Microsoft-Windows-FailoverClustering-Clusport-Diagnostic

Event	Title	Channel	Sample	Rule
256	Event ID 256	Operational	N	N
256	Driver load result Status.	Diagnostic	N	N
512	Event ID 512	Operational	N	N
512	Io Started: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N	N
768	Event ID 768	Operational	N	N
768	Io Post: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N	N
1024	Event ID 1024	Operational	N	N
1024	Io Resume: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N	N
1280	Event ID 1280	Operational	N	N
1280	Io Continue: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N	N
1536	Event ID 1536	Operational	N	N
1536	Io Completed: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N	N
1792	Event ID 1792	Operational	N	N
1792	Io Pause: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N	N
2048	Event ID 2048	Operational	N	N
2048	Device State Change Start Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N	N
2304	Event ID 2304	Operational	N	N
2304	Device State Paused Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N	N
4096	Event ID 4096	Operational	N	N
4096	Device State Change Complete Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N	N
4352	Event ID 4352	Operational	N	N
4352	Rundown Start Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N	N
4608	Event ID 4608	Operational	N	N
4608	Rundown Complete Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N	N
4864	Event ID 4864	Operational	N	N
4864	Device Add - Obj Disk Device# DeviceNumber Protected Protected.	Operational	Y	N
5120	Event ID 5120	Operational	N	N
5120	Device Remove - Obj Disk Device# DeviceNumber Protected Protected.	Operational	N	N
5376	Event ID 5376	Operational	N	N
5376	Add DevicePath Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) …	Operational	Y	N
5632	Event ID 5632	Operational	N	N
5632	Remove DevicePath - Obj Disk Device# DeviceNumber Node TargetNodeName …	Operational	N	N
5888	Event ID 5888	Operational	N	N
5888	DeviceStarted - Obj Disk Device# DeviceNumber Protected Protected.	Operational	N	N
6144	Event ID 6144	Operational	N	N
6144	DeviceStopped - Obj Disk Device# DeviceNumber Surprise Surprise.	Operational	N	N
6400	Event ID 6400	Operational	N	N
6400	DevicePathPause - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) …	Operational	N	N
8192	Event ID 8192	Operational	N	N
8192	DevicePathPaused - Obj Disk Device# DeviceNumber Node TargetNodeName …	Operational	N	N
8448	Event ID 8448	Operational	N	N
8448	DeviceExceededLatencyLimit - Obj Disk Device# DeviceNumber Exceed Latency Limit …	Operational	N	N
8704	Event ID 8704	Operational	N	N
8704	PathExceededLatencyLimit - Obj Disk Device# DeviceNumber Node TargetNodeName …	Operational	N	N
8960	Event ID 8960	Operational	N	N
8960	PathEnumerated - Node TargetNodeName (Node) Enumerated #Count paths.	Operational	Y	N
9216	Event ID 9216	Operational	N	N
9216	DeviceArrivalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid.	Operational	Y	N
9472	Event ID 9472	Operational	N	N
9472	DeviceRemovalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid …	Operational	N	N
9728	Event ID 9728	Operational	N	N
9728	DeviceReportState - Obj Disk Device# DeviceNumber State Enabled.	Operational	N	N
9984	Event ID 9984	Operational	N	N
9984	MultiPath detected for Obj Disk Device# DeviceNumber.	Operational	N	N
10240	Event ID 10240	Operational	N	N
10240	Operation: Operation Status: Status.	Operational	N	N
10496	Event ID 10496	Operational	N	N
10496	Operation: Operation Status: Status.	Operational	N	N
12288	Event ID 12288	Operational	N	N
12288	Runtime error in Function@LineNumber, Node TargetNodeName(Node), Device …	Operational	N	N
12544	Event ID 12544	Operational	N	N
12544	Received an invalid output from Node TargetNodeName(Node).	Operational	N	N
12800	Event ID 12800	Operational	N	N
12800	Summary of the status of IO operations observed on this node during the last …	Operational	Y	N

Event ID 256

Channel: Operational
Task: DriverLoad

Description

Driver load result .

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 256: Driver load result Status.

Channel: Diagnostic
Task: DriverLoad

Message #

Driver load result %1.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 512

Channel: Operational
Task: IOStart

Description

Io Started: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 512: Io Started: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Channel: Diagnostic
Task: IOStart

Message #

Io Started: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 768

Channel: Operational
Task: IOPost

Description

Io Post: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 768: Io Post: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Channel: Diagnostic
Task: IOPost

Message #

Io Post: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1024

Channel: Operational
Task: IOResume

Description

Io Resume: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1024: Io Resume: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Channel: Diagnostic
Task: IOResume

Message #

Io Resume: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1280

Channel: Operational
Task: IOContinue

Description

Io Continue: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1280: Io Continue: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Channel: Diagnostic
Task: IOContinue

Message #

Io Continue: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1536

Channel: Operational
Task: IOCompleted

Description

Io Completed: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1536: Io Completed: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Channel: Diagnostic
Task: IOCompleted

Message #

Io Completed: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1792

Channel: Operational
Task: IOPaused

Description

Io Pause: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1792: Io Pause: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Channel: Diagnostic
Task: IOPaused

Message #

Io Pause: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 2048

Channel: Operational
Task: StateChangeStarted

Description

Device State Change Start Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 2048: Device State Change Start Obj Disk Device# DeviceNumber Protected Protected.

Channel: Diagnostic
Task: StateChangeStarted

Message #

Device State Change Start Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 2304

Channel: Operational
Task: DevicePaused

Description

Device State Paused Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 2304: Device State Paused Obj Disk Device# DeviceNumber Protected Protected.

Channel: Diagnostic
Task: DevicePaused

Message #

Device State Paused Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4096

Channel: Operational
Task: StateChangeCompleted

Description

Device State Change Complete Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4096: Device State Change Complete Obj Disk Device# DeviceNumber Protected Protected.

Channel: Diagnostic
Task: StateChangeCompleted

Message #

Device State Change Complete Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4352

Channel: Operational
Task: RunDownStarted

Description

Rundown Start Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4352: Rundown Start Obj Disk Device# DeviceNumber Protected Protected.

Channel: Diagnostic
Task: RunDownStarted

Message #

Rundown Start Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4608

Channel: Operational
Task: RunDownComplete

Description

Rundown Complete Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4608: Rundown Complete Obj Disk Device# DeviceNumber Protected Protected.

Channel: Diagnostic
Task: RunDownComplete

Message #

Rundown Complete Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4864

Channel: Operational
Task: DeviceAdded

Description

Device Add - Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4864: Device Add - Obj Disk Device# DeviceNumber Protected Protected.

Channel: Operational
Level: Informational
Task: DeviceAdded

Message #

Device Add - Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 4864,
    "version": 0,
    "level": 4,
    "task": 113,
    "opcode": 0,
    "keywords": 4611686018427392000,
    "time_created": "2026-05-30T02:33:58.1359016+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5276
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Disk": "0xffffd60c4fa4ccc0",
    "DeviceNumber": "0",
    "Protected": "true",
    "DriveManufacturer": "QEMU",
    "DriveModel": "Standard PC (i440FX + PIIX, 1996)",
    "DriveSerial": "",
    "DriveRevision": "pc-i440fx-10.1",
    "DeviceGuid": "{00000000-0000-0000-0000-000000000000}"
  },
  "message": "Device Add - Obj 0xffffd60c4fa4ccc0 Device# 0 Protected true \r\n  Manufacturer: QEMU \r\n  Model Number: Standard PC (i440FX + PIIX, 1996) \r\n  Serial Number:  \r\n  Revision Level: pc-i440fx-10.1 \r\n  DeviceGuid: {00000000-0000-0000-0000-000000000000}"
}

Event ID 5120

Channel: Operational
Task: RemoveDevice

Description

Device Remove - Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5120: Device Remove - Obj Disk Device# DeviceNumber Protected Protected.

