Microsoft-Windows-FailoverClustering-NetFt

Event	Title	Channel	Sample	Rule
0	Event ID 0	Operational	N	N
0	[AdpCreateAdapter] Invalid Adapter Type	Verbose	N	N
1	Event ID 1	Operational	N	N
1	[AdpCreateAdapter] Invalid Adapter Object size	Verbose	N	N
2	Event ID 2	Operational	N	N
2	[AdpCreateAdapter] AdpInsertAdapterTable failed	Verbose	N	N
3	Event ID 3	Operational	N	N
3	[AdpCreateAdapter] AdapterInitialize failed	Verbose	N	N
4	Event ID 4	Operational	N	N
4	[AdpCreateAdapter] NetftAcquireIoRemoveLock failed	Verbose	N	N
5	Event ID 5	Operational	N	N
5	[AdpCreateAdapter] Failed to allocate memory	Verbose	N	N
6	Event ID 6	Operational	N	N
6	Created Adapter of type Type adapter Context.	Verbose	Y	N
7	Event ID 7	Operational	N	N
7	Deleted Adapter of type Type adapter Context.	Verbose	N	N
8	Event ID 8	Operational	N	N
8	Monitor Context (LocalAddress - RemoteAddress) being marked for special HB.	Verbose	N	N
9	Event ID 9	Operational	N	N
9	Device DeviceContext is processing Irp IrpContext (MajorFunctionCode).	Verbose	N	N
10	Event ID 10	Operational	N	N
10	Device DeviceContext is failed Irp IrpContext (MajorFunctionCode) with …	Verbose	N	N
11	Event ID 11	Operational	N	N
11	Created device object DeviceContext (handle Handle) with Status.	Verbose	Y	N
12	Event ID 12	Operational	N	N
12	Deleted device object DeviceContext (handle Handle).	Verbose	N	N
13	Event ID 13	Operational	N	N
13	Event \KernelObjects\Cluster.	Verbose	N	N
14	Event ID 14	Operational	N	N
14	Failed to create \KernelObjects\Cluster.	Verbose	N	N
15	Event ID 15	Operational	N	N
15	[ProcessNotifyRoutine] : Cluster service PID ProcessId is terminating.	Verbose	N	N
16	Event ID 16	Operational	N	N
16	Failed to open a tunnel adapter bound to address LocalAddress with error Status.	Verbose	N	N
17	Event ID 17	Operational	N	N
17	Failed to allocate memory while creating a tunnel record.	Verbose	N	N
18	Event ID 18	Operational	N	N
18	[NetftDispatchAddRoute] Route already exists	Verbose	N	N
19	Event ID 19	Operational	N	N
19	[NetftDispatchAddRoute] ExtensionSize calculation returned status Status.	Verbose	N	N
20	Event ID 20	Operational	N	N
20	[RegisterClusterService] : Cluster service is already registered.	Verbose	N	N
21	Event ID 21	Operational	N	N
21	[RegisterClusterService] : Cluster service PID is ProcessId.	Verbose	N	N
22	Event ID 22	Operational	N	N
22	[NetftSweepRdbWorkerRoutine] : Routes associated with context Context will be …	Verbose	N	N
23	Event ID 23	Operational	N	N
23	[NetftSweepRdbWorkerRoutine] : Route cleanup timer fired	Verbose	N	N
24	Event ID 24	Operational	N	N
24	[NetftSweepRdbWorkerRoutine] : Route cleanup event signaled	Verbose	N	N
25	Event ID 25	Operational	N	N
25	[ClusterServicePreTerminate] : Cluster service PID is %p is about to go down.	Verbose	N	N
26	Event ID 26	Operational	N	N
26	[ClusterServicePreTerminate]: Deleting routes associated with calling context.	Verbose	N	N
27	Event ID 27	Operational	N	N
27	[ClusterServicePreTerminate]: Couldn't schedule route cleanup.	Verbose	N	N
28	Event ID 28	Operational	N	N
28	[WerCaptureLiveKernelDumpAddSecondaryData] : Adding resource type to secondary …	Verbose	N	N
29	Event ID 29	Operational	N	N
29	[WerCaptureLiveKernelDumpAddSecondaryData] : Secondary data GUID; Size 0xSize; …	Verbose	N	N
30	Event ID 30	Operational	N	N
30	[WerCaptureLiveKernelDump] : Live dump collection is disabled.	Verbose	N	N
31	Event ID 31	Operational	N	N
31	[WerCaptureLiveKernelDump] : Live dump collection is throttled.	Verbose	N	N
32	Event ID 32	Operational	N	N
32	[WerCaptureLiveKernelDump] Threshold time is not met.	Verbose	N	N
33	Event ID 33	Operational	N	N
33	[NetftDispatchSetLiveDumpPolicy] : Live dump policy = LiveDumpPolicy.	Verbose	N	N
34	Event ID 34	Operational	N	N
34	[NetftDispatchSetOperationalVersion] : Operational Version = Version.	Verbose	N	N
35	Event ID 35	Operational	N	N
35	[NetftIssueEvent] Failed to allocate entry for EventType event.	Verbose	N	N
36	Event ID 36	Operational	N	N
36	[NetftIssueEvent] Invalid event type specified (EventType event).	Verbose	N	N
37	Event ID 37	Operational	N	N
37	Starvation threshold reached.	Verbose	N	N
38	Event ID 38	Operational	N	N
38	Pending event IRP IrpContext is being cancelled.	Verbose	N	N
39	Event ID 39	Operational	N	N
39	-----------------------------+ LOG BEGIN +-----------------------------	Verbose	N	N
40	Event ID 40	Operational	N	N
40	Driver %p is loading, registry path %S.	Verbose	N	N
41	Event ID 41	Operational	N	N
41	Driver %p failed to register with ETW (status %x).	Verbose	N	N
42	Event ID 42	Operational	N	N
42	Driver %p failed initialization with %x	Verbose	N	N
43	Event ID 43	Operational	N	N
43	Miniport adapter AdapterContext failed to query permanent data link address.	Verbose	N	N
44	Event ID 44	Operational	N	N
44	MaInitializeAdapter: Creating MiniportCounterSet instance 'Instance' result …	Verbose	Y	N
45	Event ID 45	Operational	N	N
45	[DROP] MaSendPackets - Tcb creation failed, adapter AdapterContext.	Verbose	N	N
46	Event ID 46	Operational	N	N
46	[DROP] MaSendPackets - Adapter AdapterContext is not active.	Verbose	N	N
47	Event ID 47	Operational	N	N
47	NetBufferList NBLContext with NLBCount NetBuffers completed send with error …	Verbose	N	N
48	Event ID 48	Operational	N	N
48	MaStatus: Miniport adapter AdapterContext signals connect.	Verbose	N	N
49	Event ID 49	Operational	N	N
49	MaStatus: Miniport adapter AdapterContext signals disconnect.	Verbose	N	N
50	Event ID 50	Operational	N	N
50	[DROP] MaReceivePacket - Adapter %p is not active	Verbose	N	N
51	Event ID 51	Operational	N	N
51	Received a split packet of size Size, split at byte Offset.	Verbose	N	N
52	Event ID 52	Operational	N	N
52	Generated data link address Layer2Address.	Verbose	Y	N
53	Event ID 53	Operational	N	N
53	Searching for registered data link address at interface index InterfaceIndex, …	Verbose	Y	N
54	Event ID 54	Operational	N	N
54	Using registered data link address Instance.	Verbose	N	N
55	Event ID 55	Operational	N	N
55	Found data link address collision with physical address on interface index …	Verbose	N	N
56	Event ID 56	Operational	N	N
56	Found data link address collision with permanentphysical address on interface …	Verbose	N	N
57	Event ID 57	Operational	N	N
57	Successfully generated data link address Layer2Address.	Verbose	Y	N
58	Event ID 58	Operational	N	N
58	[DROP] MaBuildTcbChain - Send from LocalAddress to RemoteAddress failed …	Verbose	N	N
59	Event ID 59	Operational	N	N
59	[DROP] MaBuildTcbChain - Send from LocalAddress to RemoteAddress failed …	Verbose	N	N
60	Event ID 60	Operational	N	N
60	Initializing NDIS miniport AdapterHandle.	Verbose	Y	N
61	Event ID 61	Operational	N	N
61	Initialized NDIS miniport AdapterHandle.	Verbose	Y	N
62	Event ID 62	Operational	N	N
62	Initialize NDIS miniport AdapterHandle failed with Status.	Verbose	N	N
63	Event ID 63	Operational	N	N
63	Miniport adapter AdapterContext halted.	Verbose	N	N
64	Event ID 64	Operational	N	N
64	NDIS attempted to cancel send operation.	Verbose	N	N
65	Event ID 65	Operational	N	N
65	Driver DriverContext unloaded.	Verbose	N	N
66	Event ID 66	Operational	N	N
66	Interface NetbiosName was inserted into the system.	Verbose	N	N
67	Event ID 67	Operational	N	N
67	Interface NetbiosName was removed from the system.	Verbose	N	N
68	Event ID 68	Operational	N	N
68	nconsistent route count.	Verbose	N	N
69	Event ID 69	Operational	N	N
69	[RmInitializeAdapter] no valid configuration.	Verbose	N	N
70	Event ID 70	Operational	N	N
70	[RmInitializeAdapter] Heartbeat parameters are not valid.	Verbose	N	N
71	Event ID 71	Operational	N	N
71	[RmInitializeAdapter] RmCreateSecurityContext failed.	Verbose	N	N
72	Event ID 72	Operational	N	N
72	[RmInitializeAdapter] TotalMessage Size is too large Status.	Verbose	N	N
73	Event ID 73	Operational	N	N
73	[RmInitializeAdapter] NdisAllocateMemoryWithTag failed with Status.	Verbose	N	N
74	Event ID 74	Operational	N	N
74	[RmInitializeAdapter] NdisAllocateNetBufferListPool failed with Status.	Verbose	N	N
75	Event ID 75	Operational	N	N
75	[RmInitializeAdapter] AdpOpenTunnelAdapter returned Status.	Verbose	N	N
76	Event ID 76	Operational	N	N
76	Monitor MonitorContext started HB from LocalAddress to RemoteAddress with delay …	Verbose	N	N
77	Event ID 77	Operational	N	N
77	RmCreateCounterSet: Creating RouteMonitorCounterSet instance 'LocalAddress - …	Verbose	N	N
78	Event ID 78	Operational	N	N
78	Monitor MonitorContext forced the endpoint RemoteAddress to be unreachable.	Verbose	N	N
79	Event ID 79	Operational	N	N
79	Monitor MonitorContext stopped HB to RemoteAddress.	Verbose	N	N
80	Event ID 80	Operational	N	N
80	Monitor MonitorContext (LocalAddress - RemoteAddress) missed two-fifth …	Verbose	N	N
81	Event ID 81	Operational	N	N
81	Monitor MonitorContext (LocalAddress - RemoteAddress) reached HB threshold, …	Verbose	N	N
82	Event ID 82	Operational	N	N
82	Monitor MonitorContext (LocalAddress - RemoteAddress) missed HB response, …	Verbose	N	N
83	Event ID 83	Operational	N	N
83	Monitor MonitorContext routine RmHeartbeatTimerDpc took too long to complete.	Verbose	N	N
84	Event ID 84	Operational	N	N
84	Monitor MonitorContext (LocalAddress - RemoteAddress) sending RCP stop adapter …	Verbose	N	N
85	Event ID 85	Operational	N	N
85	[DROP] RmSendPackets - Tcb Creation Failed for RmAdapter MonitorContext.	Verbose	N	N
86	Event ID 86	Operational	N	N
86	[DROP] RmSendPackets - Could not find TunnelAdapter for RmAdapter …	Verbose	N	N
87	Event ID 87	Operational	N	N
87	Monitor MonitorContext routine RmSendPackets took too long to complete.	Verbose	N	N
88	Event ID 88	Operational	N	N
88	Switched tunnel for this RMA from OldTunnelAddress to NewTunnelAddress.	Verbose	N	N
89	Event ID 89	Operational	N	N
89	Monitor MonitorContext routine RmSendComplete took too long to complete.	Verbose	N	N
90	Event ID 90	Operational	N	N
90	[DROP] Monitor MonitorContext (LocalAddress - RemoteAddress) Ignoring incomming …	Verbose	N	N
91	Event ID 91	Operational	N	N
91	Monitor MonitorContext (LocalAddress - RemoteAddress) received RCP request …	Verbose	N	N
92	Event ID 92	Operational	N	N
92	Monitor MonitorContext (LocalAddress - RemoteAddress) received RCP request …	Verbose	N	N
93	Event ID 93	Operational	N	N
93	[DROP] Monitor MonitorContext (LocalAddress - RemoteAddress) received …	Verbose	N	N
94	Event ID 94	Operational	N	N
94	[DROP] Monitor MonitorContext (LocalAddress - RemoteAddress) RmParseRcpPacket …	Verbose	N	N
95	Event ID 95	Operational	N	N
95	Monitor MonitorContext routine RmReceivePacket took too long to complete.	Verbose	N	N
96	Event ID 96	Operational	N	N
96	Monitor adapter MonitorContext signals media connect.	Verbose	N	N
97	Event ID 97	Operational	N	N
97	Monitor adapter MonitorContext signals media disconnect.	Verbose	N	N
98	Event ID 98	Operational	N	N
98	Monitor MonitorContext was disconnected, remote endpoint RemoteAddress is …	Verbose	N	N
99	Event ID 99	Operational	N	N
99	Monitor adapter MonitorContext signals status change Status.	Verbose	N	N
100	Event ID 100	Operational	N	N
100	Monitor MonitorContext (LocalAddress - RemoteAddress) failed to sign RCP message …	Verbose	N	N
101	Event ID 101	Operational	N	N
101	Monitor MonitorContext detected that remote endpoint RemoteAddress is reachable.	Verbose	N	N
102	Event ID 102	Operational	N	N
102	Monitor MonitorContext routine RmProcessRcpRequest took too long to complete.	Verbose	N	N
103	Event ID 103	Operational	N	N
103	Failed to invalidate ARP cache.	Verbose	N	N
104	Event ID 104	Operational	N	N
104	Failed to invalidate neighbor cache.	Verbose	N	N
105	Event ID 105	Operational	N	N
105	Failed to invalidate neighbor cache fault-tolerant adapter not found.	Verbose	N	N
106	Event ID 106	Operational	N	N
106	Monitor MonitorContext routine RmpUpdateNeighborEntries took too long to …	Verbose	N	N
107	Event ID 107	Operational	N	N
107	[RmStoreHeartbeatRecord] Monitor MonitorContext (LocalAddress - RemoteAddress) …	Verbose	N	N
108	Event ID 108	Operational	N	N
108	[RmStoreHeartbeatRecord] Monitor MonitorContext (LocalAddress - RemoteAddress) …	Verbose	N	N
109	Event ID 109	Operational	N	N
109	[RmHandleHeartbeatResponse] Monitor MonitorContext (LocalAddress - …	Verbose	N	N
110	Event ID 110	Operational	N	N
110	Failed to allocate neighbor update work item	Verbose	N	N
111	Event ID 111	Operational	N	N
111	Validation of RCP packet failed - Packet too small (DataLength bytes).	Verbose	N	N
112	Event ID 112	Operational	N	N
112	Validation of RCP packet failed - Bad message type (Type).	Verbose	N	N
113	Event ID 113	Operational	N	N
113	Validation of RCP packet failed - Bad version (Version).	Verbose	N	N
114	Event ID 114	Operational	N	N
114	Validation of RCP packet failed - Invalid reserved value (Reserved).	Verbose	N	N
115	Event ID 115	Operational	N	N
115	Validation of RCP packet failed - Invalid extension header order (NextHeader).	Verbose	N	N
116	Event ID 116	Operational	N	N
116	Validation of RCP packet failed - Invalid IPv4 address pair.	Verbose	N	N
117	Event ID 117	Operational	N	N
117	Validation of RCP packet failed - Invalid IPv6 address pair.	Verbose	N	N
118	Event ID 118	Operational	N	N
118	Validation of RCP packet failed - Invalid address pair extension header.	Verbose	N	N
119	Event ID 119	Operational	N	N
119	Validation of RCP packet failed - Invalid signature buffer.	Verbose	N	N
120	Event ID 120	Operational	N	N
120	Validation of RCP packet failed - Invalid signature extension header.	Verbose	N	N
121	Event ID 121	Operational	N	N
121	Validation of RCP packet failed - Monitor MonitorContext failed to verify …	Verbose	N	N
122	Event ID 122	Operational	N	N
122	Validation of RCP packet failed - Missing signature extension header.	Verbose	N	N
123	Event ID 123	Operational	N	N
123	Validation of RCP packet failed - Route monitor (LocalAddress - RemoteAddress) …	Verbose	N	N
124	Event ID 124	Operational	N	N
124	Validation of RCP packet failed - Invalid RCP header.	Verbose	N	N
125	Event ID 125	Operational	N	N
125	Error in RmParseRcpPacketForLRR, could not retrieve packet in contiguous buffer …	Verbose	N	N
126	Event ID 126	Operational	N	N
126	Reference process object (ID 0xProcessID, handle 0xHandle) by handle failed with …	Verbose	N	N
127	Event ID 127	Operational	N	N
127	Open client process (ID 0xProcessID) failed with Status.	Verbose	N	N
128	Event ID 128	Operational	N	N
128	Close client process (handle 0xHandle) failed with Status.	Verbose	N	N
129	Event ID 129	Operational	N	N
129	TaInitializeAdapter: Creating TunnelCounterSet instance 'EndpointAddress' result …	Verbose	N	N
130	Event ID 130	Operational	N	N
130	TaDeInitializeAdapter: Releasing Endpoint TunnelCounterSet instance …	Verbose	N	N
131	Event ID 131	Operational	N	N
131	[DROP] TaSendTcb - Adapter Adapter not ready to send to EndpointAddress.	Verbose	N	N
132	Event ID 132	Operational	N	N
132	[DROP] TaReceivePacket - Receive from LocalAddress to RemoteAddress failed …	Verbose	N	N
133	Event ID 133	Operational	N	N
133	Tunnel adapter Adapter signals media connect.	Verbose	N	N
134	Event ID 134	Operational	N	N
134	Tunnel adapter Adapter signals media disconnect.	Verbose	N	N
135	Event ID 135	Operational	N	N
135	Tunnel adapter Adapter signals status change Status.	Verbose	N	N
136	Event ID 136	Operational	N	N
136	[DROP] Dropping received RCP messages from RemoteAddress.	Verbose	N	N
137	Event ID 137	Operational	N	N
137	[DROP] Dropping received RCP messages from RemoteAddress invalid port number.	Verbose	N	N
138	Event ID 138	Operational	N	N
138	[DROP] TaFilterPacket Invalid Ethernet Header	Verbose	N	N
139	Event ID 139	Operational	N	N
139	[DROP] TaFilterPacket NetftInitializeDataBuffer failed	Verbose	N	N
140	Event ID 140	Operational	N	N
140	The client process (ID 0xProcessId) was terminated.	Verbose	N	N
141	Event ID 141	Operational	N	N
141	Watchdog timer timed out for the client process (ID 0xProcessId).	Verbose	N	N
142	Event ID 142	Operational	N	N
142	Watchdog timer timed out for the client process (ID 0xProcessId).	Verbose	N	N
143	Event ID 143	Operational	N	N
143	Tunnel adapter EndpointContext bound to EndpointAddress.	Verbose	N	N
144	Event ID 144	Operational	N	N
144	Tunnel adapter EndpointContext failed to create socket EndpointAddress (status …	Verbose	N	N
145	Event ID 145	Operational	N	N
145	NetftEndpointCreateCounterSet: Creating WskCounterSet instance 'EndpointAddress' …	Verbose	N	N
146	Event ID 146	Operational	N	N
146	[DROP] NetftSendDatagram - IoAllocateIrp failed when trying to send to …	Verbose	N	N
147	Event ID 147	Operational	N	N
147	[DROP] NetftSendDatagram - NdisAllocateFromNPagedLookasideList failed when …	Verbose	N	N
148	Event ID 148	Operational	N	N
148	[DROP] NetftReceiveDatagramHandler - AdpReferenceAdapterSafe failed (tunnel …	Verbose	N	N
149	Event ID 149	Operational	N	N
149	[DROP] NetftReceiveDatagramHandler - Tunnel adapter EndpointContext is stopping.	Verbose	N	N
150	Event ID 150	Operational	N	N
150	[DROP] NetftReceiveDatagramHandler - Tunnel adapter EndpointContext is not …	Verbose	N	N
151	Event ID 151	Operational	N	N
151	[DROP] Underlying socket terminated by WSK provider (tunnel adapter …	Verbose	N	N
152	Event ID 152	Operational	N	N
152	[DROP] Tunnel adapter EndpointContext failed to build datagram descriptor list.	Verbose	N	N
153	Event ID 153	Operational	N	N
153	Tunnel adapter EndpointContext unbound from EndpointAddress with Status.	Verbose	N	N
154	Event ID 154	Operational	N	N
154	Tunnel adapter failed to allocate NBL.	Verbose	N	N
155	Event ID 155	Operational	N	N
155	[NetftQueryIfIndexByDataLinkddress] : NetftEnumerateInterfaces returned status …	Verbose	N	N
156	Event ID 156	Operational	N	N
156	[NetftIsFaultTolerantIpAddress] : AdpOpenMiniportAdapter returned status Status.	Verbose	N	N
157	Event ID 157	Operational	N	N
157	[NetftIsFaultTolerantIpAddress] : NetftQueryIfIndexByIpAddress returned status …	Verbose	N	N
158	Event ID 158	Operational	N	N
158	Insert EndpointAddress into interface InterfaceId completed with Status.	Verbose	N	N
159	Event ID 159	Operational	N	N
159	Insert EndpointAddress into interface InterfaceId completed with Status.	Verbose	N	N
160	Event ID 160	Operational	N	N
160	Remove EndpointAddress from interface InterfaceId completed with Status.	Verbose	N	N
161	Event ID 161	Operational	N	N
161	Remove EndpointAddress from interface InterfaceId completed with Status.	Verbose	N	N
162	Event ID 162	Operational	N	N
162	Failed to register address change handler with IPv4/802 provider (Status).	Verbose	N	N
163	Event ID 163	Operational	N	N
163	Failed to register address change handler with IPv6/802 provider (Status).	Verbose	N	N
164	Event ID 164	Operational	N	N
164	Failed to register media sense handler with NDIS provider (Status).	Verbose	N	N
165	Event ID 165	Operational	N	N
165	PnP signals Context address change (NotificationType).	Verbose	Y	N
166	Event ID 166	Operational	N	N
166	Interface InterfaceId signals address EndpointAddress IP DAD State change to …	Verbose	N	N
167	Event ID 167	Operational	N	N
167	Interface InterfaceId signals address EndpointAddress IP DAD State change to …	Verbose	N	N
168	Event ID 168	Operational	N	N
168	PnP signals interface operational status change (NotificationType).	Verbose	Y	N
169	Event ID 169	Operational	N	N
169	Interface InterfaceId signals operational status Status.	Verbose	N	N
4096	Driver loaded.	Operational	Y	N
8192	Watchdog Started.	Operational	N	N
12288	Watchdog Stopped.	Operational	N	N
16384	Watchdog Heartbeat Missed.	Operational	N	N
20480	Watchdog Fired.	Operational	N	N
24576	Watchdog Updated.	Operational	N	N
28672	Watchdog Orphaned.	Operational	N	N
32768	Watchdog Orphaned.	Operational	N	N
36864	Route added from SourceIP to DestinationIP for context Context, …	Operational	N	N
40960	Route from SourceIP to DestinationIP deleted for context Context, …	Operational	N	N
45056	Route cleanup scheduled for context Context, ContextRouteCount: …	Operational	N	N
49152	Livedump started.	Operational	N	N
53248	Livedump Completed.	Operational	N	N
57344	DPC Skew detected for Monitor Context.	Operational	N	N

Event ID 0

Channel: Operational
Task: NetftTraceMessage

Description

[AdpCreateAdapter] Invalid Adapter Type.

Event ID 0: [AdpCreateAdapter] Invalid Adapter Type

Channel: Verbose
Task: NetftTraceMessage

Event ID 1

Channel: Operational
Task: NetftTraceMessage

Description

[AdpCreateAdapter] Invalid Adapter Object size.

Event ID 1: [AdpCreateAdapter] Invalid Adapter Object size

Channel: Verbose
Task: NetftTraceMessage

Event ID 2

Channel: Operational
Task: NetftTraceMessage

Description

[AdpCreateAdapter] AdpInsertAdapterTable failed.

Event ID 2: [AdpCreateAdapter] AdpInsertAdapterTable failed

Channel: Verbose
Task: NetftTraceMessage

Event ID 3

Channel: Operational
Task: NetftTraceMessage

Description

[AdpCreateAdapter] AdapterInitialize failed.

Event ID 3: [AdpCreateAdapter] AdapterInitialize failed

Channel: Verbose
Task: NetftTraceMessage

Event ID 4

Channel: Operational
Task: NetftTraceMessage

Description

[AdpCreateAdapter] NetftAcquireIoRemoveLock failed.

Event ID 4: [AdpCreateAdapter] NetftAcquireIoRemoveLock failed

Channel: Verbose
Task: NetftTraceMessage

Event ID 5

Channel: Operational
Task: NetftTraceMessage

Description

[AdpCreateAdapter] Failed to allocate memory.

Event ID 5: [AdpCreateAdapter] Failed to allocate memory

Channel: Verbose
Task: NetftTraceMessage

Event ID 6

Channel: Operational
Task: NetftTraceMessage

Description

Created Adapter of type adapter.

Fields #

Name	Description
`Type` HexInt32
`Context` HexInt64

Event ID 6: Created Adapter of type Type adapter Context.

Channel: Verbose
Level: Informational
Task: NetftTraceMessage

Message #

Created Adapter of type %1 adapter %2

Fields #

Name	Description
`Type` HexInt32
`Context` HexInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 4,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213693984,
    "time_created": "2026-05-30T02:33:58.5722063+00:00",
    "event_record_id": 31,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Type": "0x0",
    "Context": "0xffffd60c5e9d47d0"
  },
  "message": "Created Adapter of type 0x0 adapter 0xFFFFD60C5E9D47D0"
}

Event ID 7

Channel: Operational
Task: NetftTraceMessage

Description

Deleted Adapter of type adapter.

Fields #

Name	Description
`Type` HexInt32
`Context` HexInt64

Event ID 7: Deleted Adapter of type Type adapter Context.

Channel: Verbose
Task: NetftTraceMessage

Message #

Deleted Adapter of type %1 adapter %2

Fields #

Name	Description
`Type` HexInt32
`Context` HexInt64

Event ID 8

Channel: Operational
Task: NetftTraceMessage

Description

Monitor ( - ) being marked for special HB.

Fields #

Name	Description
`Context` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 8: Monitor Context (LocalAddress - RemoteAddress) being marked for special HB.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 (%3 - %5) being marked for special HB

Fields #

Name	Description
`Context` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 9

Channel: Operational
Task: NetftTraceMessage

Description

Device is processing Irp ().

Fields #

Name	Description
`DeviceContext` HexInt64
`IrpContext` HexInt64
`MajorFunctionCode` HexInt32

Event ID 9: Device DeviceContext is processing Irp IrpContext (MajorFunctionCode).

Channel: Verbose
Task: NetftTraceMessage

Message #

Device %1 is processing Irp %2 (%3)

Fields #

Name	Description
`DeviceContext` HexInt64
`IrpContext` HexInt64
`MajorFunctionCode` HexInt32

Event ID 10

Channel: Operational
Task: NetftTraceMessage

Description

Device is failed Irp () with.

Fields #

Name	Description
`DeviceContext` HexInt64
`IrpContext` HexInt64
`MajorFunctionCode` HexInt32
`ErrorCode` HexInt32

Event ID 10: Device DeviceContext is failed Irp IrpContext (MajorFunctionCode) with ErrorCode.

Channel: Verbose
Task: NetftTraceMessage

Message #

Device %1 is failed Irp %2 (%3) with %4

Fields #

Name	Description
`DeviceContext` HexInt64
`IrpContext` HexInt64
`MajorFunctionCode` HexInt32
`ErrorCode` HexInt32

Event ID 11

Channel: Operational
Task: NetftTraceMessage

Description

Created device object (handle ) with.

Fields #

Name	Description
`DeviceContext` HexInt64
`Handle` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 11: Created device object DeviceContext (handle Handle) with Status.

Channel: Verbose
Level: Informational
Task: NetftTraceMessage

Message #

Created device object %1 (handle %2) with %3

Fields #

Name	Description
`DeviceContext` HexInt64
`Handle` HexInt64
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 4,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213694016,
    "time_created": "2026-05-30T02:33:58.5716884+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceContext": "0xffffd60c5c693060",
    "Handle": "0xffffd60c5c6931b0",
    "Status": "0x0"
  },
  "message": "Created device object 0xFFFFD60C5C693060 (handle 0xFFFFD60C5C6931B0) with 0x0"
}

Event ID 12

Channel: Operational
Task: NetftTraceMessage

Description

Deleted device object (handle ).

Fields #

Name	Description
`DeviceContext` HexInt64
`Handle` HexInt64

Event ID 12: Deleted device object DeviceContext (handle Handle).

Channel: Verbose
Task: NetftTraceMessage

Message #

Deleted device object %1 (handle %2)

Fields #

Name	Description
`DeviceContext` HexInt64
`Handle` HexInt64

Event ID 13

Channel: Operational
Task: NetftTraceMessage

Description

Event \KernelObjects\Cluster.Service.Running.Event still exists. Trying to open existing event.

Event ID 13: Event \KernelObjects\Cluster.

Channel: Verbose
Task: NetftTraceMessage

Description

Event \KernelObjects\Cluster.Service.Running.Event still exists. Trying to open existing event.

Message #

Event \KernelObjects\Cluster.Service.Running.Event still exists. Trying to open existing event

Event ID 14

Channel: Operational
Task: NetftTraceMessage

Description

Failed to create \KernelObjects\Cluster.Service.Running.Event.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 14: Failed to create \KernelObjects\Cluster.

Channel: Verbose
Task: NetftTraceMessage

Description

Failed to create \KernelObjects\Cluster.Service.Running.Event. Status.

Message #

Failed to create \KernelObjects\Cluster.Service.Running.Event. %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 15

Channel: Operational
Task: NetftTraceMessage

Description

[ProcessNotifyRoutine] : Cluster service PID is terminating. Setting event.

Fields #

Name	Description
`ProcessId` HexInt64

Event ID 15: [ProcessNotifyRoutine] : Cluster service PID ProcessId is terminating.

Channel: Verbose
Task: NetftTraceMessage

Description

[ProcessNotifyRoutine] : Cluster service PID ProcessId is terminating. Setting event.

Message #

[ProcessNotifyRoutine] : Cluster service PID %1 is terminating. Setting event

Fields #

Name	Description
`ProcessId` HexInt64

Event ID 16

Channel: Operational
Task: NetftTraceMessage

Description

Failed to open a tunnel adapter bound to address with error.

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 16: Failed to open a tunnel adapter bound to address LocalAddress with error Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Failed to open a tunnel adapter bound to address %2 with error %3

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 17

Channel: Operational
Task: NetftTraceMessage

Description

Failed to allocate memory while creating a tunnel record. Error =.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 17: Failed to allocate memory while creating a tunnel record.

Channel: Verbose
Task: NetftTraceMessage

Description

Failed to allocate memory while creating a tunnel record. Error = Status.

Message #

Failed to allocate memory while creating a tunnel record. Error = %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 18

Channel: Operational
Task: NetftTraceMessage

Description

[NetftDispatchAddRoute] Route already exists.

Event ID 18: [NetftDispatchAddRoute] Route already exists

Channel: Verbose
Task: NetftTraceMessage

Event ID 19

Channel: Operational
Task: NetftTraceMessage

Description

[NetftDispatchAddRoute] ExtensionSize calculation returned status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 19: [NetftDispatchAddRoute] ExtensionSize calculation returned status Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftDispatchAddRoute] ExtensionSize calculation returned status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 20

Channel: Operational
Task: NetftTraceMessage

Description

[RegisterClusterService] : Cluster service is already registered. Cluster service PID . Current process PID .

Fields #

Name	Description
`NewProcessId` HexInt64
`CurProcessId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 20: [RegisterClusterService] : Cluster service is already registered.

Channel: Verbose
Task: NetftTraceMessage

Description

[RegisterClusterService] : Cluster service is already registered. Cluster service PID NewProcessId. Current process PID CurProcessId. Status.

Message #

[RegisterClusterService] : Cluster service is already registered. Cluster service PID %1. Current process PID %2. %3

Fields #

Name	Description
`NewProcessId` HexInt64
`CurProcessId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 21

Channel: Operational
Task: NetftTraceMessage

Description

[RegisterClusterService] : Cluster service PID is . Resetting event.

Fields #

Name	Description
`ProcessId` HexInt64

Event ID 21: [RegisterClusterService] : Cluster service PID is ProcessId.

Channel: Verbose
Task: NetftTraceMessage

Description

[RegisterClusterService] : Cluster service PID is ProcessId. Resetting event.

Message #

[RegisterClusterService] : Cluster service PID is %1. Resetting event

Fields #

Name	Description
`ProcessId` HexInt64

Event ID 22

Channel: Operational
Task: NetftTraceMessage

Description

[NetftSweepRdbWorkerRoutine] : Routes associated with context will be deleted when the wait completes.

Fields #

Name	Description
`Context` HexInt64

Event ID 22: [NetftSweepRdbWorkerRoutine] : Routes associated with context Context will be deleted when the wait completes.

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftSweepRdbWorkerRoutine] : Routes associated with context %1 will be deleted when the wait completes

Fields #

Name	Description
`Context` HexInt64

Event ID 23

Channel: Operational
Task: NetftTraceMessage

Description

[NetftSweepRdbWorkerRoutine] : Route cleanup timer fired.

Event ID 23: [NetftSweepRdbWorkerRoutine] : Route cleanup timer fired

Channel: Verbose
Task: NetftTraceMessage

Event ID 24

Channel: Operational
Task: NetftTraceMessage

Description

[NetftSweepRdbWorkerRoutine] : Route cleanup event signaled.

Event ID 24: [NetftSweepRdbWorkerRoutine] : Route cleanup event signaled

Channel: Verbose
Task: NetftTraceMessage

Event ID 25

Channel: Operational
Task: NetftTraceMessage

Description

[ClusterServicePreTerminate] : Cluster service PID is %p is about to go down.

Fields #

Name	Description
`ProcessId` HexInt64

Event ID 25: [ClusterServicePreTerminate] : Cluster service PID is %p is about to go down.

Channel: Verbose
Task: NetftTraceMessage

Fields #

Name	Description
`ProcessId` HexInt64

Event ID 26

Channel: Operational
Task: NetftTraceMessage

Description

[ClusterServicePreTerminate]: Deleting routes associated with calling context.

Event ID 26: [ClusterServicePreTerminate]: Deleting routes associated with calling context.

Channel: Verbose
Task: NetftTraceMessage

Event ID 27

Channel: Operational
Task: NetftTraceMessage

Description

[ClusterServicePreTerminate]: Couldn't schedule route cleanup. Deleting routes.

Event ID 27: [ClusterServicePreTerminate]: Couldn't schedule route cleanup.

Channel: Verbose
Task: NetftTraceMessage

Description

[ClusterServicePreTerminate]: Couldn't schedule route cleanup. Deleting routes.

Message #

[ClusterServicePreTerminate]: Couldn't schedule route cleanup. Deleting routes

Event ID 28

Channel: Operational
Task: NetftTraceMessage

Description

[WerCaptureLiveKernelDumpAddSecondaryData] : Adding resource type to secondary data ; Status.

Fields #

Name	Description
`GUID` GUID
`ReportType` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 28: [WerCaptureLiveKernelDumpAddSecondaryData] : Adding resource type to secondary data GUID ReportType; Status Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[WerCaptureLiveKernelDumpAddSecondaryData] : Adding resource type to secondary data %1 %2; Status %3

Fields #

Name	Description
`GUID` GUID
`ReportType` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 29

Channel: Operational
Task: NetftTraceMessage

Description

[WerCaptureLiveKernelDumpAddSecondaryData] : Secondary data ; Size 0x; Status.

Fields #

Name	Description
`GUID` GUID
`Size` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 29: [WerCaptureLiveKernelDumpAddSecondaryData] : Secondary data GUID; Size 0xSize; Status Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[WerCaptureLiveKernelDumpAddSecondaryData] : Secondary data %1; Size 0x%2; Status %3

Fields #

Name	Description
`GUID` GUID
`Size` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 30

Channel: Operational
Task: NetftTraceMessage

Description

[WerCaptureLiveKernelDump] : Live dump collection is disabled. Current policy.

Fields #

Name	Description
`LiveDumpPolicy` HexInt64

Event ID 30: [WerCaptureLiveKernelDump] : Live dump collection is disabled.

Channel: Verbose
Task: NetftTraceMessage

Description

[WerCaptureLiveKernelDump] : Live dump collection is disabled. Current policy LiveDumpPolicy.

Message #

[WerCaptureLiveKernelDump] : Live dump collection is disabled. Current policy %1

Fields #

Name	Description
`LiveDumpPolicy` HexInt64

Event ID 31

Channel: Operational
Task: NetftTraceMessage

Description

[WerCaptureLiveKernelDump] : Live dump collection is throttled.

Event ID 31: [WerCaptureLiveKernelDump] : Live dump collection is throttled.

Channel: Verbose
Task: NetftTraceMessage

Event ID 32

Channel: Operational
Task: NetftTraceMessage

Description

[WerCaptureLiveKernelDump] Threshold time is not met. Threshold value , Threshold time , Current time , Remaining x 100ns.

Fields #

Name	Description
`ThresholdTime` HexInt64
`Threshold` HexInt64
`CurrentTime` HexInt64
`TimeDeltaRemaining` HexInt64

Event ID 32: [WerCaptureLiveKernelDump] Threshold time is not met.

Channel: Verbose
Task: NetftTraceMessage

Description

[WerCaptureLiveKernelDump] Threshold time is not met. Threshold value ThresholdTime, Threshold time Threshold, Current time CurrentTime, Remaining TimeDeltaRemaining x 100ns.

Message #

[WerCaptureLiveKernelDump] Threshold time is not met. Threshold value %1, Threshold time %2, Current time %3, Remaining %4 x 100ns

Fields #

Name	Description
`ThresholdTime` HexInt64
`Threshold` HexInt64
`CurrentTime` HexInt64
`TimeDeltaRemaining` HexInt64

Event ID 33

Channel: Operational
Task: NetftTraceMessage

Description

[NetftDispatchSetLiveDumpPolicy] : Live dump policy =.

Fields #

Name	Description
`LiveDumpPolicy` HexInt64

Event ID 33: [NetftDispatchSetLiveDumpPolicy] : Live dump policy = LiveDumpPolicy.

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftDispatchSetLiveDumpPolicy] : Live dump policy = %1

Fields #

Name	Description
`LiveDumpPolicy` HexInt64

Event ID 34

Channel: Operational
Task: NetftTraceMessage

Description

[NetftDispatchSetOperationalVersion] : Operational Version =.

