Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget

38 events across 3 channels

Event	Title	Channel	Sample
101	Storage Spaces Direct has successfully provisioned a disk for the cache.	Management	N
101	Event ID 101	Operational	N
102	Event ID 102	Operational	N
102	Storage Spaces Direct cannot provision a disk for the cache due to an error.	System	N
110	Event ID 110	Operational	N
110	Storage Spaces Direct found a disk that cannot be used for the cache because …	System	N
111	Event ID 111	Operational	N
111	Storage Spaces Direct found a disk that cannot be used for the cache because the …	System	N
112	Event ID 112	Operational	N
112	Storage Spaces Direct found a disk that cannot be used for the cache because it …	System	N
113	Event ID 113	Operational	N
113	Storage Spaces Direct found a disk that cannot be used for the cache due to an …	System	N
201	Storage Spaces Direct is optimizing the cache.	Management	N
201	Event ID 201	Operational	N
202	Storage Spaces Direct has selected the following drive to be rebalanced during …	Management	N
202	Event ID 202	Operational	N
203	Storage Spaces Direct has finished optimizing the cache.	Management	N
203	Event ID 203	Operational	N
204	Storage Spaces Direct cannot optimize the cache on a device.	Management	N
204	Event ID 204	Operational	N
301	Event ID 301	Operational	N
301	Storage Spaces Direct found that a flash drive is missing.	System	N
302	Event ID 302	Operational	N
302	A missing flash device has reappeared.	System	N
303	Event ID 303	Operational	N
303	Storage Spaces Direct has timed out waiting for a missing flash drive to …	System	N
304	Event ID 304	Operational	N
304	Storage Spaces Direct has found that a flash device has failed to initialize.	System	N
305	Event ID 305	Operational	N
305	Storage Spaces Direct has found that a disk has reached the media error …	System	N
401	The Storage Spaces Direct configuration has changed.	Management	N
401	Event ID 401	Operational	N
501	Storage Spaces Direct has successfully provisioned a SED drive for the cache.	Management	N
501	Event ID 501	Operational	N
502	Storage Spaces Direct encountered an error while configuring the following SED …	Management	N
502	Event ID 502	Operational	N
503	Storage Spaces Direct failed to configure the following SED drive.	Management	N
503	Event ID 503	Operational	N

Event ID 101: Storage Spaces Direct has successfully provisioned a disk for the cache.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: Diskprovisioning

Description

Storage Spaces Direct has successfully provisioned a disk for the cache.

Message #

Storage Spaces Direct has successfully provisioned a disk for the cache.

Cache mode: %11

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 101

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Diskprovisioning

Description

Storage Spaces Direct has successfully provisioned a disk for the cache.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 102

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Diskprovisioning

Description

Storage Spaces Direct cannot provision a disk for the cache due to an error.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`RecentError1TimeStamp` FILETIME
`RecentError1FailedStage` UInt32
`RecentError1ErrorCode` UInt32
`RecentError2TimeStamp` FILETIME
`RecentError2FailedStage` UInt32
`RecentError2ErrorCode` UInt32
`RecentError3TimeStamp` FILETIME
`RecentError3FailedStage` UInt32
`RecentError3ErrorCode` UInt32
`RecentError4TimeStamp` FILETIME
`RecentError4FailedStage` UInt32
`RecentError4ErrorCode` UInt32
`ProvisioningErrorsCount` UInt16
`ProvisioningErrors` 25

Event ID 102: Storage Spaces Direct cannot provision a disk for the cache due to an error.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Diskprovisioning

Description

Storage Spaces Direct cannot provision a disk for the cache due to an error.

Message #

Storage Spaces Direct cannot provision a disk for the cache due to an error.

Error: %14
Stage: %13

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Cache mode: %11

Guidance:
The most recent error code is listed above. Any prior errors about provisioning the disk are in the event details. The disk has been removed from Storage Spaces Direct. Check to ensure that cabling to your storage devices is fully seated and intact. Ensure that the disk is still present and is healthy, and that you have the latest drivers and firmware for the device and the storage controller.

To find the disk in PowerShell, use the following commands:
Get-PhysicalDisk |? ObjectId -Match "%1"
Get-PhysicalDisk -SerialNumber %5
Get-Disk -Number %2

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`RecentError1TimeStamp` FILETIME
`RecentError1FailedStage` UInt32
`RecentError1ErrorCode` UInt32
`RecentError2TimeStamp` FILETIME
`RecentError2FailedStage` UInt32
`RecentError2ErrorCode` UInt32
`RecentError3TimeStamp` FILETIME
`RecentError3FailedStage` UInt32
`RecentError3ErrorCode` UInt32
`RecentError4TimeStamp` FILETIME
`RecentError4FailedStage` UInt32
`RecentError4ErrorCode` UInt32
`ProvisioningErrorsCount` UInt16
`ProvisioningErrors` 25

Event ID 110

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Diskprovisioning

Description

Storage Spaces Direct found a disk that cannot be used for the cache because data partitions already exist on the disk.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 110: Storage Spaces Direct found a disk that cannot be used for the cache because data partitions already exist on the disk.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Diskprovisioning

Description

Storage Spaces Direct found a disk that cannot be used for the cache because data partitions already exist on the disk.

Message #

Storage Spaces Direct found a disk that cannot be used for the cache because data partitions already exist on the disk.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Cache mode: %11

Guidance:
To use the disk for Storage Spaces Direct, you must delete all data partitions off of the disk.
To see which partitions are on the disk, run the following PowerShell cmdlet:
Get-Disk -Number %2 | Get-Partition

To delete all data partitions on the disk, run the following PowerShell cmdlet:
Set-Disk -Number %2 -IsOffline $false
Set-Disk -Number %2 -IsReadOnly $false
Clear-Disk -Number %2 ?RemoveData -RemoveOEM

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 111

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Diskprovisioning

Description

Storage Spaces Direct found a disk that cannot be used for the cache because the disk is not initialized as a GPT disk.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 111: Storage Spaces Direct found a disk that cannot be used for the cache because the disk is not initialized as a GPT disk.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Diskprovisioning

Description

Storage Spaces Direct found a disk that cannot be used for the cache because the disk is not initialized as a GPT disk.

Message #

Storage Spaces Direct found a disk that cannot be used for the cache because the disk is not initialized as a GPT disk.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Cache mode: %11

Guidance:
To use the disk for Storage Spaces Direct, you must initialize the disk as a GPT disk. First, ensure that the disk does contain any data that you want to save, then clear the disk using the following instructions.

To clear the disk:
Set-Disk -Number %2 -IsOffline $false
Set-Disk -Number %2 -IsReadOnly $false
Clear-Disk -Number %2 ?RemoveData -RemoveOEM

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 112

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Diskprovisioning

Description

Storage Spaces Direct found a disk that cannot be used for the cache because it has insufficient disk space for the reserved metadata portion.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`CacheMetadataReserveBytes` UInt64

Event ID 112: Storage Spaces Direct found a disk that cannot be used for the cache because it has insufficient disk space for the reserved metadata portion.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Diskprovisioning

Description

Storage Spaces Direct found a disk that cannot be used for the cache because it has insufficient disk space for the reserved metadata portion.

Message #

Storage Spaces Direct found a disk that cannot be used for the cache because it has insufficient disk space for the reserved metadata portion.

Configured reserved bytes: %12

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Cache mode: %11

Guidance:
To use the disk for Storage Spaces Direct, you must reduce the amount of metadata reserve bytes.
To reduce the metadata reserve bytes, run the following PowerShell command:
(Get-Cluster).S2DMetadataReserveBytes = (%12 / 2)

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`CacheMetadataReserveBytes` UInt64

Event ID 113

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Diskprovisioning

Description

Storage Spaces Direct found a disk that cannot be used for the cache due to an unexpected error.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 113: Storage Spaces Direct found a disk that cannot be used for the cache due to an unexpected error.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Diskprovisioning

Description

Storage Spaces Direct found a disk that cannot be used for the cache due to an unexpected error.

Message #

Storage Spaces Direct found a disk that cannot be used for the cache due to an unexpected error.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Cache mode: %11

Guidance:
Check to ensure that cabling to your storage devices is fully seated and intact. Ensure that the disk is still present and is healthy, and that you have the latest drivers and firmware for the device and the storage controller.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 201: Storage Spaces Direct is optimizing the cache.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: Optimization

Message #

Storage Spaces Direct is optimizing the cache. While the cache is being optimized, some IOs to this node will not be cached and you may notice a performance degradation. Event 203 will be logged when optimization is complete.

Event ID 201

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Optimization

Event ID 202: Storage Spaces Direct has selected the following drive to be rebalanced during optimization.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: Optimization

Message #

Storage Spaces Direct has selected the following drive to be rebalanced during optimization. While the cache is being optimized, some IOs to this drive cannot be cached. Event 203 is logged when cache optimization is completed for all the drives.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`BindingAttributes` UInt64
`DirtyPages` UInt64
`DirtySlots` UInt64
`CacheDeviceId` GUID

Event ID 202

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Optimization

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`BindingAttributes` UInt64
`DirtyPages` UInt64
`DirtySlots` UInt64
`CacheDeviceId` GUID

Event ID 203: Storage Spaces Direct has finished optimizing the cache.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: Optimization

Description

Storage Spaces Direct has finished optimizing the cache.

Message #

Storage Spaces Direct has finished optimizing the cache.

Event ID 203

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Optimization

Description

Storage Spaces Direct has finished optimizing the cache.

Event ID 204: Storage Spaces Direct cannot optimize the cache on a device.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: Optimization

Description

Storage Spaces Direct cannot optimize the cache on a device.

Message #

Storage Spaces Direct cannot optimize the cache on a device.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Guidance:
This occurs when some of the disks on this computer are not in a healthy state. Wait for all the disks to reach a healthy state, and then try to optimize the cache again.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 204

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Optimization

Description

Storage Spaces Direct cannot optimize the cache on a device.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 301

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Healthcheck

Description

Storage Spaces Direct found that a flash drive is missing. The following disk is associated with that flash drive will not be able to serve IO until the problem is corrected.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`TimeoutSeconds` UInt32

Event ID 301: Storage Spaces Direct found that a flash drive is missing.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Healthcheck

Description

Storage Spaces Direct found that a flash drive is missing. The following disk is associated with that flash drive will not be able to serve IO until the problem is corrected.

Message #

Storage Spaces Direct found that a flash drive is missing. The following disk is associated with that flash drive will not be able to serve IO until the problem is corrected.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Timeout (seconds): %11

Guidance:
Storage Spaces Direct will wait for the flash drive to reappear. When the device reappears, it results in event 302. If the device does not reappear within the timeout period that is listed above, Storage Spaces Direct will associate this affected hybrid disk with another flash drive. If the device does not reappear, it results in event 303.
Check to ensure that cabling to your storage devices is fully seated and intact. Ensure that the disk is still present and is healthy, and that you have the latest drivers and firmware for the device and the storage controller.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`TimeoutSeconds` UInt32

Event ID 302

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Healthcheck

Description

A missing flash device has reappeared. This hybrid disk will resume serving IO.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`TimeoutSeconds` UInt32

Event ID 302: A missing flash device has reappeared.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Healthcheck

Description

A missing flash device has reappeared. This hybrid disk will resume serving IO.

Message #

A missing flash device has reappeared. This hybrid disk will resume serving IO.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Guidance:
This is the culmination of the preceding event 301. No further action is necessary.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`TimeoutSeconds` UInt32

Event ID 303

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Healthcheck

Description

Storage Spaces Direct has timed out waiting for a missing flash drive to reappear and will now bind this hybrid to a different flash drive.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`TimeoutSeconds` UInt32

Event ID 303: Storage Spaces Direct has timed out waiting for a missing flash drive to reappear and will now bind this hybrid to a different flash drive.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Healthcheck

Description

Storage Spaces Direct has timed out waiting for a missing flash drive to reappear and will now bind this hybrid to a different flash drive.

Message #

Storage Spaces Direct has timed out waiting for a missing flash drive to reappear and will now bind this hybrid to a different flash drive.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Guidance:
This is the culmination of the preceding event 301. No further action is necessary.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`TimeoutSeconds` UInt32

Event ID 304

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Healthcheck

Description

Storage Spaces Direct has found that a flash device has failed to initialize.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`StatusCode` UInt32	NTSTATUS reference

Event ID 304: Storage Spaces Direct has found that a flash device has failed to initialize.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Healthcheck

Description

Storage Spaces Direct has found that a flash device has failed to initialize.

Message #

Storage Spaces Direct has found that a flash device has failed to initialize.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Status: %12

Guidance:
This flash could not initialize cache. Try Repair-ClusterStorageSpacesDirect to recover

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32
`StatusCode` UInt32	NTSTATUS reference

Event ID 305

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Healthcheck

Description

Storage Spaces Direct has found that a disk has reached the media error threshold.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 305: Storage Spaces Direct has found that a disk has reached the media error threshold.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: System
Task: Healthcheck

Description

Storage Spaces Direct has found that a disk has reached the media error threshold.

Message #

Storage Spaces Direct has found that a disk has reached the media error threshold.

Disk GUID: %1
Disk number: %2
Manufacturer: %3
Product ID: %4
Serial: %5

Enclosure location:
Enclosure slot: %6
Enclosure manufacturer: %7
Enclosure product ID: %8
Enclosure serial: %9

Guidance:
If this is a flash device, Storage Spaces Direct will bind any hybrid disks associated with this flash device to another flash device. No further action is necessary.

Fields #

Name	Description
`DiskGuid` GUID
`DiskNumber` UInt32
`DiskManufacturer` UnicodeString
`DiskProductId` UnicodeString
`DiskSerial` UnicodeString
`EnclosureSlotNumber` UInt32
`EnclosureManufacturer` UnicodeString
`EnclosureProductId` UnicodeString
`EnclosureSerial` UnicodeString
`EnclosureGuid` GUID
`CacheMode` UInt32

Event ID 401: The Storage Spaces Direct configuration has changed.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: Configuration

Description

The Storage Spaces Direct configuration has changed.

Message #

The Storage Spaces Direct configuration has changed.

New configuration:

Cache state: %1
Cache metadata reserve bytes: %2
Cache behavior: %3

Old configuration:

Cache state %4
Cache metadata reserve bytes: %5
Cache behavior: %6

Fields #

Name	Description
`NewCacheMode` UInt32
`NewMetadataReserveBytes` UInt64
`NewCacheBehaviorFlags` UInt32
`OldCacheMode` UInt32
`OldMetadataReserveBytes` UInt64
`OldCacheBehaviorFlags` UInt32

Event ID 401

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: Configuration

Description

The Storage Spaces Direct configuration has changed.

Fields #

Name	Description
`NewCacheMode` UInt32
`NewMetadataReserveBytes` UInt64
`NewCacheBehaviorFlags` UInt32
`OldCacheMode` UInt32
`OldMetadataReserveBytes` UInt64
`OldCacheBehaviorFlags` UInt32

Event ID 501: Storage Spaces Direct has successfully provisioned a SED drive for the cache.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: SEDDriveProvisioning

Description

Storage Spaces Direct has successfully provisioned a SED drive for the cache.

Message #

Storage Spaces Direct has successfully provisioned a SED drive for the cache.

Disk GUID: %1
SED Drive Provisioning State: %2

Fields #

Name	Description
`DiskGuid` GUID
`DiskSedState` UInt32

Event ID 501

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: SEDDriveProvisioning

Description

Storage Spaces Direct has successfully provisioned a SED drive for the cache.

Fields #

Name	Description
`DiskGuid` GUID
`DiskSedState` UInt32

Event ID 502: Storage Spaces Direct encountered an error while configuring the following SED drive.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: SEDDriveProvisioning

Description

Storage Spaces Direct encountered an error while configuring the following SED drive.

Message #

Storage Spaces Direct encountered an error while configuring the following SED drive.

Disk GUID: %1
SED Drive Provisioning State: %2
Status: %3

Fields #

Name	Description
`DiskGuid` GUID
`DiskSedState` UInt32
`ErrorCode` Int32

Event ID 502

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: SEDDriveProvisioning

Description

Storage Spaces Direct encountered an error while configuring the following SED drive.

Fields #

Name	Description
`DiskGuid` GUID
`DiskSedState` UInt32
`ErrorCode` Int32

Event ID 503: Storage Spaces Direct failed to configure the following SED drive.

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Management
Task: SEDDriveProvisioning

Description

Storage Spaces Direct failed to configure the following SED drive. This drive will not be used by S2D.

Message #

Storage Spaces Direct failed to configure the following SED drive. This drive will not be used by S2D.

Disk GUID: %1
SED Drive Provisioning State: %2
Status: %3

Fields #

Name	Description
`DiskGuid` GUID
`DiskSedState` UInt32
`ErrorCode` Int32

Event ID 503

Provider: Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget
Channel: Operational
Task: SEDDriveProvisioning

Description

Storage Spaces Direct failed to configure the following SED drive. This drive will not be used by S2D.

Fields #

Name	Description
`DiskGuid` GUID
`DiskSedState` UInt32
`ErrorCode` Int32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 0ac0708a-a44e-49ef-aa7e-fbe8ccc603a6

Defined in SblTargetMgrProvider.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-FailoverClustering-SoftwareStorageBusTarget registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)