Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65

237 events across 1 channel

Event	Title	Channel	Sample
10	task_0	ETW Trace	N
11	task_011	ETW Trace	N
12	task_012	ETW Trace	N
13	task_013	ETW Trace	N
14	task_014	ETW Trace	N
15	task_015	ETW Trace	N
16	task_016	ETW Trace	N
17	task_017	ETW Trace	N
18	task_018	ETW Trace	N
19	task_019	ETW Trace	N
20	task_020	ETW Trace	N
21	task_021	ETW Trace	N
22	task_022	ETW Trace	N
23	task_023	ETW Trace	N
24	task_024	ETW Trace	N
25	task_025	ETW Trace	N
26	task_026	ETW Trace	N
27	task_027	ETW Trace	N
28	task_028	ETW Trace	N
29	task_029	ETW Trace	N
30	task_030	ETW Trace	N
31	task_031	ETW Trace	N
32	task_032	ETW Trace	N
33	task_033	ETW Trace	N
34	task_034	ETW Trace	N
35	task_035	ETW Trace	N
36	task_036	ETW Trace	N
37	task_037	ETW Trace	N
38	task_038	ETW Trace	N
39	task_039	ETW Trace	N
40	task_040	ETW Trace	N
41	task_041	ETW Trace	N
42	task_042	ETW Trace	N
43	task_043	ETW Trace	N
44	task_044	ETW Trace	N
45	task_045	ETW Trace	N
46	task_046	ETW Trace	N
47	task_047	ETW Trace	N
48	task_048	ETW Trace	N
49	task_049	ETW Trace	N
50	task_050	ETW Trace	N
51	task_051	ETW Trace	N
52	task_052	ETW Trace	N
53	task_053	ETW Trace	N
54	task_054	ETW Trace	N
55	task_055	ETW Trace	N
56	task_056	ETW Trace	N
57	task_057	ETW Trace	N
58	task_058	ETW Trace	N
59	task_059	ETW Trace	N
60	task_060	ETW Trace	N
61	task_061	ETW Trace	N
62	task_062	ETW Trace	N
63	task_063	ETW Trace	N
64	task_064	ETW Trace	N
65	task_065	ETW Trace	N
66	task_066	ETW Trace	N
67	task_067	ETW Trace	N
68	task_068	ETW Trace	N
69	task_069	ETW Trace	N
70	task_070	ETW Trace	N
71	task_071	ETW Trace	N
72	task_072	ETW Trace	N
73	task_073	ETW Trace	N
74	task_074	ETW Trace	N
75	task_075	ETW Trace	N
76	task_076	ETW Trace	N
77	task_077	ETW Trace	N
78	task_078	ETW Trace	N
79	task_079	ETW Trace	N
80	task_080	ETW Trace	N
81	task_081	ETW Trace	N
82	task_082	ETW Trace	N
83	task_083	ETW Trace	N
84	task_084	ETW Trace	N
85	task_085	ETW Trace	N
86	task_086	ETW Trace	N
87	task_087	ETW Trace	N
88	task_088	ETW Trace	N
89	task_089	ETW Trace	N
90	task_090	ETW Trace	N
91	task_091	ETW Trace	N
92	task_092	ETW Trace	N
93	task_093	ETW Trace	N
94	task_094	ETW Trace	N
95	task_095	ETW Trace	N
96	task_096	ETW Trace	N
97	task_097	ETW Trace	N
98	task_098	ETW Trace	N
99	task_099	ETW Trace	N
100	task_0100	ETW Trace	N
101	task_0101	ETW Trace	N
102	task_0102	ETW Trace	N
103	task_0103	ETW Trace	N
104	task_0104	ETW Trace	N
105	task_0105	ETW Trace	N
106	task_0106	ETW Trace	N
107	task_0107	ETW Trace	N
108	task_0108	ETW Trace	N
109	task_0109	ETW Trace	N
110	task_0110	ETW Trace	N
111	task_0111	ETW Trace	N
112	task_0112	ETW Trace	N
113	task_0113	ETW Trace	N
114	task_0114	ETW Trace	N
115	task_0115	ETW Trace	N
116	task_0116	ETW Trace	N
117	task_0117	ETW Trace	N
118	task_0118	ETW Trace	N
119	task_0119	ETW Trace	N
120	task_0120	ETW Trace	N
121	task_0121	ETW Trace	N
122	task_0122	ETW Trace	N
123	task_0123	ETW Trace	N
124	task_0124	ETW Trace	N
125	task_0125	ETW Trace	N
126	task_0126	ETW Trace	N
127	task_0127	ETW Trace	N
128	task_0128	ETW Trace	N
129	task_0129	ETW Trace	N
130	task_0130	ETW Trace	N
131	task_0131	ETW Trace	N
132	task_0132	ETW Trace	N
133	task_0133	ETW Trace	N
134	task_0134	ETW Trace	N
135	task_0135	ETW Trace	N
136	task_0136	ETW Trace	N
137	task_0137	ETW Trace	N
138	task_0138	ETW Trace	N
139	task_0139	ETW Trace	N
140	task_0140	ETW Trace	N
141	task_0141	ETW Trace	N
142	task_0142	ETW Trace	N
143	task_0143	ETW Trace	N
144	task_0144	ETW Trace	N
145	task_0145	ETW Trace	N
146	task_0146	ETW Trace	N
147	task_0147	ETW Trace	N
148	task_0148	ETW Trace	N
149	task_0149	ETW Trace	N
150	task_0150	ETW Trace	N
151	task_0151	ETW Trace	N
152	task_0152	ETW Trace	N
153	task_0153	ETW Trace	N
154	task_0154	ETW Trace	N
155	task_0155	ETW Trace	N
156	task_0156	ETW Trace	N
157	task_0157	ETW Trace	N
158	task_0158	ETW Trace	N
159	task_0159	ETW Trace	N
160	task_0160	ETW Trace	N
161	task_0161	ETW Trace	N
162	task_0162	ETW Trace	N
163	task_0163	ETW Trace	N
164	task_0164	ETW Trace	N
165	task_0165	ETW Trace	N
166	task_0166	ETW Trace	N
167	task_0167	ETW Trace	N
168	task_0168	ETW Trace	N
169	task_0169	ETW Trace	N
170	task_0170	ETW Trace	N
171	task_0171	ETW Trace	N
172	task_0172	ETW Trace	N
173	task_0173	ETW Trace	N
174	task_0174	ETW Trace	N
175	task_0175	ETW Trace	N
176	task_0176	ETW Trace	N
177	task_0177	ETW Trace	N
178	task_0178	ETW Trace	N
179	task_0179	ETW Trace	N
180	task_0180	ETW Trace	N
181	task_0181	ETW Trace	N
182	task_0182	ETW Trace	N
183	task_0183	ETW Trace	N
184	task_0184	ETW Trace	N
185	task_0185	ETW Trace	N
186	task_0186	ETW Trace	N
187	task_0187	ETW Trace	N
188	task_0188	ETW Trace	N
189	task_0189	ETW Trace	N
190	task_0190	ETW Trace	N
191	task_0191	ETW Trace	N
192	task_0192	ETW Trace	N
193	task_0193	ETW Trace	N
194	task_0194	ETW Trace	N
195	task_0195	ETW Trace	N
196	task_0196	ETW Trace	N
197	task_0197	ETW Trace	N
198	task_0198	ETW Trace	N
199	task_0199	ETW Trace	N
200	task_0200	ETW Trace	N
201	task_0201	ETW Trace	N
202	task_0202	ETW Trace	N
203	task_0203	ETW Trace	N
204	task_0204	ETW Trace	N
205	task_0205	ETW Trace	N
206	task_0206	ETW Trace	N
207	task_0207	ETW Trace	N
208	task_0208	ETW Trace	N
209	task_0209	ETW Trace	N
210	task_0210	ETW Trace	N
211	task_0211	ETW Trace	N
212	task_0212	ETW Trace	N
213	task_0213	ETW Trace	N
214	task_0214	ETW Trace	N
215	task_0215	ETW Trace	N
216	task_0216	ETW Trace	N
217	task_0217	ETW Trace	N
218	task_0218	ETW Trace	N
219	task_0219	ETW Trace	N
220	task_0220	ETW Trace	N
221	task_0221	ETW Trace	N
222	task_0222	ETW Trace	N
223	task_0223	ETW Trace	N
224	task_0224	ETW Trace	N
225	task_0225	ETW Trace	N
226	task_0226	ETW Trace	N
227	task_0227	ETW Trace	N
228	task_0228	ETW Trace	N
229	task_0229	ETW Trace	N
230	task_0230	ETW Trace	N
231	task_0231	ETW Trace	N
232	task_0232	ETW Trace	N
233	task_0233	ETW Trace	N
234	task_0234	ETW Trace	N
235	task_0235	ETW Trace	N
236	task_0236	ETW Trace	N
237	task_0237	ETW Trace	N
238	task_0238	ETW Trace	N
239	task_0239	ETW Trace	N
240	task_0240	ETW Trace	N
241	task_0241	ETW Trace	N
242	task_0242	ETW Trace	N
243	task_0243	ETW Trace	N
244	task_0244	ETW Trace	N
245	task_0245	ETW Trace	N
246	task_0246	ETW Trace	N

