Microsoft-Windows-FileManagerDataModel

Event	Title	Channel	Sample	Rule
1	Error message: {UnicodeString}.	Operational	N	N
2	Warning message: {UnicodeString}.	Operational	N	N
3	Information message: {UnicodeString}.	Operational	N	N
4	Information message: {UnicodeString}.	Operational	N	N
5	Warning message: {UnicodeString}.	Operational	N	N
6	Error message: {UnicodeString}.	Operational	N	N
7	backtrace from {MethodName}; trace: {Backtrace}.	Operational	N	N
100	RegisterEventHandlers threw {HresultValue}.	Operational	N	N
104	Status while getting the user identity: {HresultValue}.	Operational	N	N
403	Pause state changing: [.	Operational	N	N
404	Pause state changed: {Boolean}.	Operational	N	N
405	Internal Pause state changed: {Boolean}.	Operational	N	N
407	ExecuteSyncPauseRequest status: {HresultValue}.	Operational	N	N
408	Calling Sync Engine {Boolean}.	Operational	N	N
412	Registering SyncEngine callback object	Operational	N	N
414	Setting selective sync options for rootFolderId=.	Operational	N	N
415	Selective Sync option for ItemId = {ItemId}; state = {State}.	Operational	N	N
416	Cleaning up SyncEngineManager requests list; {Integer} requests.	Operational	N	N
417	EndSetSelectiveSync called; cookie:{Cookie}; result: {Result}.	Operational	N	N
418	Couldn't start the SyncEngine; hr = {HresultValue}.	Operational	N	N
421	BeginRefreshSync stopped: {HresultValue}.	Operational	N	N
426	Sync Engine callback is no longer valid: {HresultValue}.	Operational	N	N
500	FileSyncBlockedReason: {Integer}.	Operational	N	N
501	FileSyncBlocked event fired: {HresultValue}.	Operational	N	N
503	AuthenticationErrorEvent fired: [.	Operational	N	N
601	Retrieve fast properties store.	Operational	N	N
711	In StartGetRunningOperations; _pollingInProgress is {Boolean}.	Operational	N	N
712	Enabling/Disabling toast notificiations: {Boolean}.	Operational	N	N
713	Setting new polling frequency to {HresultValue}.	Operational	N	N
714	Handling interrupt [.	Operational	N	N
900	Location {UnicodeString} is a fastlocation; generating scope.	Operational	N	N
1004	Terminating operation [.	Operational	N	N
1005	Operations are destroyed on {Boolean}.	Operational	N	N
1006	New polling rate: {Integer} milliseconds.	Operational	N	N
1009	Processing {Integer} operations.	Operational	N	N
1010	{Integer} operations were processed.	Operational	N	N
1100	NetworkStatusChanged event received when EventsEnabled = {Boolean}.	Operational	N	N
1103	Setting EventsEnabled: {Boolean}.	Operational	N	N
1200	Sync status from indexer for {Path} is {Status}; hr = {HResult}.	Operational	N	N
1201	Notify change for property {PropertyName} with override property …	Operational	N	N
1203	Global SyncEngineStatus: GlobalErroState [.	Operational	N	N
1204	Global SyncEngineStatus: GlobalErroState [.	Operational	N	N
1206	Could not check whether item is marked for offline availability for {This}; …	Operational	N	N
1207	Erasing entry for property {UnicodeString}.	Operational	N	N
1208	Failed to retrieve IShellItem; hr = {HresultValue}.	Operational	N	N
1300	Listening to shell change status: {Id}; on window id: {HResult}.	Operational	N	N
1301	Stopped listening to shell change notifications; handler=.	Operational	N	N
1302	Updating status to: {Integer}.	Operational	N	N
1303	Stopping timer for window: {Integer}.	Operational	N	N
1306	OnTileAvailabilityCheckTimerTick: Updating tile status	Operational	N	N
1401	Timer tick with refresh = [.	Operational	N	N
1402	Firing SyncEngineStatus event: currentError: {CurrentError}; currentSyncStatu: …	Operational	N	N
1501	HealthMonitor's GetSyncEngineStatus stopped {HresultValue}.	Operational	N	N
1503	HealthMonitor's GetIndexerStatus stopped {HresultValue}.	Operational	N	N
1504	HealthMonitor will start in {Integer} seconds.	Operational	N	N
1506	HealthMonitor stopped: {HresultValue}.	Operational	N	N
1600	PerformanceTimer::Start failed with hr=.	Operational	N	N
1601	PerformanceTimer::GetDuration failed with hr=.	Operational	N	N

Event ID 1: Error message: {UnicodeString}.

