable Binding on Sdd device %1 (%2), Partition Id %3, Binding %4, Hdd Device %5, Status=%6.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`BindingGuid` GUID
`HddDeviceGuid` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 260

Channel: Operational
Task: CacheConfig

Description

Set Binding Attributes on device (), Partition Id , Binding , Hdd Device , Attributes(mask) (), Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`BindingGuid` GUID
`HddDeviceGuid` GUID
`Attributes` HexInt32
`AttributesMask` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 260: Set Binding Attributes on device DeviceGuid (DeviceId), Partition Id CacheStorePartitionId, Binding BindingGuid, Hdd Device HddDeviceGuid, Attributes(mask) Attributes(AttributesMask), Status=Status.

Channel: Operational
Task: CacheConfig

Message #

Set Binding Attributes on device %1 (%2), Partition Id %3, Binding %4, Hdd Device %5, Attributes(mask) %6(%7), Status=%8.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`BindingGuid` GUID
`HddDeviceGuid` GUID
`Attributes` HexInt32
`AttributesMask` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 261

Channel: Operational
Task: CacheConfig

Description

Disabled Read and Write Cache on Ssd Cache Store partition on device (), PartitionId due to IO Error=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 261: Disabled Read and Write Cache on Ssd Cache Store partition on device DeviceGuid (DeviceId), PartitionId CacheStorePartitionId due to IO Error=Status.

Channel: Operational
Task: CacheConfig

Message #

Disabled Read and Write Cache on Ssd Cache Store partition on device %1 (%2), PartitionId %3 due to IO Error=%4.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 301

Channel: Operational
Task: Runtime

Description

Runtime error in @, Status=.

Fields #

Name	Description
`Function` AnsiString
`LineNumber` Int32
`Status` HexInt32	NTSTATUS reference

Event ID 301: Runtime error in Function@LineNumber, Status=Status.

Channel: Operational
Level: Warning
Task: Runtime

Message #

Runtime error in %1@%2, Status=%3.

Fields #

Name	Description
`Function` AnsiString
`Line Number`
`Status` HexInt32	NTSTATUS reference
`LineNumber` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-ClusBflt-Diagnostic",
    "guid": "{923BCB94-58D2-42BE-BBA9-B1315F363838}",
    "event_source_name": "",
    "event_id": 301,
    "version": 0,
    "level": 3,
    "task": 7,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T02:33:58.0651726+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-ClusBflt/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Function": "TargetMgrImpl::AddPath",
    "Line Number": "1184",
    "Status": "0xc0000034"
  },
  "message": "Runtime error in TargetMgrImpl::AddPath@1184, Status=Object Name not found.."
}

Event ID 351

Channel: Operational
Task: CacheLoad

Description

Starting to load Cache Store on device (), PartitionId , Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 351: Starting to load Cache Store on device DeviceGuid (DeviceId), PartitionId CacheStorePartitionId, Status=Status.

Channel: Operational
Task: CacheLoad

Message #

Starting to load Cache Store on device %1 (%2), PartitionId %3, Status=%4.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 352

Channel: Operational
Task: CacheLoad

Description

Loaded Cache Store on device (), PartitionId , Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 352: Loaded Cache Store on device DeviceGuid (DeviceId), PartitionId CacheStorePartitionId, Status=Status.

Channel: Operational
Task: CacheLoad

Message #

Loaded Cache Store on device %1 (%2), PartitionId %3, Status=%4.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 353

Channel: Operational
Task: CacheLoad

Description

Failed to load Cache Store on device (), PartitionId , Status=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 353: Failed to load Cache Store on device DeviceGuid (DeviceId), PartitionId CacheStorePartitionId, Status=Status.

Channel: Operational
Task: CacheLoad

Message #

Failed to load Cache Store on device %1 (%2), PartitionId %3, Status=%4.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceId` Int32
`CacheStorePartitionId` GUID
`Status` HexInt32	NTSTATUS reference

Event ID 401

Channel: Operational
Task: DataGuard

Description

Data mismatch detected at bottom layer. Disk , io_offset=, io_length=, mismatch_offset=, mismatch_length=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt64
`MismatchOffset` HexInt64
`MismatchLength` HexInt64

Event ID 401: Data mismatch detected at bottom layer.

Channel: Operational
Task: DataGuard

Description

Data mismatch detected at bottom layer. Disk DeviceNumber, io_offset=IOOffset, io_length=IOLength, mismatch_offset=MismatchOffset, mismatch_length=MismatchLength.

Message #

Data mismatch detected at bottom layer. Disk %2, io_offset=%3, io_length=%4, mismatch_offset=%5, mismatch_length=%6

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt64
`MismatchOffset` HexInt64
`MismatchLength` HexInt64

Event ID 402

Channel: Operational
Task: DataGuard

Description

Data mismatch detected at top layer. Disk , io_offset=, io_length=, mismatch_offset=, mismatch_length=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt64
`MismatchOffset` HexInt64
`MismatchLength` HexInt64

Event ID 402: Data mismatch detected at top layer.

Channel: Operational
Task: DataGuard

Description

Data mismatch detected at top layer. Disk DeviceNumber, io_offset=IOOffset, io_length=IOLength, mismatch_offset=MismatchOffset, mismatch_length=MismatchLength.

Message #

Data mismatch detected at top layer. Disk %2, io_offset=%3, io_length=%4, mismatch_offset=%5, mismatch_length=%6

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt64
`MismatchOffset` HexInt64
`MismatchLength` HexInt64

Event ID 403

Channel: Operational
Task: DataGuard

Description

Data mismatch detected at standby. Disk , io_offset=, io_length=, mismatch_offset=, mismatch_length=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt64
`MismatchOffset` HexInt64
`MismatchLength` HexInt64

Event ID 403: Data mismatch detected at standby.

Channel: Operational
Task: DataGuard

Description

Data mismatch detected at standby. Disk DeviceNumber, io_offset=IOOffset, io_length=IOLength, mismatch_offset=MismatchOffset, mismatch_length=MismatchLength.

Message #

Data mismatch detected at standby. Disk %2, io_offset=%3, io_length=%4, mismatch_offset=%5, mismatch_length=%6

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt64
`MismatchOffset` HexInt64
`MismatchLength` HexInt64

Event ID 404

Channel: Operational
Task: DataGuard

Description

Bad IO completion at bottom layer. Disk , io_offset=, io_length=, status=, informational=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt32
`Status` HexInt32	NTSTATUS reference
`Informational` HexInt64

Event ID 404: Bad IO completion at bottom layer.

Channel: Operational
Task: DataGuard

Description

Bad IO completion at bottom layer. Disk DeviceNumber, io_offset=IOOffset, io_length=IOLength, status=Status, informational=Informational.

Message #

Bad IO completion at bottom layer. Disk %2, io_offset=%3, io_length=%4, status=%5, informational=%6

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt32
`Status` HexInt32	NTSTATUS reference
`Informational` HexInt64

Event ID 405

Channel: Operational
Task: DataGuard

Description

Bad IO completion at top layer. Disk , io_offset=, io_length=, status=, informational=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt32
`Status` HexInt32	NTSTATUS reference
`Informational` HexInt64

Event ID 405: Bad IO completion at top layer.

Channel: Operational
Task: DataGuard

Description

Bad IO completion at top layer. Disk DeviceNumber, io_offset=IOOffset, io_length=IOLength, status=Status, informational=Informational.

Message #

Bad IO completion at top layer. Disk %2, io_offset=%3, io_length=%4, status=%5, informational=%6

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt32
`Status` HexInt32	NTSTATUS reference
`Informational` HexInt64

Event ID 406

Channel: Operational
Task: DataGuard

Description

Overlapping IOs detected.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt32
`ExistingIOOffset` HexInt64
`ExistingIOLength` HexInt32

Event ID 406: Overlapping IOs detected

Channel: Operational
Task: DataGuard

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOOffset` HexInt64
`IOLength` HexInt32
`ExistingIOOffset` HexInt64
`ExistingIOLength` HexInt32

Event ID 407

Channel: Operational
Task: DataGuard

Description

Prohibited IOCTL was rejected. Disk , ioctl=.

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOCTL` HexInt32

Event ID 407: Prohibited IOCTL was rejected.

Channel: Operational
Task: DataGuard

Description

Prohibited IOCTL was rejected. Disk DeviceNumber, ioctl=IOCTL.

Message #

Prohibited IOCTL was rejected. Disk %2, ioctl=%3

Fields #

Name	Description
`DeviceGuid` GUID
`DeviceNumber` Int32
`IOCTL` HexInt32

Provenance

ETW provider GUID 923bcb94-58d2-42be-bba9-b1315f363838

Defined in ClusBflt.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB