Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a

237 events across 1 channel

Event	Title	Channel	Sample
10	[TL_%!	Operational	N
11	[TL_%!	Operational	N
12	[TL_%!	Operational	N
13	[TL_%!	Operational	N
14	[TL_%!	Operational	N
15	[TL_%!	Operational	N
16	[TL_%!	Operational	N
17	[TL_%!	Operational	N
18	[TL_%!	Operational	N
19	[TL_%!	Operational	N
20	[TL_%!	Operational	N
21	[TL_%!	Operational	N
22	[TL_%!	Operational	N
23	[TL_%!	Operational	N
24	[TL_%!	Operational	N
25	[TL_%!	Operational	N
26	[TL_%!	Operational	N
27	[TL_%!	Operational	N
28	[TL_%!	Operational	N
29	[TL_%!	Operational	N
30	[TL_%!	Operational	N
31	[TL_%!	Operational	N
32	[TL_%!	Operational	N
33	[TL_%!	Operational	N
34	[TL_%!	Operational	N
35	[TL_%!	Operational	N
36	[TL_%!	Operational	N
37	[TL_%!	Operational	N
38	[TL_%!	Operational	N
39	[TL_%!	Operational	N
40	[TL_%!	Operational	N
41	[TL_%!	Operational	N
42	[TL_%!	Operational	N
43	[TL_%!	Operational	N
44	[TL_%!	Operational	N
45	[TL_%!	Operational	N
46	[TL_%!	Operational	N
47	[TL_%!	Operational	N
48	[TL_%!	Operational	N
49	[TL_%!	Operational	N
50	[TL_%!	Operational	N
51	[TL_%!	Operational	N
52	[TL_%!	Operational	N
53	[TL_%!	Operational	N
54	[TL_%!	Operational	N
55	[TL_%!	Operational	N
56	[TL_%!	Operational	N
57	[TL_%!	Operational	N
58	[TL_%!	Operational	N
59	[TL_%!	Operational	N
60	[TL_%!	Operational	N
61	[TL_%!	Operational	N
62	[TL_%!	Operational	N
63	[TL_%!	Operational	N
64	[TL_%!	Operational	N
65	[TL_%!	Operational	N
66	[TL_%!	Operational	N
67	[TL_%!	Operational	N
68	[TL_%!	Operational	N
69	[TL_%!	Operational	N
70	[TL_%!	Operational	N
71	[TL_%!	Operational	N
72	[TL_%!	Operational	N
73	[TL_%!	Operational	N
74	[TL_%!	Operational	N
75	[TL_%!	Operational	N
76	[TL_%!	Operational	N
77	[TL_%!	Operational	N
78	[TL_%!	Operational	N
79	[TL_%!	Operational	N
80	[TL_%!	Operational	N
81	[TL_%!	Operational	N
82	[TL_%!	Operational	N
83	[TL_%!	Operational	N
84	[TL_%!	Operational	N
85	[TL_%!	Operational	N
86	[TL_%!	Operational	N
87	[TL_%!	Operational	N
88	[TL_%!	Operational	N
89	[TL_%!	Operational	N
90	[TL_%!	Operational	N
91	[TL_%!	Operational	N
92	[TL_%!	Operational	N
93	[TL_%!	Operational	N
94	[TL_%!	Operational	N
95	[TL_%!	Operational	N
96	[TL_%!	Operational	N
97	[TL_%!	Operational	N
98	[TL_%!	Operational	N
99	[TL_%!	Operational	N
100	[TL_%!	Operational	N
101	[TL_%!	Operational	N
102	[TL_%!	Operational	N
103	[TL_%!	Operational	N
104	[TL_%!	Operational	N
105	[TL_%!	Operational	N
106	[TL_%!	Operational	N
107	[TL_%!	Operational	N
108	[TL_%!	Operational	N
109	[TL_%!	Operational	N
110	[TL_%!	Operational	N
111	[TL_%!	Operational	N
112	[TL_%!	Operational	N
113	[TL_%!	Operational	N
114	[TL_%!	Operational	N
115	[TL_%!	Operational	N
116	[TL_%!	Operational	N
117	[TL_%!	Operational	N
118	[TL_%!	Operational	N
119	[TL_%!	Operational	N
120	[TL_%!	Operational	N
121	[TL_%!	Operational	N
122	[TL_%!	Operational	N
123	[TL_%!	Operational	N
124	[TL_%!	Operational	N
125	[TL_%!	Operational	N
126	[TL_%!	Operational	N
127	[TL_%!	Operational	N
128	[TL_%!	Operational	N
129	[TL_%!	Operational	N
130	[TL_%!	Operational	N
131	[TL_%!	Operational	N
132	[TL_%!	Operational	N
133	[TL_%!	Operational	N
134	[TL_%!	Operational	N
135	[TL_%!	Operational	N
136	[TL_%!	Operational	N
137	[TL_%!	Operational	N
138	[TL_%!	Operational	N
139	[TL_%!	Operational	N
140	[TL_%!	Operational	N
141	[TL_%!	Operational	N
142	[TL_%!	Operational	N
143	[TL_%!	Operational	N
144	[TL_%!	Operational	N
145	[TL_%!	Operational	N
146	[TL_%!	Operational	N
147	[TL_%!	Operational	N
148	[TL_%!	Operational	N
149	[TL_%!	Operational	N
150	[TL_%!	Operational	N
151	[TL_%!	Operational	N
152	[TL_%!	Operational	N
153	[TL_%!	Operational	N
154	[TL_%!	Operational	N
155	[TL_%!	Operational	N
156	[TL_%!	Operational	N
157	[TL_%!	Operational	N
158	[TL_%!	Operational	N
159	[TL_%!	Operational	N
160	[TL_%!	Operational	N
161	[TL_%!	Operational	N
162	[TL_%!	Operational	N
163	[TL_%!	Operational	N
164	[TL_%!	Operational	N
165	[TL_%!	Operational	N
166	[TL_%!	Operational	N
167	[TL_%!	Operational	N
168	[TL_%!	Operational	N
169	[TL_%!	Operational	N
170	[TL_%!	Operational	N
171	[TL_%!	Operational	N
172	[TL_%!	Operational	N
173	[TL_%!	Operational	N
174	[TL_%!	Operational	N
175	[TL_%!	Operational	N
176	[TL_%!	Operational	N
177	[TL_%!	Operational	N
178	[TL_%!	Operational	N
179	[TL_%!	Operational	N
180	[TL_%!	Operational	N
181	[TL_%!	Operational	N
182	[TL_%!	Operational	N
183	[TL_%!	Operational	N
184	[TL_%!	Operational	N
185	[TL_%!	Operational	N
186	[TL_%!	Operational	N
187	[TL_%!	Operational	N
188	[TL_%!	Operational	N
189	[TL_%!	Operational	N
190	[TL_%!	Operational	N
191	[TL_%!	Operational	N
192	[TL_%!	Operational	N
193	[TL_%!	Operational	N
194	[TL_%!	Operational	N
195	[TL_%!	Operational	N
196	[TL_%!	Operational	N
197	[TL_%!	Operational	N
198	[TL_%!	Operational	N
199	[TL_%!	Operational	N
200	[TL_%!	Operational	N
201	[TL_%!	Operational	N
202	[TL_%!	Operational	N
203	[TL_%!	Operational	N
204	[TL_%!	Operational	N
205	[TL_%!	Operational	N
206	[TL_%!	Operational	N
207	[TL_%!	Operational	N
208	[TL_%!	Operational	N
209	[TL_%!	Operational	N
210	[TL_%!	Operational	N
211	[TL_%!	Operational	N
212	[TL_%!	Operational	N
213	[TL_%!	Operational	N
214	[TL_%!	Operational	N
215	[TL_%!	Operational	N
216	[TL_%!	Operational	N
217	[TL_%!	Operational	N
218	[TL_%!	Operational	N
219	[TL_%!	Operational	N
220	[TL_%!	Operational	N
221	[TL_%!	Operational	N
222	[TL_%!	Operational	N
223	[TL_%!	Operational	N
224	[TL_%!	Operational	N
225	[TL_%!	Operational	N
226	[TL_%!	Operational	N
227	[TL_%!	Operational	N
228	[TL_%!	Operational	N
229	[TL_%!	Operational	N
230	[TL_%!	Operational	N
231	[TL_%!	Operational	N
232	[TL_%!	Operational	N
233	[TL_%!	Operational	N
234	[TL_%!	Operational	N
235	[TL_%!	Operational	N
236	[TL_%!	Operational	N
237	[TL_%!	Operational	N
238	[TL_%!	Operational	N
239	[TL_%!	Operational	N
240	[TL_%!	Operational	N
241	[TL_%!	Operational	N
242	[TL_%!	Operational	N
243	[TL_%!	Operational	N
244	[TL_%!	Operational	N
245	[TL_%!	Operational	N
246	[TL_%!	Operational	N

Event ID 10: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(342) %!FUNC!:Forcing small completion stack size of !d! instead of !d!

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(342) %!FUNC!:Forcing small completion stack size of %2!d! instead of %3!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_stackSize` Int32
`A11_oldStackSize` Int32

Event ID 11: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1378) %!FUNC!:Extending completion stack from !d! to !d! (irpCtrl=!p!).

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1378) %!FUNC!:Extending completion stack from %2!d! to %3!d! (irpCtrl=%4!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrlCompletionStackLength` Int32
`A11_newStackSize` Int32
`A12_IrpCtrl` Pointer

Event ID 12: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1461) %!FUNC!:CN Insert Active (extend) IrpCtrl=!p! CompNode=!p!, [!d!].

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1461) %!FUNC!:CN Insert Active (extend) IrpCtrl=%2!p! CompNode=%3!p!, [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_newCNodeIrpCtrl` Pointer
`A11_newCNode` Pointer
`A12_newCNodeDataSnapshotMajorFunction` Int32

Event ID 13: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1476) %!FUNC!:CN Insert Waiting (extend) IrpCtrl=!p! CompNode=!p!, [!d!].

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1476) %!FUNC!:CN Insert Waiting (extend)  IrpCtrl=%2!p! CompNode=%3!p!, [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_newCNodeIrpCtrl` Pointer
`A11_newCNode` Pointer
`A12_newCNodeDataSnapshotMajorFunction` Int32

Event ID 14: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1502) %!FUNC!:While extending, hit non-tracked completion node, IrpCtrl=!p! [!d!,!d!].

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1502) %!FUNC!:While extending, hit non-tracked completion node, IrpCtrl=%2!p! [%3!d!,%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrl` Pointer
`A11_CHARnewCNodeDataSnapshotMajorFunction` Int32
`A12_CHARnewCNodeDataSnapshotMinorFunction` Int32

Event ID 15: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1524) %!FUNC!:Extending an already extended stack.

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1524) %!FUNC!:Extending an already extended stack

Fields #

Name	Description
`FUNC` AnsiString

Event ID 16: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1850) %!FUNC!:Allocated type !d! IrpCtrl (!p!) for thread (!p!).

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1850) %!FUNC!:Allocated type %2!d! IrpCtrl (%3!p!) for thread (%4!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_OpType` Int32
`A11_irpCtrl` Pointer
`A12_FrameReserveIrpCtrlsStaticOwningThreadOpType` Pointer

Event ID 17: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1909) %!FUNC!:Freeing type !d! IrpCtrl (!p!) for thread (!p!).