Fields #

Name	Description
`Version` HexInt32

Event ID 34: [NetftDispatchSetOperationalVersion] : Operational Version = Version.

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftDispatchSetOperationalVersion] : Operational Version =  %1

Fields #

Name	Description
`Version` HexInt32

Event ID 35

Channel: Operational
Task: NetftTraceMessage

Description

[NetftIssueEvent] Failed to allocate entry for event.

Fields #

Name	Description
`EventType` HexInt32

Event ID 35: [NetftIssueEvent] Failed to allocate entry for EventType event.

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftIssueEvent] Failed to allocate entry for %1 event

Fields #

Name	Description
`EventType` HexInt32

Event ID 36

Channel: Operational
Task: NetftTraceMessage

Description

[NetftIssueEvent] Invalid event type specified ( event).

Fields #

Name	Description
`EventType` HexInt32

Event ID 36: [NetftIssueEvent] Invalid event type specified (EventType event).

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftIssueEvent] Invalid event type specified (%1 event)

Fields #

Name	Description
`EventType` HexInt32

Event ID 37

Channel: Operational
Task: NetftTraceMessage

Description

Starvation threshold reached. Wait for event delivery terminated.

Event ID 37: Starvation threshold reached.

Channel: Verbose
Task: NetftTraceMessage

Description

Starvation threshold reached. Wait for event delivery terminated.

Message #

Starvation threshold reached. Wait for event delivery terminated.

Event ID 38

Channel: Operational
Task: NetftTraceMessage

Description

Pending event IRP is being cancelled.

Fields #

Name	Description
`IrpContext` HexInt64

Event ID 38: Pending event IRP IrpContext is being cancelled.

Channel: Verbose
Task: NetftTraceMessage

Message #

Pending event IRP %1 is being cancelled.

Fields #

Name	Description
`IrpContext` HexInt64

Event ID 39

Channel: Operational
Task: NetftTraceMessage

Description

-----------------------------+ LOG BEGIN +-----------------------------.

Event ID 39: -----------------------------+ LOG BEGIN +-----------------------------

Channel: Verbose
Task: NetftTraceMessage

Event ID 40

Channel: Operational
Task: NetftTraceMessage

Description

Driver %p is loading, registry path %S.

Fields #

Name	Description
`Context` HexInt64
`RegPath` UnicodeString

Event ID 40: Driver %p is loading, registry path %S.

Channel: Verbose
Task: NetftTraceMessage

Fields #

Name	Description
`Context` HexInt64
`RegPath` UnicodeString

Event ID 41

Channel: Operational
Task: NetftTraceMessage

Description

Driver %p failed to register with ETW (status %x).

Fields #

Name	Description
`Context` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 41: Driver %p failed to register with ETW (status %x).

Channel: Verbose
Task: NetftTraceMessage

Fields #

Name	Description
`Context` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 42

Channel: Operational
Task: NetftTraceMessage

Description

Driver %p failed initialization with %x.

Fields #

Name	Description
`Context` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 42: Driver %p failed initialization with %x

Channel: Verbose
Task: NetftTraceMessage

Fields #

Name	Description
`Context` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 43

Channel: Operational
Task: NetftTraceMessage

Description

Miniport adapter failed to query permanent data link address.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 43: Miniport adapter AdapterContext failed to query permanent data link address.

Channel: Verbose
Task: NetftTraceMessage

Message #

Miniport adapter %1 failed to query permanent data link address.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 44

Channel: Operational
Task: NetftTraceMessage

Description

MaInitializeAdapter: Creating MiniportCounterSet instance 'Instance' result Status.

Fields #

Name	Description
`Instance` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 44: MaInitializeAdapter: Creating MiniportCounterSet instance 'Instance' result Status.

Channel: Verbose
Level: Informational
Task: NetftTraceMessage

Message #

MaInitializeAdapter: Creating MiniportCounterSet instance '%1' result %2

Fields #

Name	Description
`Instance` UnicodeString
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 44,
    "version": 0,
    "level": 4,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213696000,
    "time_created": "2026-05-30T02:33:58.5721947+00:00",
    "event_record_id": 30,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Instance": "02-22-13-75-32-8C",
    "Status": "0x0"
  },
  "message": "MaInitializeAdapter: Creating MiniportCounterSet instance '02-22-13-75-32-8C' result 0x0"
}

Event ID 45

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] MaSendPackets - Tcb creation failed, adapter .

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 45: [DROP] MaSendPackets - Tcb creation failed, adapter AdapterContext.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] MaSendPackets - Tcb creation failed, adapter %1.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 46

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] MaSendPackets - Adapter is not active.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 46: [DROP] MaSendPackets - Adapter AdapterContext is not active.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] MaSendPackets - Adapter %1 is not active.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 47

Channel: Operational
Task: NetftTraceMessage

Description

NetBufferList with NetBuffers completed send with error .

Fields #

Name	Description
`NBLContext` HexInt64
`NLBCount` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 47: NetBufferList NBLContext with NLBCount NetBuffers completed send with error Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

NetBufferList %1 with %2 NetBuffers completed send with error %3.

Fields #

Name	Description
`NBLContext` HexInt64
`NLBCount` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 48

Channel: Operational
Task: NetftTraceMessage

Description

MaStatus: Miniport adapter signals connect.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 48: MaStatus: Miniport adapter AdapterContext signals connect.

Channel: Verbose
Task: NetftTraceMessage

Message #

MaStatus: Miniport adapter %1 signals connect.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 49

Channel: Operational
Task: NetftTraceMessage

Description

MaStatus: Miniport adapter signals disconnect.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 49: MaStatus: Miniport adapter AdapterContext signals disconnect.

Channel: Verbose
Task: NetftTraceMessage

Message #

MaStatus: Miniport adapter %1 signals disconnect.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 50

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] MaReceivePacket - Adapter %p is not active.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 50: [DROP] MaReceivePacket - Adapter %p is not active

Channel: Verbose
Task: NetftTraceMessage

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 51

Channel: Operational
Task: NetftTraceMessage

Description

Received a split packet of size , split at byte .

Fields #

Name	Description
`Size` HexInt64
`Offset` HexInt64

Event ID 51: Received a split packet of size Size, split at byte Offset.

Channel: Verbose
Task: NetftTraceMessage

Message #

Received a split packet of size %1, split at byte %2.

Fields #

Name	Description
`Size` HexInt64
`Offset` HexInt64

Event ID 52

Channel: Operational
Task: NetftTraceMessage

Description

Generated data link address .

Fields #

Name	Description
`Layer2Address` UnicodeString

Event ID 52: Generated data link address Layer2Address.

Channel: Verbose
Level: Informational
Task: NetftTraceMessage

Message #

Generated data link address %1.

Fields #

Name	Description
`Layer2Address` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 52,
    "version": 0,
    "level": 4,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213696000,
    "time_created": "2026-05-30T02:33:58.5719985+00:00",
    "event_record_id": 28,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Layer2Address": "02-22-13-75-32-8C"
  },
  "message": "Generated data link address 02-22-13-75-32-8C."
}

Event ID 53

Channel: Operational
Task: NetftTraceMessage

Description

Searching for registered data link address at interface index , type , oper status , address .

Fields #

Name	Description
`InterfaceIndex` HexInt32
`InterfaceType` HexInt32
`InterfaceStatus` HexInt32
`Layer2Address` UnicodeString

Event ID 53: Searching for registered data link address at interface index InterfaceIndex, type InterfaceType, oper status InterfaceStatus, address Layer2Address.

Channel: Verbose
Level: Informational
Task: NetftTraceMessage

Message #

Searching for registered data link address at interface index %1, type %2, oper status %3, address %4.

Fields #

Name	Description
`InterfaceIndex` HexInt32
`InterfaceType` HexInt32
`InterfaceStatus` HexInt32
`Layer2Address` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 53,
    "version": 0,
    "level": 4,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213696000,
    "time_created": "2026-05-30T02:33:58.5719868+00:00",
    "event_record_id": 27,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceIndex": "0x19",
    "InterfaceType": "0x83",
    "InterfaceStatus": "0x2",
    "Layer2Address": "00-00-00-00-00-00"
  },
  "message": "Searching for registered data link address at interface index 0x19, type 0x83, oper status 0x2, address 00-00-00-00-00-00."
}

Event ID 54

Channel: Operational
Task: NetftTraceMessage

Description

Using registered data link address .

Fields #

Name	Description
`Instance` UnicodeString

Event ID 54: Using registered data link address Instance.

Channel: Verbose
Task: NetftTraceMessage

Message #

Using registered data link address %1.

Fields #

Name	Description
`Instance` UnicodeString

Event ID 55

Channel: Operational
Task: NetftTraceMessage

Description

Found data link address collision with physical address on interface index , address .

Fields #

Name	Description
`InterfaceIndex` HexInt32
`Layer2Address` UnicodeString

Event ID 55: Found data link address collision with physical address on interface index InterfaceIndex, address Layer2Address.

Channel: Verbose
Task: NetftTraceMessage

Message #

Found data link address collision with physical address on interface index %1, address %2.

Fields #

Name	Description
`InterfaceIndex` HexInt32
`Layer2Address` UnicodeString

Event ID 56

Channel: Operational
Task: NetftTraceMessage

Description

Found data link address collision with permanentphysical address on interface index , address .

Fields #

Name	Description
`InterfaceIndex` HexInt32
`Layer2Address` UnicodeString

Event ID 56: Found data link address collision with permanentphysical address on interface index InterfaceIndex, address Layer2Address.

Channel: Verbose
Task: NetftTraceMessage

Message #

Found data link address collision with permanentphysical address on interface index %1, address %2.

Fields #

Name	Description
`InterfaceIndex` HexInt32
`Layer2Address` UnicodeString

Event ID 57

Channel: Operational
Task: NetftTraceMessage

Description

Successfully generated data link address .

Fields #

Name	Description
`Layer2Address` UnicodeString

Event ID 57: Successfully generated data link address Layer2Address.

Channel: Verbose
Level: Informational
Task: NetftTraceMessage

Message #

Successfully generated data link address %1.

Fields #

Name	Description
`Layer2Address` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 57,
    "version": 0,
    "level": 4,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213696000,
    "time_created": "2026-05-30T02:33:58.5721445+00:00",
    "event_record_id": 29,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Layer2Address": "02-22-13-75-32-8C"
  },
  "message": "Successfully generated data link address 02-22-13-75-32-8C."
}

Event ID 58

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] MaBuildTcbChain - Send from to failed RdbLookupActiveRoute.

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 58: [DROP] MaBuildTcbChain - Send from LocalAddress to RemoteAddress failed RdbLookupActiveRoute.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] MaBuildTcbChain - Send from %2 to %4 failed RdbLookupActiveRoute

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 59

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] MaBuildTcbChain - Send from to failed NetftParsePacket failed with.

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 59: [DROP] MaBuildTcbChain - Send from LocalAddress to RemoteAddress failed NetftParsePacket failed with RemoteAddressIPLength.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] MaBuildTcbChain - Send from %2 to %4 failed NetftParsePacket failed with %3

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 60

Channel: Operational
Task: NetftTraceMessage

Description

Initializing NDIS miniport.

Fields #

Name	Description
`AdapterHandle` HexInt64

Event ID 60: Initializing NDIS miniport AdapterHandle.

Channel: Verbose
Level: Informational
Task: NetftTraceMessage

Message #

Initializing NDIS miniport %1

Fields #

Name	Description
`AdapterHandle` HexInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 60,
    "version": 0,
    "level": 4,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213696000,
    "time_created": "2026-05-30T02:33:58.5716197+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "AdapterHandle": "0xffffd60c625d81a0"
  },
  "message": "Initializing NDIS miniport 0xFFFFD60C625D81A0"
}

Event ID 61

Channel: Operational
Task: NetftTraceMessage

Description

Initialized NDIS miniport . (miniport adapter: ).

Fields #

Name	Description
`AdapterHandle` HexInt64
`AdapterContext` HexInt64

Event ID 61: Initialized NDIS miniport AdapterHandle.

Channel: Verbose
Level: Informational
Task: NetftTraceMessage

Description

Initialized NDIS miniport AdapterHandle. (miniport adapter: AdapterContext).

Message #

Initialized NDIS miniport %1. (miniport adapter: %2)

Fields #

Name	Description
`AdapterHandle` HexInt64
`AdapterContext` HexInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 61,
    "version": 0,
    "level": 4,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213696000,
    "time_created": "2026-05-30T02:33:58.5723612+00:00",
    "event_record_id": 32,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7116
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "AdapterHandle": "0xffffd60c625d81a0",
    "AdapterContext": "0xffffd60c5e9d47d0"
  },
  "message": "Initialized NDIS miniport 0xFFFFD60C625D81A0. (miniport adapter: 0xFFFFD60C5E9D47D0)"
}

Event ID 62

Channel: Operational
Task: NetftTraceMessage

Description

Initialize NDIS miniport failed with.

Fields #

Name	Description
`AdapterHandle` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 62: Initialize NDIS miniport AdapterHandle failed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Initialize NDIS miniport %1 failed with %2

Fields #

Name	Description
`AdapterHandle` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 63

Channel: Operational
Task: NetftTraceMessage

Description

Miniport adapter halted.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 63: Miniport adapter AdapterContext halted.

Channel: Verbose
Task: NetftTraceMessage

Message #

Miniport adapter %1 halted.

Fields #

Name	Description
`AdapterContext` HexInt64

Event ID 64

Channel: Operational
Task: NetftTraceMessage

Description

NDIS attempted to cancel send operation.

Event ID 64: NDIS attempted to cancel send operation.

Channel: Verbose
Task: NetftTraceMessage

Event ID 65

Channel: Operational
Task: NetftTraceMessage

Description

Driver unloaded.

Fields #

Name	Description
`DriverContext` HexInt64

Event ID 65: Driver DriverContext unloaded.

Channel: Verbose
Task: NetftTraceMessage

Message #

Driver %1 unloaded.

Fields #

Name	Description
`DriverContext` HexInt64

Event ID 66

Channel: Operational
Task: NetftTraceMessage

Description

Interface was inserted into the system.

Fields #

Name	Description
`NetbiosName` UnicodeString

Event ID 66: Interface NetbiosName was inserted into the system.

Channel: Verbose
Task: NetftTraceMessage

Message #

Interface %1 was inserted into the system.

Fields #

Name	Description
`NetbiosName` UnicodeString

Event ID 67

Channel: Operational
Task: NetftTraceMessage

Description

Interface was removed from the system.

Fields #

Name	Description
`NetbiosName` UnicodeString

Event ID 67: Interface NetbiosName was removed from the system.

Channel: Verbose
Task: NetftTraceMessage

Message #

Interface %1 was removed from the system.

Fields #

Name	Description
`NetbiosName` UnicodeString

Event ID 68

Channel: Operational
Task: NetftTraceMessage

Description

nconsistent route count. ContextRouteCount , Actual route count .

Fields #

Name	Description
`ExpectedCount` HexInt64
`ActualCount` HexInt64

Event ID 68: nconsistent route count.

Channel: Verbose
Task: NetftTraceMessage

Description

nconsistent route count. ContextRouteCount ExpectedCount, Actual route count ActualCount.

Message #

nconsistent route count. ContextRouteCount %1, Actual route count %2.

Fields #

Name	Description
`ExpectedCount` HexInt64
`ActualCount` HexInt64

Event ID 69

Channel: Operational
Task: NetftTraceMessage

Description

[RmInitializeAdapter] no valid configuration. Status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 69: [RmInitializeAdapter] no valid configuration.

Channel: Verbose
Task: NetftTraceMessage

Description

[RmInitializeAdapter] no valid configuration. Status Status.

Message #

[RmInitializeAdapter] no valid configuration. Status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 70

Channel: Operational
Task: NetftTraceMessage

Description

[RmInitializeAdapter] Heartbeat parameters are not valid. Status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 70: [RmInitializeAdapter] Heartbeat parameters are not valid.

Channel: Verbose
Task: NetftTraceMessage

Description

[RmInitializeAdapter] Heartbeat parameters are not valid. Status Status.

Message #

[RmInitializeAdapter] Heartbeat parameters are not valid. Status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 71

Channel: Operational
Task: NetftTraceMessage

Description

[RmInitializeAdapter] RmCreateSecurityContext failed. Status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 71: [RmInitializeAdapter] RmCreateSecurityContext failed.

Channel: Verbose
Task: NetftTraceMessage

Description

[RmInitializeAdapter] RmCreateSecurityContext failed. Status Status.

Message #

[RmInitializeAdapter] RmCreateSecurityContext failed. Status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 72

Channel: Operational
Task: NetftTraceMessage

Description

[RmInitializeAdapter] TotalMessage Size is too large.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 72: [RmInitializeAdapter] TotalMessage Size is too large Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[RmInitializeAdapter] TotalMessage Size is too large %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 73

Channel: Operational
Task: NetftTraceMessage

Description

[RmInitializeAdapter] NdisAllocateMemoryWithTag failed with.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 73: [RmInitializeAdapter] NdisAllocateMemoryWithTag failed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[RmInitializeAdapter] NdisAllocateMemoryWithTag failed with %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 74

Channel: Operational
Task: NetftTraceMessage

Description

[RmInitializeAdapter] NdisAllocateNetBufferListPool failed with.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 74: [RmInitializeAdapter] NdisAllocateNetBufferListPool failed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[RmInitializeAdapter] NdisAllocateNetBufferListPool failed with %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 75

Channel: Operational
Task: NetftTraceMessage

Description

[RmInitializeAdapter] AdpOpenTunnelAdapter returned.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 75: [RmInitializeAdapter] AdpOpenTunnelAdapter returned Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[RmInitializeAdapter] AdpOpenTunnelAdapter returned %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 76

Channel: Operational
Task: NetftTraceMessage

Description

Monitor started HB from to with delay and threshold . [Min, Max] allowed delay = [, ] ticks (@ ticks per sec). CurrentProcessor=, DpcTargetProcessor=.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Delay` HexInt32
`Threshold` HexInt32
`MinTicks` HexInt64
`MaxTicks` HexInt64
`Tickrate` HexInt64
`CurrentCPU` HexInt32
`TargetCPU` HexInt32

Event ID 76: Monitor MonitorContext started HB from LocalAddress to RemoteAddress with delay Delay and threshold Threshold.

Channel: Verbose
Task: NetftTraceMessage

Description

Monitor MonitorContext started HB from LocalAddress to RemoteAddress with delay Delay and threshold Threshold. [Min, Max] allowed delay = [MinTicks, MaxTicks] ticks (@ Tickrate ticks per sec). CurrentProcessor=CurrentCPU, DpcTargetProcessor=TargetCPU.

Message #

Monitor %1 started HB from %3 to %5 with delay %6 and threshold %7. [Min, Max] allowed delay = [%8, %9] ticks (@ %10 ticks per sec). CurrentProcessor=%11, DpcTargetProcessor=%12

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Delay` HexInt32
`Threshold` HexInt32
`MinTicks` HexInt64
`MaxTicks` HexInt64
`Tickrate` HexInt64
`CurrentCPU` HexInt32
`TargetCPU` HexInt32

Event ID 77

Channel: Operational
Task: NetftTraceMessage

Description

RmCreateCounterSet: Creating RouteMonitorCounterSet instance ' - ' result.

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 77: RmCreateCounterSet: Creating RouteMonitorCounterSet instance 'LocalAddress - RemoteAddress' result Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

RmCreateCounterSet: Creating RouteMonitorCounterSet instance '%2 - %4' result %5

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 78

Channel: Operational
Task: NetftTraceMessage

Description

Monitor forced the endpoint to be unreachable.

Fields #

Name	Description
`MonitorContext` HexInt64
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 78: Monitor MonitorContext forced the endpoint RemoteAddress to be unreachable.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 forced the endpoint %3 to be unreachable.

Fields #

Name	Description
`MonitorContext` HexInt64
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 79

Channel: Operational
Task: NetftTraceMessage

Description

Monitor stopped HB to.

Fields #

Name	Description
`MonitorContext` HexInt64
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 79: Monitor MonitorContext stopped HB to RemoteAddress.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 stopped HB to %3

Fields #

Name	Description
`MonitorContext` HexInt64
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 80

Channel: Operational
Task: NetftTraceMessage

Description

Monitor ( - ) missed two-fifth consecutive HB response.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 80: Monitor MonitorContext (LocalAddress - RemoteAddress) missed two-fifth consecutive HB response.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 (%3 -  %5) missed two-fifth consecutive HB response

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 81

Channel: Operational
Task: NetftTraceMessage

Description

Monitor ( - ) reached HB threshold, remote endpoint is unreachable. Counter=, threshold=.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Counter` HexInt32
`Threshold` HexInt32

Event ID 81: Monitor MonitorContext (LocalAddress - RemoteAddress) reached HB threshold, remote endpoint RemoteAddress is unreachable.

Channel: Verbose
Task: NetftTraceMessage

Description

Monitor MonitorContext (LocalAddress - RemoteAddress) reached HB threshold, remote endpoint RemoteAddress is unreachable. Counter=Counter, threshold=Threshold.

Message #

Monitor %1 (%3 -  %5) reached HB threshold, remote endpoint %5 is unreachable. Counter=%6, threshold=%7.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Counter` HexInt32
`Threshold` HexInt32

Event ID 82

Channel: Operational
Task: NetftTraceMessage

Description

Monitor ( - ) missed HB response, gap=.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`gap` HexInt32

Event ID 82: Monitor MonitorContext (LocalAddress - RemoteAddress) missed HB response, gap=gap.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 (%3 -  %5) missed HB response, gap=%6

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`gap` HexInt32

Event ID 83

Channel: Operational
Task: NetftTraceMessage

Description

Monitor routine RmHeartbeatTimerDpc took too long to complete. Start=, end=, diff=.

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 83: Monitor MonitorContext routine RmHeartbeatTimerDpc took too long to complete.

Channel: Verbose
Task: NetftTraceMessage

Description

Monitor MonitorContext routine RmHeartbeatTimerDpc took too long to complete. Start=StartTicks, end=EndTicks, diff=TickDelta.

Message #

Monitor %1 routine RmHeartbeatTimerDpc took too long to complete. Start=%2, end=%3, diff=%4

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 84

Channel: Operational
Task: NetftTraceMessage

Description

Monitor ( - ) sending RCP stop adapter request (sequence ).

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64
`Sequence` HexInt32

Event ID 84: Monitor MonitorContext (LocalAddress - RemoteAddress) sending RCP stop adapter request NBLContext (sequence Sequence).

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 (%3 -  %5) sending RCP stop adapter request %6 (sequence %7).

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64
`Sequence` HexInt32

Event ID 85

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] RmSendPackets - Tcb Creation Failed for RmAdapter.

Fields #

Name	Description
`MonitorContext` HexInt64

Event ID 85: [DROP] RmSendPackets - Tcb Creation Failed for RmAdapter MonitorContext.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] RmSendPackets - Tcb Creation Failed for RmAdapter %1

Fields #

Name	Description
`MonitorContext` HexInt64

Event ID 86

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] RmSendPackets - Could not find TunnelAdapter for RmAdapter.

Fields #

Name	Description
`MonitorContext` HexInt64

Event ID 86: [DROP] RmSendPackets - Could not find TunnelAdapter for RmAdapter MonitorContext.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] RmSendPackets - Could not find TunnelAdapter for RmAdapter %1

Fields #

Name	Description
`MonitorContext` HexInt64

Event ID 87

Channel: Operational
Task: NetftTraceMessage

Description

Monitor routine RmSendPackets took too long to complete. Start=, end=, diff=.

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 87: Monitor MonitorContext routine RmSendPackets took too long to complete.

Channel: Verbose
Task: NetftTraceMessage

Description

Monitor MonitorContext routine RmSendPackets took too long to complete. Start=StartTicks, end=EndTicks, diff=TickDelta.

Message #

Monitor %1 routine RmSendPackets took too long to complete. Start=%2, end=%3, diff=%4

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 88

Channel: Operational
Task: NetftTraceMessage

Description

Switched tunnel for this RMA from to.

Fields #

Name	Description
`OldTunnelAddressIPLength` UInt32
`OldTunnelAddress` Binary
`NewTunnelAddressIPLength` UInt32
`NewTunnelAddress` Binary

Event ID 88: Switched tunnel for this RMA from OldTunnelAddress to NewTunnelAddress.

Channel: Verbose
Task: NetftTraceMessage

Message #

Switched tunnel for this RMA from %2 to %4

Fields #

Name	Description
`OldTunnelAddressIPLength` UInt32
`OldTunnelAddress` Binary
`NewTunnelAddressIPLength` UInt32
`NewTunnelAddress` Binary

Event ID 89

Channel: Operational
Task: NetftTraceMessage

Description

Monitor routine RmSendComplete took too long to complete. Start=, end=, diff=.

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 89: Monitor MonitorContext routine RmSendComplete took too long to complete.

Channel: Verbose
Task: NetftTraceMessage

Description

Monitor MonitorContext routine RmSendComplete took too long to complete. Start=StartTicks, end=EndTicks, diff=TickDelta.

Message #

Monitor %1 routine RmSendComplete took too long to complete. Start=%2, end=%3, diff=%4

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 90

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] Monitor ( - ) Ignoring incomming heartbeat. Route blocked , SpecialHeartbeat .

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`RouteBlocked` UnicodeString
`SpecialHBEnabled` UnicodeString

Event ID 90: [DROP] Monitor MonitorContext (LocalAddress - RemoteAddress) Ignoring incomming heartbeat.

Channel: Verbose
Task: NetftTraceMessage

Description

[DROP] Monitor MonitorContext (LocalAddress - RemoteAddress) Ignoring incomming heartbeat. Route blocked RouteBlocked, SpecialHeartbeat SpecialHBEnabled.

Message #

[DROP] Monitor %1 (%3 -  %5) Ignoring incomming heartbeat. Route blocked %6, SpecialHeartbeat %7.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`RouteBlocked` UnicodeString
`SpecialHBEnabled` UnicodeString

Event ID 91

Channel: Operational
Task: NetftTraceMessage

Description

Monitor ( - ) received RCP request special (sequence ).

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64
`Sequence` HexInt32

Event ID 91: Monitor MonitorContext (LocalAddress - RemoteAddress) received RCP request special NBLContext (sequence Sequence).

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 (%3 -  %5) received RCP request special %6 (sequence %7)

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64
`Sequence` HexInt32

Event ID 92

Channel: Operational
Task: NetftTraceMessage

Description

Monitor ( - ) received RCP request adapter stopping (sequence ).

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64
`Sequence` HexInt32

Event ID 92: Monitor MonitorContext (LocalAddress - RemoteAddress) received RCP request adapter stopping NBLContext (sequence Sequence).

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 (%3 -  %5) received RCP request adapter stopping %6 (sequence %7)

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64
`Sequence` HexInt32

Event ID 93

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] Monitor ( - ) received unsupported RCP message (type ).

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64
`MessageType` HexInt32

Event ID 93: [DROP] Monitor MonitorContext (LocalAddress - RemoteAddress) received unsupported RCP message NBLContext (type MessageType).

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] Monitor %1 (%3 -  %5) received unsupported RCP message %6 (type %7)

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64
`MessageType` HexInt32

Event ID 94

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] Monitor ( - ) RmParseRcpPacket failed message \n).

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64

Event ID 94: [DROP] Monitor MonitorContext (LocalAddress - RemoteAddress) RmParseRcpPacket failed message NBLContext\n).

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] Monitor %1 (%3 -  %5) RmParseRcpPacket failed message %6\n)

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`NBLContext` HexInt64

Event ID 95

Channel: Operational
Task: NetftTraceMessage

Description

Monitor routine RmReceivePacket took too long to complete. Start=, end=, diff=.

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 95: Monitor MonitorContext routine RmReceivePacket took too long to complete.

Channel: Verbose
Task: NetftTraceMessage

Description

Monitor MonitorContext routine RmReceivePacket took too long to complete. Start=StartTicks, end=EndTicks, diff=TickDelta.

Message #

Monitor %1 routine RmReceivePacket took too long to complete. Start=%2, end=%3, diff=%4

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 96

Channel: Operational
Task: NetftTraceMessage

Description

Monitor adapter signals media connect.

Fields #

Name	Description
`MonitorContext` HexInt64

Event ID 96: Monitor adapter MonitorContext signals media connect.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor adapter %1 signals media connect.

Fields #

Name	Description
`MonitorContext` HexInt64

Event ID 97

Channel: Operational
Task: NetftTraceMessage

Description

Monitor adapter signals media disconnect.

Fields #

Name	Description
`MonitorContext` HexInt64

Event ID 97: Monitor adapter MonitorContext signals media disconnect.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor adapter %1 signals media disconnect.

Fields #

Name	Description
`MonitorContext` HexInt64

Event ID 98

Channel: Operational
Task: NetftTraceMessage

Description

Monitor was disconnected, remote endpoint is unreachable.

Fields #

Name	Description
`MonitorContext` HexInt64
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 98: Monitor MonitorContext was disconnected, remote endpoint RemoteAddress is unreachable.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 was disconnected, remote endpoint %3 is unreachable.

Fields #

Name	Description
`MonitorContext` HexInt64
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 99

Channel: Operational
Task: NetftTraceMessage

Description

Monitor adapter signals status change .

Fields #

Name	Description
`MonitorContext` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 99: Monitor adapter MonitorContext signals status change Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor adapter %1 signals status change %2.

Fields #

Name	Description
`MonitorContext` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 100

Channel: Operational
Task: NetftTraceMessage

Description

Monitor ( - ) failed to sign RCP message with.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 100: Monitor MonitorContext (LocalAddress - RemoteAddress) failed to sign RCP message with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 (%3 -  %5) failed to sign RCP message with %6

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 101

Channel: Operational
Task: NetftTraceMessage

Description

Monitor detected that remote endpoint is reachable.

Fields #

Name	Description
`MonitorContext` HexInt64
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 101: Monitor MonitorContext detected that remote endpoint RemoteAddress is reachable.

Channel: Verbose
Task: NetftTraceMessage

Message #

Monitor %1 detected that remote endpoint %3 is reachable.

Fields #

Name	Description
`MonitorContext` HexInt64
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 102

Channel: Operational
Task: NetftTraceMessage

Description

Monitor routine RmProcessRcpRequest took too long to complete. Start=, end=, diff=.

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 102: Monitor MonitorContext routine RmProcessRcpRequest took too long to complete.

Channel: Verbose
Task: NetftTraceMessage

Description

Monitor MonitorContext routine RmProcessRcpRequest took too long to complete. Start=StartTicks, end=EndTicks, diff=TickDelta.

Message #

Monitor %1 routine RmProcessRcpRequest took too long to complete. Start=%2, end=%3, diff=%4

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 103

Channel: Operational
Task: NetftTraceMessage

Description

Failed to invalidate ARP cache. Status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 103: Failed to invalidate ARP cache.

Channel: Verbose
Task: NetftTraceMessage

Description

Failed to invalidate ARP cache. Status Status.

Message #

Failed to invalidate ARP cache. Status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 104

Channel: Operational
Task: NetftTraceMessage

Description

Failed to invalidate neighbor cache. Status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 104: Failed to invalidate neighbor cache.

Channel: Verbose
Task: NetftTraceMessage

Description

Failed to invalidate neighbor cache. Status Status.

Message #

Failed to invalidate neighbor cache. Status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 105

Channel: Operational
Task: NetftTraceMessage

Description

Failed to invalidate neighbor cache fault-tolerant adapter not found. Status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 105: Failed to invalidate neighbor cache fault-tolerant adapter not found.

Channel: Verbose
Task: NetftTraceMessage

Description

Failed to invalidate neighbor cache fault-tolerant adapter not found. Status Status.

Message #

Failed to invalidate neighbor cache fault-tolerant adapter not found. Status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 106

Channel: Operational
Task: NetftTraceMessage

Description

Monitor routine RmpUpdateNeighborEntries took too long to complete. Start=, end=, diff=.

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 106: Monitor MonitorContext routine RmpUpdateNeighborEntries took too long to complete.

Channel: Verbose
Task: NetftTraceMessage

Description

Monitor MonitorContext routine RmpUpdateNeighborEntries took too long to complete. Start=StartTicks, end=EndTicks, diff=TickDelta.

Message #

Monitor %1 routine RmpUpdateNeighborEntries took too long to complete. Start=%2, end=%3, diff=%4

Fields #

Name	Description
`MonitorContext` HexInt64
`StartTicks` HexInt64
`EndTicks` HexInt64
`TickDelta` HexInt64

Event ID 107

Channel: Operational
Task: NetftTraceMessage

Description

[RmStoreHeartbeatRecord] Monitor ( - ) MissedHBCount is already 0.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 107: [RmStoreHeartbeatRecord] Monitor MonitorContext (LocalAddress - RemoteAddress) MissedHBCount is already 0.

Channel: Verbose
Task: NetftTraceMessage

Message #

[RmStoreHeartbeatRecord] Monitor %1 (%3 -  %5) MissedHBCount is already 0

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 108

Channel: Operational
Task: NetftTraceMessage

Description

[RmStoreHeartbeatRecord] Monitor ( - ) MissedHBCount = , Error =.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`MissedHBCount` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 108: [RmStoreHeartbeatRecord] Monitor MonitorContext (LocalAddress - RemoteAddress) MissedHBCount = MissedHBCount, Error = Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[RmStoreHeartbeatRecord] Monitor %1 (%3 -  %5) MissedHBCount = %6, Error = %7

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`MissedHBCount` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 109

Channel: Operational
Task: NetftTraceMessage

Description

[RmHandleHeartbeatResponse] Monitor ( - ) MissedHBCount is already 0.

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 109: [RmHandleHeartbeatResponse] Monitor MonitorContext (LocalAddress - RemoteAddress) MissedHBCount is already 0.

Channel: Verbose
Task: NetftTraceMessage

Message #

[RmHandleHeartbeatResponse] Monitor %1 (%3 -  %5) MissedHBCount is already 0

Fields #

Name	Description
`MonitorContext` HexInt64
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 110

Channel: Operational
Task: NetftTraceMessage

Description

Failed to allocate neighbor update work item.

Event ID 110: Failed to allocate neighbor update work item

Channel: Verbose
Task: NetftTraceMessage

Event ID 111

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Packet too small ( bytes). Sender: .

Fields #

Name	Description
`DataLength` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 111: Validation of RCP packet failed - Packet too small (DataLength bytes).

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Packet too small (DataLength bytes). Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Packet too small (%1 bytes). Sender: %3.

Fields #

Name	Description
`DataLength` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 112

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Bad message type (). Sender: .

Fields #

Name	Description
`Type` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 112: Validation of RCP packet failed - Bad message type (Type).

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Bad message type (Type). Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Bad message type (%1). Sender: %3.

Fields #

Name	Description
`Type` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 113

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Bad version (). Sender: .

Fields #

Name	Description
`Version` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 113: Validation of RCP packet failed - Bad version (Version).

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Bad version (Version). Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Bad version (%1). Sender: %3.

Fields #

Name	Description
`Version` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 114

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid reserved value (). Sender.

Fields #

Name	Description
`Reserved` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 114: Validation of RCP packet failed - Invalid reserved value (Reserved).

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid reserved value (Reserved). Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Invalid reserved value (%1). Sender: %3

Fields #

Name	Description
`Reserved` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 115

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid extension header order (). Sender.

Fields #

Name	Description
`NextHeader` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 115: Validation of RCP packet failed - Invalid extension header order (NextHeader).

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid extension header order (NextHeader). Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Invalid extension header order (%1). Sender: %3

Fields #

Name	Description
`NextHeader` UInt32
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 116

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid IPv4 address pair. Sender.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 116: Validation of RCP packet failed - Invalid IPv4 address pair.

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid IPv4 address pair. Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Invalid IPv4 address pair. Sender: %2

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 117

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid IPv6 address pair. Sender.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 117: Validation of RCP packet failed - Invalid IPv6 address pair.

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid IPv6 address pair. Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Invalid IPv6 address pair. Sender: %2

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 118

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid address pair extension header. Sender.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 118: Validation of RCP packet failed - Invalid address pair extension header.

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid address pair extension header. Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Invalid address pair extension header. Sender: %2

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 119

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid signature buffer. Sender.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 119: Validation of RCP packet failed - Invalid signature buffer.

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid signature buffer. Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Invalid signature buffer. Sender: %2

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 120

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid signature extension header. Sender.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 120: Validation of RCP packet failed - Invalid signature extension header.

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid signature extension header. Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Invalid signature extension header. Sender: %2

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 121

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Monitor failed to verify signature (). Sender.

Fields #

Name	Description
`MonitorContext` HexInt64
`Status` HexInt32	NTSTATUS reference
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 121: Validation of RCP packet failed - Monitor MonitorContext failed to verify signature (Status).

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Monitor MonitorContext failed to verify signature (Status). Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Monitor %1 failed to verify signature (%2). Sender: %4

Fields #

Name	Description
`MonitorContext` HexInt64
`Status` HexInt32	NTSTATUS reference
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 122

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Missing signature extension header. Sender.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 122: Validation of RCP packet failed - Missing signature extension header.

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Missing signature extension header. Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Missing signature extension header. Sender: %2

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 123

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Route monitor ( - ) FT IPs ( - ) not found.

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`DestinationAddressIPLength` UInt32
`DestinationAddress` Binary
`SourceAddressIPLength` UInt32
`SourceAddress` Binary

Event ID 123: Validation of RCP packet failed - Route monitor (LocalAddress - RemoteAddress) FT IPs (DestinationAddress - SourceAddress) not found.

Channel: Verbose
Task: NetftTraceMessage

Message #

Validation of RCP packet failed - Route monitor (%2 -  %4) FT IPs (%6 -  %8) not found.

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary
`DestinationAddressIPLength` UInt32
`DestinationAddress` Binary
`SourceAddressIPLength` UInt32
`SourceAddress` Binary

Event ID 124

Channel: Operational
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid RCP header. Sender: .

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 124: Validation of RCP packet failed - Invalid RCP header.

Channel: Verbose
Task: NetftTraceMessage

Description

Validation of RCP packet failed - Invalid RCP header. Sender: RemoteAddress.

Message #

Validation of RCP packet failed - Invalid RCP header. Sender: %2.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 125

Channel: Operational
Task: NetftTraceMessage

Description

Error in RmParseRcpPacketForLRR, could not retrieve packet in contiguous buffer bytes.

Fields #

Name	Description
`DataLength` UInt32

Event ID 125: Error in RmParseRcpPacketForLRR, could not retrieve packet in contiguous buffer DataLength bytes.

Channel: Verbose
Task: NetftTraceMessage

Message #

Error in RmParseRcpPacketForLRR, could not retrieve packet in contiguous buffer %1 bytes.

Fields #

Name	Description
`DataLength` UInt32

Event ID 126

Channel: Operational
Task: NetftTraceMessage

Description

Reference process object (ID 0x, handle 0x) by handle failed with .

Fields #

Name	Description
`ProcessID` HexInt64
`Handle` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 126: Reference process object (ID 0xProcessID, handle 0xHandle) by handle failed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Reference process object (ID 0x%1, handle 0x%2) by handle failed with %3.

Fields #

Name	Description
`ProcessID` HexInt64
`Handle` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 127

Channel: Operational
Task: NetftTraceMessage

Description

Open client process (ID 0x) failed with .

Fields #

Name	Description
`ProcessID` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 127: Open client process (ID 0xProcessID) failed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Open client process (ID 0x%1) failed with %2.

Fields #

Name	Description
`ProcessID` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 128

Channel: Operational
Task: NetftTraceMessage

Description

Close client process (handle 0x) failed with .

Fields #

Name	Description
`Handle` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 128: Close client process (handle 0xHandle) failed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Close client process (handle 0x%1) failed with %2.

Fields #

Name	Description
`Handle` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 129

Channel: Operational
Task: NetftTraceMessage

Description

TaInitializeAdapter: Creating TunnelCounterSet instance 'EndpointAddress' result Status.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 129: TaInitializeAdapter: Creating TunnelCounterSet instance 'EndpointAddress' result Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

TaInitializeAdapter: Creating TunnelCounterSet instance '%2' result %3

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 130

Channel: Operational
Task: NetftTraceMessage

Description

TaDeInitializeAdapter: Releasing Endpoint TunnelCounterSet instance 'EndpointAddress'.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 130: TaDeInitializeAdapter: Releasing Endpoint TunnelCounterSet instance 'EndpointAddress'.

Channel: Verbose
Task: NetftTraceMessage

Message #

TaDeInitializeAdapter: Releasing Endpoint TunnelCounterSet instance '%2'

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 131

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] TaSendTcb - Adapter not ready to send to.

Fields #

Name	Description
`Adapter` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 131: [DROP] TaSendTcb - Adapter Adapter not ready to send to EndpointAddress.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] TaSendTcb - Adapter %1 not ready to send to %3

Fields #

Name	Description
`Adapter` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 132

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] TaReceivePacket - Receive from to failed TaFilterPacket.

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 132: [DROP] TaReceivePacket - Receive from LocalAddress to RemoteAddress failed TaFilterPacket.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] TaReceivePacket - Receive from %2 to %4 failed TaFilterPacket

Fields #

Name	Description
`LocalAddressIPLength` UInt32
`LocalAddress` Binary
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 133

Channel: Operational
Task: NetftTraceMessage

Description

Tunnel adapter signals media connect. \n.

Fields #

Name	Description
`Adapter` HexInt64

Event ID 133: Tunnel adapter Adapter signals media connect.

Channel: Verbose
Task: NetftTraceMessage

Description

Tunnel adapter Adapter signals media connect. \n.

Message #

Tunnel adapter %1 signals media connect. \n

Fields #

Name	Description
`Adapter` HexInt64

Event ID 134

Channel: Operational
Task: NetftTraceMessage

Description

Tunnel adapter signals media disconnect.\n.

Fields #

Name	Description
`Adapter` HexInt64

Event ID 134: Tunnel adapter Adapter signals media disconnect.

Channel: Verbose
Task: NetftTraceMessage

Description

Tunnel adapter Adapter signals media disconnect.\n.

Message #

Tunnel adapter %1 signals media disconnect.\n

Fields #

Name	Description
`Adapter` HexInt64

Event ID 135

Channel: Operational
Task: NetftTraceMessage

Description

Tunnel adapter signals status change .\n.

Fields #

Name	Description
`Adapter` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 135: Tunnel adapter Adapter signals status change Status.

Channel: Verbose
Task: NetftTraceMessage

Description

Tunnel adapter Adapter signals status change Status.\n.

Message #

Tunnel adapter %1 signals status change %2.\n

Fields #

Name	Description
`Adapter` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 136

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] Dropping received RCP messages from .

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 136: [DROP] Dropping received RCP messages from RemoteAddress.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] Dropping received RCP messages from %2.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 137

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] Dropping received RCP messages from invalid port number.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 137: [DROP] Dropping received RCP messages from RemoteAddress invalid port number.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] Dropping received RCP messages from %2 invalid port number.

Fields #

Name	Description
`RemoteAddressIPLength` UInt32
`RemoteAddress` Binary

Event ID 138

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] TaFilterPacket Invalid Ethernet Header.

Event ID 138: [DROP] TaFilterPacket Invalid Ethernet Header

Channel: Verbose
Task: NetftTraceMessage

Event ID 139

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] TaFilterPacket NetftInitializeDataBuffer failed.

Event ID 139: [DROP] TaFilterPacket NetftInitializeDataBuffer failed

Channel: Verbose
Task: NetftTraceMessage

Event ID 140

Channel: Operational
Task: NetftTraceMessage

Description

The client process (ID 0x) was terminated. Watchdog source .

Fields #

Name	Description
`ProcessId` HexInt64
`WatchdogSource` HexInt32

Event ID 140: The client process (ID 0xProcessId) was terminated.

Channel: Verbose
Task: NetftTraceMessage

Description

The client process (ID 0xProcessId) was terminated. Watchdog source WatchdogSource.

Message #

The client process (ID 0x%1) was terminated. Watchdog source %2.

Fields #

Name	Description
`ProcessId` HexInt64
`WatchdogSource` HexInt32

Event ID 141

Channel: Operational
Task: NetftTraceMessage

Description

Watchdog timer timed out for the client process (ID 0x). The system will be halted. Watchdog source .

Fields #

Name	Description
`ProcessId` HexInt64
`WatchdogSource` HexInt32

Event ID 141: Watchdog timer timed out for the client process (ID 0xProcessId).

Channel: Verbose
Task: NetftTraceMessage

Description

Watchdog timer timed out for the client process (ID 0xProcessId). The system will be halted. Watchdog source WatchdogSource.

Message #

Watchdog timer timed out for the client process (ID 0x%1). The system will be halted. Watchdog source %2.

Fields #

Name	Description
`ProcessId` HexInt64
`WatchdogSource` HexInt32

Event ID 142

Channel: Operational
Task: NetftTraceMessage

Description

Watchdog timer timed out for the client process (ID 0x). Looking for kd to allow debugging. Watchdog source .

Fields #

Name	Description
`ProcessId` HexInt64
`WatchdogSource` HexInt32

Event ID 142: Watchdog timer timed out for the client process (ID 0xProcessId).

Channel: Verbose
Task: NetftTraceMessage

Description

Watchdog timer timed out for the client process (ID 0xProcessId). Looking for kd to allow debugging. Watchdog source WatchdogSource.

Message #

Watchdog timer timed out for the client process (ID 0x%1). Looking for kd to allow debugging. Watchdog source %2.

Fields #

Name	Description
`ProcessId` HexInt64
`WatchdogSource` HexInt32

Event ID 143

Channel: Operational
Task: NetftTraceMessage

Description

Tunnel adapter bound to.

Fields #

Name	Description
`EndpointContext` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 143: Tunnel adapter EndpointContext bound to EndpointAddress.

Channel: Verbose
Task: NetftTraceMessage

Message #

Tunnel adapter %1 bound to %3

Fields #

Name	Description
`EndpointContext` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 144

Channel: Operational
Task: NetftTraceMessage

Description

Tunnel adapter failed to create socket (status ).

Fields #

Name	Description
`EndpointContext` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 144: Tunnel adapter EndpointContext failed to create socket EndpointAddress (status Status).

Channel: Verbose
Task: NetftTraceMessage

Message #

Tunnel adapter %1 failed to create socket %3 (status %4)

Fields #

Name	Description
`EndpointContext` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 145

Channel: Operational
Task: NetftTraceMessage

Description

NetftEndpointCreateCounterSet: Creating WskCounterSet instance 'EndpointAddress' result Status.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 145: NetftEndpointCreateCounterSet: Creating WskCounterSet instance 'EndpointAddress' result Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

NetftEndpointCreateCounterSet: Creating WskCounterSet instance '%2' result %3

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 146

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] NetftSendDatagram - IoAllocateIrp failed when trying to send to.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 146: [DROP] NetftSendDatagram - IoAllocateIrp failed when trying to send to EndpointAddress.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] NetftSendDatagram - IoAllocateIrp failed when trying to send to %2

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 147

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] NetftSendDatagram - NdisAllocateFromNPagedLookasideList failed when trying to send to.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 147: [DROP] NetftSendDatagram - NdisAllocateFromNPagedLookasideList failed when trying to send to EndpointAddress.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] NetftSendDatagram - NdisAllocateFromNPagedLookasideList failed when trying to send to %2

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary

Event ID 148

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] NetftReceiveDatagramHandler - AdpReferenceAdapterSafe failed (tunnel adapter ).

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 148: [DROP] NetftReceiveDatagramHandler - AdpReferenceAdapterSafe failed (tunnel adapter EndpointContext).

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] NetftReceiveDatagramHandler - AdpReferenceAdapterSafe failed (tunnel adapter %1).

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 149

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] NetftReceiveDatagramHandler - Tunnel adapter is stopping.

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 149: [DROP] NetftReceiveDatagramHandler - Tunnel adapter EndpointContext is stopping.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] NetftReceiveDatagramHandler - Tunnel adapter %1 is stopping.

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 150

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] NetftReceiveDatagramHandler - Tunnel adapter is not active.

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 150: [DROP] NetftReceiveDatagramHandler - Tunnel adapter EndpointContext is not active.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] NetftReceiveDatagramHandler - Tunnel adapter %1 is not active.

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 151

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] Underlying socket terminated by WSK provider (tunnel adapter ).

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 151: [DROP] Underlying socket terminated by WSK provider (tunnel adapter EndpointContext).

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] Underlying socket terminated by WSK provider (tunnel adapter %1).

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 152

Channel: Operational
Task: NetftTraceMessage

Description

[DROP] Tunnel adapter failed to build datagram descriptor list.

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 152: [DROP] Tunnel adapter EndpointContext failed to build datagram descriptor list.

Channel: Verbose
Task: NetftTraceMessage

Message #

[DROP] Tunnel adapter %1 failed to build datagram descriptor list.

Fields #

Name	Description
`EndpointContext` HexInt64

Event ID 153

Channel: Operational
Task: NetftTraceMessage

Description

Tunnel adapter unbound from with .

Fields #

Name	Description
`EndpointContext` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 153: Tunnel adapter EndpointContext unbound from EndpointAddress with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Tunnel adapter %1 unbound from %3 with %4.

Fields #

Name	Description
`EndpointContext` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`Status` HexInt32	NTSTATUS reference

Event ID 154

Channel: Operational
Task: NetftTraceMessage

Description

Tunnel adapter failed to allocate NBL.

Event ID 154: Tunnel adapter failed to allocate NBL.

Channel: Verbose
Task: NetftTraceMessage

Event ID 155

Channel: Operational
Task: NetftTraceMessage

Description

[NetftQueryIfIndexByDataLinkddress] : NetftEnumerateInterfaces returned status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 155: [NetftQueryIfIndexByDataLinkddress] : NetftEnumerateInterfaces returned status Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftQueryIfIndexByDataLinkddress] : NetftEnumerateInterfaces returned status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 156

Channel: Operational
Task: NetftTraceMessage

Description

[NetftIsFaultTolerantIpAddress] : AdpOpenMiniportAdapter returned status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 156: [NetftIsFaultTolerantIpAddress] : AdpOpenMiniportAdapter returned status Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftIsFaultTolerantIpAddress] : AdpOpenMiniportAdapter returned status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 157

Channel: Operational
Task: NetftTraceMessage

Description

[NetftIsFaultTolerantIpAddress] : NetftQueryIfIndexByIpAddress returned status.

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 157: [NetftIsFaultTolerantIpAddress] : NetftQueryIfIndexByIpAddress returned status Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

[NetftIsFaultTolerantIpAddress] : NetftQueryIfIndexByIpAddress returned status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 158

Channel: Operational
Task: NetftTraceMessage

Description

Insert into interface completed with.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 158: Insert EndpointAddress into interface InterfaceId completed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Insert %2 into interface %3 completed with %4

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 159

Channel: Operational
Task: NetftTraceMessage

Description

Insert into interface completed with.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 159: Insert EndpointAddress into interface InterfaceId completed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Insert %2 into interface %3 completed with %4

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 160

Channel: Operational
Task: NetftTraceMessage

Description

Remove from interface completed with.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 160: Remove EndpointAddress from interface InterfaceId completed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Remove %2 from interface %3 completed with %4

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 161

Channel: Operational
Task: NetftTraceMessage

Description

Remove from interface completed with.

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 161: Remove EndpointAddress from interface InterfaceId completed with Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Remove %2 from interface %3 completed with %4

Fields #

Name	Description
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 162

Channel: Operational
Task: NetftTraceMessage

Description

Failed to register address change handler with IPv4/802 provider ().

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 162: Failed to register address change handler with IPv4/802 provider (Status).

Channel: Verbose
Task: NetftTraceMessage

Message #

Failed to register address change handler with IPv4/802 provider (%1)

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 163

Channel: Operational
Task: NetftTraceMessage

Description

Failed to register address change handler with IPv6/802 provider ().

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 163: Failed to register address change handler with IPv6/802 provider (Status).

Channel: Verbose
Task: NetftTraceMessage

Message #

Failed to register address change handler with IPv6/802 provider (%1)

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 164

Channel: Operational
Task: NetftTraceMessage

Description

Failed to register media sense handler with NDIS provider ().

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 164: Failed to register media sense handler with NDIS provider (Status).

Channel: Verbose
Task: NetftTraceMessage

Message #

Failed to register media sense handler with NDIS provider (%1)

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 165

Channel: Operational
Task: NetftTraceMessage

Description

PnP signals address change ().

Fields #

Name	Description
`Context` HexInt64
`NotificationType` HexInt32

Event ID 165: PnP signals Context address change (NotificationType).

Channel: Verbose
Level: Verbose
Task: NetftTraceMessage

Message #

PnP signals %1 address change (%2)

Fields #

Name	Description
`Context` HexInt64
`NotificationType` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 165,
    "version": 0,
    "level": 5,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213694208,
    "time_created": "2026-06-13T13:35:47.2434365+00:00",
    "event_record_id": 35,
    "correlation": {},
    "execution": {
      "process_id": 1760,
      "thread_id": 6536
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Context": "0x17",
    "NotificationType": "0x3"
  },
  "message": "PnP signals 0x17 address change (0x3)"
}

Event ID 166

Channel: Operational
Task: NetftTraceMessage

Description

Interface signals address IP DAD State change to.

Fields #

Name	Description
`InterfaceId` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`IpDadState` HexInt32

Event ID 166: Interface InterfaceId signals address EndpointAddress IP DAD State change to IpDadState.

Channel: Verbose
Task: NetftTraceMessage

Message #

Interface %1 signals address %3 IP DAD State change to %4

Fields #

Name	Description
`InterfaceId` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`IpDadState` HexInt32

Event ID 167

Channel: Operational
Task: NetftTraceMessage

Description

Interface signals address IP DAD State change to.

Fields #

Name	Description
`InterfaceId` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`IpDadState` HexInt32

Event ID 167: Interface InterfaceId signals address EndpointAddress IP DAD State change to IpDadState.

Channel: Verbose
Task: NetftTraceMessage

Message #

Interface %1 signals address %3 IP DAD State change to %4

Fields #

Name	Description
`InterfaceId` HexInt64
`EndpointAddressIPLength` UInt32
`EndpointAddress` Binary
`IpDadState` HexInt32

Event ID 168

Channel: Operational
Task: NetftTraceMessage

Description

PnP signals interface operational status change ().

Fields #

Name	Description
`NotificationType` HexInt32

Event ID 168: PnP signals interface operational status change (NotificationType).

Channel: Verbose
Level: Verbose
Task: NetftTraceMessage

Message #

PnP signals interface operational status change (%1)

Fields #

Name	Description
`NotificationType` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 168,
    "version": 0,
    "level": 5,
    "task": 11400,
    "opcode": 0,
    "keywords": 2305843009213694208,
    "time_created": "2026-06-13T13:35:47.2434278+00:00",
    "event_record_id": 33,
    "correlation": {},
    "execution": {
      "process_id": 1760,
      "thread_id": 6536
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Verbose",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NotificationType": "0x3"
  },
  "message": "PnP signals interface operational status change (0x3)"
}

Event ID 169

Channel: Operational
Task: NetftTraceMessage

Description

Interface signals operational status.

Fields #

Name	Description
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 169: Interface InterfaceId signals operational status Status.

Channel: Verbose
Task: NetftTraceMessage

Message #

Interface %1 signals operational status %2

Fields #

Name	Description
`InterfaceId` HexInt64
`Status` HexInt32	NTSTATUS reference

Event ID 4096: Driver loaded.

Channel: Operational
Level: Informational
Task: DriverLoad

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FailoverClustering-NetFt",
    "guid": "{C1FCCEB3-3F19-42A9-95B9-27B550FA1FBA}",
    "event_source_name": "",
    "event_id": 4096,
    "version": 0,
    "level": 4,
    "task": 10100,
    "opcode": 0,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-30T02:33:58.5658198+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 12572
    },
    "channel": "Microsoft-Windows-FailoverClustering-NetFt/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Status": "0x0"
  },
  "message": "Driver loaded."
}

Event ID 8192: Watchdog Started.

Channel: Operational
Task: WatchdogStarted

Description

Watchdog Started. Instance: Context; Image Name: ProcessName; PID: PID; Action: Action; Source: Source; Counter: Counter; Missing Heartbeats Limit: Period.

Message #

Watchdog Started. Instance: %1; Image Name: %4; PID: %2; Action: %5; Source: %6; Counter: %8; Missing Heartbeats Limit: %7;

Fields #

Name	Description
`Context` HexInt64
`PID` HexInt64
`ProcessImageNameLength` UInt16
`ProcessName` UnicodeString
`Action` UInt32
`Source` UInt32
`Period` UInt32
`Counter` UInt32

Event ID 12288: Watchdog Stopped.

Channel: Operational
Task: WatchdogStopped

Description

Watchdog Stopped. Instance: Context; Image Name: ProcessName; PID: PID; Action: Action; Source: Source; Counter: Counter; Missing Heartbeats Limit: Period.

Message #

Watchdog Stopped. Instance: %1; Image Name: %4; PID: %2; Action: %5; Source: %6; Counter: %8; Missing Heartbeats Limit: %7;

Fields #

Name	Description
`Context` HexInt64
`PID` HexInt64
`ProcessImageNameLength` UInt16
`ProcessName` UnicodeString
`Action` UInt32
`Source` UInt32
`Period` UInt32
`Counter` UInt32

Event ID 16384: Watchdog Heartbeat Missed.

Channel: Operational
Task: WatchdogHeartbeatMissed

Description

Watchdog Heartbeat Missed. Instance: Context; Image Name: ProcessName; PID: PID; Action: Action; Source: Source; Counter: Counter; Missing Heartbeats Limit: Period.

Message #

Watchdog Heartbeat Missed. Instance: %1; Image Name: %4; PID: %2; Action: %5; Source: %6; Counter: %8; Missing Heartbeats Limit: %7;

Fields #

Name	Description
`Context` HexInt64
`PID` HexInt64
`ProcessImageNameLength` UInt16
`ProcessName` UnicodeString
`Action` UInt32
`Source` UInt32
`Period` UInt32
`Counter` UInt32

Event ID 20480: Watchdog Fired.

Channel: Operational
Task: WatchdogFired

Description

Watchdog Fired. Instance: Context; Image Name: ProcessName; PID: PID; Action: Action; Source: Source; Counter: Counter; Missing Heartbeats Limit: Period.

Message #

Watchdog Fired. Instance: %1; Image Name: %4; PID: %2; Action: %5; Source: %6; Counter: %8; Missing Heartbeats Limit: %7;

Fields #

Name	Description
`Context` HexInt64
`PID` HexInt64
`ProcessImageNameLength` UInt16
`ProcessName` UnicodeString
`Action` UInt32
`Source` UInt32
`Period` UInt32
`Counter` UInt32

Event ID 24576: Watchdog Updated.

Channel: Operational
Task: WatchdogUpdated

Description

Watchdog Updated. Instance: Context; Image Name: ProcessName; PID: PID; Action: Action; Source: Source; Counter: Counter; Missing Heartbeats Limit: Period.

Message #

Watchdog Updated. Instance: %1; Image Name: %4; PID: %2; Action: %5; Source: %6; Counter: %8; Missing Heartbeats Limit: %7;

Fields #

Name	Description
`Context` HexInt64
`PID` HexInt64
`ProcessImageNameLength` UInt16
`ProcessName` UnicodeString
`Action` UInt32
`Source` UInt32
`Period` UInt32
`Counter` UInt32

Event ID 28672: Watchdog Orphaned.

Channel: Operational
Task: WatchdogOrphaned

Description

Watchdog Orphaned. Instance: Context; Image Name: ProcessName; PID: PID; Action: Action; Source: Source; Counter: Counter; Missing Heartbeats Limit: Period.

Message #

Watchdog Orphaned. Instance: %1; Image Name: %4; PID: %2; Action: %5; Source: %6; Counter: %8; Missing Heartbeats Limit: %7;

Fields #

Name	Description
`Context` HexInt64
`PID` HexInt64
`ProcessImageNameLength` UInt16
`ProcessName` UnicodeString
`Action` UInt32
`Source` UInt32
`Period` UInt32
`Counter` UInt32

Event ID 32768: Watchdog Orphaned.

Channel: Operational
Task: WatchdogOrphanedProcessTerminationCompleted

Description

Watchdog Orphaned. Process termination completed. Instance: Context; Image Name: ProcessName; PID: PID; Action: Action; Source: Source; Counter: Counter; Missing Heartbeats Limit: Period.

Message #

Watchdog Orphaned. Process termination completed. Instance: %1; Image Name: %4; PID: %2; Action: %5; Source: %6; Counter: %8; Missing Heartbeats Limit: %7;

Fields #

Name	Description
`Context` HexInt64
`PID` HexInt64
`ProcessImageNameLength` UInt16
`ProcessName` UnicodeString
`Action` UInt32
`Source` UInt32
`Period` UInt32
`Counter` UInt32

Event ID 36864: Route added from SourceIP to DestinationIP for context Context, ContextRouteCount: ContextRouteCount.

Channel: Operational
Task: RouteAdded

Description

Route added from SourceIP to DestinationIP for context Context, ContextRouteCount: ContextRouteCount. Source: Source.

Message #

Route added from %4 to %5 for context %1, ContextRouteCount: %6. Source: %7

Fields #

Name	Description
`Context` HexInt64
`SourceIPLength` UInt32
`DestinationIPLength` UInt32
`SourceIP` Binary
`DestinationIP` Binary
`ContextRouteCount` UInt32
`Source` UInt32

Event ID 40960: Route from SourceIP to DestinationIP deleted for context Context, ContextRouteCount: ContextRouteCount.

Channel: Operational
Task: RouteDeleted

Description

Route from SourceIP to DestinationIP deleted for context Context, ContextRouteCount: ContextRouteCount. Source: Source.

Message #

Route from %4 to %5 deleted for context %1, ContextRouteCount: %6. Source: %7

Fields #

Name	Description
`Context` HexInt64
`SourceIPLength` UInt32
`DestinationIPLength` UInt32
`SourceIP` Binary
`DestinationIP` Binary
`ContextRouteCount` UInt32
`Source` UInt32

Event ID 45056: Route cleanup scheduled for context Context, ContextRouteCount: ContextRouteCount, Source: Source.

Channel: Operational
Task: NetftRouteDeletionScheduled

Message #

Route cleanup scheduled for context %1, ContextRouteCount: %2, Source: %3

Fields #

Name	Description
`Context` HexInt64
`ContextRouteCount` UInt32
`Source` UInt32

Event ID 49152: Livedump started.

Channel: Operational
Task: NetftLiveDump

Description

Livedump started. : Report type: ReportType; Bugcheck code: BugcheckCode; Parameter1: Parameter1; Parameter2: Parameter2; Parameter3: Parameter3; Parameter4: Parameter4; Flags: Flags.

Message #

Livedump started. : Report type: %2; Bugcheck code: %3; Parameter1: %4; Parameter2: %5; Parameter3: %6; Parameter4: %7; Flags: %8

Fields #

Name	Description
`Context` HexInt64
`ReportType` UnicodeString
`BugcheckCode` HexInt64
`Parameter1` HexInt64
`Parameter2` HexInt64
`Parameter3` HexInt64
`Parameter4` HexInt64
`Flags` HexInt32

Event ID 53248: Livedump Completed.

Channel: Operational
Task: NetftLiveDump

Description

Livedump Completed. : Report type: ReportType; Bugcheck code: BugcheckCode; Parameter1: Parameter1; Parameter2: Parameter2; Parameter3: Parameter3; Parameter4: Parameter4; Flags: Flags Status: Status.

Message #

Livedump Completed. : Report type: %2; Bugcheck code: %3; Parameter1: %4; Parameter2: %5; Parameter3: %6; Parameter4: %7; Flags: %8 Status: %9

Fields #

Name	Description
`Context` HexInt64
`ReportType` UnicodeString
`BugcheckCode` HexInt64
`Parameter1` HexInt64
`Parameter2` HexInt64
`Parameter3` HexInt64
`Parameter4` HexInt64
`Flags` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 57344: DPC Skew detected for Monitor Context.

Channel: Operational
Task: NetftDPCTimeSkew

Description

DPC Skew detected for Monitor Context. DPC routine fired in DelayTicks ticks (@ TickRate ticks per sec), but was scheduled scheduled for ScheduledTimeMilliseconds msecs, with tolerance range [min, max] = [MinimumToleranceTicks, MaximumToleranceTicks] ticks, current tick count CurrentTickCount.

Message #

DPC Skew detected for Monitor %1. DPC routine fired in %2 ticks (@ %3 ticks per sec), but was scheduled scheduled for %4 msecs, with tolerance range [min, max] = [%5, %6] ticks, current tick count %7.

Fields #

Name	Description
`Context` HexInt64
`DelayTicks` HexInt64
`TickRate` HexInt64
`ScheduledTimeMilliseconds` UInt32
`MinimumToleranceTicks` HexInt64
`MaximumToleranceTicks` HexInt64
`CurrentTickCount` HexInt64

Provenance

ETW provider GUID c1fcceb3-3f19-42a9-95b9-27b550fa1fba

Defined in NetFt.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB