Microsoft-Windows-FailoverClustering-Clusport-Diagnostic

64 events across 3 channels

Event	Title	Channel	Sample
256	Event ID 256	Operational	N
256	Driver load result Status.	Diagnostic	N
512	Event ID 512	Operational	N
512	Io Started: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N
768	Event ID 768	Operational	N
768	Io Post: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N
1024	Event ID 1024	Operational	N
1024	Io Resume: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N
1280	Event ID 1280	Operational	N
1280	Io Continue: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N
1536	Event ID 1536	Operational	N
1536	Io Completed: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N
1792	Event ID 1792	Operational	N
1792	Io Pause: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major …	Diagnostic	N
2048	Event ID 2048	Operational	N
2048	Device State Change Start Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N
2304	Event ID 2304	Operational	N
2304	Device State Paused Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N
4096	Event ID 4096	Operational	N
4096	Device State Change Complete Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N
4352	Event ID 4352	Operational	N
4352	Rundown Start Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N
4608	Event ID 4608	Operational	N
4608	Rundown Complete Obj Disk Device# DeviceNumber Protected Protected.	Diagnostic	N
4864	Event ID 4864	Operational	N
4864	Device Add - Obj Disk Device# DeviceNumber Protected Protected.	Operational	Y
5120	Event ID 5120	Operational	N
5120	Device Remove - Obj Disk Device# DeviceNumber Protected Protected.	Operational	N
5376	Event ID 5376	Operational	N
5376	Add DevicePath Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) …	Operational	Y
5632	Event ID 5632	Operational	N
5632	Remove DevicePath - Obj Disk Device# DeviceNumber Node TargetNodeName …	Operational	N
5888	Event ID 5888	Operational	N
5888	DeviceStarted - Obj Disk Device# DeviceNumber Protected Protected.	Operational	N
6144	Event ID 6144	Operational	N
6144	DeviceStopped - Obj Disk Device# DeviceNumber Surprise Surprise.	Operational	N
6400	Event ID 6400	Operational	N
6400	DevicePathPause - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) …	Operational	N
8192	Event ID 8192	Operational	N
8192	DevicePathPaused - Obj Disk Device# DeviceNumber Node TargetNodeName …	Operational	N
8448	Event ID 8448	Operational	N
8448	DeviceExceededLatencyLimit - Obj Disk Device# DeviceNumber Exceed Latency Limit …	Operational	N
8704	Event ID 8704	Operational	N
8704	PathExceededLatencyLimit - Obj Disk Device# DeviceNumber Node TargetNodeName …	Operational	N
8960	Event ID 8960	Operational	N
8960	PathEnumerated - Node TargetNodeName (Node) Enumerated #Count paths.	Operational	Y
9216	Event ID 9216	Operational	N
9216	DeviceArrivalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid.	Operational	Y
9472	Event ID 9472	Operational	N
9472	DeviceRemovalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid …	Operational	N
9728	Event ID 9728	Operational	N
9728	DeviceReportState - Obj Disk Device# DeviceNumber State Enabled.	Operational	N
9984	Event ID 9984	Operational	N
9984	MultiPath detected for Obj Disk Device# DeviceNumber.	Operational	N
10240	Event ID 10240	Operational	N
10240	Operation: Operation Status: Status.	Operational	N
10496	Event ID 10496	Operational	N
10496	Operation: Operation Status: Status.	Operational	N
12288	Event ID 12288	Operational	N
12288	Runtime error in Function@LineNumber, Node TargetNodeName(Node), Device …	Operational	N
12544	Event ID 12544	Operational	N
12544	Received an invalid output from Node TargetNodeName(Node).	Operational	N
12800	Event ID 12800	Operational	N
12800	Summary of the status of IO operations observed on this node during the last …	Operational	Y

Event ID 256

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DriverLoad

Description

Driver load result .

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 256: Driver load result Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: DriverLoad

Description

Driver load result Status.

Message #

Driver load result %1.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 512

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: IOStart

Description

Io Started: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 512: Io Started: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: IOStart

Description

Io Started: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Message #

Io Started: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 768

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: IOPost

Description

Io Post: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 768: Io Post: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: IOPost

Description

Io Post: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Message #

Io Post: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1024

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: IOResume

Description

Io Resume: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1024: Io Resume: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: IOResume

Description

Io Resume: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Message #

Io Resume: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1280

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: IOContinue

Description

Io Continue: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1280: Io Continue: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: IOContinue

Description

Io Continue: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Message #

Io Continue: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1536

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: IOCompleted

Description

Io Completed: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1536: Io Completed: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: IOCompleted

Description

Io Completed: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Message #

Io Completed: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1792

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: IOPaused

Description

Io Pause: Obj Device# Irp IoContext Major Minor Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 1792: Io Pause: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: IOPaused

Description

Io Pause: Obj Disk Device# DeviceNumber Irp Irp IoContext IoContext Major MajorFunction Minor MinorFunction Status Status.

Message #

Io Pause: Obj %1 Device# %2 Irp %3 IoContext %4 Major %5 Minor %6 Status %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Irp` Pointer
`IoContext` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 2048

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: StateChangeStarted

Description

Device State Change Start Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 2048: Device State Change Start Obj Disk Device# DeviceNumber Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: StateChangeStarted

Description

Device State Change Start Obj Disk Device# DeviceNumber Protected Protected.

Message #

Device State Change Start Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 2304

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DevicePaused

Description

Device State Paused Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 2304: Device State Paused Obj Disk Device# DeviceNumber Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: DevicePaused

Description

Device State Paused Obj Disk Device# DeviceNumber Protected Protected.

Message #

Device State Paused Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4096

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: StateChangeCompleted

Description

Device State Change Complete Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4096: Device State Change Complete Obj Disk Device# DeviceNumber Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: StateChangeCompleted

Description

Device State Change Complete Obj Disk Device# DeviceNumber Protected Protected.

Message #

Device State Change Complete Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4352

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: RunDownStarted

Description

Rundown Start Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4352: Rundown Start Obj Disk Device# DeviceNumber Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: RunDownStarted

Description

Rundown Start Obj Disk Device# DeviceNumber Protected Protected.

Message #

Rundown Start Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4608

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: RunDownComplete

Description

Rundown Complete Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4608: Rundown Complete Obj Disk Device# DeviceNumber Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Diagnostic
Task: RunDownComplete

Description

Rundown Complete Obj Disk Device# DeviceNumber Protected Protected.

Message #

Rundown Complete Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4864

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceAdded

Description

Device Add - Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 4864: Device Add - Obj Disk Device# DeviceNumber Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Level: Informational
Task: DeviceAdded

Description

Device Add - Obj Disk Device# DeviceNumber Protected Protected.

Message #

Device Add - Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 4864,
    "version": 0,
    "level": 4,
    "task": 113,
    "opcode": 0,
    "keywords": 4611686018427392000,
    "time_created": "2026-05-30T02:33:58.1359016+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5276
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Disk": "0xffffd60c4fa4ccc0",
    "DeviceNumber": "0",
    "Protected": "true",
    "DriveManufacturer": "QEMU",
    "DriveModel": "Standard PC (i440FX + PIIX, 1996)",
    "DriveSerial": "",
    "DriveRevision": "pc-i440fx-10.1",
    "DeviceGuid": "{00000000-0000-0000-0000-000000000000}"
  },
  "message": "Device Add - Obj 0xffffd60c4fa4ccc0 Device# 0 Protected true \r\n  Manufacturer: QEMU \r\n  Model Number: Standard PC (i440FX + PIIX, 1996) \r\n  Serial Number:  \r\n  Revision Level: pc-i440fx-10.1 \r\n  DeviceGuid: {00000000-0000-0000-0000-000000000000}"
}

Event ID 5120

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: RemoveDevice

Description

Device Remove - Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5120: Device Remove - Obj Disk Device# DeviceNumber Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: RemoveDevice

Description

Device Remove - Obj Disk Device# DeviceNumber Protected Protected.

Message #

Device Remove - Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5376

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: AddDevicePath

Description

Add DevicePath Obj Device# Node () PathId Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5376: Add DevicePath Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Level: Informational
Task: AddDevicePath

Description

Add DevicePath Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Message #

Add DevicePath Obj %1 Device# %2 Node %4 (%5) PathId %6 Protected %7 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 5376,
    "version": 0,
    "level": 4,
    "task": 115,
    "opcode": 0,
    "keywords": 4611686018427404288,
    "time_created": "2026-05-30T02:33:58.1359114+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5276
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Disk": "0xffffd60c4fa4ccc0",
    "DeviceNumber": "0",
    "Data1Length": "0",
    "TargetNodeName": "",
    "TargetNode": "0",
    "PathId": "0x1",
    "Protected": "true",
    "DriveManufacturer": "QEMU",
    "DriveModel": "Standard PC (i440FX + PIIX, 1996)",
    "DriveSerial": "",
    "DriveRevision": "pc-i440fx-10.1",
    "DeviceGuid": "{00000000-0000-0000-0000-000000000000}"
  },
  "message": "Add DevicePath Obj 0xffffd60c4fa4ccc0 Device# 0 Node  (0) PathId 0x1 Protected true \r\n  Manufacturer: QEMU \r\n  Model Number: Standard PC (i440FX + PIIX, 1996) \r\n  Serial Number:  \r\n  Revision Level: pc-i440fx-10.1 \r\n  DeviceGuid: {00000000-0000-0000-0000-000000000000}"
}

Event ID 5632

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: RemoveDevicePath

Description

Remove DevicePath - Obj Device# Node () PathId Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5632: Remove DevicePath - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: RemoveDevicePath

Description

Remove DevicePath - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Message #

Remove DevicePath - Obj %1 Device# %2 Node %4 (%5) PathId %6 Protected %7 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5888

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceStarted

Description

DeviceStarted - Obj Device# Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 5888: DeviceStarted - Obj Disk Device# DeviceNumber Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceStarted

Description

DeviceStarted - Obj Disk Device# DeviceNumber Protected Protected.

Message #

DeviceStarted - Obj %1 Device# %2 Protected %3 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 6144

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceStopped

Description

DeviceStopped - Obj Device# Surprise.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Surprise` Boolean
`DeviceGuid` GUID

Event ID 6144: DeviceStopped - Obj Disk Device# DeviceNumber Surprise Surprise.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceStopped

Description

DeviceStopped - Obj Disk Device# DeviceNumber Surprise Surprise.

Message #

DeviceStopped - Obj %1 Device# %2 Surprise %3

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Surprise` Boolean
`DeviceGuid` GUID

Event ID 6400

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DevicePathPause

Description

DevicePathPause - Obj Device# Node () PathId Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Status` HexInt32	NTSTATUS reference
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 6400: DevicePathPause - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Status Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DevicePathPause

Description

DevicePathPause - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Status Status.

Message #

DevicePathPause - Obj %1 Device# %2 Node %4 (%5) PathId %6 Status %7 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Status` HexInt32	NTSTATUS reference
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8192

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DevicePathPaused

Description

DevicePathPaused - Obj Device# Node () PathId Protected.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8192: DevicePathPaused - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DevicePathPaused

Description

DevicePathPaused - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Protected Protected.

Message #

DevicePathPaused - Obj %1 Device# %2  Node %4 (%5) PathId %6 Protected %7 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Protected` Boolean
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8448

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceExceededLatencylimit

Description

DeviceExceededLatencyLimit - Obj Device# Exceed Latency Limit - ms.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Latency` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8448: DeviceExceededLatencyLimit - Obj Disk Device# DeviceNumber Exceed Latency Limit - Latency ms.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceExceededLatencylimit

Description

DeviceExceededLatencyLimit - Obj Disk Device# DeviceNumber Exceed Latency Limit - Latency ms.

Message #

DeviceExceededLatencyLimit - Obj %1 Device# %2 Exceed Latency Limit - %3 ms 
  Manufacturer: %4 
  Model Number: %5 
  Serial Number: %6 
  Revision Level: %7 
  DeviceGuid: %8

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Latency` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8704

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: PathExceededLatencylimit

Description

PathExceededLatencyLimit - Obj Device# Node () PathId Exceed Latency Limit - ms.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Latency` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8704: PathExceededLatencyLimit - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Exceed Latency Limit - Latency ms.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: PathExceededLatencylimit

Description

PathExceededLatencyLimit - Obj Disk Device# DeviceNumber Node TargetNodeName (TargetNode) PathId PathId Exceed Latency Limit - Latency ms.

Message #

PathExceededLatencyLimit - Obj %1 Device# %2 Node %4 (%5) PathId %6 Exceed Latency Limit - %7 ms 
  Manufacturer: %8 
  Model Number: %9 
  Serial Number: %10 
  Revision Level: %11 
  DeviceGuid: %12

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`TargetNode` UInt16
`PathId` HexInt32
`Latency` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 8960

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DevicePathsenumerated

Description

PathEnumerated - Node () Enumerated # paths.

Fields #

Name	Description
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16
`Count` UInt32

Event ID 8960: PathEnumerated - Node TargetNodeName (Node) Enumerated #Count paths.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Level: Informational
Task: DevicePathsenumerated

Description

PathEnumerated - Node TargetNodeName (Node) Enumerated #Count paths.

Message #

PathEnumerated - Node %2 (%3) Enumerated #%4 paths.

Fields #

Name	Description
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16
`Count` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 8960,
    "version": 0,
    "level": 4,
    "task": 123,
    "opcode": 0,
    "keywords": 4611686018431582208,
    "time_created": "2026-05-30T02:33:58.1358392+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5276
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data1Length": "0",
    "TargetNodeName": "",
    "Node": "0",
    "Count": "1"
  },
  "message": "PathEnumerated - Node  (0) Enumerated #1 paths."
}

Event ID 9216

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceArrivalReported

Description

DeviceArrivalReported - Obj Device# DeviceGuid.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DeviceGuid` GUID

Event ID 9216: DeviceArrivalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Level: Informational
Task: DeviceArrivalReported

Description

DeviceArrivalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid.

Message #

DeviceArrivalReported - Obj %1 Device# %2 DeviceGuid: %3

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DeviceGuid` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 9216,
    "version": 0,
    "level": 4,
    "task": 124,
    "opcode": 0,
    "keywords": 4611686018435776512,
    "time_created": "2026-05-30T02:33:58.1359972+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11696
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Disk": "0xffffd60c51c2f560",
    "DeviceNumber": "0",
    "DeviceGuid": "{00000000-0000-0000-0000-000000000000}"
  },
  "message": "DeviceArrivalReported - Obj 0xffffd60c51c2f560 Device# 0 DeviceGuid: {00000000-0000-0000-0000-000000000000}"
}

Event ID 9472

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceRemovalReported

Description

DeviceRemovalReported - Obj Device# DeviceGuid: Reason: Status.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DeviceGuid` GUID
`RemovalReason` UInt32
`RemovalStatus` HexInt32

Event ID 9472: DeviceRemovalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid Reason: RemovalReason Status: RemovalStatus.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceRemovalReported

Description

DeviceRemovalReported - Obj Disk Device# DeviceNumber DeviceGuid: DeviceGuid Reason: RemovalReason Status: RemovalStatus.

Message #

DeviceRemovalReported - Obj %1 Device# %2 DeviceGuid: %3 Reason: %4 Status: %5

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DeviceGuid` GUID
`RemovalReason` UInt32
`RemovalStatus` HexInt32

Event ID 9728

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceReportState

Description

DeviceReportState - Obj Device# State .

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Enabled` Boolean

Event ID 9728: DeviceReportState - Obj Disk Device# DeviceNumber State Enabled.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: DeviceReportState

Description

DeviceReportState - Obj Disk Device# DeviceNumber State Enabled.

Message #

DeviceReportState - Obj %1 Device# %2 State %3.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`Enabled` Boolean

Event ID 9984

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: MultiPathdetected

Description

MultiPath detected for Obj Device#.

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 9984: MultiPath detected for Obj Disk Device# DeviceNumber.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: MultiPathdetected

Description

MultiPath detected for Obj Disk Device# DeviceNumber.

Message #

MultiPath detected for Obj %1 Device# %2 
  Manufacturer: %3 
  Model Number: %4 
  Serial Number: %5 
  Revision Level: %6  
  DeviceGuid: %7

Fields #

Name	Description
`Disk` Pointer
`DeviceNumber` UInt32
`DriveManufacturer` AnsiString
`DriveModel` AnsiString
`DriveSerial` AnsiString
`DriveRevision` AnsiString
`DeviceGuid` GUID

Event ID 10240

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: ReportOperation

Description

Operation: Status.

Fields #

Name	Description
`Operation` AnsiString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Status` HexInt32	NTSTATUS reference
`Data1Length` UInt16
`Data1` UnicodeString
`Data2` UInt32

Event ID 10240: Operation: Operation Status: Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: ReportOperation

Description

Operation: Operation Status: Status.

Message #

Operation: %1 Status: %2 
 Data1: %4 
 Data2: %5

Fields #

Name	Description
`Operation` AnsiString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Status` HexInt32	NTSTATUS reference
`Data1Length` UInt16
`Data1` UnicodeString
`Data2` UInt32

Event ID 10496

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: ReportOperation

Description

Operation: Status.

Fields #

Name	Description
`Operation` AnsiString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Status` HexInt32	NTSTATUS reference
`Data1Length` UInt16
`Data1` UnicodeString
`Data2` UInt32

Event ID 10496: Operation: Operation Status: Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: ReportOperation

Description

Operation: Operation Status: Status.

Message #

Operation: %1 Status: %2 
 Data1: %4 
 Data2: %5

Fields #

Name	Description
`Operation` AnsiString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Status` HexInt32	NTSTATUS reference
`Data1Length` UInt16
`Data1` UnicodeString
`Data2` UInt32

Event ID 12288

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: RuntimeError

Description

Runtime error in @, Node (), Device Path Status=.

Fields #

Name	Description
`Function` AnsiString
`LineNumber` Int32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16
`DeviceNumber` UInt32
`PathId` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 12288: Runtime error in Function@LineNumber, Node TargetNodeName(Node), Device DeviceNumber Path PathId Status=Status.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: RuntimeError

Description

Runtime error in Function@LineNumber, Node TargetNodeName(Node), Device DeviceNumber Path PathId Status=Status.

Message #

Runtime error in %1@%2, Node %4(%5), Device %6 Path %7 Status=%8.

Fields #

Name	Description
`Function` AnsiString
`LineNumber` Int32
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16
`DeviceNumber` UInt32
`PathId` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 12544

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: ProtocolMismatch

Description

Received an invalid output from Node (). This is usually caused by binary incompatibility between the initiator and the target nodes.

Fields #

Name	Description
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16

Event ID 12544: Received an invalid output from Node TargetNodeName(Node).

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: ProtocolMismatch

Description

Received an invalid output from Node TargetNodeName(Node). This is usually caused by binary incompatibility between the initiator and the target nodes.

Message #

Received an invalid output from Node %2(%3). This is usually caused by binary incompatibility between the initiator and the target nodes.

Fields #

Name	Description
`Data1Length` UInt16
`TargetNodeName` UnicodeString
`Node` UInt16

Event ID 12800

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Task: NodeStatusSummary

Description

Summary of the status of IO operations observed on this node during the last minutes.

Fields #

Name	Description
`TimeInMinutes` UInt32
`Data1Length` UInt16
`ErrorSummary` UnicodeString

Event ID 12800: Summary of the status of IO operations observed on this node during the last TimeInMinutes minutes.

Provider: Microsoft-Windows-FailoverClustering-Clusport-Diagnostic
Channel: Operational
Level: Informational
Task: NodeStatusSummary

Description

Summary of the status of IO operations observed on this node during the last TimeInMinutes minutes.

Message #

Summary of the status of IO operations observed on this node during the last %1 minutes:
%3

Fields #

Name	Description
`TimeInMinutes` UInt32
`Data1Length` UInt16
`ErrorSummary` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-Clusport-Diagnostic",
    "guid": "{29C07D0E-E5A0-4E85-A004-1F668531CE22}",
    "event_source_name": "",
    "event_id": 12800,
    "version": 0,
    "level": 4,
    "task": 131,
    "opcode": 0,
    "keywords": 4611686020574871552,
    "time_created": "2026-05-30T04:12:01.2562464+00:00",
    "event_record_id": 9,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 436
    },
    "channel": "Microsoft-Windows-FailoverClustering-Clusport/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TimeInMinutes": "60",
    "Data1Length": "764",
    "ErrorSummary": "\nNode (0):\n\tSTATUS_BAD_NETWORK_PATH: 0\n\tSTATUS_CONNECTION_DISCONNECTED: 0\n\tSTATUS_UNEXPECTED_NETWORK_ERROR: 0\n\tSTATUS_INVALID_NETWORK_RESPONSE: 0\n\tSTATUS_IO_TIMEOUT: 0\n\tSTATUS_CONNECTION_RESET: 0\n\tSTATUS_CONNECTION_ABORTED: 0\n\tSTATUS_ACCESS_DENIED: 0\n\tSTATUS_NETWORK_NAME_DELETED: 0\n\tSTATUS_USER_SESSION_DELETED: 0\n\tSTATUS_FILE_CLOSED: 0\n\tSTATUS_LOGON_FAILURE: 0\n\tSTATUS_SUCCESS: 0\n"
  },
  "message": "Summary of the status of IO operations observed on this node during the last 60 minutes:\r\n\nNode (0):\n\tSTATUS_BAD_NETWORK_PATH: 0\n\tSTATUS_CONNECTION_DISCONNECTED: 0\n\tSTATUS_UNEXPECTED_NETWORK_ERROR: 0\n\tSTATUS_INVALID_NETWORK_RESPONSE: 0\n\tSTATUS_IO_TIMEOUT: 0\n\tSTATUS_CONNECTION_RESET: 0\n\tSTATUS_CONNECTION_ABORTED: 0\n\tSTATUS_ACCESS_DENIED: 0\n\tSTATUS_NETWORK_NAME_DELETED: 0\n\tSTATUS_USER_SESSION_DELETED: 0\n\tSTATUS_FILE_CLOSED: 0\n\tSTATUS_LOGON_FAILURE: 0\n\tSTATUS_SUCCESS: 0\n"
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 29c07d0e-e5a0-4e85-a004-1f668531ce22

Defined in Clusport.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02

Downloads

Microsoft-Windows-FailoverClustering-Clusport-Diagnostic registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)