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1909) %!FUNC!:Freeing type %2!d! IrpCtrl (%3!p!) for thread (%4!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_OpType` Int32
`A11_IrpCtrl` Pointer
`A12_FrameReserveIrpCtrlsStaticOwningThreadOpType` Pointer

Event ID 18: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2053) %!FUNC!:Allocated BackPocket IrpCtrl-1: (!p!) for thread (!p!), count=!d! index=!d!

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2053) %!FUNC!:Allocated BackPocket IrpCtrl-1: (%2!p!) for thread (%3!p!), count=%4!d! index=%5!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_th` Pointer
`A12_FrameReserveIrpCtrlsEntriesiCount` Int32
`A13_i` Int32

Event ID 19: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2125) %!FUNC!:Allocated BackPocket IrpCtrl-2: (!p!) for thread (!p!), count=!d! index=!d!

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2125) %!FUNC!:Allocated BackPocket IrpCtrl-2: (%2!p!) for thread (%3!p!), count=%4!d! index=%5!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_th` Pointer
`A12_FrameReserveIrpCtrlsEntriesiCount` Int32
`A13_i` Int32

Event ID 20: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2222) %!FUNC!:Freeing BackPocket IrpCtrl (!p!) for thread (!p!), count=!d! index=!d!

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2222) %!FUNC!:Freeing BackPocket IrpCtrl (%2!p!) for thread (%3!p!), count=%4!d! index=%5!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrl` Pointer
`A11_IrpCtrlDataThread` Pointer
`A12_FrameReserveIrpCtrlsEntriesiCount` Int32
`A13_i` Int32

Event ID 21: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(1211) %!FUNC!:Already attached to FS : DO=!p! Vol=!p! "!S!" (!S!).

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1211) %!FUNC!:Already attached to FS  :   DO=%2!p! Vol=%3!p! "%4!S!" (%5!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_FsControlDeviceObject` Pointer
`A11_NULL` Pointer
`A12_ControlDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMEFsControlDeviceObjectDeviceType` AnsiString

Event ID 22: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(1848) %!FUNC!:Error creating control device object, status=.

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1848) %!FUNC!:Error creating control device object, status=%2

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 23: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(1986) %!FUNC!:Error creating volume device object, status=.

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1986) %!FUNC!:Error creating volume device object, status=%2

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 24: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(2022) %!FUNC!:Error initializing Volume structure, status=.

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2022) %!FUNC!:Error initializing Volume structure, status=%2

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 25: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(2175) %!FUNC!:Attaching to file system DO=!p! Vol=!p! "!S!" (!S!).

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2175) %!FUNC!:Attaching to file system   DO=%2!p! Vol=%3!p! "%4!S!" (%5!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_NewDeviceObject` Pointer
`A11_NULL` Pointer
`A12__cdoDevExtControlDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMENewDeviceObjectDeviceType` AnsiString

Event ID 26: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(2218) %!FUNC!:Attaching to volume DO=!p! Vol=!p! "!S!" (!S!) AttachedToDO=!p!

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2218) %!FUNC!:Attaching to volume        DO=%2!p! Vol=%3!p! "%4!S!" (%5!S!)          AttachedToDO=%6!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_NewDeviceObject` Pointer
`A11_volume` Pointer
`A12__volumeDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMENewDeviceObjectDeviceType` AnsiString
`A14_DeviceObjectToAttachTo` Pointer

Event ID 27: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(2318) %!FUNC!:Detaching from filesystem DO=!p! Vol=!p! "!S!" (!S!) Notify=!x!

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2318) %!FUNC!:Detaching from filesystem  DO=%2!p! Vol=%3!p! "%4!S!" (%5!S!) Notify=%6!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer
`A11_NULL` Pointer
`A12__cdoDevExtControlDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMEDeviceObjectDeviceType` AnsiString
`A14_NotifyFlags` HexInt32

Event ID 28: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(2341) %!FUNC!:Detaching from volume DO=!p! Vol=!p! "!S!" (!S!) Notify=!x! AttachedToDO=!p!

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2341) %!FUNC!:Detaching from volume      DO=%2!p! Vol=%3!p! "%4!S!" (%5!S!) Notify=%6!x! AttachedToDO=%7!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer
`A11_volume` Pointer
`A12__volumeDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMEDeviceObjectDeviceType` AnsiString
`A14_NotifyFlags` HexInt32
`A15_devExtHeaderAttachedToDeviceObject` Pointer

Event ID 29: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(2439) %:Name caching ENABLED on "A10__VolumeDeviceName".

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2439) %!FUNC!:Name caching ENABLED on "%2"

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String

Event ID 30: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(2449) %:Name caching DISABLED on "A10__VolumeDeviceName".

Message #

[TL_%!LEVEL!] AttachDetachSup.c(2449) %!FUNC!:Name caching DISABLED on "%2"

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String

Event ID 31: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CallbackSup.c(378) %!FUNC!:Buffer Swap Detected: oldB=!p! oldMdl=!p! newB=!p! newMdl=!p!

Message #

[TL_%!LEVEL!] CallbackSup.c(378) %!FUNC!:Buffer Swap Detected:      oldB=%2!p! oldMdl=%3!p! newB=%4!p! newMdl=%5!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_origBufferPtr` Pointer
`A11_origMdlAddressPtrorigMdlAddressPtrNULL` Pointer
`A12_newBufferPtr` Pointer
`A13_newMdlAddressPtrnewMdlAddressPtrNULL` Pointer

Event ID 32: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(707) %!FUNC!:MiniFilter returned Post-Op failure: Irp %2!p!, MajorFunction %3!S!, Instance %4!p!, Altitude %5!S!, Filter %6!p! FilterName %7!S!, InitiatingInstance %8!p!, FileObject %9!p!, FsContext %10!p!, Status %11!S!, Previous Status %12!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_CallbackNodeInstance` Pointer
`A13__CallbackNodeInstanceAltitude` CountedUtf16String
`A14_CallbackNodeInstanceFilter` Pointer
`A15__CallbackNodeInstanceFilterName` CountedUtf16String
`A16_IrpCtrlInitiatingInstance` Pointer
`A17_eventFileObject` Pointer
`A18_eventFsContext` Pointer
`A19_status` HexInt32
`A20_IrpCtrlTraceStatus` HexInt32

Event ID 33: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(734) %!FUNC!:MiniFilter returned Post-Op failure: Irp %2!p!, MajorFunction %3!S!, Instance %4!p!, Altitude %5!S!, Filter %6!p! FilterName %7!S!, InitiatingInstance %8!p!, FileObject %9!p!, FsContext %10!p!, Status %11!S!, Previous Status %12!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_CallbackNodeInstance` Pointer
`A13__CallbackNodeInstanceAltitude` CountedUtf16String
`A14_CallbackNodeInstanceFilter` Pointer
`A15__CallbackNodeInstanceFilterName` CountedUtf16String
`A16_IrpCtrlInitiatingInstance` Pointer
`A17_eventFileObject` Pointer
`A18_eventFsContext` Pointer
`A19_status` HexInt32
`A20_IrpCtrlTraceStatus` HexInt32

Event ID 34: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(771) %!FUNC!:MiniFilter completed Pre-Operation: Irp %2!p!, MajorFunction %3!S!, Instance %4!p!, Altitude %5!S!, Filter %6!p! FilterName %7!S!, InitiatingInstance %8!p!, FileObject %9!p!, FsContext %10!p!, Status %11!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_CallbackNodeInstance` Pointer
`A13__CallbackNodeInstanceAltitude` CountedUtf16String
`A14_CallbackNodeInstanceFilter` Pointer
`A15__CallbackNodeInstanceFilterName` CountedUtf16String
`A16_IrpCtrlInitiatingInstance` Pointer
`A17_eventFileObject` Pointer
`A18_eventFsContext` Pointer
`A19_status` HexInt32

Event ID 35: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(796) %!FUNC!:MiniFilter completed Pre-Operation: Irp %2!p!, MajorFunction %3!S!, Instance %4!p!, Altitude %5!S!, Filter %6!p! FilterName %7!S!, InitiatingInstance %8!p!, FileObject %9!p!, FsContext %10!p!, Status %11!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_CallbackNodeInstance` Pointer
`A13__CallbackNodeInstanceAltitude` CountedUtf16String
`A14_CallbackNodeInstanceFilter` Pointer
`A15__CallbackNodeInstanceFilterName` CountedUtf16String
`A16_IrpCtrlInitiatingInstance` Pointer
`A17_eventFileObject` Pointer
`A18_eventFsContext` Pointer
`A19_status` HexInt32

Event ID 36: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CallbackSup.c(842) %!FUNC!:File System returned an error: Irp !p!, MajorFunction !S!, InitiatingInstance !p!, FileObject !p!, FsContext !p!, Status !S!

Message #

[TL_%!LEVEL!] CallbackSup.c(842) %!FUNC!:File System returned an error: Irp %2!p!, MajorFunction %3!S!, InitiatingInstance %4!p!, FileObject %5!p!, FsContext %6!p!, Status %7!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_IrpCtrlInitiatingInstance` Pointer
`A13_eventFileObject` Pointer
`A14_eventFsContext` Pointer
`A15_status` HexInt32

Event ID 37: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CallbackSup.c(861) %!FUNC!:File System returned an error: Irp !p!, MajorFunction !S!, InitiatingInstance !p!, FileObject !p!, FsContext !p!, Status !S!

Message #

[TL_%!LEVEL!] CallbackSup.c(861) %!FUNC!:File System returned an error: Irp %2!p!, MajorFunction %3!S!, InitiatingInstance %4!p!, FileObject %5!p!, FsContext %6!p!, Status %7!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_IrpCtrlInitiatingInstance` Pointer
`A13_eventFileObject` Pointer
`A14_eventFsContext` Pointer
`A15_status` HexInt32

Event ID 38: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CallbackSup.c(1263) %!FUNC!:Hiding operation in FltpPerformPreCallbacks: T=!p! FO=!p! Vol=!p! Major=!d! (!S!).

Message #

[TL_%!LEVEL!] CallbackSup.c(1263) %!FUNC!:Hiding operation in FltpPerformPreCallbacks:  T=%2!p! FO=%3!p! Vol=%4!p! Major=%5!d! (%6!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_irpCtrlFileObject` Pointer
`A12_volume` Pointer
`A13_CHARirpMajorId` Int32
`A14_FltGetIrpNameirpMajorId` AnsiString

Event ID 39: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CallbackSup.c(1895) %!FUNC!:Pending operation: !x!, Irpctrl=!p!, callbackNode=!p! (!S!).

Message #

[TL_%!LEVEL!] CallbackSup.c(1895) %!FUNC!:Pending operation: %2!x!, Irpctrl=%3!p!, callbackNode=%4!p! (%5!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpMajorId` HexInt32
`A11_irpCtrl` Pointer
`A12_callbackNode` Pointer
`A13_FlagOnirpCtrlFlagsIRPCTRFL_SYNCHRONIZESYNCNotSYNC` AnsiString

Event ID 40: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(335) %!FUNC!:Freeing completion node tracking structure !p!

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(335) %!FUNC!:Freeing completion node tracking structure %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_TrackingCtrlPointerToFree` Pointer

Event ID 41: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(401) %!FUNC!:CN Not Tracking IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(401) %!FUNC!:CN Not Tracking   IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_CompNodeIrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 42: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(441) %!FUNC!:CN Insert Active IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(441) %!FUNC!:CN Insert Active  IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_CompNodeIrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 43: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(481) %!FUNC!:CN Insert Waiting IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(481) %!FUNC!:CN Insert Waiting IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 44: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(507) %!FUNC!:Linking, swapped buffers, canceling IRP !d!,!d! (!S!).

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(507) %!FUNC!:Linking, swapped buffers, canceling IRP %2!d!,%3!d! (%4!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString

Event ID 45: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(515) %!FUNC!:Linking, swapped buffers, wait for non-IRP operation !d!,!d! (!S!).

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(515) %!FUNC!:Linking, swapped buffers, wait for non-IRP operation %2!d!,%3!d! (%4!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString

Event ID 46: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(549) %!FUNC!:CN Insert Waiting (non-drainable) IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(549) %!FUNC!:CN Insert Waiting (non-drainable) IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 47: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(560) %!FUNC!:Linking, wait for non-drainable operation !d!,!d! (!S!) IrpCtrl=!p!

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(560) %!FUNC!:Linking, wait for non-drainable operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 48: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(582) %!FUNC!:CN Insert Active IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(582) %!FUNC!:CN Insert Active  IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_CompNodeIrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 49: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(622) %!FUNC!:CN Insert Waiting IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(622) %!FUNC!:CN Insert Waiting IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 50: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(648) %!FUNC!:Linking, swapped buffers, canceling IRP !d!,!d! (!S!).

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(648) %!FUNC!:Linking, swapped buffers, canceling IRP %2!d!,%3!d! (%4!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString

Event ID 51: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(656) %!FUNC!:Linking, swapped buffers, wait for non-IRP operation !d!,!d! (!S!).

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(656) %!FUNC!:Linking, swapped buffers, wait for non-IRP operation %2!d!,%3!d! (%4!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString

Event ID 52: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(690) %!FUNC!:CN Insert Waiting (non-drainable) IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(690) %!FUNC!:CN Insert Waiting (non-drainable) IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 53: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(701) %!FUNC!:Linking, wait for non-drainable operation !d!,!d! (!S!) IrpCtrl=!p!

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(701) %!FUNC!:Linking, wait for non-drainable operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 54: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(739) %!FUNC!:CN Delete IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(739) %!FUNC!:CN Delete         IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_CompNodeIrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 55: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(923) %!FUNC!:Draining, IRP Cancel routine called.

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(923) %!FUNC!:Draining, IRP Cancel routine called

Fields #

Name	Description
`FUNC` AnsiString

Event ID 56: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(1108) %!FUNC!:Draining operation !d!,!d! (!S!) IrpCtrl=!p!

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1108) %!FUNC!:Draining operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARlocalIrpCtrlDataIopbMajorFunction` Int32
`A11_CHARlocalIrpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNamelocalIrpCtrlDataIopbMajorFunction` AnsiString
`A13_localCompNodeIrpCtrl` Pointer

Event ID 57: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(1273) %!FUNC!:CN Insert Waiting (bufSwaped) IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1273) %!FUNC!:CN Insert Waiting (bufSwaped) IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_completionNodeIrpCtrl` Pointer
`A11_completionNode` Pointer
`A12_CHARcompletionNodeDataSnapshotMajorFunction` Int32

Event ID 58: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(1296) %!FUNC!:Draining, Swapped buffers, canceling IRP !d!,!d! (!S!) IrpCtrl=!p!

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1296) %!FUNC!:Draining, Swapped buffers, canceling IRP %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 59: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(1359) %!FUNC!:Draining, Swapped buffers, waiting for non-IRP operation !d!,!d! (!S!) IrpCtrl=!p!

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1359) %!FUNC!:Draining, Swapped buffers, waiting for non-IRP operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 60: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(1392) %!FUNC!:CN Insert Waiting (NotDrainable) IrpCtrl=!p! CompNode=!p! [!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1392) %!FUNC!:CN Insert Waiting (NotDrainable) IrpCtrl=%2!p! CompNode=%3!p! [%4!d!]

Fields #

Name	Description
`FUNC` AnsiString
`A10_completionNodeIrpCtrl` Pointer
`A11_completionNode` Pointer
`A12_CHARcompletionNodeDataSnapshotMajorFunction` Int32

Event ID 61: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(1407) %!FUNC!:Draining, Waiting for non-drainable operation !d!,!d! (!S!) IrpCtrl=!p!

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1407) %!FUNC!:Draining, Waiting for non-drainable operation %2!d!,%3!d! (%4!S!) IrpCtrl=%5!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 62: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] EnumerationSup.c(1105) %!FUNC!:Wrong type of device object passed in: devobj !p!

Message #

[TL_%!LEVEL!] EnumerationSup.c(1105) %!FUNC!:Wrong type of device object passed in: devobj %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer

Event ID 63: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] EnumerationSup.c(1148) %!FUNC!:Wrong type of device object passed in: devobj !p!

Message #

[TL_%!LEVEL!] EnumerationSup.c(1148) %!FUNC!:Wrong type of device object passed in: devobj %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer

Event ID 64: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] ExceptionSup.c(62) %!FUNC!:Caught exception (!08x!, !p!, !p!, !p!).

Message #

[TL_%!LEVEL!] ExceptionSup.c(62) %!FUNC!:Caught exception (%2!08x!, %3!p!, %4!p!, %5!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_ExceptionPointerExceptionRecordExceptionCode` HexInt32
`A11_ExceptionPointerContextRecord` Pointer
`A12_ExceptionPointerExceptionRecord` Pointer
`A13_ExceptionPointerExceptionRecordExceptionAddress` Pointer

Event ID 65: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(367) %!FUNC!:passing through FAST_IO_CHECK_IF_POSSIBLE.

Message #

[TL_%!LEVEL!] FastIoSup.c(367) %!FUNC!:passing through FAST_IO_CHECK_IF_POSSIBLE

Fields #

Name	Description
`FUNC` AnsiString

Event ID 66: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(392) %!FUNC!:passing through FAST_IO_READ.

Message #

[TL_%!LEVEL!] FastIoSup.c(392) %!FUNC!:passing through FAST_IO_READ

Fields #

Name	Description
`FUNC` AnsiString

Event ID 67: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(417) %!FUNC!:passing through FAST_IO_WRITE.

Message #

[TL_%!LEVEL!] FastIoSup.c(417) %!FUNC!:passing through FAST_IO_WRITE

Fields #

Name	Description
`FUNC` AnsiString

Event ID 68: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(441) %!FUNC!:passing through FAST_IO_QUERY_BASIC_INFO.

Message #

[TL_%!LEVEL!] FastIoSup.c(441) %!FUNC!:passing through FAST_IO_QUERY_BASIC_INFO

Fields #

Name	Description
`FUNC` AnsiString

Event ID 69: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(466) %!FUNC!:passing through FAST_IO_QUERY_STANDARD_INFO.

Message #

[TL_%!LEVEL!] FastIoSup.c(466) %!FUNC!:passing through FAST_IO_QUERY_STANDARD_INFO

Fields #

Name	Description
`FUNC` AnsiString

Event ID 70: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(487) %!FUNC!:passing through FAST_IO_QUERY_NETWORK_OPEN_INFO.

Message #

[TL_%!LEVEL!] FastIoSup.c(487) %!FUNC!:passing through FAST_IO_QUERY_NETWORK_OPEN_INFO

Fields #

Name	Description
`FUNC` AnsiString

Event ID 71: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(526) %!FUNC!:passing through FAST_IO_LOCK.

Message #

[TL_%!LEVEL!] FastIoSup.c(526) %!FUNC!:passing through FAST_IO_LOCK

Fields #

Name	Description
`FUNC` AnsiString

Event ID 72: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(551) %!FUNC!:passing through FAST_IO_UNLOCK_SINGLE.

Message #

[TL_%!LEVEL!] FastIoSup.c(551) %!FUNC!:passing through FAST_IO_UNLOCK_SINGLE

Fields #

Name	Description
`FUNC` AnsiString

Event ID 73: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(574) %!FUNC!:passing through FAST_IO_UNLOCK_ALL.

Message #

[TL_%!LEVEL!] FastIoSup.c(574) %!FUNC!:passing through FAST_IO_UNLOCK_ALL

Fields #

Name	Description
`FUNC` AnsiString

Event ID 74: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(595) %!FUNC!:passing through FAST_IO_UNLOCK_ALL_BY_KEY.

Message #

[TL_%!LEVEL!] FastIoSup.c(595) %!FUNC!:passing through FAST_IO_UNLOCK_ALL_BY_KEY

Fields #

Name	Description
`FUNC` AnsiString

Event ID 75: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(624) %!FUNC!:passing through FAST_IO_DEVICE_CONTROL.

Message #

[TL_%!LEVEL!] FastIoSup.c(624) %!FUNC!:passing through FAST_IO_DEVICE_CONTROL

Fields #

Name	Description
`FUNC` AnsiString

Event ID 76: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(652) %!FUNC!:passing through FAST_IO_QUERY_OPEN.

Message #

[TL_%!LEVEL!] FastIoSup.c(652) %!FUNC!:passing through FAST_IO_QUERY_OPEN

Fields #

Name	Description
`FUNC` AnsiString

Event ID 77: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(714) %!FUNC!:passing through FAST_IO_MDL_READ.

Message #

[TL_%!LEVEL!] FastIoSup.c(714) %!FUNC!:passing through FAST_IO_MDL_READ

Fields #

Name	Description
`FUNC` AnsiString

Event ID 78: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(738) %!FUNC!:passing through FAST_IO_MDL_READ_COMPLETE.

Message #

[TL_%!LEVEL!] FastIoSup.c(738) %!FUNC!:passing through FAST_IO_MDL_READ_COMPLETE

Fields #

Name	Description
`FUNC` AnsiString

Event ID 79: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(758) %!FUNC!:passing through FAST_IO_PREPARE_MDL_WRITE.

Message #

[TL_%!LEVEL!] FastIoSup.c(758) %!FUNC!:passing through FAST_IO_PREPARE_MDL_WRITE

Fields #

Name	Description
`FUNC` AnsiString

Event ID 80: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(782) %!FUNC!:passing through FAST_IO_MDL_WRITE_COMPLETE.

Message #

[TL_%!LEVEL!] FastIoSup.c(782) %!FUNC!:passing through FAST_IO_MDL_WRITE_COMPLETE

Fields #

Name	Description
`FUNC` AnsiString

Event ID 81: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(198) %!FUNC!:Starting (!p!).

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(198) %!FUNC!:Starting (%2!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10__localHead` Pointer

Event ID 82: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(224) %:For "A10__VolumeDeviceName".

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(224) %!FUNC!:For "%2"

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String

Event ID 83: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(274) %!FUNC!:FSDelete (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(274) %!FUNC!:FSDelete  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_fileList` Pointer
`A11_fileListFlags` HexInt32
`A12_fileListUseCount` Int32

Event ID 84: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(445) %!FUNC!:Found (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(445) %!FUNC!:Found     (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_fileList` Pointer
`A11_fileListFlags` HexInt32
`A12_fileListUseCount` Int32

Event ID 85: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(565) %!FUNC!:Created (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(565) %!FUNC!:Created   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_newFileList` Pointer
`A11_newFileListFlags` HexInt32
`A12_newFileListUseCount` Int32

Event ID 86: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(588) %!FUNC!:Found New (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(588) %!FUNC!:Found New (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_fileList` Pointer
`A11_fileListFlags` HexInt32
`A12_fileListUseCount` Int32

Event ID 87: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(732) %!FUNC!:Allocate (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(732) %!FUNC!:Allocate  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_newFileList` Pointer
`A11_newFileListFlags` HexInt32
`A12_newFileListUseCount` Int32

Event ID 88: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(769) %!FUNC!:Release (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(769) %!FUNC!:Release   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileList` Pointer
`A11_FileListFlags` HexInt32
`A12_FileListUseCount` Int32

Event ID 89: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(792) %!FUNC!:DEFFERED (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(792) %!FUNC!:DEFFERED  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileList` Pointer
`A11_FileListFlags` HexInt32
`A12_FileListUseCount` Int32

Event ID 90: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(827) %!FUNC!:Cleanup (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(827) %!FUNC!:Cleanup   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileList` Pointer
`A11_FileListFlags` HexInt32
`A12_FileListUseCount` Int32

Event ID 91: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(995) %!FUNC!:DriverEntry: Error EtwRegister, status=!x!

Message #

[TL_%!LEVEL!] fltmgr.c(995) %!FUNC!:DriverEntry: Error EtwRegister, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 92: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1032) %!FUNC!:Failed to start notification for dynamic settings. status=!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1032) %!FUNC!:Failed to start notification for dynamic settings. status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 93: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1095) %!FUNC!:Num processors=!d!

Message #

[TL_%!LEVEL!] fltmgr.c(1095) %!FUNC!:Num processors=%2!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltGlobalsNumProcessors` Int32

Event ID 94: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1099) %!FUNC!:Max processors=!d!

Message #

[TL_%!LEVEL!] fltmgr.c(1099) %!FUNC!:Max processors=%2!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeQueryMaximumProcessorCountExALL_PROCESSOR_GROUPS` Int32

Event ID 95: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1103) %!FUNC!:CacheLine size=!d! (0x!x!).

Message #

[TL_%!LEVEL!] fltmgr.c(1103) %!FUNC!:CacheLine size=%2!d! (0x%3!x!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltGlobalsCacheLineSize` Int32
`A11_FltGlobalsCacheLineSize` HexInt32

Event ID 96: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1110) %!FUNC!:Breaking on errors.

Message #

[TL_%!LEVEL!] fltmgr.c(1110) %!FUNC!:Breaking on errors

Fields #

Name	Description
`FUNC` AnsiString

Event ID 97: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1116) %!FUNC!:Attaching to File System Recognizers.

Message #

[TL_%!LEVEL!] fltmgr.c(1116) %!FUNC!:Attaching to File System Recognizers

Fields #

Name	Description
`FUNC` AnsiString

Event ID 98: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1122) %!FUNC!:Randomly using STATIC IrpCtrl.

Message #

[TL_%!LEVEL!] fltmgr.c(1122) %!FUNC!:Randomly using STATIC IrpCtrl

Fields #

Name	Description
`FUNC` AnsiString

Event ID 99: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1128) %!FUNC!:Randomly using short CompletionNode stacks.

Message #

[TL_%!LEVEL!] fltmgr.c(1128) %!FUNC!:Randomly using short CompletionNode stacks

Fields #

Name	Description
`FUNC` AnsiString

Event ID 100: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1188) %!FUNC!:DriverEntry: Error creating device, status=!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1188) %!FUNC!:DriverEntry: Error creating device, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 101: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1218) %!FUNC!:DriverEntry: Error creating symbolic link for control device, status=!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1218) %!FUNC!:DriverEntry: Error creating symbolic link for control device, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 102: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1269) %!FUNC!:DriverEntry: Failed query for perf trace routines, status=!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1269) %!FUNC!:DriverEntry: Failed query for perf trace routines, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 103: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1411) %!FUNC!:DriverEntry: Error Initializing Messaging Support, status=!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1411) %!FUNC!:DriverEntry: Error Initializing Messaging Support, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 104: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1677) %!FUNC!:Unloading driver (!p!).

Message #

[TL_%!LEVEL!] fltmgr.c(1677) %!FUNC!:Unloading driver (%2!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_DriverObject` Pointer

Event ID 105: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1957) %!FUNC!:Waiting for !d! Zombied FltObject(s) to be freed.

Message #

[TL_%!LEVEL!] fltmgr.c(1957) %!FUNC!:Waiting for %2!d! Zombied FltObject(s) to be freed

Fields #

Name	Description
`FUNC` AnsiString
`A10_i` Int32

Event ID 106: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1965) %!FUNC!:Rundown wait complete.

Message #

[TL_%!LEVEL!] fltmgr.c(1965) %!FUNC!:Rundown wait complete

Fields #

Name	Description
`FUNC` AnsiString

Event ID 107: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1989) %!FUNC!:Waiting for !d! outstanding IrpCtrl(s) to complete.

Message #

[TL_%!LEVEL!] fltmgr.c(1989) %!FUNC!:Waiting for %2!d! outstanding IrpCtrl(s) to complete

Fields #

Name	Description
`FUNC` AnsiString
`A10_i` Int32

Event ID 108: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1998) %!FUNC!:Rundown wait complete.

Message #

[TL_%!LEVEL!] fltmgr.c(1998) %!FUNC!:Rundown wait complete

Fields #

Name	Description
`FUNC` AnsiString

Event ID 109: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(2163) %!FUNC!: DO=!p! Vol=!p! "!S!" (!S!).

Message #

[TL_%!LEVEL!] fltmgr.c(2163) %!FUNC!:%2   DO=%3!p! Vol=%4!p! "%5!S!" (%6!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_FsActiveActivatingfilesystemDeactivatingfilesystem` AnsiString
`A11_FsControlDeviceObject` Pointer
`A12_NULL` Pointer
`A13__controlDeviceNameCtrlName` CountedUtf16String
`A14_GET_DEVICE_TYPE_NAMEFsControlDeviceObjectDeviceType` AnsiString

Event ID 110: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(2270) %!FUNC!:Paging File operation, (!d!).

Message #

[TL_%!LEVEL!] fltmgr.c(2270) %!FUNC!:Paging File operation, %2(%3!d!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltGetIrpNameirpSpMajorFunction` AnsiString
`A11_irpSpMajorFunction` Int32

Event ID 111: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(2770) %!FUNC!:FO=!p! Closing "!S!".

Message #

[TL_%!LEVEL!] fltmgr.c(2770) %!FUNC!:FO=%2!p! Closing  "%3!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpSpFileObject` Pointer
`A11__irpSpFileObjectFileName` CountedUtf16String

Event ID 112: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(4419) %!FUNC!:Posting Irp !p! major=!d!

Message #

[TL_%!LEVEL!] fltmgr.c(4419) %!FUNC!:Posting Irp %2!p! major=%3!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrlIrp` Pointer
`A11_IrpCtrlDataIopbMajorFunction` Int32

Event ID 113: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(4747) %!FUNC!:Posting Irp !p!

Message #

[TL_%!LEVEL!] fltmgr.c(4747) %!FUNC!:Posting Irp %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_Irp` Pointer

Event ID 114: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(4916) %!FUNC!:TopLevelIrp set with unknown Irp 0x!x!

Message #

[TL_%!LEVEL!] fltmgr.c(4916) %!FUNC!:TopLevelIrp set with unknown Irp 0x%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpSpMajorFunction` HexInt32

Event ID 115: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(5774) %!FUNC!:Set thread hiding in FltpCreate: T=!p! FO=!p! Vol=!p! Name="!S!".

Message #

[TL_%!LEVEL!] fltmgr.c(5774) %!FUNC!:Set thread hiding in FltpCreate:              T=%2!p! FO=%3!p! Vol=%4!p! Name="%5!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_fileObject` Pointer
`A12_iccVolume` Pointer
`A13_fileObjectFileName` CountedUtf16String

Event ID 116: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(5845) %!FUNC!:Calling InstanceSetup on CreateIrp.

Message #

[TL_%!LEVEL!] fltmgr.c(5845) %!FUNC!:Calling InstanceSetup on CreateIrp

Fields #

Name	Description
`FUNC` AnsiString

Event ID 117: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(5883) %!FUNC!:FO=!p! Creating "!S!".

Message #

[TL_%!LEVEL!] fltmgr.c(5883) %!FUNC!:FO=%2!p! Creating "%3!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_fileObject` Pointer
`A11__fileObjectFileName` CountedUtf16String

Event ID 118: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(6152) %!FUNC!:Reset thread hiding in FltpCreatePostCompl: T=!p! FO=!p! Vol=!p! status=!S!

Message #

[TL_%!LEVEL!] fltmgr.c(6152) %!FUNC!:Reset thread hiding in FltpCreatePostCompl:   T=%2!p! FO=%3!p! Vol=%4!p! status=%5!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_IrpCtrlFileObject` Pointer
`A12_volume` Pointer
`A13_IrpCtrlDataIoStatusStatus` HexInt32

Event ID 119: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(6160) %!FUNC!:Continue Thread hiding in FltpCreatePostCompl:T=!p! FO=!p! Vol=!p! status=!S!

Message #

[TL_%!LEVEL!] fltmgr.c(6160) %!FUNC!:Continue Thread hiding in FltpCreatePostCompl:T=%2!p! FO=%3!p! Vol=%4!p! status=%5!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_IrpCtrlFileObject` Pointer
`A12_volume` Pointer
`A13_IrpCtrlDataIoStatusStatus` HexInt32

Event ID 120: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(6301) %!FUNC!:Calling InstanceSetup on CreateIrp.

Message #

[TL_%!LEVEL!] fltmgr.c(6301) %!FUNC!:Calling InstanceSetup on CreateIrp

Fields #

Name	Description
`FUNC` AnsiString

Event ID 121: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(7471) %!FUNC!:Mount volume failure for DO=!p! Vol=!p! "!S!", status=!S! AttachedToDO=!p! FsCDO=!p!

Message #

[TL_%!LEVEL!] fltmgr.c(7471) %!FUNC!:Mount volume failure for   DO=%2!p! Vol=%3!p! "%4!S!", status=%5!S!            AttachedToDO=%6!p! FsCDO=%7!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_newDeviceObject` Pointer
`A11_volume` Pointer
`A12__volumeDeviceName` CountedUtf16String
`A13_status` HexInt32
`A14_FltpGetFsDeviceObjectAfterMountdiskDeviceObject` Pointer
`A15_FsControlDeviceObject` Pointer

Event ID 122: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(7598) %!FUNC!:DeviceObject !p!, Loading File System, Detaching from !S!

Message #

[TL_%!LEVEL!] fltmgr.c(7598) %!FUNC!:DeviceObject %2!p!,  Loading File System, Detaching from %3!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer
`A11__devExtControlDeviceName` CountedUtf16String

Event ID 123: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(7649) %!FUNC!:Detaching from recognizer DO=!p! Vol=!p! "!S!", status=!S!

Message #

[TL_%!LEVEL!] fltmgr.c(7649) %!FUNC!:Detaching from recognizer  DO=%2!p! Vol=%3!p! "%4!S!", status=%5!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer
`A11_NULL` Pointer
`A12__devExtControlDeviceName` CountedUtf16String
`A13_IrpIoStatusStatus` HexInt32

Event ID 124: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(11091) %!FUNC!:Calling InstanceSetup on FastIoQueryOpen.

Message #

[TL_%!LEVEL!] fltmgr.c(11091) %!FUNC!:Calling InstanceSetup on FastIoQueryOpen

Fields #

Name	Description
`FUNC` AnsiString

Event ID 125: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(12425) %!FUNC!:Failed to restart registry watch, Context=!p!, status=!x!

Message #

[TL_%!LEVEL!] fltmgr.c(12425) %!FUNC!:Failed to restart registry watch, Context=%2!p!, status=%3!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_Context` Pointer
`A11_regWatchContextNotificationStatus` HexInt32

Event ID 126: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(13271) %!FUNC!:Resetting notification for dynamic registry settings failed. Context=!p!, status=!x!

Message #

[TL_%!LEVEL!] fltmgr.c(13271) %!FUNC!:Resetting notification for dynamic registry settings failed. Context=%2!p!, status=%3!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_regWatchContext` Pointer
`A11_regWatchContextNotificationStatus` HexInt32

Event ID 127: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(549) %!FUNC!:Error registering FS change notification, status=!x!

Message #

[TL_%!LEVEL!] FrameSup.c(549) %!FUNC!:Error registering FS change notification, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 128: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(584) %!FUNC!:Error 0x!X! attaching to device !S!

Message #

[TL_%!LEVEL!] FrameSup.c(584) %!FUNC!:Error 0x%2!X! attaching to device %3!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32
`A11__tempString` CountedUtf16String

Event ID 129: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(613) %!FUNC!:Error 0x!X! attaching to device !S!

Message #

[TL_%!LEVEL!] FrameSup.c(613) %!FUNC!:Error 0x%2!X! attaching to device %3!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32
`A11__tempString` CountedUtf16String

Event ID 130: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(629) %!FUNC!:Created Frame !d! with altitude range !S!-!S!

Message #

[TL_%!LEVEL!] FrameSup.c(629) %!FUNC!:Created Frame %2!d! with altitude range %3!S!-%4!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_frameFrameID` Int32
`A11__frameAltitudeIntervalLow` CountedUtf16String
`A12__frameAltitudeIntervalHigh` CountedUtf16String

Event ID 131: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(1647) %!FUNC!:Failed allocating timer.

Message #

[TL_%!LEVEL!] FrameSup.c(1647) %!FUNC!:Failed allocating timer

Fields #

Name	Description
`FUNC` AnsiString

Event ID 132: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(1659) %!FUNC!:Starting timer.

Message #

[TL_%!LEVEL!] FrameSup.c(1659) %!FUNC!:Starting timer

Fields #

Name	Description
`FUNC` AnsiString

Event ID 133: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(1762) %!FUNC!:FltpManualDeviceAttachWorker: Delaying: fl=!Ix!, dl=!d! (!d!).

Message #

[TL_%!LEVEL!] FrameSup.c(1762) %!FUNC!:FltpManualDeviceAttachWorker: Delaying: fl=%2!Ix!, dl=%3!d! (%4!d!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_ctxFlags` Pointer
`A11_FltGlobalsManualAttachDelayCounter` Int32
`A12_FltGlobalsManualDeviceAttachLimit` Int32

Event ID 134: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(1778) %!FUNC!:FltpManualDeviceAttachWorker: Checking: fl=!Ix!, dl=!d! (!d!).

Message #

[TL_%!LEVEL!] FrameSup.c(1778) %!FUNC!:FltpManualDeviceAttachWorker: Checking: fl=%2!Ix!, dl=%3!d! (%4!d!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_ctxFlags` Pointer
`A11_FltGlobalsManualAttachDelayCounter` Int32
`A12_FltGlobalsManualDeviceAttachLimit` Int32

Event ID 135: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(2181) %!FUNC!:Altidue range for Frame !d! changed from !S!-!S! to !S!-!S!

Message #

[TL_%!LEVEL!] FrameSup.c(2181) %!FUNC!:Altidue range for Frame %2!d! changed from %3!S!-%4!S! to %5!S!-%6!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_TopFrameFrameID` Int32
`A11__TopFrameAltitudeIntervalLow` CountedUtf16String
`A12__TopFrameAltitudeIntervalHigh` CountedUtf16String
`A13__TopFrameAltitudeIntervalLow` CountedUtf16String
`A14_legacyAltitude` CountedUtf16String

Event ID 136: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(2291) %:The "A10__DriverObjDriverExtensionServiceKeyName" legacy filter is using the "A11_PCWCHARvalueInfoData" load order group.

Message #

[TL_%!LEVEL!] FrameSup.c(2291) %!FUNC!:The "%2" legacy filter is using the "%3!S!" load order group

Fields #

Name	Description
`FUNC` AnsiString
`A10__DriverObjDriverExtensionServiceKeyName` CountedUtf16String
`A11_PCWCHARvalueInfoData` UnicodeString

Event ID 137: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] InstanceSup.c(663) %!FUNC!:Instance Setup Aborted for Filter (!p!) "!S!", instance (!p!) on volume (!p!) "!S!".

Message #

[TL_%!LEVEL!] InstanceSup.c(663) %!FUNC!:Instance Setup Aborted for Filter (%2!p!) "%3!S!", instance (%4!p!) on volume (%5!p!) "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_Filter` Pointer
`A11__FilterName` CountedUtf16String
`A12_instance` Pointer
`A13_Volume` Pointer
`A14__VolumeDeviceName` CountedUtf16String

Event ID 138: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] InstanceSup.c(680) %!FUNC!:Filter (!p!) "!S!" attached instance (!p!) to volume (!p!) "!S!".

Message #

[TL_%!LEVEL!] InstanceSup.c(680) %!FUNC!:Filter (%2!p!) "%3!S!" attached instance (%4!p!) to volume (%5!p!) "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_Filter` Pointer
`A11__FilterName` CountedUtf16String
`A12_instance` Pointer
`A13_Volume` Pointer
`A14__VolumeDeviceName` CountedUtf16String

Event ID 139: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] InstanceSup.c(1880) %!FUNC!:New instance for filter (!p!) "!S!" at altitude !S! for volume !p! "!S!".

Message #

[TL_%!LEVEL!] InstanceSup.c(1880) %!FUNC!:New instance for filter (%2!p!) "%3!S!" at altitude %4!S! for volume %5!p! "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_InstanceFilter` Pointer
`A11__InstanceFilterName` CountedUtf16String
`A12__InstanceAltitude` CountedUtf16String
`A13_Volume` Pointer
`A14__VolumeDeviceName` CountedUtf16String

Event ID 140: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] InstanceSup.c(1977) %!FUNC!:Instance !p! for filter (!p!) "!S!" already exists at altitude !S!

Message #

[TL_%!LEVEL!] InstanceSup.c(1977) %!FUNC!:Instance %2!p! for filter (%3!p!) "%4!S!" already exists at altitude %5!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_currentInstance` Pointer
`A11_currentInstanceFilter` Pointer
`A12__currentInstanceFilterName` CountedUtf16String
`A13__InstanceAltitude` CountedUtf16String

Event ID 141: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] InstanceSup.c(2065) %!FUNC!:Filter (!p!) "!S!" detached instance (!p!) from volume (!p!) "!S!" NotifyFlags=!x!

Message #

[TL_%!LEVEL!] InstanceSup.c(2065) %!FUNC!:Filter (%2!p!) "%3!S!" detached instance (%4!p!) from volume (%5!p!) "%6!S!" NotifyFlags=%7!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_filter` Pointer
`A11__filterName` CountedUtf16String
`A12_Instance` Pointer
`A13_volume` Pointer
`A14__volumeDeviceName` CountedUtf16String
`A15_Reason` HexInt32

Event ID 142: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(4656) %!FUNC!:Attemping Fastio (no lower minifilters) from FltReadFile: Buffer=!p!, offset=!I64x!, length=!x!

Message #

[TL_%!LEVEL!] IoSup.c(4656) %!FUNC!:Attemping Fastio (no lower minifilters) from FltReadFile: Buffer=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_Buffer` Pointer
`A11_fileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 143: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(4706) %!FUNC!:Attemping Fastio from FltReadFile: Buffer=!p!, offset=!I64x!, length=!x!

Message #

[TL_%!LEVEL!] IoSup.c(4706) %!FUNC!:Attemping Fastio from FltReadFile: Buffer=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_Buffer` Pointer
`A11_fileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 144: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(4812) %!FUNC!:Fastio attempt from FltReadFile failed.

Message #

[TL_%!LEVEL!] IoSup.c(4812) %!FUNC!:Fastio attempt from FltReadFile failed

Fields #

Name	Description
`FUNC` AnsiString

Event ID 145: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5228) %!FUNC!:Attemping Fastio (no lower minifilters) from FltWriteFile: Buffer=!p!, offset=!I64x!, length=!x!

Message #

[TL_%!LEVEL!] IoSup.c(5228) %!FUNC!:Attemping Fastio (no lower minifilters) from FltWriteFile: Buffer=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_Buffer` Pointer
`A11_fileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 146: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5279) %!FUNC!:Attemping Fastio from FltWriteFile: Buffer=!p!, offset=!I64x!, length=!x!

Message #

[TL_%!LEVEL!] IoSup.c(5279) %!FUNC!:Attemping Fastio from FltWriteFile: Buffer=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_Buffer` Pointer
`A11_fileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 147: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5386) %!FUNC!:Fastio attempt from FltWriteFile failed.

Message #

[TL_%!LEVEL!] IoSup.c(5386) %!FUNC!:Fastio attempt from FltWriteFile failed

Fields #

Name	Description
`FUNC` AnsiString

Event ID 148: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5588) %!FUNC!:(No lower minifilters).

Message #

[TL_%!LEVEL!] IoSup.c(5588) %!FUNC!:(No lower minifilters)

Fields #

Name	Description
`FUNC` AnsiString

Event ID 149: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5663) %!FUNC!:(Lower minifilter(s) exist).

Message #

[TL_%!LEVEL!] IoSup.c(5663) %!FUNC!:(Lower minifilter(s) exist)

Fields #

Name	Description
`FUNC` AnsiString

Event ID 150: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5801) %!FUNC!:Attemping Fastio from FltFastIoMdlRead: MDLChain=!p!, offset=!I64x!, length=!x!

Message #

[TL_%!LEVEL!] IoSup.c(5801) %!FUNC!:Attemping Fastio from FltFastIoMdlRead: MDLChain=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 151: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5819) %!FUNC!:Fastio attempt from FltReadFile failed.

Message #

[TL_%!LEVEL!] IoSup.c(5819) %!FUNC!:Fastio attempt from FltReadFile failed

Fields #

Name	Description
`FUNC` AnsiString

Event ID 152: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5840) %!FUNC!:Attemping Fastio from FltFastIoMdlReadComplete: MDLChain=!p!

Message #

[TL_%!LEVEL!] IoSup.c(5840) %!FUNC!:Attemping Fastio from FltFastIoMdlReadComplete: MDLChain=%2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_MdlChain` Pointer

Event ID 153: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5855) %!FUNC!:Fastio attempt from FltFastIoMdlReadComplete failed.

Message #

[TL_%!LEVEL!] IoSup.c(5855) %!FUNC!:Fastio attempt from FltFastIoMdlReadComplete failed

Fields #

Name	Description
`FUNC` AnsiString

Event ID 154: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5880) %!FUNC!:Attemping Fastio from FltFastIoPrepareMdlWrite: MDLChain=!p!, offset=!I64x!, length=!x!

Message #

[TL_%!LEVEL!] IoSup.c(5880) %!FUNC!:Attemping Fastio from FltFastIoPrepareMdlWrite: MDLChain=%2!p!, offset=%3!I64x!, length=%4!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 155: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5898) %!FUNC!:Fastio attempt from FltFastIoPrepareMdlWrite failed.

Message #

[TL_%!LEVEL!] IoSup.c(5898) %!FUNC!:Fastio attempt from FltFastIoPrepareMdlWrite failed

Fields #

Name	Description
`FUNC` AnsiString

Event ID 156: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5921) %!FUNC!:Attemping Fastio from FltFastIoMdlWriteComplete: MDLChain=!p!, offset=!I64x!

Message #

[TL_%!LEVEL!] IoSup.c(5921) %!FUNC!:Attemping Fastio from FltFastIoMdlWriteComplete: MDLChain=%2!p!, offset=%3!I64x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffsetQuadPart` HexInt64

Event ID 157: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5938) %!FUNC!:Fastio attempt from FltFastIoMdlWriteComplete failed.

Message #

[TL_%!LEVEL!] IoSup.c(5938) %!FUNC!:Fastio attempt from FltFastIoMdlWriteComplete failed

Fields #

Name	Description
`FUNC` AnsiString

Event ID 158: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2005) %!FUNC!:Timed out waiting for listener.

Message #

[TL_%!LEVEL!] MessageSup.c(2005) %!FUNC!:Timed out waiting for listener.

Fields #

Name	Description
`FUNC` AnsiString

Event ID 159: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2018) %!FUNC!:Port is disconncted: abandoning listener.

Message #

[TL_%!LEVEL!] MessageSup.c(2018) %!FUNC!:Port is disconncted: abandoning listener

Fields #

Name	Description
`FUNC` AnsiString

Event ID 160: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2026) %!FUNC!:Thread is Terminating.

Message #

[TL_%!LEVEL!] MessageSup.c(2026) %!FUNC!:Thread is Terminating.

Fields #

Name	Description
`FUNC` AnsiString

Event ID 161: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2102) %!FUNC!:Timed out waiting for listener.

Message #

[TL_%!LEVEL!] MessageSup.c(2102) %!FUNC!:Timed out waiting for listener.

Fields #

Name	Description
`FUNC` AnsiString

Event ID 162: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2115) %!FUNC!:Port is disconncted: abandoning listener.

Message #

[TL_%!LEVEL!] MessageSup.c(2115) %!FUNC!:Port is disconncted: abandoning listener

Fields #

Name	Description
`FUNC` AnsiString

Event ID 163: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2123) %!FUNC!:Thread is Terminating.

Message #

[TL_%!LEVEL!] MessageSup.c(2123) %!FUNC!:Thread is Terminating.

Fields #

Name	Description
`FUNC` AnsiString

Event ID 164: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2156) %!FUNC!:Found waiter IRP (!p!), dequeued it.

Message #

[TL_%!LEVEL!] MessageSup.c(2156) %!FUNC!:Found waiter IRP (%2!p!), dequeued it

Fields #

Name	Description
`FUNC` AnsiString
`A10_irp` Pointer

Event ID 165: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2257) %!FUNC!:Found waiter, but could not map user's buffer, IRP=!p!

Message #

[TL_%!LEVEL!] MessageSup.c(2257) %!FUNC!:Found waiter, but could not map user's buffer, IRP=%2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_irp` Pointer

Event ID 166: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2381) %!FUNC!:Queueing replyWaiter (!p!).

Message #

[TL_%!LEVEL!] MessageSup.c(2381) %!FUNC!:Queueing replyWaiter (%2!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10__replyWaiter` Pointer

Event ID 167: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2434) %!FUNC!:Wait for reply status !x!

Message #

[TL_%!LEVEL!] MessageSup.c(2434) %!FUNC!:Wait for reply status %2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 168: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2442) %!FUNC!:Thread is Terminating Thread timed out Port disconnected.

Message #

[TL_%!LEVEL!] MessageSup.c(2442) %!FUNC!:Thread is Terminating Thread timed out Port disconnected

Fields #

Name	Description
`FUNC` AnsiString

Event ID 169: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2803) %!FUNC!:Found waiter !p!, dequeued it.

Message #

[TL_%!LEVEL!] MessageSup.c(2803) %!FUNC!:Found waiter %2!p!, dequeued it

Fields #

Name	Description
`FUNC` AnsiString
`A10_currentWaiter` Pointer

Event ID 170: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2866) %!FUNC!:Setting reply event.

Message #

[TL_%!LEVEL!] MessageSup.c(2866) %!FUNC!:Setting reply event

Fields #

Name	Description
`FUNC` AnsiString

Event ID 171: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2883) %!FUNC!:No waiter for reply, messageId: 0x!X!

Message #

[TL_%!LEVEL!] MessageSup.c(2883) %!FUNC!:No waiter for reply, messageId: 0x%2!X!

Fields #

Name	Description
`FUNC` AnsiString
`A10_ULONGreplyMessageId` HexInt32

Event ID 172: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2932) %!FUNC!:Allocated !p!, enqueueing it (async).

Message #

[TL_%!LEVEL!] MessageSup.c(2932) %!FUNC!:Allocated %2!p!, enqueueing it (async)

Fields #

Name	Description
`FUNC` AnsiString
`A10_Irp` Pointer

Event ID 173: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2995) %!FUNC!:Dequeued waiter !p!

Message #

[TL_%!LEVEL!] MessageSup.c(2995) %!FUNC!:Dequeued waiter %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_irp` Pointer

Event ID 174: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3047) %!FUNC!:Verifying waiter list for Queue: !p! --.

Message #

[TL_%!LEVEL!] MessageSup.c(3047) %!FUNC!:Verifying waiter list for Queue: %2!p! --

Fields #

Name	Description
`FUNC` AnsiString
`A10_Queue` Pointer

Event ID 175: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3057) %!FUNC!: -- currentLink !p!

Message #

[TL_%!LEVEL!] MessageSup.c(3057) %!FUNC!:                    -- currentLink %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_currentLink` Pointer

Event ID 176: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3158) %!FUNC!:Error creating server port object type, status=!x!

Message #

[TL_%!LEVEL!] MessageSup.c(3158) %!FUNC!:Error creating server port object type, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 177: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3223) %!FUNC!:Error creating connection port object type, status=!x!

Message #

[TL_%!LEVEL!] MessageSup.c(3223) %!FUNC!:Error creating connection port object type, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 178: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3245) %!FUNC!:Error creating msg device object, status=!x!

Message #

[TL_%!LEVEL!] MessageSup.c(3245) %!FUNC!:Error creating msg device object, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 179: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3263) %!FUNC!:Error creating symbolic link to msg device object, status=!x!

Message #

[TL_%!LEVEL!] MessageSup.c(3263) %!FUNC!:Error creating symbolic link to msg device object, status=%2!x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 180: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3365) %!FUNC!:Setting MessageWaiter event.

Message #

[TL_%!LEVEL!] MessageSup.c(3365) %!FUNC!:Setting MessageWaiter event

Fields #

Name	Description
`FUNC` AnsiString

Event ID 181: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3377) %!FUNC!:Setting MessageWaiter semaphore.

Message #

[TL_%!LEVEL!] MessageSup.c(3377) %!FUNC!:Setting MessageWaiter semaphore

Fields #

Name	Description
`FUNC` AnsiString

Event ID 182: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3435) %!FUNC!:Cancelling MessageWaiter !p!

Message #

[TL_%!LEVEL!] MessageSup.c(3435) %!FUNC!:Cancelling MessageWaiter %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_Irp` Pointer

Event ID 183: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3484) %!FUNC!:Removed MessageWaiter !p! from queue.

Message #

[TL_%!LEVEL!] MessageSup.c(3484) %!FUNC!:Removed MessageWaiter %2!p! from queue

Fields #

Name	Description
`FUNC` AnsiString
`A10_Irp` Pointer

Event ID 184: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(849) %!FUNC!:Temporary: (!p!) FO=!p!, Fl=!03x!, Use=!d! "!S!".

Message #

[TL_%!LEVEL!] NameCacheSup.c(849) %!FUNC!:Temporary: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 185: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(1918) %!FUNC!:Deleting Node: (!p!) Fl=!03x!, Use=!d! "!S!".

Message #

[TL_%!LEVEL!] NameCacheSup.c(1918) %!FUNC!:Deleting Node: (%2!p!) Fl=%3!03x!, Use=%4!d! "%5!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_nameCacheNodeTreeLinkFlagsflagToClear` HexInt32
`A12_nameCacheNodeUseCount` Int32
`A13__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 186: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(3470) %!FUNC!:Freeing Node: (!p!), flags:!04x!, name: "!S!".

Message #

[TL_%!LEVEL!] NameCacheSup.c(3470) %!FUNC!:Freeing Node: (%2!p!), flags:%3!04x!, name: "%4!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_FlagOnnameCacheNodeTreeLinkFlags0x0ffff` HexInt32
`A12__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 187: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(3719) %!FUNC!:Getting NORMALIZED name for fo: !p!

Message #

[TL_%!LEVEL!] NameCacheSup.c(3719) %!FUNC!:Getting NORMALIZED name for fo: %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenCtxFileObject` Pointer

Event ID 188: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(3728) %!FUNC!:Getting OPENED name for fo: !p!

Message #

[TL_%!LEVEL!] NameCacheSup.c(3728) %!FUNC!:Getting OPENED name for fo: %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenCtxFileObject` Pointer

Event ID 189: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(3738) %!FUNC!:Getting SHORT name for fo: !p!

Message #

[TL_%!LEVEL!] NameCacheSup.c(3738) %!FUNC!:Getting SHORT name for fo: %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenCtxFileObject` Pointer

Event ID 190: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(4313) %!FUNC!:Found: (!p!) FO=!p!, Fl=!03x!, Use=!d! "!S!".

Message #

[TL_%!LEVEL!] NameCacheSup.c(4313) %!FUNC!:Found: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 191: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(4469) %!FUNC!:Inserted: (!p!) FO=!p!, Fl=!03x!, Use=!d! "!S!".

Message #

[TL_%!LEVEL!] NameCacheSup.c(4469) %!FUNC!:Inserted: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 192: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(4545) %!FUNC!:Replaced: (!p!) FO=!p!, Fl=!03x!, Use=!d! "!S!".

Message #

[TL_%!LEVEL!] NameCacheSup.c(4545) %!FUNC!:Replaced: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 193: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(4572) %!FUNC!:Duplicate: (!p!) FO=!p!, Fl=!03x!, Use=!d! "!S!".

Message #

[TL_%!LEVEL!] NameCacheSup.c(4572) %!FUNC!:Duplicate: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_foundNameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_foundNameCacheNodeTreeLinkFlags` HexInt32
`A13_foundNameCacheNodeUseCount` Int32
`A14__foundNameCacheNodeNameInfoName` CountedUtf16String

Event ID 194: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(4596) %!FUNC!:Temporary: (!p!) FO=!p!, Fl=!03x!, Use=!d! "!S!".