Channel: Operational

Fields #

Name	Description
`UnicodeString`

Event ID 2: Warning message: {UnicodeString}.

Channel: Operational

Fields #

Name	Description
`UnicodeString`

Event ID 3: Information message: {UnicodeString}.

Channel: Operational

Fields #

Name	Description
`UnicodeString`

Event ID 4: Information message: {UnicodeString}.

Channel: Operational

Fields #

Name	Description
`UnicodeString`

Event ID 5: Warning message: {UnicodeString}.

Channel: Operational

Fields #

Name	Description
`UnicodeString`

Event ID 6: Error message: {UnicodeString}.

Channel: Operational

Fields #

Name	Description
`UnicodeString`

Event ID 7: backtrace from {MethodName}; trace: {Backtrace}.

Channel: Operational

Fields #

Name	Description
`MethodName`
`Backtrace`

Event ID 100: RegisterEventHandlers threw {HresultValue}.

Channel: Operational

Description

RegisterEventHandlers threw {HresultValue}. If E_ACCESSDENIED; a Guest account could be a readon of this failure.

Message #

RegisterEventHandlers threw {HresultValue}. If E_ACCESSDENIED; a Guest account could be a readon of this failure.

Fields #

Name	Description
`HresultValue`

Event ID 104: Status while getting the user identity: {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 403: Pause state changing: [.

Channel: Operational

Description

Pause state changing: [{CurrentState}] => [{RequestedState}].

Message #

Pause state changing: [{CurrentState}] => [{RequestedState}]

Fields #

Name	Description
`CurrentState`
`RequestedState`

Event ID 404: Pause state changed: {Boolean}.

Channel: Operational

Fields #

Name	Description
`Boolean`

Event ID 405: Internal Pause state changed: {Boolean}.

Channel: Operational

Fields #

Name	Description
`Boolean`

Event ID 407: ExecuteSyncPauseRequest status: {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 408: Calling Sync Engine {Boolean}.

Channel: Operational

Fields #

Name	Description
`Boolean`

Event ID 412: Registering SyncEngine callback object

Channel: Operational

Event ID 414: Setting selective sync options for rootFolderId=.

Channel: Operational

Description

Setting selective sync options for rootFolderId={UnicodeString}.

Message #

Setting selective sync options for rootFolderId={UnicodeString}

Fields #

Name	Description
`UnicodeString`

Event ID 415: Selective Sync option for ItemId = {ItemId}; state = {State}.

Channel: Operational

Fields #

Name	Description
`ItemId`
`State`

Event ID 416: Cleaning up SyncEngineManager requests list; {Integer} requests.

Channel: Operational

Fields #

Name	Description
`Integer`

Event ID 417: EndSetSelectiveSync called; cookie:{Cookie}; result: {Result}.

Channel: Operational

Fields #

Name	Description
`Cookie`
`Result`

Event ID 418: Couldn't start the SyncEngine; hr = {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 421: BeginRefreshSync stopped: {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 426: Sync Engine callback is no longer valid: {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 500: FileSyncBlockedReason: {Integer}.

Channel: Operational

Fields #

Name	Description
`Integer`

Event ID 501: FileSyncBlocked event fired: {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 503: AuthenticationErrorEvent fired: [.

Channel: Operational

Description

AuthenticationErrorEvent fired: [{HresultValue}].

Message #

AuthenticationErrorEvent fired: [{HresultValue}]

Fields #

Name	Description
`HresultValue`

Event ID 601: Retrieve fast properties store.

Channel: Operational

Description

Retrieve fast properties store. Extrinsic property store could not be created; errorCode: {HresultValue}.

Message #

Retrieve fast properties store. Extrinsic property store could not be created; errorCode: {HresultValue}

Fields #

Name	Description
`HresultValue`

Event ID 711: In StartGetRunningOperations; _pollingInProgress is {Boolean}.

Channel: Operational

Fields #

Name	Description
`Boolean`

Event ID 712: Enabling/Disabling toast notificiations: {Boolean}.

Channel: Operational

Fields #

Name	Description
`Boolean`

Event ID 713: Setting new polling frequency to {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 714: Handling interrupt [.

Channel: Operational

Description

Handling interrupt [{Guid}].

Message #

Handling interrupt [{Guid}]

Fields #

Name	Description
`Guid`

Event ID 900: Location {UnicodeString} is a fastlocation; generating scope.

Channel: Operational

Fields #

Name	Description
`UnicodeString`

Event ID 1004: Terminating operation [.

Channel: Operational

Description

Terminating operation [{Guid}].

Message #

Terminating operation [{Guid}]

Fields #

Name	Description
`Guid`

Event ID 1005: Operations are destroyed on {Boolean}.

Channel: Operational

Fields #

Name	Description
`Boolean`

Event ID 1006: New polling rate: {Integer} milliseconds.

Channel: Operational

Fields #

Name	Description
`Integer`

Event ID 1009: Processing {Integer} operations.

Channel: Operational

Fields #

Name	Description
`Integer`

Event ID 1010: {Integer} operations were processed.

Channel: Operational

Fields #

Name	Description
`Integer`

Event ID 1100: NetworkStatusChanged event received when EventsEnabled = {Boolean}.

Channel: Operational

Fields #

Name	Description
`Boolean`

Event ID 1103: Setting EventsEnabled: {Boolean}.

Channel: Operational

Fields #

Name	Description
`Boolean`

Event ID 1200: Sync status from indexer for {Path} is {Status}; hr = {HResult}.

Channel: Operational

Fields #

Name	Description
`Path`
`Status`	NTSTATUS reference
`HResult`

Event ID 1201: Notify change for property {PropertyName} with override property {OverridePropertyName}.

Channel: Operational

Fields #

Name	Description
`PropertyName`
`OverridePropertyName`

Event ID 1203: Global SyncEngineStatus: GlobalErroState [.

Channel: Operational

Description

Global SyncEngineStatus: GlobalErroState [{GlobalError}] GlobalSyncState[{GlobalSyncState}].

Message #

Global SyncEngineStatus: GlobalErroState [{GlobalError}] GlobalSyncState[{GlobalSyncState}]

Fields #

Name	Description
`GlobalError`
`GlobalSyncState`

Event ID 1204: Global SyncEngineStatus: GlobalErroState [.

Channel: Operational

Description

Global SyncEngineStatus: GlobalErroState [{GlobalError}] GlobalSyncState[{GlobalSyncState}].

Message #

Global SyncEngineStatus: GlobalErroState [{GlobalError}] GlobalSyncState[{GlobalSyncState}]

Fields #

Name	Description
`GlobalError`
`GlobalSyncState`

Event ID 1206: Could not check whether item is marked for offline availability for {This}; result: [{HResult}].

Channel: Operational

Fields #

Name	Description
`This`
`HResult`

Event ID 1207: Erasing entry for property {UnicodeString}.

Channel: Operational

Fields #

Name	Description
`UnicodeString`

Event ID 1208: Failed to retrieve IShellItem; hr = {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 1300: Listening to shell change status: {Id}; on window id: {HResult}.

Channel: Operational

Fields #

Name	Description
`Id`
`HResult`

Event ID 1301: Stopped listening to shell change notifications; handler=.

Channel: Operational

Description

Stopped listening to shell change notifications; handler={Integer}.

Message #

Stopped listening to shell change notifications; handler={Integer}

Fields #

Name	Description
`Integer`

Event ID 1302: Updating status to: {Integer}.

Channel: Operational

Fields #

Name	Description
`Integer`

Event ID 1303: Stopping timer for window: {Integer}.

Channel: Operational

Fields #

Name	Description
`Integer`

Event ID 1306: OnTileAvailabilityCheckTimerTick: Updating tile status

Channel: Operational

Event ID 1401: Timer tick with refresh = [.

Channel: Operational

Description

Timer tick with refresh = [{UnicodeString}].

Message #

Timer tick with refresh = [{UnicodeString}]

Fields #

Name	Description
`UnicodeString`

Event ID 1402: Firing SyncEngineStatus event: currentError: {CurrentError}; currentSyncStatu: {CurrentSyncStatus}; currentTransferStatus: {CurrentSyncStatus}.

Channel: Operational

Fields #

Name	Description
`CurrentError`
`CurrentSyncStatus`

Event ID 1501: HealthMonitor's GetSyncEngineStatus stopped {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 1503: HealthMonitor's GetIndexerStatus stopped {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 1504: HealthMonitor will start in {Integer} seconds.

Channel: Operational

Fields #

Name	Description
`Integer`

Event ID 1506: HealthMonitor stopped: {HresultValue}.

Channel: Operational

Fields #

Name	Description
`HresultValue`

Event ID 1600: PerformanceTimer::Start failed with hr=.

Channel: Operational

Description

PerformanceTimer::Start failed with hr={HresultValue}.

Message #

PerformanceTimer::Start failed with hr={HresultValue}

Fields #

Name	Description
`HresultValue`

Event ID 1601: PerformanceTimer::GetDuration failed with hr=.

Channel: Operational

Description

PerformanceTimer::GetDuration failed with hr={HresultValue}.

Message #

PerformanceTimer::GetDuration failed with hr={HresultValue}

Fields #

Name	Description
`HresultValue`