Event ID 10: task_0

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(342) %!FUNC!:Forcing small completion stack size of %2!d! instead of %3!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_stackSize` Int32
`A11_oldStackSize` Int32

Event ID 11: task_011

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1378) %!FUNC!:Extending completion stack from %2!d! to %3!d! (irpCtrl=%4!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_IrpCtrl->CompletionStackLength` Int32
`A11_newStackSize` Int32
`A12_IrpCtrl` Pointer

Event ID 12: task_012

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1461) %!FUNC!:CN Insert Active (extend) IrpCtrl=%2!p! CompNode=%3!p!, [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_newCNode->IrpCtrl` Pointer
`A11_newCNode` Pointer
`A12_newCNode->DataSnapshot.MajorFunction` Int32

Event ID 13: task_013

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1476) %!FUNC!:CN Insert Waiting (extend)  IrpCtrl=%2!p! CompNode=%3!p!, [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_newCNode->IrpCtrl` Pointer
`A11_newCNode` Pointer
`A12_newCNode->DataSnapshot.MajorFunction` Int32

Event ID 14: task_014

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1502) %!FUNC!:While extending, hit non-tracked completion node, IrpCtrl=%2!p! [%3!d!,%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_IrpCtrl` Pointer
`A11_(CHAR)newCNode->DataSnapshot.MajorFunction` Int32
`A12_(CHAR)newCNode->DataSnapshot.MinorFunction` Int32

Event ID 15: task_015

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1524) %!FUNC!:Extending an already extended stack

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 16: task_016

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1850) %!FUNC!:Allocated type %2!d! IrpCtrl (%3!p!) for thread (%4!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_OpType` Int32
`A11_irpCtrl` Pointer
`A12_Frame->ReserveIrpCtrls.StaticOwningThread[OpType]` Pointer

Event ID 17: task_017

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1909) %!FUNC!:Freeing type %2!d! IrpCtrl (%3!p!) for thread (%4!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_OpType` Int32
`A11_IrpCtrl` Pointer
`A12_Frame->ReserveIrpCtrls.StaticOwningThread[OpType]` Pointer

Event ID 18: task_018

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2053) %!FUNC!:Allocated BackPocket IrpCtrl-1: (%2!p!) for thread (%3!p!), count=%4!d! index=%5!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl` Pointer
`A11_th` Pointer
`A12_Frame->ReserveIrpCtrls.Entries[i].Count` Int32
`A13_i` Int32

Event ID 19: task_019

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2125) %!FUNC!:Allocated BackPocket IrpCtrl-2: (%2!p!) for thread (%3!p!), count=%4!d! index=%5!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl` Pointer
`A11_th` Pointer
`A12_Frame->ReserveIrpCtrls.Entries[i].Count` Int32
`A13_i` Int32

Event ID 20: task_020

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2222) %!FUNC!:Freeing BackPocket IrpCtrl (%2!p!) for thread (%3!p!), count=%4!d! index=%5!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_IrpCtrl` Pointer
`A11_IrpCtrl->Data.Thread` Pointer
`A12_Frame->ReserveIrpCtrls.Entries[i].Count` Int32
`A13_i` Int32

Event ID 21: task_021

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1211) %!FUNC!:Already attached to FS  :   DO=%2!p! Vol=%3!p! &quot;%4!S!&quot; (%5!S!)

Event ID 22: task_022

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1848) %!FUNC!:Error creating control device object, status=%2

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 23: task_023

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1986) %!FUNC!:Error creating volume device object, status=%2

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 24: task_024

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2022) %!FUNC!:Error initializing Volume structure, status=%2

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 25: task_025

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2175) %!FUNC!:Attaching to file system   DO=%2!p! Vol=%3!p! &quot;%4!S!&quot; (%5!S!)

Event ID 26: task_026

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2218) %!FUNC!:Attaching to volume        DO=%2!p! Vol=%3!p! &quot;%4!S!&quot; (%5!S!)          AttachedToDO=%6!p!

Event ID 27: task_027

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2318) %!FUNC!:Detaching from filesystem  DO=%2!p! Vol=%3!p! &quot;%4!S!&quot; (%5!S!) Notify=%6!x!

Event ID 28: task_028

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2341) %!FUNC!:Detaching from volume      DO=%2!p! Vol=%3!p! &quot;%4!S!&quot; (%5!S!) Notify=%6!x! AttachedToDO=%7!p!

Event ID 29: task_029

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2439) %!FUNC!:Name caching ENABLED on &quot;%2&quot;

Event ID 30: task_030

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2449) %!FUNC!:Name caching DISABLED on &quot;%2&quot;

Event ID 31: task_031

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(377) %!FUNC!:Buffer Swap Detected:      oldB=%2!p! oldMdl=%3!p! newB=%4!p! newMdl=%5!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_*origBufferPtr` Pointer
`A11_origMdlAddressPtr ? *origMdlAddressPtr : NULL` Pointer
`A12_*newBufferPtr` Pointer
`A13_newMdlAddressPtr ? *newMdlAddressPtr : NULL` Pointer

Event ID 32: task_032

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(706) %!FUNC!:MiniFilter returned Post-Op failure: Irp %2!p!, MajorFunction %3!S!, Instance %4!p!, Altitude %5!S!, Filter %6!p! FilterName %7!S!, InitiatingInstance %8!p!, FileObject %9!p!, FsContext %10!p!, Status %11!S!, Previous Status %12!S!

Event ID 33: task_033

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(733) %!FUNC!:MiniFilter returned Post-Op failure: Irp %2!p!, MajorFunction %3!S!, Instance %4!p!, Altitude %5!S!, Filter %6!p! FilterName %7!S!, InitiatingInstance %8!p!, FileObject %9!p!, FsContext %10!p!, Status %11!S!, Previous Status %12!S!

Event ID 34: task_034

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(770) %!FUNC!:MiniFilter completed Pre-Operation: Irp %2!p!, MajorFunction %3!S!, Instance %4!p!, Altitude %5!S!, Filter %6!p! FilterName %7!S!, InitiatingInstance %8!p!, FileObject %9!p!, FsContext %10!p!, Status %11!S!

Event ID 35: task_035

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(795) %!FUNC!:MiniFilter completed Pre-Operation: Irp %2!p!, MajorFunction %3!S!, Instance %4!p!, Altitude %5!S!, Filter %6!p! FilterName %7!S!, InitiatingInstance %8!p!, FileObject %9!p!, FsContext %10!p!, Status %11!S!

Event ID 36: task_036

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(841) %!FUNC!:File System returned an error: Irp %2!p!, MajorFunction %3!S!, InitiatingInstance %4!p!, FileObject %5!p!, FsContext %6!p!, Status %7!S!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_event.IrpPtr` Pointer
`A11_event.MajorFunction` UInt32
`A12_IrpCtrl->InitiatingInstance` Pointer
`A13_event.FileObject` Pointer
`A14_event.FsContext` Pointer
`A15_status` HexInt32

Event ID 37: task_037

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(860) %!FUNC!:File System returned an error: Irp %2!p!, MajorFunction %3!S!, InitiatingInstance %4!p!, FileObject %5!p!, FsContext %6!p!, Status %7!S!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_event.IrpPtr` Pointer
`A11_event.MajorFunction` UInt32
`A12_IrpCtrl->InitiatingInstance` Pointer
`A13_event.FileObject` Pointer
`A14_event.FsContext` Pointer
`A15_status` HexInt32

Event ID 38: task_038

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(1262) %!FUNC!:Hiding operation in FltpPerformPreCallbacks:  T=%2!p! FO=%3!p! Vol=%4!p! Major=%5!d! (%6!S!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_KeGetCurrentThread()` Pointer
`A11_irpCtrl->FileObject` Pointer
`A12_volume` Pointer
`A13_(CHAR)irpMajorId` Int32
`A14_FltGetIrpName(irpMajorId)` AnsiString

Event ID 39: task_039

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CallbackSup.c(1894) %!FUNC!:Pending operation: %2!x!, Irpctrl=%3!p!, callbackNode=%4!p! (%5!S!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpMajorId` HexInt32
`A11_irpCtrl` Pointer
`A12_callbackNode` Pointer
`A13_FlagOn(irpCtrlFlags,IRPCTRFL_SYNCHRONIZE) ? 'SYNC' : 'NotSYNC'` AnsiString

Event ID 40: task_040

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(335) %!FUNC!:Freeing completion node tracking structure %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_TrackingCtrl->PointerToFree` Pointer

Event ID 41: task_041

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(401) %!FUNC!:CN Not Tracking   IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_CompNode->IrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_(CHAR)CompNode->DataSnapshot.MajorFunction` Int32

Event ID 42: task_042

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(441) %!FUNC!:CN Insert Active  IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_CompNode->IrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_(CHAR)CompNode->DataSnapshot.MajorFunction` Int32

Event ID 43: task_043

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(481) %!FUNC!:CN Insert Waiting IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_(CHAR)CompNode->DataSnapshot.MajorFunction` Int32

Event ID 44: task_044

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(507) %!FUNC!:Linking, swapped buffers, canceling IRP %2!d!,%3!d! (%4!S!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString

Event ID 45: task_045

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(515) %!FUNC!:Linking, swapped buffers, wait for non-IRP operation %2!d!,%3!d! (%4!S!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString

Event ID 46: task_046

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(549) %!FUNC!:CN Insert Waiting (non-drainable) IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_(CHAR)CompNode->DataSnapshot.MajorFunction` Int32

Event ID 47: task_047

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(560) %!FUNC!:Linking, wait for non-drainable operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString
`A13_irpCtrl` Pointer

Event ID 48: task_048

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(582) %!FUNC!:CN Insert Active  IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_CompNode->IrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_(CHAR)CompNode->DataSnapshot.MajorFunction` Int32

Event ID 49: task_049

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(622) %!FUNC!:CN Insert Waiting IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_(CHAR)CompNode->DataSnapshot.MajorFunction` Int32

Event ID 50: task_050

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(648) %!FUNC!:Linking, swapped buffers, canceling IRP %2!d!,%3!d! (%4!S!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString

Event ID 51: task_051

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(656) %!FUNC!:Linking, swapped buffers, wait for non-IRP operation %2!d!,%3!d! (%4!S!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString

Event ID 52: task_052

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(690) %!FUNC!:CN Insert Waiting (non-drainable) IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_(CHAR)CompNode->DataSnapshot.MajorFunction` Int32

Event ID 53: task_053

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(701) %!FUNC!:Linking, wait for non-drainable operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString
`A13_irpCtrl` Pointer

Event ID 54: task_054

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(739) %!FUNC!:CN Delete         IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_CompNode->IrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_(CHAR)CompNode->DataSnapshot.MajorFunction` Int32

Event ID 55: task_055

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(923) %!FUNC!:Draining, IRP Cancel routine called

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 56: task_056

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1108) %!FUNC!:Draining operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)localIrpCtrl.Data.Iopb->MajorFunction` Int32
`A11_(CHAR)localIrpCtrl.Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(localIrpCtrl.Data.Iopb->MajorFunction)` AnsiString
`A13_localCompNode.IrpCtrl` Pointer

Event ID 57: task_057

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1273) %!FUNC!:CN Insert Waiting (bufSwaped) IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_completionNode->IrpCtrl` Pointer
`A11_completionNode` Pointer
`A12_(CHAR)completionNode->DataSnapshot.MajorFunction` Int32

Event ID 58: task_058

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1296) %!FUNC!:Draining, Swapped buffers, canceling IRP %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString
`A13_irpCtrl` Pointer

Event ID 59: task_059

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1359) %!FUNC!:Draining, Swapped buffers, waiting for non-IRP operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString
`A13_irpCtrl` Pointer

Event ID 60: task_060

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1392) %!FUNC!:CN Insert Waiting (NotDrainable) IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_completionNode->IrpCtrl` Pointer
`A11_completionNode` Pointer
`A12_(CHAR)completionNode->DataSnapshot.MajorFunction` Int32

Event ID 61: task_061

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1407) %!FUNC!:Draining, Waiting for non-drainable operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction` Int32
`A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction` Int32
`A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)` AnsiString
`A13_irpCtrl` Pointer

Event ID 62: task_062

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] EnumerationSup.c(1105) %!FUNC!:Wrong type of device object passed in: devobj %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_DeviceObject` Pointer

Event ID 63: task_063

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] EnumerationSup.c(1148) %!FUNC!:Wrong type of device object passed in: devobj %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_DeviceObject` Pointer

Event ID 64: task_064

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] ExceptionSup.c(62) %!FUNC!:Caught exception (%2!08x!, %3!p!, %4!p!, %5!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_ExceptionPointer->ExceptionRecord->ExceptionCode` HexInt32
`A11_ExceptionPointer->ContextRecord` Pointer
`A12_ExceptionPointer->ExceptionRecord` Pointer
`A13_ExceptionPointer->ExceptionRecord->ExceptionAddress` Pointer

Event ID 65: task_065

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(367) %!FUNC!:passing through FAST_IO_CHECK_IF_POSSIBLE

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 66: task_066

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(392) %!FUNC!:passing through FAST_IO_READ

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 67: task_067

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(417) %!FUNC!:passing through FAST_IO_WRITE

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 68: task_068

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(441) %!FUNC!:passing through FAST_IO_QUERY_BASIC_INFO

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 69: task_069

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(466) %!FUNC!:passing through FAST_IO_QUERY_STANDARD_INFO

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 70: task_070

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(487) %!FUNC!:passing through FAST_IO_QUERY_NETWORK_OPEN_INFO

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 71: task_071

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(526) %!FUNC!:passing through FAST_IO_LOCK

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 72: task_072

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(551) %!FUNC!:passing through FAST_IO_UNLOCK_SINGLE

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 73: task_073

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(574) %!FUNC!:passing through FAST_IO_UNLOCK_ALL

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 74: task_074

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(595) %!FUNC!:passing through FAST_IO_UNLOCK_ALL_BY_KEY

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 75: task_075

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(624) %!FUNC!:passing through FAST_IO_DEVICE_CONTROL

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 76: task_076

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(652) %!FUNC!:passing through FAST_IO_QUERY_OPEN

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 77: task_077

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(714) %!FUNC!:passing through FAST_IO_MDL_READ

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 78: task_078

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(738) %!FUNC!:passing through FAST_IO_MDL_READ_COMPLETE

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 79: task_079

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(758) %!FUNC!:passing through FAST_IO_PREPARE_MDL_WRITE

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 80: task_080

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FastIoSup.c(782) %!FUNC!:passing through FAST_IO_MDL_WRITE_COMPLETE

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 81: task_081

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(198) %!FUNC!:Starting (%2!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10__localHead` Pointer

Event ID 82: task_082

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(224) %!FUNC!:For &quot;%2&quot;

Event ID 83: task_083

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(274) %!FUNC!:FSDelete  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_fileList` Pointer
`A11_fileList->Flags` HexInt32
`A12_fileList->UseCount` Int32

Event ID 84: task_084

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(445) %!FUNC!:Found     (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_fileList` Pointer
`A11_fileList->Flags` HexInt32
`A12_fileList->UseCount` Int32

Event ID 85: task_085

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(565) %!FUNC!:Created   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_newFileList` Pointer
`A11_newFileList->Flags` HexInt32
`A12_newFileList->UseCount` Int32

Event ID 86: task_086

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(588) %!FUNC!:Found New (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_fileList` Pointer
`A11_fileList->Flags` HexInt32
`A12_fileList->UseCount` Int32

Event ID 87: task_087

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(732) %!FUNC!:Allocate  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_newFileList` Pointer
`A11_newFileList->Flags` HexInt32
`A12_newFileList->UseCount` Int32

Event ID 88: task_088

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(769) %!FUNC!:Release   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FileList` Pointer
`A11_FileList->Flags` HexInt32
`A12_FileList->UseCount` Int32

Event ID 89: task_089

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(792) %!FUNC!:DEFFERED  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FileList` Pointer
`A11_FileList->Flags` HexInt32
`A12_FileList->UseCount` Int32

Event ID 90: task_090

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(827) %!FUNC!:Cleanup   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FileList` Pointer
`A11_FileList->Flags` HexInt32
`A12_FileList->UseCount` Int32

Event ID 91: task_091

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(995) %!FUNC!:DriverEntry: Error EtwRegister, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 92: task_092

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1032) %!FUNC!:Failed to start notification for dynamic settings. status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 93: task_093

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1095) %!FUNC!:Num processors=%2!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltGlobals.NumProcessors` Int32

Event ID 94: task_094

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1099) %!FUNC!:Max processors=%2!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_KeQueryMaximumProcessorCountEx( ALL_PROCESSOR_GROUPS )` Int32

Event ID 95: task_095

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1103) %!FUNC!:CacheLine size=%2!d! (0x%3!x!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltGlobals.CacheLineSize` Int32
`A11_FltGlobals.CacheLineSize` HexInt32

Event ID 96: task_096

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1110) %!FUNC!:Breaking on errors

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 97: task_097

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1116) %!FUNC!:Attaching to File System Recognizers

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 98: task_098

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1122) %!FUNC!:Randomly using STATIC IrpCtrl

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 99: task_099

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1128) %!FUNC!:Randomly using short CompletionNode stacks

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 100: task_0100

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1188) %!FUNC!:DriverEntry: Error creating device, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 101: task_0101

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1218) %!FUNC!:DriverEntry: Error creating symbolic link for control device, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 102: task_0102

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1269) %!FUNC!:DriverEntry: Failed query for perf trace routines, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 103: task_0103

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1411) %!FUNC!:DriverEntry: Error Initializing Messaging Support, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 104: task_0104

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1677) %!FUNC!:Unloading driver (%2!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_DriverObject` Pointer

Event ID 105: task_0105

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1957) %!FUNC!:Waiting for %2!d! Zombied FltObject(s) to be freed

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_i` Int32

Event ID 106: task_0106

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1965) %!FUNC!:Rundown wait complete

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 107: task_0107

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1989) %!FUNC!:Waiting for %2!d! outstanding IrpCtrl(s) to complete

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_i` Int32

Event ID 108: task_0108

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(1998) %!FUNC!:Rundown wait complete

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 109: task_0109

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(2163) %!FUNC!:%2   DO=%3!p! Vol=%4!p! &quot;%5!S!&quot; (%6!S!)

Event ID 110: task_0110

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(2270) %!FUNC!:Paging File operation, %2(%3!d!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltGetIrpName(irpSp->MajorFunction)` AnsiString
`A11_irpSp->MajorFunction` Int32

Event ID 111: task_0111

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(2770) %!FUNC!:FO=%2!p! Closing  &quot;%3!S!&quot;

Event ID 112: task_0112

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(4572) %!FUNC!:Posting Irp %2!p! major=%3!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_IrpCtrl->Irp` Pointer
`A11_IrpCtrl->Data.Iopb->MajorFunction` Int32

Event ID 113: task_0113

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(4900) %!FUNC!:Posting Irp %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Irp` Pointer

Event ID 114: task_0114

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(5069) %!FUNC!:TopLevelIrp set with unknown Irp 0x%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpSp->MajorFunction` HexInt32

Event ID 115: task_0115

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(5927) %!FUNC!:Set thread hiding in FltpCreate:              T=%2!p! FO=%3!p! Vol=%4!p! Name=&quot;%5!S!&quot;

Event ID 116: task_0116

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(5998) %!FUNC!:Calling InstanceSetup on CreateIrp

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 117: task_0117

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(6036) %!FUNC!:FO=%2!p! Creating &quot;%3!S!&quot;

Event ID 118: task_0118

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(6305) %!FUNC!:Reset thread hiding in FltpCreatePostCompl:   T=%2!p! FO=%3!p! Vol=%4!p! status=%5!S!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_KeGetCurrentThread()` Pointer
`A11_IrpCtrl->FileObject` Pointer
`A12_volume` Pointer
`A13_IrpCtrl->Data.IoStatus.Status` HexInt32

Event ID 119: task_0119

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(6313) %!FUNC!:Continue Thread hiding in FltpCreatePostCompl:T=%2!p! FO=%3!p! Vol=%4!p! status=%5!S!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_KeGetCurrentThread()` Pointer
`A11_IrpCtrl->FileObject` Pointer
`A12_volume` Pointer
`A13_IrpCtrl->Data.IoStatus.Status` HexInt32

Event ID 120: task_0120

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(6454) %!FUNC!:Calling InstanceSetup on CreateIrp

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 121: task_0121

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(7659) %!FUNC!:Mount volume failure for   DO=%2!p! Vol=%3!p! &quot;%4!S!&quot;, status=%5!S!            AttachedToDO=%6!p! FsCDO=%7!p!

Event ID 122: task_0122

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(7786) %!FUNC!:DeviceObject %2!p!,  Loading File System, Detaching from %3!S!

Event ID 123: task_0123

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(7874) %!FUNC!:Detaching from recognizer  DO=%2!p! Vol=%3!p! &quot;%4!S!&quot;, status=%5!S!

Event ID 124: task_0124

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(11316) %!FUNC!:Calling InstanceSetup on FastIoQueryOpen

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 125: task_0125

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(12650) %!FUNC!:Failed to restart registry watch, Context=%2!p!, status=%3!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Context` Pointer
`A11_regWatchContext->NotificationStatus` HexInt32

Event ID 126: task_0126

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] fltmgr.c(13496) %!FUNC!:Resetting notification for dynamic registry settings failed. Context=%2!p!, status=%3!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_regWatchContext` Pointer
`A11_regWatchContext->NotificationStatus` HexInt32

Event ID 127: task_0127

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(549) %!FUNC!:Error registering FS change notification, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 128: task_0128

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(584) %!FUNC!:Error 0x%2!X! attaching to device %3!S!

Event ID 129: task_0129

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(613) %!FUNC!:Error 0x%2!X! attaching to device %3!S!

Event ID 130: task_0130

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(629) %!FUNC!:Created Frame %2!d! with altitude range %3!S!-%4!S!

Event ID 131: task_0131

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(1647) %!FUNC!:Failed allocating timer

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 132: task_0132

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(1659) %!FUNC!:Starting timer

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 133: task_0133

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(1762) %!FUNC!:FltpManualDeviceAttachWorker: Delaying: fl=%2!Ix!, dl=%3!d! (%4!d!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_ctxFlags` Pointer
`A11_FltGlobals.ManualAttachDelayCounter` Int32
`A12_FltGlobals.ManualDeviceAttachLimit` Int32

Event ID 134: task_0134

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(1778) %!FUNC!:FltpManualDeviceAttachWorker: Checking: fl=%2!Ix!, dl=%3!d! (%4!d!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_ctxFlags` Pointer
`A11_FltGlobals.ManualAttachDelayCounter` Int32
`A12_FltGlobals.ManualDeviceAttachLimit` Int32

Event ID 135: task_0135

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(2181) %!FUNC!:Altidue range for Frame %2!d! changed from %3!S!-%4!S! to %5!S!-%6!S!

Event ID 136: task_0136

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] FrameSup.c(2291) %!FUNC!:The &quot;%2&quot; legacy filter is using the &quot;%3!S!&quot; load order group

Event ID 137: task_0137

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] InstanceSup.c(663) %!FUNC!:Instance Setup Aborted for Filter (%2!p!) &quot;%3!S!&quot;, instance (%4!p!) on volume (%5!p!) &quot;%6!S!&quot;

Event ID 138: task_0138

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] InstanceSup.c(680) %!FUNC!:Filter (%2!p!) &quot;%3!S!&quot; attached instance (%4!p!) to volume (%5!p!) &quot;%6!S!&quot;

Event ID 139: task_0139

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] InstanceSup.c(1880) %!FUNC!:New instance for filter (%2!p!) &quot;%3!S!&quot; at altitude %4!S! for volume %5!p! &quot;%6!S!&quot;

Event ID 140: task_0140

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] InstanceSup.c(1977) %!FUNC!:Instance %2!p! for filter (%3!p!) &quot;%4!S!&quot; already exists at altitude %5!S!

Event ID 141: task_0141

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] InstanceSup.c(2065) %!FUNC!:Filter (%2!p!) &quot;%3!S!&quot; detached instance (%4!p!) from volume (%5!p!) &quot;%6!S!&quot; NotifyFlags=%7!x!

Event ID 142: task_0142

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(4656) %!FUNC!:Attemping Fastio (no lower minifilters) from FltReadFile: Buffer=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Buffer` Pointer
`A11_fileOffset.QuadPart` HexInt64
`A12_Length` HexInt32

Event ID 143: task_0143

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(4706) %!FUNC!:Attemping Fastio from FltReadFile: Buffer=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Buffer` Pointer
`A11_fileOffset.QuadPart` HexInt64
`A12_Length` HexInt32

Event ID 144: task_0144

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(4812) %!FUNC!:Fastio attempt from FltReadFile failed

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 145: task_0145

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5228) %!FUNC!:Attemping Fastio (no lower minifilters) from FltWriteFile: Buffer=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Buffer` Pointer
`A11_fileOffset.QuadPart` HexInt64
`A12_Length` HexInt32

Event ID 146: task_0146

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5279) %!FUNC!:Attemping Fastio from FltWriteFile: Buffer=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Buffer` Pointer
`A11_fileOffset.QuadPart` HexInt64
`A12_Length` HexInt32

Event ID 147: task_0147

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5386) %!FUNC!:Fastio attempt from FltWriteFile failed

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 148: task_0148

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5588) %!FUNC!:(No lower minifilters)

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 149: task_0149

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5663) %!FUNC!:(Lower minifilter(s) exist)

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 150: task_0150

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5801) %!FUNC!:Attemping Fastio from FltFastIoMdlRead: MDLChain=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffset->QuadPart` HexInt64
`A12_Length` HexInt32

Event ID 151: task_0151

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5819) %!FUNC!:Fastio attempt from FltReadFile failed

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 152: task_0152

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5840) %!FUNC!:Attemping Fastio from FltFastIoMdlReadComplete: MDLChain=%2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_MdlChain` Pointer

Event ID 153: task_0153

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5855) %!FUNC!:Fastio attempt from FltFastIoMdlReadComplete failed

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 154: task_0154

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5880) %!FUNC!:Attemping Fastio from FltFastIoPrepareMdlWrite: MDLChain=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffset->QuadPart` HexInt64
`A12_Length` HexInt32

Event ID 155: task_0155

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5898) %!FUNC!:Fastio attempt from FltFastIoPrepareMdlWrite failed

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 156: task_0156

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5921) %!FUNC!:Attemping Fastio from FltFastIoMdlWriteComplete: MDLChain=%2!p!, offset=%3!I64x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffset->QuadPart` HexInt64

Event ID 157: task_0157

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] IoSup.c(5938) %!FUNC!:Fastio attempt from FltFastIoMdlWriteComplete failed

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 158: task_0158

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2005) %!FUNC!:Timed out waiting for listener.

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 159: task_0159

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2018) %!FUNC!:Port is disconncted: abandoning listener

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 160: task_0160

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2026) %!FUNC!:Thread is Terminating.

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 161: task_0161

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2102) %!FUNC!:Timed out waiting for listener.

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 162: task_0162

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2115) %!FUNC!:Port is disconncted: abandoning listener

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 163: task_0163

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2123) %!FUNC!:Thread is Terminating.

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 164: task_0164

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2156) %!FUNC!:Found waiter IRP (%2!p!), dequeued it

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irp` Pointer

Event ID 165: task_0165

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2257) %!FUNC!:Found waiter, but could not map user&apos;s buffer, IRP=%2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irp` Pointer

Event ID 166: task_0166

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2381) %!FUNC!:Queueing replyWaiter (%2!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10__replyWaiter` Pointer

Event ID 167: task_0167

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2434) %!FUNC!:Wait for reply status %2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 168: task_0168

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2442) %!FUNC!:Thread is Terminating Thread timed out Port disconnected

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 169: task_0169

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2803) %!FUNC!:Found waiter %2!p!, dequeued it

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_currentWaiter` Pointer

Event ID 170: task_0170

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2866) %!FUNC!:Setting reply event

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 171: task_0171

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2883) %!FUNC!:No waiter for reply, messageId: 0x%2!X!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_(ULONG) replyMessageId` HexInt32

Event ID 172: task_0172

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2932) %!FUNC!:Allocated %2!p!, enqueueing it (async)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Irp` Pointer

Event ID 173: task_0173

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(2995) %!FUNC!:Dequeued waiter %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irp` Pointer

Event ID 174: task_0174

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3047) %!FUNC!:Verifying waiter list for Queue: %2!p! --

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Queue` Pointer

Event ID 175: task_0175

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3057) %!FUNC!:                    -- currentLink %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_currentLink` Pointer

Event ID 176: task_0176

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3158) %!FUNC!:Error creating server port object type, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 177: task_0177

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3223) %!FUNC!:Error creating connection port object type, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 178: task_0178

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3245) %!FUNC!:Error creating msg device object, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 179: task_0179

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3263) %!FUNC!:Error creating symbolic link to msg device object, status=%2!x!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 180: task_0180

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3365) %!FUNC!:Setting MessageWaiter event

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 181: task_0181

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3377) %!FUNC!:Setting MessageWaiter semaphore

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 182: task_0182

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3435) %!FUNC!:Cancelling MessageWaiter %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Irp` Pointer

Event ID 183: task_0183

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] MessageSup.c(3484) %!FUNC!:Removed MessageWaiter %2!p! from queue

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_Irp` Pointer

Event ID 184: task_0184

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(849) %!FUNC!:Temporary: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! &quot;%6!S!&quot;

Event ID 185: task_0185

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(1918) %!FUNC!:Deleting Node: (%2!p!) Fl=%3!03x!, Use=%4!d! &quot;%5!S!&quot;

Event ID 186: task_0186

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(3470) %!FUNC!:Freeing Node: (%2!p!), flags:%3!04x!, name: &quot;%4!S!&quot;

Event ID 187: task_0187

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(3719) %!FUNC!:Getting NORMALIZED name for fo: %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_GenCtx->FileObject` Pointer

Event ID 188: task_0188

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(3728) %!FUNC!:Getting OPENED name for fo: %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_GenCtx->FileObject` Pointer

Event ID 189: task_0189

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(3738) %!FUNC!:Getting SHORT name for fo: %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_GenCtx->FileObject` Pointer

Event ID 190: task_0190

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(4313) %!FUNC!:Found: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! &quot;%6!S!&quot;

Event ID 191: task_0191

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(4469) %!FUNC!:Inserted: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! &quot;%6!S!&quot;

Event ID 192: task_0192

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(4545) %!FUNC!:Replaced: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! &quot;%6!S!&quot;

Event ID 193: task_0193

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(4572) %!FUNC!:Duplicate: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! &quot;%6!S!&quot;

Event ID 194: task_0194

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(4596) %!FUNC!:Temporary: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! &quot;%6!S!&quot;

Event ID 195: task_0195

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(4826) %!FUNC!:Invalidate Caching (0x%2!x!, 0x%3!x!): &quot;%4!S!&quot;, [%5!S!] (%6!p!)

Event ID 196: task_0196

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(5072) %!FUNC!:Reinstate Caching (0x%2!x!, 0x%3!x!): &quot;%4!S!&quot;, [%5!S!] (%6!p!)

Event ID 197: task_0197

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(6074) %!FUNC!:Refcounting file name information: %2!p! cnt=%3!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FileNameInformation` Pointer
`A11_nameCacheNode->UseCount` Int32

Event ID 198: task_0198

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(6135) %!FUNC!:Releasing fni %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FileNameInformation` Pointer

Event ID 199: task_0199

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(6164) %!FUNC!: *FREEING FNI*

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 200: task_0200

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(6173) %!FUNC!:

Fields #

Name	Description
`!FUNC!` AnsiString

Event ID 201: task_0201

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(6996) %!FUNC!:Expanded    &quot;%2&quot; to &quot;%3!S!&quot;

Event ID 202: task_0202

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(7501) %!FUNC!:Purge name cache for POSIX delete: &quot;%2&quot;, [%3!S!] (%4!p!)

Event ID 203: task_0203

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameCacheSup.c(7516) %!FUNC!:Failed to invalidate name cache for POSIX delete: %2

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_status` HexInt32

Event ID 204: task_0204

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(854) %!FUNC!:Error building name: NameCtrl (%2!p!) [0x%3!x!] Error: 0x%4!x!  ShareNameLength: 0x%5!x! StreamNameLength: 0x%6!x!  Name: %7!S! CurrentShortName: %8!S!

Event ID 205: task_0205

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(987) %!FUNC!:Realloc:    (%2!p!) oldSz=%3!05x! newSz=%4!05x! name: %5!S! oldFlags: %6!08x! flagsToSet: %7!08x!

Event ID 206: task_0206

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(2828) %!FUNC!:Opening By ID: %2\%3!04x!%4!04x! %5!04x!%6!04x!

Event ID 207: task_0207

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(3578) %!FUNC!:Expanded    &quot;%2&quot; to &quot;%3!S!&quot;

Event ID 208: task_0208

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(4213) %!FUNC!:Opening name: %2

Event ID 209: task_0209

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(5979) %!FUNC!:Expanding path for fo: %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_GenCtx->FileObject` Pointer

Event ID 210: task_0210

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(7307) %!FUNC!:NORMALIZE FORMAT for name in (%2!p!)   Name: %3!S!   Volume: %4!S!   Final Component: %5!S!   Extension: %6!S!   Stream: %7!S!   Parent Dir: %8!S!

Event ID 211: task_0211

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(7325) %!FUNC!:OPENED FORMAT for name in (%2!p!)   Name: %3!S!   Volume: %4!S!   Final Component: %5!S!   Extension: %6!S!   Stream: %7!S!   Parent Dir: %8!S!

Event ID 212: task_0212

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(7343) %!FUNC!:SHORT FORMAT for name in (%2!p!)   Name: %3!S!   Volume: %4!S!   Final Component: %5!S!   Extension: %6!S!   Stream: %7!S!   Parent Dir: %8!S!

Event ID 213: task_0213

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] NameSup.c(7361) %!FUNC!:UNKNOWN FORMAT for name in (%2!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FileNameInformation` Pointer

Event ID 214: task_0214

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] PendingSup.c(626) %!FUNC!:Resumed Pending operation: %2!x!, Irpctrl=%3!p!, callbackNode=%4!p! (%5!S!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_CallbackData->Iopb->MajorFunction` HexInt32
`A11_icc.IrpCtrl` Pointer
`A12_icc.IrpCtrl->PendingCallbackNode` Pointer
`A13_FlagOn(icc.IrpCtrl->Flags,IRPCTRFL_SYNCHRONIZE) ? 'SYNC' : 'NotSYNC'` AnsiString

Event ID 215: task_0215

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] queuesup.c(686) %!FUNC!:Posting --- Irp:%2!p! MajorFunction:%3!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl->Irp` Pointer
`A11_irpCtrl->Data.Iopb->MajorFunction` Int32

Event ID 216: task_0216

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] queuesup.c(712) %!FUNC!:Could not post -- Irp:%2!p! MajorFunction:%3!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl->Irp` Pointer
`A11_irpCtrl->Data.Iopb->MajorFunction` Int32

Event ID 217: task_0217

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] queuesup.c(723) %!FUNC!:Processing inline -- Irp:%2!p! MajorFunction: %3!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_irpCtrl->Irp` Pointer
`A11_irpCtrl->Data.Iopb->MajorFunction` Int32

Event ID 218: task_0218

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] RegSup.c(451) %!FUNC!:Error %2!x! initializing verifier for filter: %3!S!

Event ID 219: task_0219

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] RegSup.c(572) %!FUNC!:Filter &quot;%2&quot; registered at altitude %3!S!

Event ID 220: task_0220

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] RegSup.c(829) %!FUNC!:Filter &quot;%2&quot; unregistering

Event ID 221: task_0221

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(177) %!FUNC!:Starting (%2!p!)

Fields #

Name	Description
`!FUNC!` AnsiString
`A10__localHead` Pointer

Event ID 222: task_0222

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(205) %!FUNC!:For &quot;%2&quot;

Event ID 223: task_0223

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(256) %!FUNC!:FSDelete  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_streamList` Pointer
`A11_streamList->Flags` HexInt32
`A12_streamList->UseCount` Int32

Event ID 224: task_0224

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(409) %!FUNC!:Found     (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_streamList` Pointer
`A11_streamList->Flags` HexInt32
`A12_streamList->UseCount` Int32

Event ID 225: task_0225

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(540) %!FUNC!:Created   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_newStreamList` Pointer
`A11_newStreamList->Flags` HexInt32
`A12_newStreamList->UseCount` Int32

Event ID 226: task_0226

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(572) %!FUNC!:Found New (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_streamList` Pointer
`A11_streamList->Flags` HexInt32
`A12_streamList->UseCount` Int32

Event ID 227: task_0227

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(715) %!FUNC!:Allocate  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_newStreamList` Pointer
`A11_newStreamList->Flags` HexInt32
`A12_newStreamList->UseCount` Int32

Event ID 228: task_0228

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(754) %!FUNC!:Release   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_StreamList` Pointer
`A11_StreamList->Flags` HexInt32
`A12_StreamList->UseCount` Int32

Event ID 229: task_0229

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(807) %!FUNC!:DEFFERED  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_StreamList` Pointer
`A11_StreamList->Flags` HexInt32
`A12_StreamList->UseCount` Int32

Event ID 230: task_0230

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(843) %!FUNC!:Cleanup   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_StreamList` Pointer
`A11_StreamList->Flags` HexInt32
`A12_StreamList->UseCount` Int32

Event ID 231: task_0231

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] SyncSup.c(260) %!FUNC!:PointerRef: %2!p! (%3!d!) %4!S!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltObject` Pointer
`A11_((PFLT_OBJECT)FltObject)->PointerCount` Int32
`A12_reason` AnsiString

Event ID 232: task_0232

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] SyncSup.c(302) %!FUNC!:PointerDeRef: %2!p! (%3!d!) %4!S!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltObject` Pointer
`A11_((PFLT_OBJECT)FltObject)->PointerCount` Int32
`A12_reason` AnsiString

Event ID 233: task_0233

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] TargetedIoSup.c(1924) %!FUNC!:Wrong type of device object passed in: devobj %2!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_deviceObject` Pointer

Event ID 234: task_0234

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] VolumeSup.c(225) %!FUNC!:The file system driver %2 is an unknown file system type

Event ID 235: task_0235

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] VolumeSup.c(952) %!FUNC!:SetupNotify already called for volume (%2!p!) &quot;%3!S!&quot;

Event ID 236: task_0236

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] VolumeSup.c(2606) %!FUNC!:Cleared thread hiding in FltpClearHiddenOp...: T=%2!p! FO=%3!p! Vol=%4!p! IrpMaj=%5!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_KeGetCurrentThread()` Pointer
`A11_FileObject` Pointer
`A12_Volume` Pointer
`A13_IrpMajor` Int32

Event ID 237: task_0237

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(193) %!FUNC!:Work=%2!p! QueType=%3!d! Count=%4!d! Limit=%5!d!, QUEUED

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningCount` Int32
`A13_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningLimit` Int32

Event ID 238: task_0238

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(214) %!FUNC!:Work=%2!p! QType=%3!d! Count=%4!d! Limit=%5!d!, THROTTLED

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningCount` Int32
`A13_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningLimit` Int32

Event ID 239: task_0239

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(290) %!FUNC!:Work=%2!p! QType=%3!d! Count=%4!d! Limit=%5!d!, UnTHROTTLED

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_fltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningCount` Int32
`A13_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningLimit` Int32

Event ID 240: task_0240

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(319) %!FUNC!:Work=%2!p! QType=%3!d! Count=%4!d! Limit=%5!d!, UnQUEUED

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_NULL` Pointer
`A11_QueueType` Int32
`A12_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningCount` Int32
`A13_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningLimit` Int32

Event ID 241: task_0241

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(457) %!FUNC!:Work=%2!p! QType=%3!d! FltObj=%4!p! Routine=%5!p! Context=%6!p! IoPriority=%7!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_GenericWorkItem` Pointer
`A11_qtype` Int32
`A12_fltObject` Pointer
`A13_GenericWorkItem->GenericWorkerRoutine` Pointer
`A14_GenericWorkItem->Context` Pointer
`A15_GenericWorkItem->IoPriorityInfo.IoPriority` Int32

Event ID 242: task_0242

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(569) %!FUNC!:Work=%2!p! QType=%3!d! Instnc=%4!p! Routine=%5!p! Context=%6!p! IoPriority=%7!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_DeferredWorkItem` Pointer
`A11_qtype` Int32
`A12_instance` Pointer
`A13_DeferredWorkItem->DeferredWorkerRoutine` Pointer
`A14_DeferredWorkItem->Context` Pointer
`A15_DeferredWorkItem->IoPriorityInfo.IoPriority` Int32

Event ID 243: task_0243

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(666) %!FUNC!:Work=%2!p! QType=%3!d! FltObj=%4!p! Routine=%5!p! Context=%6!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltWorkItem` Pointer
`A11_FltWorkItem->QueueType` Int32
`A12_FltWorkItem->FltObject` Pointer
`A13_FltWorkItem->GenericWorkerRoutine` Pointer
`A14_FltWorkItem->Context` Pointer

Event ID 244: task_0244

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(714) %!FUNC!:Work=%2!p! QType=%3!d! Instnc=%4!p! Routine=%5!p! Context=%6!p!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltWorkItem` Pointer
`A11_FltWorkItem->QueueType` Int32
`A12_FltWorkItem->Instance` Pointer
`A13_FltWorkItem->DeferredWorkerRoutine` Pointer
`A14_FltWorkItem->Context` Pointer

Event ID 245: task_0245

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(841) %!FUNC!:Work=%2!p! QType=%3!d! FltObj=%4!p! Routine=%5!p! Context=%6!p! IoPriority=%7!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltWorkItem` Pointer
`A11_QueueType` Int32
`A12_FltObject` Pointer
`A13_WorkerRoutine` Pointer
`A14_Context` Pointer
`A15_FltWorkItem->IoPriorityInfo.IoPriority` Int32

Event ID 246: task_0246

Provider: Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65
Channel: ETW Trace

Message #

[TL_%!LEVEL!] WorkSup.c(1022) %!FUNC!:Work=%2!p! QType=%3!d! Instnc=%4!p! Routine=%5!p! Context=%6!p! IoPriority=%7!d!

Fields #

Name	Description
`!FUNC!` AnsiString
`A10_FltWorkItem` Pointer
`A11_QueueType` Int32
`A12_FltWorkItem->Instance` Pointer
`A13_WorkerRoutine` Pointer
`A14_Context` Pointer
`A15_FltWorkItem->IoPriorityInfo.IoPriority` Int32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 04b6ad31-b1f8-3ea8-49de-9331df976a65

Defined in fltmgrres.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02

Downloads

Microsoft-Windows-FltMgrTrace_04b6ad31b1f83ea849de9331df976a65 registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)