Channel: Operational
Task: RemoveDevice

Message #

Device Remove - Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5376

Channel: Operational
Task: AddDevicePath

Description

Add DevicePath Obj Device# Node () PathId Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5376: Add DevicePath Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Channel: Operational
Level: Informational
Task: AddDevicePath

Message #

Add DevicePath Obj %1 Device# %2 Node %4 (%5) PathId %6 Protected %7 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 5376,
    "version": 0,
    "level": 4,
    "task": 115,
    "opcode": 0,
    "keywords": 4611686018427404288,
    "time_created": "2026-05-30T02:33:58.1359114+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5276
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Disk": "0xffffd60c4fa4ccc0",
    "DeviceNumber": "0",
    "Data1Length": "0",
    "TargetNodeName": "",
    "TargetNode": "0",
    "PathId": "0x1",
    "Protected": "true",
    "DriveManufacturer": "QEMU",
    "DriveModel": "Standard PC (i440FX + PIIX, 1996)",
    "DriveSerial": "",
    "DriveRevision": "pc-i440fx-10.1",
    "DeviceGuid": "{00000000-0000-0000-0000-000000000000}"
  },
  "message": "Add DevicePath Obj 0xffffd60c4fa4ccc0 Device# 0 Node  (0) PathId 0x1 Protected true \r\n  Manufacturer: QEMU \r\n  Model Number: Standard PC (i440FX + PIIX, 1996) \r\n  Serial Number:  \r\n  Revision Level: pc-i440fx-10.1 \r\n  DeviceGuid: {00000000-0000-0000-0000-000000000000}"
}

Event ID 5632

Channel: Operational
Task: RemoveDevicePath

Description

Remove DevicePath - Obj Device# Node () PathId Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5632: Remove DevicePath - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Channel: Operational
Task: RemoveDevicePath

Message #

Remove DevicePath - Obj %1 Device# %2 Node %4 (%5) PathId %6 Protected %7 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5888

Channel: Operational
Task: DeviceStarted

Description

DeviceStarted - Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5888: DeviceStarted - Obj Disk Device# DeviceNumber Protected Protected.

Channel: Operational
Task: DeviceStarted

Message #

DeviceStarted - Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 6144

Channel: Operational
Task: DeviceStopped

Description

DeviceStopped - Obj Device# Surprise.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Surprise` Boolean
`DeviceGuid` GUID

Event ID 6144: DeviceStopped - Obj Disk Device# DeviceNumber Surprise Surprise.

Channel: Operational
Task: DeviceStopped

Message #

DeviceStopped - Obj %1 Device# %2 Surprise %3

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Surprise` Boolean
`DeviceGuid` GUID

Event ID 6400

Channel: Operational
Task: DevicePathPause

Description

DevicePathPause - Obj Device# Node () PathId Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Status` HexInt32	NTSTATUS reference
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 6400: DevicePathPause - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Status Status.

Channel: Operational
Task: DevicePathPause

Message #

DevicePathPause - Obj %1 Device# %2 Node %4 (%5) PathId %6 Status %7 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Status` HexInt32	NTSTATUS reference
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8192

Channel: Operational
Task: DevicePathPaused

Description

DevicePathPaused - Obj Device# Node () PathId Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8192: DevicePathPaused - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Channel: Operational
Task: DevicePathPaused

Message #

DevicePathPaused - Obj %1 Device# %2  Node %4 (%5) PathId %6 Protected %7 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8448

Channel: Operational
Task: DeviceExceededLatencylimit

Description

DeviceExceededLatencyLimit - Obj Device# Exceed Latency Limit - ms.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Latency` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8448: DeviceExceededLatencyLimit - Obj Disk Device# DeviceNumber Exceed Latency Limit - Latency ms.

Channel: Operational
Task: DeviceExceededLatencylimit

Message #

DeviceExceededLatencyLimit - Obj %1 Device# %2 Exceed Latency Limit - %3 ms 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Latency` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8704

Channel: Operational
Task: PathExceededLatencylimit

Description

PathExceededLatencyLimit - Obj Device# Node () PathId Exceed Latency Limit - ms.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Latency` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8704: PathExceededLatencyLimit - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Exceed Latency Limit - Latency ms.

Channel: Operational
Task: PathExceededLatencylimit

Message #

PathExceededLatencyLimit - Obj %1 Device# %2 Node %4 (%5) PathId %6 Exceed Latency Limit - %7 ms 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Latency` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8960

Channel: Operational
Task: DevicePathsenumerated

Description

PathEnumerated - Node () Enumerated # paths.

Fields #

Name	Description
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16
`Count` UInt32

Event ID 8960: PathEnumerated - Node TargetNodeName (Node) Enumerated #Count paths.

Channel: Operational
Level: Informational
Task: DevicePathsenumerated

Message #

PathEnumerated - Node %2 (%3) Enumerated #%4 paths.