Message #

[TL_%!LEVEL!] NameCacheSup.c(4596) %!FUNC!:Temporary: (%2!p!) FO=%3!p!, Fl=%4!03x!, Use=%5!d! "%6!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 195: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(4826) %!FUNC!:Invalidate Caching (0x!x!, 0x!x!): "!S!", [!S!] (!p!).

Message #

[TL_%!LEVEL!] NameCacheSup.c(4826) %!FUNC!:Invalidate Caching (0x%2!x!, 0x%3!x!): "%4!S!", [%5!S!] (%6!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrlNULLIrpCtrlDataIopbMajorFunction0xff` HexInt32
`A11_IrpCtrlNULLIrpCtrlDataIopbMinorFunction0xff` HexInt32
`A12__VolumeDeviceName` CountedUtf16String
`A13__FileObjectFileName` CountedUtf16String
`A14_FileObject` Pointer

Event ID 196: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(5072) %!FUNC!:Reinstate Caching (0x!x!, 0x!x!): "!S!", [!S!] (!p!).

Message #

[TL_%!LEVEL!] NameCacheSup.c(5072) %!FUNC!:Reinstate Caching (0x%2!x!, 0x%3!x!): "%4!S!", [%5!S!] (%6!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrlNULLIrpCtrlDataIopbMajorFunction0xff` HexInt32
`A11_IrpCtrlNULLIrpCtrlDataIopbMinorFunction0xff` HexInt32
`A12__VolumeDeviceName` CountedUtf16String
`A13__FileObjectFileName` CountedUtf16String
`A14_FileObject` Pointer

Event ID 197: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6074) %!FUNC!:Refcounting file name information: !p! cnt=!d!

Message #

[TL_%!LEVEL!] NameCacheSup.c(6074) %!FUNC!:Refcounting file name information: %2!p! cnt=%3!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer
`A11_nameCacheNodeUseCount` Int32

Event ID 198: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6135) %!FUNC!:Releasing fni !p!

Message #

[TL_%!LEVEL!] NameCacheSup.c(6135) %!FUNC!:Releasing fni %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer

Event ID 199: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6164) %!FUNC!: *FREEING FNI*.

Message #

[TL_%!LEVEL!] NameCacheSup.c(6164) %!FUNC!: *FREEING FNI*

Fields #

Name	Description
`FUNC` AnsiString

Event ID 200: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6173) %!FUNC!

Message #

[TL_%!LEVEL!] NameCacheSup.c(6173) %!FUNC!:

Fields #

Name	Description
`FUNC` AnsiString

Event ID 201: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6996) %:Expanded "A10__GenCtxShortFileName" to "A11__localGenCtxFileNameInformationName".

Message #

[TL_%!LEVEL!] NameCacheSup.c(6996) %!FUNC!:Expanded    "%2" to "%3!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10__GenCtxShortFileName` CountedUtf16String
`A11__localGenCtxFileNameInformationName` CountedUtf16String

Event ID 202: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(7501) %:Purge name cache for POSIX delete: "A10__VolumeDeviceName", [A11__FileObjectFileName] (A12_FileObject).

Message #

[TL_%!LEVEL!] NameCacheSup.c(7501) %!FUNC!:Purge name cache for POSIX delete: "%2", [%3!S!] (%4!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String
`A11__FileObjectFileName` CountedUtf16String
`A12_FileObject` Pointer

Event ID 203: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(7516) %!FUNC!:Failed to invalidate name cache for POSIX delete.

Message #

[TL_%!LEVEL!] NameCacheSup.c(7516) %!FUNC!:Failed to invalidate name cache for POSIX delete: %2

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 204: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(854) %!FUNC!:Error building name: NameCtrl (!p!) [0x!x!] Error: 0x!x! ShareNameLength: 0x!x! StreamNameLength: 0x!x! Name: !S! CurrentShortName: !S!

Message #

[TL_%!LEVEL!] NameSup.c(854) %!FUNC!:Error building name: NameCtrl (%2!p!) [0x%3!x!] Error: 0x%4!x!  ShareNameLength: 0x%5!x! StreamNameLength: 0x%6!x!  Name: %7!S! CurrentShortName: %8!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_NameCtrl` Pointer
`A11_NameCtrlNameGenerationFlags` HexInt32
`A12_NameCtrlError` HexInt32
`A13_NameCtrlShareNameLength` HexInt32
`A14_NameCtrlStreamNameLength` HexInt32
`A15__NameCtrlName` CountedUtf16String
`A16__NameCtrlCurrentShortName` CountedUtf16String

Event ID 205: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(987) %!FUNC!:Realloc: (!p!) oldSz=!05x! newSz=!05x! name: !S! oldFlags: !08x! flagsToSet: !08x!

Message #

[TL_%!LEVEL!] NameSup.c(987) %!FUNC!:Realloc:    (%2!p!) oldSz=%3!05x! newSz=%4!05x! name: %5!S! oldFlags: %6!08x! flagsToSet: %7!08x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_NameCtrl` Pointer
`A11_NameCtrlBufferSize` HexInt32
`A12_NewSize` HexInt32
`A13__NameCtrlName` CountedUtf16String
`A14_NameCtrlFlags` HexInt32
`A15_FlagsToSet` HexInt32

Event ID 206: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(2828) %!FUNC!:Opening By ID: \!04x!!04x! !04x!!04x!

Message #

[TL_%!LEVEL!] NameSup.c(2828) %!FUNC!:Opening By ID: %2\%3!04x!%4!04x! %5!04x!%6!04x!

Fields #

Name	Description
`FUNC` AnsiString
`A10_GET_NAME_SUPPORT_VOLUME_DEVICE_NAMEGenCtx` CountedUtf16String
`A11_GenCtxFileObjectFileNameBuffer0` HexInt32
`A12_GenCtxFileObjectFileNameBuffer1` HexInt32
`A13_GenCtxFileObjectFileNameBuffer2` HexInt32
`A14_GenCtxFileObjectFileNameBuffer3` HexInt32

Event ID 207: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(3578) %:Expanded "A10__GenCtxShortFileName" to "A11__GenCtxExpandedFileName".

Message #

[TL_%!LEVEL!] NameSup.c(3578) %!FUNC!:Expanded    "%2" to "%3!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10__GenCtxShortFileName` CountedUtf16String
`A11__GenCtxExpandedFileName` CountedUtf16String

Event ID 208: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(4213) %!FUNC!:Opening name.

Message #

[TL_%!LEVEL!] NameSup.c(4213) %!FUNC!:Opening name: %2

Fields #

Name	Description
`FUNC` AnsiString
`A10__GenCtxNameCtrlName` CountedUtf16String

Event ID 209: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(5979) %!FUNC!:Expanding path for fo: !p!

Message #

[TL_%!LEVEL!] NameSup.c(5979) %!FUNC!:Expanding path for fo: %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenCtxFileObject` Pointer

Event ID 210: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(7307) %!FUNC!:NORMALIZE FORMAT for name in (!p!) Name: !S! Volume: !S! Final Component: !S! Extension: !S! Stream: !S! Parent Dir: !S!

Message #

[TL_%!LEVEL!] NameSup.c(7307) %!FUNC!:NORMALIZE FORMAT for name in (%2!p!)   Name: %3!S!   Volume: %4!S!   Final Component: %5!S!   Extension: %6!S!   Stream: %7!S!   Parent Dir: %8!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer
`A11__FileNameInformationName` CountedUtf16String
`A12__FileNameInformationVolume` CountedUtf16String
`A13__FileNameInformationFinalComponent` CountedUtf16String
`A14__FileNameInformationExtension` CountedUtf16String
`A15__FileNameInformationStream` CountedUtf16String
`A16__FileNameInformationParentDir` CountedUtf16String

Event ID 211: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(7325) %!FUNC!:OPENED FORMAT for name in (!p!) Name: !S! Volume: !S! Final Component: !S! Extension: !S! Stream: !S! Parent Dir: !S!

Message #

[TL_%!LEVEL!] NameSup.c(7325) %!FUNC!:OPENED FORMAT for name in (%2!p!)   Name: %3!S!   Volume: %4!S!   Final Component: %5!S!   Extension: %6!S!   Stream: %7!S!   Parent Dir: %8!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer
`A11__FileNameInformationName` CountedUtf16String
`A12__FileNameInformationVolume` CountedUtf16String
`A13__FileNameInformationFinalComponent` CountedUtf16String
`A14__FileNameInformationExtension` CountedUtf16String
`A15__FileNameInformationStream` CountedUtf16String
`A16__FileNameInformationParentDir` CountedUtf16String

Event ID 212: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(7343) %!FUNC!:SHORT FORMAT for name in (!p!) Name: !S! Volume: !S! Final Component: !S! Extension: !S! Stream: !S! Parent Dir: !S!

Message #

[TL_%!LEVEL!] NameSup.c(7343) %!FUNC!:SHORT FORMAT for name in (%2!p!)   Name: %3!S!   Volume: %4!S!   Final Component: %5!S!   Extension: %6!S!   Stream: %7!S!   Parent Dir: %8!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer
`A11__FileNameInformationName` CountedUtf16String
`A12__FileNameInformationVolume` CountedUtf16String
`A13__FileNameInformationFinalComponent` CountedUtf16String
`A14__FileNameInformationExtension` CountedUtf16String
`A15__FileNameInformationStream` CountedUtf16String
`A16__FileNameInformationParentDir` CountedUtf16String

Event ID 213: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(7361) %!FUNC!:UNKNOWN FORMAT for name in (!p!).

Message #

[TL_%!LEVEL!] NameSup.c(7361) %!FUNC!:UNKNOWN FORMAT for name in (%2!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer

Event ID 214: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] PendingSup.c(626) %!FUNC!:Resumed Pending operation: !x!, Irpctrl=!p!, callbackNode=!p! (!S!).

Message #

[TL_%!LEVEL!] PendingSup.c(626) %!FUNC!:Resumed Pending operation: %2!x!, Irpctrl=%3!p!, callbackNode=%4!p! (%5!S!)

Fields #

Name	Description
`FUNC` AnsiString
`A10_CallbackDataIopbMajorFunction` HexInt32
`A11_iccIrpCtrl` Pointer
`A12_iccIrpCtrlPendingCallbackNode` Pointer
`A13_FlagOniccIrpCtrlFlagsIRPCTRFL_SYNCHRONIZESYNCNotSYNC` AnsiString

Event ID 215: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] queuesup.c(686) %!FUNC!:Posting --- Irp:!p! MajorFunction:!d!

Message #

[TL_%!LEVEL!] queuesup.c(686) %!FUNC!:Posting --- Irp:%2!p! MajorFunction:%3!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrlIrp` Pointer
`A11_irpCtrlDataIopbMajorFunction` Int32

Event ID 216: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] queuesup.c(712) %!FUNC!:Could not post -- Irp:!p! MajorFunction:!d!

Message #

[TL_%!LEVEL!] queuesup.c(712) %!FUNC!:Could not post -- Irp:%2!p! MajorFunction:%3!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrlIrp` Pointer
`A11_irpCtrlDataIopbMajorFunction` Int32

Event ID 217: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] queuesup.c(723) %!FUNC!:Processing inline -- Irp:!p! MajorFunction: !d!

Message #

[TL_%!LEVEL!] queuesup.c(723) %!FUNC!:Processing inline -- Irp:%2!p! MajorFunction: %3!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrlIrp` Pointer
`A11_irpCtrlDataIopbMajorFunction` Int32

Event ID 218: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] RegSup.c(451) %!FUNC!:Error !x! initializing verifier for filter: !S!

Message #

[TL_%!LEVEL!] RegSup.c(451) %!FUNC!:Error %2!x! initializing verifier for filter: %3!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32
`A11__filterName` CountedUtf16String

Event ID 219: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] RegSup.c(572) %:Filter "A10__filterName" registered at altitude A11__filterDefaultAltitude.

Message #

[TL_%!LEVEL!] RegSup.c(572) %!FUNC!:Filter "%2" registered at altitude %3!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10__filterName` CountedUtf16String
`A11__filterDefaultAltitude` CountedUtf16String

Event ID 220: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] RegSup.c(829) %:Filter "A10__FilterName" unregistering.

Message #

[TL_%!LEVEL!] RegSup.c(829) %!FUNC!:Filter "%2" unregistering

Fields #

Name	Description
`FUNC` AnsiString
`A10__FilterName` CountedUtf16String

Event ID 221: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(177) %!FUNC!:Starting (!p!).

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(177) %!FUNC!:Starting (%2!p!)

Fields #

Name	Description
`FUNC` AnsiString
`A10__localHead` Pointer

Event ID 222: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(205) %:For "A10__VolumeDeviceName".

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(205) %!FUNC!:For "%2"

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String

Event ID 223: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(256) %!FUNC!:FSDelete (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(256) %!FUNC!:FSDelete  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_streamList` Pointer
`A11_streamListFlags` HexInt32
`A12_streamListUseCount` Int32

Event ID 224: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(409) %!FUNC!:Found (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(409) %!FUNC!:Found     (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_streamList` Pointer
`A11_streamListFlags` HexInt32
`A12_streamListUseCount` Int32

Event ID 225: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(540) %!FUNC!:Created (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(540) %!FUNC!:Created   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_newStreamList` Pointer
`A11_newStreamListFlags` HexInt32
`A12_newStreamListUseCount` Int32

Event ID 226: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(572) %!FUNC!:Found New (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(572) %!FUNC!:Found New (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_streamList` Pointer
`A11_streamListFlags` HexInt32
`A12_streamListUseCount` Int32

Event ID 227: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(715) %!FUNC!:Allocate (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(715) %!FUNC!:Allocate  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_newStreamList` Pointer
`A11_newStreamListFlags` HexInt32
`A12_newStreamListUseCount` Int32

Event ID 228: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(754) %!FUNC!:Release (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(754) %!FUNC!:Release   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_StreamList` Pointer
`A11_StreamListFlags` HexInt32
`A12_StreamListUseCount` Int32

Event ID 229: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(807) %!FUNC!:DEFFERED (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(807) %!FUNC!:DEFFERED  (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_StreamList` Pointer
`A11_StreamListFlags` HexInt32
`A12_StreamListUseCount` Int32

Event ID 230: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(843) %!FUNC!:Cleanup (!p!) Fl=!03x! Use=!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(843) %!FUNC!:Cleanup   (%2!p!)              Fl=%3!03x! Use=%4!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_StreamList` Pointer
`A11_StreamListFlags` HexInt32
`A12_StreamListUseCount` Int32

Event ID 231: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] SyncSup.c(260) %!FUNC!:PointerRef: !p! (!d!) !S!

Message #

[TL_%!LEVEL!] SyncSup.c(260) %!FUNC!:PointerRef: %2!p! (%3!d!) %4!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltObject` Pointer
`A11_PFLT_OBJECTFltObjectPointerCount` Int32
`A12_reason` AnsiString

Event ID 232: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] SyncSup.c(302) %!FUNC!:PointerDeRef: !p! (!d!) !S!

Message #

[TL_%!LEVEL!] SyncSup.c(302) %!FUNC!:PointerDeRef: %2!p! (%3!d!) %4!S!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltObject` Pointer
`A11_PFLT_OBJECTFltObjectPointerCount` Int32
`A12_reason` AnsiString

Event ID 233: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] TargetedIoSup.c(1924) %!FUNC!:Wrong type of device object passed in: devobj !p!

Message #

[TL_%!LEVEL!] TargetedIoSup.c(1924) %!FUNC!:Wrong type of device object passed in: devobj %2!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_deviceObject` Pointer

Event ID 234: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] VolumeSup.c(225) %!FUNC!:The file system driver is an unknown file system type.

Message #

[TL_%!LEVEL!] VolumeSup.c(225) %!FUNC!:The file system driver %2 is an unknown file system type

Fields #

Name	Description
`FUNC` AnsiString
`A10_CDODriverName` CountedUtf16String

Event ID 235: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] VolumeSup.c(952) %!FUNC!:SetupNotify already called for volume (!p!) "!S!".

Message #

[TL_%!LEVEL!] VolumeSup.c(952) %!FUNC!:SetupNotify already called for volume (%2!p!) "%3!S!"

Fields #

Name	Description
`FUNC` AnsiString
`A10_Volume` Pointer
`A11__VolumeDeviceName` CountedUtf16String

Event ID 236: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] VolumeSup.c(2606) %!FUNC!:Cleared thread hiding in FltpClearHiddenOp...: T=!p! FO=!p! Vol=!p! IrpMaj=!d!

Message #

[TL_%!LEVEL!] VolumeSup.c(2606) %!FUNC!:Cleared thread hiding in FltpClearHiddenOp...: T=%2!p! FO=%3!p! Vol=%4!p! IrpMaj=%5!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_FileObject` Pointer
`A12_Volume` Pointer
`A13_IrpMajor` Int32

Event ID 237: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(193) %!FUNC!:Work=!p! QueType=!d! Count=!d! Limit=!d!, QUEUED.

Message #

[TL_%!LEVEL!] WorkSup.c(193) %!FUNC!:Work=%2!p! QueType=%3!d! Count=%4!d! Limit=%5!d!, QUEUED

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningCount` Int32
`A13_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningLimit` Int32

Event ID 238: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(214) %!FUNC!:Work=!p! QType=!d! Count=!d! Limit=!d!, THROTTLED.

Message #

[TL_%!LEVEL!] WorkSup.c(214) %!FUNC!:Work=%2!p! QType=%3!d! Count=%4!d! Limit=%5!d!, THROTTLED

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningCount` Int32
`A13_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningLimit` Int32

Event ID 239: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(290) %!FUNC!:Work=!p! QType=!d! Count=!d! Limit=!d!, UnTHROTTLED.

Message #

[TL_%!LEVEL!] WorkSup.c(290) %!FUNC!:Work=%2!p! QType=%3!d! Count=%4!d! Limit=%5!d!, UnTHROTTLED

Fields #

Name	Description
`FUNC` AnsiString
`A10_fltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningCount` Int32
`A13_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningLimit` Int32

Event ID 240: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(319) %!FUNC!:Work=!p! QType=!d! Count=!d! Limit=!d!, UnQUEUED.

Message #

[TL_%!LEVEL!] WorkSup.c(319) %!FUNC!:Work=%2!p! QType=%3!d! Count=%4!d! Limit=%5!d!, UnQUEUED

Fields #

Name	Description
`FUNC` AnsiString
`A10_NULL` Pointer
`A11_QueueType` Int32
`A12_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningCount` Int32
`A13_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningLimit` Int32

Event ID 241: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(457) %!FUNC!:Work=!p! QType=!d! FltObj=!p! Routine=!p! Context=!p! IoPriority=!d!

Message #

[TL_%!LEVEL!] WorkSup.c(457) %!FUNC!:Work=%2!p! QType=%3!d! FltObj=%4!p! Routine=%5!p! Context=%6!p! IoPriority=%7!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenericWorkItem` Pointer
`A11_qtype` Int32
`A12_fltObject` Pointer
`A13_GenericWorkItemGenericWorkerRoutine` Pointer
`A14_GenericWorkItemContext` Pointer
`A15_GenericWorkItemIoPriorityInfoIoPriority` Int32

Event ID 242: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(569) %!FUNC!:Work=!p! QType=!d! Instnc=!p! Routine=!p! Context=!p! IoPriority=!d!

Message #

[TL_%!LEVEL!] WorkSup.c(569) %!FUNC!:Work=%2!p! QType=%3!d! Instnc=%4!p! Routine=%5!p! Context=%6!p! IoPriority=%7!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeferredWorkItem` Pointer
`A11_qtype` Int32
`A12_instance` Pointer
`A13_DeferredWorkItemDeferredWorkerRoutine` Pointer
`A14_DeferredWorkItemContext` Pointer
`A15_DeferredWorkItemIoPriorityInfoIoPriority` Int32

Event ID 243: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(666) %!FUNC!:Work=!p! QType=!d! FltObj=!p! Routine=!p! Context=!p!

Message #

[TL_%!LEVEL!] WorkSup.c(666) %!FUNC!:Work=%2!p! QType=%3!d! FltObj=%4!p! Routine=%5!p! Context=%6!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWorkItem` Pointer
`A11_FltWorkItemQueueType` Int32
`A12_FltWorkItemFltObject` Pointer
`A13_FltWorkItemGenericWorkerRoutine` Pointer
`A14_FltWorkItemContext` Pointer

Event ID 244: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(714) %!FUNC!:Work=!p! QType=!d! Instnc=!p! Routine=!p! Context=!p!

Message #

[TL_%!LEVEL!] WorkSup.c(714) %!FUNC!:Work=%2!p! QType=%3!d! Instnc=%4!p! Routine=%5!p! Context=%6!p!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWorkItem` Pointer
`A11_FltWorkItemQueueType` Int32
`A12_FltWorkItemInstance` Pointer
`A13_FltWorkItemDeferredWorkerRoutine` Pointer
`A14_FltWorkItemContext` Pointer

Event ID 245: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(841) %!FUNC!:Work=!p! QType=!d! FltObj=!p! Routine=!p! Context=!p! IoPriority=!d!

Message #

[TL_%!LEVEL!] WorkSup.c(841) %!FUNC!:Work=%2!p! QType=%3!d! FltObj=%4!p! Routine=%5!p! Context=%6!p! IoPriority=%7!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWorkItem` Pointer
`A11_QueueType` Int32
`A12_FltObject` Pointer
`A13_WorkerRoutine` Pointer
`A14_Context` Pointer
`A15_FltWorkItemIoPriorityInfoIoPriority` Int32

Event ID 246: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a
Channel: Operational

Description

[TL_%!LEVEL!] WorkSup.c(1022) %!FUNC!:Work=!p! QType=!d! Instnc=!p! Routine=!p! Context=!p! IoPriority=!d!

Message #

[TL_%!LEVEL!] WorkSup.c(1022) %!FUNC!:Work=%2!p! QType=%3!d! Instnc=%4!p! Routine=%5!p! Context=%6!p! IoPriority=%7!d!

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWorkItem` Pointer
`A11_QueueType` Int32
`A12_FltWorkItemInstance` Pointer
`A13_WorkerRoutine` Pointer
`A14_Context` Pointer
`A15_FltWorkItemIoPriorityInfoIoPriority` Int32

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)