Fields #

Name	Description
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16
`Count` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 8960,
    "version": 0,
    "level": 4,
    "task": 123,
    "opcode": 0,
    "keywords": 4611686018431582208,
    "time_created": "2026-05-30T02:33:58.1358392+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5276
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data1Length": "0",
    "TargetNodeName": "",
    "Node": "0",
    "Count": "1"
  },
  "message": "PathEnumerated - Node  (0) Enumerated #1 paths."
}

Event ID 9216

Channel: Operational
Task: DeviceArrivalReported

Description

DeviceArrivalReported - Obj Device# DeviceGuid.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DeviceGuid` GUID

Event ID 9216: DeviceArrivalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid.

Channel: Operational
Level: Informational
Task: DeviceArrivalReported

Message #

DeviceArrivalReported - Obj %1 Device# %2 DeviceGuid: %3

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DeviceGuid` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 9216,
    "version": 0,
    "level": 4,
    "task": 124,
    "opcode": 0,
    "keywords": 4611686018435776512,
    "time_created": "2026-05-30T02:33:58.1359972+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11696
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Disk": "0xffffd60c51c2f560",
    "DeviceNumber": "0",
    "DeviceGuid": "{00000000-0000-0000-0000-000000000000}"
  },
  "message": "DeviceArrivalReported - Obj 0xffffd60c51c2f560 Device# 0 DeviceGuid: {00000000-0000-0000-0000-000000000000}"
}

Event ID 9472

Channel: Operational
Task: DeviceRemovalReported

Description

DeviceRemovalReported - Obj Device# DeviceGuid: Reason: Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DeviceGuid` GUID
`RemovalReason` UInt32
`RemovalStatus` HexInt32

Event ID 9472: DeviceRemovalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid Reason: RemovalReason Status: RemovalStatus.

Channel: Operational
Task: DeviceRemovalReported

Message #

DeviceRemovalReported - Obj %1 Device# %2 DeviceGuid: %3 Reason: %4 Status: %5

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DeviceGuid` GUID
`RemovalReason` UInt32
`RemovalStatus` HexInt32

Event ID 9728

Channel: Operational
Task: DeviceReportState

Description

DeviceReportState - Obj Device# State .

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Enabled` Boolean

Event ID 9728: DeviceReportState - Obj Disk Device# DeviceNumber State Enabled.

Channel: Operational
Task: DeviceReportState

Message #

DeviceReportState - Obj %1 Device# %2 State %3.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Enabled` Boolean

Event ID 9984

Channel: Operational
Task: MultiPathdetected

Description

MultiPath detected for Obj Device#.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 9984: MultiPath detected for Obj Disk Device# DeviceNumber.

Channel: Operational
Task: MultiPathdetected

Message #

MultiPath detected for Obj %1 Device# %2 
  Manufacturer: %3 
  Model Number: %4 
  Serial Number: %5 
  Revision Level: %6  
  DeviceGuid: %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 10240

Channel: Operational
Task: ReportOperation

Description

Operation: Status.

Fields #

Name	Description
`Operation` AnsiString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Status` HexInt32	NTSTATUS reference
`Data1Length` UInt16
`Data1` UnicodeString
`Data2` UInt32

Event ID 10240: Operation: Operation Status: Status.

Channel: Operational
Task: ReportOperation

Message #

Operation: %1 Status: %2 
 Data1: %4 
 Data2: %5

Fields #

Name	Description
`Operation` AnsiString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Status` HexInt32	NTSTATUS reference
`Data1Length` UInt16
`Data1` UnicodeString
`Data2` UInt32

Event ID 10496

Channel: Operational
Task: ReportOperation

Description

Operation: Status.

Fields #

Name	Description
`Operation` AnsiString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Status` HexInt32	NTSTATUS reference
`Data1Length` UInt16
`Data1` UnicodeString
`Data2` UInt32

Event ID 10496: Operation: Operation Status: Status.

Channel: Operational
Task: ReportOperation

Message #

Operation: %1 Status: %2 
 Data1: %4 
 Data2: %5

Fields #

Name	Description
`Operation` AnsiString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Status` HexInt32	NTSTATUS reference
`Data1Length` UInt16
`Data1` UnicodeString
`Data2` UInt32

Event ID 12288

Channel: Operational
Task: RuntimeError

Description

Runtime error in @, Node (), Device Path Status=.

Fields #

Name	Description
`Function` AnsiString
`LineNumber` Int32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16
`DeviceNumber` UInt32
`PathId` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 12288: Runtime error in Function@LineNumber, Node TargetNodeName(Node), Device DeviceNumber Path PathId Status=Status.

Channel: Operational
Task: RuntimeError

Message #

Runtime error in %1@%2, Node %4(%5), Device %6 Path %7 Status=%8.

Fields #

Name	Description
`Function` AnsiString
`LineNumber` Int32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16
`DeviceNumber` UInt32
`PathId` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 12544

Channel: Operational
Task: ProtocolMismatch

Description

Received an invalid output from Node (). This is usually caused by binary incompatibility between the initiator and the target nodes.

Fields #

Name	Description
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16

Event ID 12544: Received an invalid output from Node TargetNodeName(Node).

Channel: Operational
Task: ProtocolMismatch

Description

Received an invalid output from Node TargetNodeName(Node). This is usually caused by binary incompatibility between the initiator and the target nodes.

Message #

Received an invalid output from Node %2(%3). This is usually caused by binary incompatibility between the initiator and the target nodes.

Fields #

Name	Description
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16

Event ID 12800

Channel: Operational
Task: NodeStatusSummary

Description

Summary of the status of IO operations observed on this node during the last minutes.

Fields #

Name	Description
`TimeInMinutes` UInt32
`Data1Length` UInt16
`ErrorSummary` UnicodeString

Event ID 12800: Summary of the status of IO operations observed on this node during the last TimeInMinutes minutes.

Channel: Operational
Level: Informational
Task: NodeStatusSummary

Message #

Summary of the status of IO operations observed on this node during the last %1 minutes:
%3

Fields #

Name	Description
`TimeInMinutes` UInt32
`Data1Length` UInt16
`ErrorSummary` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 12800,
    "version": 0,
    "level": 4,
    "task": 131,
    "opcode": 0,
    "keywords": 4611686020574871552,
    "time_created": "2026-05-30T04:12:01.2562464+00:00",
    "event_record_id": 9,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 436
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TimeInMinutes": "60",
    "Data1Length": "764",
    "ErrorSummary": "\nNode (0):\n\tSTATUS_BAD_NETWORK_PATH: 0\n\tSTATUS_CONNECTION_DISCONNECTED: 0\n\tSTATUS_UNEXPECTED_NETWORK_ERROR: 0\n\tSTATUS_INVALID_NETWORK_RESPONSE: 0\n\tSTATUS_IO_TIMEOUT: 0\n\tSTATUS_CONNECTION_RESET: 0\n\tSTATUS_CONNECTION_ABORTED: 0\n\tSTATUS_ACCESS_DENIED: 0\n\tSTATUS_NETWORK_NAME_DELETED: 0\n\tSTATUS_USER_SESSION_DELETED: 0\n\tSTATUS_FILE_CLOSED: 0\n\tSTATUS_LOGON_FAILURE: 0\n\tSTATUS_SUCCESS: 0\n"
  },
  "message": "Summary of the status of IO operations observed on this node during the last 60 minutes:\r\n\nNode (0):\n\tSTATUS_BAD_NETWORK_PATH: 0\n\tSTATUS_CONNECTION_DISCONNECTED: 0\n\tSTATUS_UNEXPECTED_NETWORK_ERROR: 0\n\tSTATUS_INVALID_NETWORK_RESPONSE: 0\n\tSTATUS_IO_TIMEOUT: 0\n\tSTATUS_CONNECTION_RESET: 0\n\tSTATUS_CONNECTION_ABORTED: 0\n\tSTATUS_ACCESS_DENIED: 0\n\tSTATUS_NETWORK_NAME_DELETED: 0\n\tSTATUS_USER_SESSION_DELETED: 0\n\tSTATUS_FILE_CLOSED: 0\n\tSTATUS_LOGON_FAILURE: 0\n\tSTATUS_SUCCESS: 0\n"
}

Provenance

ETW provider GUID 29c07d0e-e5a0-4e85-a004-1f668531ce22

Defined in Clusport.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB