Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf

237 events across 1 channel

Event	Title	Channel	Sample
10	Event ID 10	Operational	N
11	Event ID 11	Operational	N
12	Event ID 12	Operational	N
13	Event ID 13	Operational	N
14	Event ID 14	Operational	N
15	Event ID 15	Operational	N
16	Event ID 16	Operational	N
17	Event ID 17	Operational	N
18	Event ID 18	Operational	N
19	Event ID 19	Operational	N
20	Event ID 20	Operational	N
21	Event ID 21	Operational	N
22	Event ID 22	Operational	N
23	Event ID 23	Operational	N
24	Event ID 24	Operational	N
25	Event ID 25	Operational	N
26	Event ID 26	Operational	N
27	Event ID 27	Operational	N
28	Event ID 28	Operational	N
29	Event ID 29	Operational	N
30	Event ID 30	Operational	N
31	Event ID 31	Operational	N
32	Event ID 32	Operational	N
33	Event ID 33	Operational	N
34	Event ID 34	Operational	N
35	Event ID 35	Operational	N
36	Event ID 36	Operational	N
37	Event ID 37	Operational	N
38	Event ID 38	Operational	N
39	Event ID 39	Operational	N
40	Event ID 40	Operational	N
41	Event ID 41	Operational	N
42	Event ID 42	Operational	N
43	Event ID 43	Operational	N
44	Event ID 44	Operational	N
45	Event ID 45	Operational	N
46	Event ID 46	Operational	N
47	Event ID 47	Operational	N
48	Event ID 48	Operational	N
49	Event ID 49	Operational	N
50	Event ID 50	Operational	N
51	Event ID 51	Operational	N
52	Event ID 52	Operational	N
53	Event ID 53	Operational	N
54	Event ID 54	Operational	N
55	Event ID 55	Operational	N
56	Event ID 56	Operational	N
57	Event ID 57	Operational	N
58	Event ID 58	Operational	N
59	Event ID 59	Operational	N
60	Event ID 60	Operational	N
61	Event ID 61	Operational	N
62	Event ID 62	Operational	N
63	Event ID 63	Operational	N
64	Event ID 64	Operational	N
65	Event ID 65	Operational	N
66	Event ID 66	Operational	N
67	Event ID 67	Operational	N
68	Event ID 68	Operational	N
69	Event ID 69	Operational	N
70	Event ID 70	Operational	N
71	Event ID 71	Operational	N
72	Event ID 72	Operational	N
73	Event ID 73	Operational	N
74	Event ID 74	Operational	N
75	Event ID 75	Operational	N
76	Event ID 76	Operational	N
77	Event ID 77	Operational	N
78	Event ID 78	Operational	N
79	Event ID 79	Operational	N
80	Event ID 80	Operational	N
81	Event ID 81	Operational	N
82	Event ID 82	Operational	N
83	Event ID 83	Operational	N
84	Event ID 84	Operational	N
85	Event ID 85	Operational	N
86	Event ID 86	Operational	N
87	Event ID 87	Operational	N
88	Event ID 88	Operational	N
89	Event ID 89	Operational	N
90	Event ID 90	Operational	N
91	Event ID 91	Operational	N
92	Event ID 92	Operational	N
93	Event ID 93	Operational	N
94	Event ID 94	Operational	N
95	Event ID 95	Operational	N
96	Event ID 96	Operational	N
97	Event ID 97	Operational	N
98	Event ID 98	Operational	N
99	Event ID 99	Operational	N
100	Event ID 100	Operational	N
101	Event ID 101	Operational	N
102	Event ID 102	Operational	N
103	Event ID 103	Operational	N
104	Event ID 104	Operational	N
105	Event ID 105	Operational	N
106	Event ID 106	Operational	N
107	Event ID 107	Operational	N
108	Event ID 108	Operational	N
109	Event ID 109	Operational	N
110	Event ID 110	Operational	N
111	Event ID 111	Operational	N
112	Event ID 112	Operational	N
113	Event ID 113	Operational	N
114	Event ID 114	Operational	N
115	Event ID 115	Operational	N
116	Event ID 116	Operational	N
117	Event ID 117	Operational	N
118	Event ID 118	Operational	N
119	Event ID 119	Operational	N
120	Event ID 120	Operational	N
121	Event ID 121	Operational	N
122	Event ID 122	Operational	N
123	Event ID 123	Operational	N
124	Event ID 124	Operational	N
125	Event ID 125	Operational	N
126	Event ID 126	Operational	N
127	Event ID 127	Operational	N
128	Event ID 128	Operational	N
129	Event ID 129	Operational	N
130	Event ID 130	Operational	N
131	Event ID 131	Operational	N
132	Event ID 132	Operational	N
133	Event ID 133	Operational	N
134	Event ID 134	Operational	N
135	Event ID 135	Operational	N
136	Event ID 136	Operational	N
137	Event ID 137	Operational	N
138	Event ID 138	Operational	N
139	Event ID 139	Operational	N
140	Event ID 140	Operational	N
141	Event ID 141	Operational	N
142	Event ID 142	Operational	N
143	Event ID 143	Operational	N
144	Event ID 144	Operational	N
145	Event ID 145	Operational	N
146	Event ID 146	Operational	N
147	Event ID 147	Operational	N
148	Event ID 148	Operational	N
149	Event ID 149	Operational	N
150	Event ID 150	Operational	N
151	Event ID 151	Operational	N
152	Event ID 152	Operational	N
153	Event ID 153	Operational	N
154	Event ID 154	Operational	N
155	Event ID 155	Operational	N
156	Event ID 156	Operational	N
157	Event ID 157	Operational	N
158	Event ID 158	Operational	N
159	Event ID 159	Operational	N
160	Event ID 160	Operational	N
161	Event ID 161	Operational	N
162	Event ID 162	Operational	N
163	Event ID 163	Operational	N
164	Event ID 164	Operational	N
165	Event ID 165	Operational	N
166	Event ID 166	Operational	N
167	Event ID 167	Operational	N
168	Event ID 168	Operational	N
169	Event ID 169	Operational	N
170	Event ID 170	Operational	N
171	Event ID 171	Operational	N
172	Event ID 172	Operational	N
173	Event ID 173	Operational	N
174	Event ID 174	Operational	N
175	Event ID 175	Operational	N
176	Event ID 176	Operational	N
177	Event ID 177	Operational	N
178	Event ID 178	Operational	N
179	Event ID 179	Operational	N
180	Event ID 180	Operational	N
181	Event ID 181	Operational	N
182	Event ID 182	Operational	N
183	Event ID 183	Operational	N
184	Event ID 184	Operational	N
185	Event ID 185	Operational	N
186	Event ID 186	Operational	N
187	Event ID 187	Operational	N
188	Event ID 188	Operational	N
189	Event ID 189	Operational	N
190	Event ID 190	Operational	N
191	Event ID 191	Operational	N
192	Event ID 192	Operational	N
193	Event ID 193	Operational	N
194	Event ID 194	Operational	N
195	Event ID 195	Operational	N
196	Event ID 196	Operational	N
197	Event ID 197	Operational	N
198	Event ID 198	Operational	N
199	Event ID 199	Operational	N
200	Event ID 200	Operational	N
201	Event ID 201	Operational	N
202	Event ID 202	Operational	N
203	Event ID 203	Operational	N
204	Event ID 204	Operational	N
205	Event ID 205	Operational	N
206	Event ID 206	Operational	N
207	Event ID 207	Operational	N
208	Event ID 208	Operational	N
209	Event ID 209	Operational	N
210	Event ID 210	Operational	N
211	Event ID 211	Operational	N
212	Event ID 212	Operational	N
213	Event ID 213	Operational	N
214	Event ID 214	Operational	N
215	Event ID 215	Operational	N
216	Event ID 216	Operational	N
217	Event ID 217	Operational	N
218	Event ID 218	Operational	N
219	Event ID 219	Operational	N
220	Event ID 220	Operational	N
221	Event ID 221	Operational	N
222	Event ID 222	Operational	N
223	Event ID 223	Operational	N
224	Event ID 224	Operational	N
225	Event ID 225	Operational	N
226	Event ID 226	Operational	N
227	Event ID 227	Operational	N
228	Event ID 228	Operational	N
229	Event ID 229	Operational	N
230	Event ID 230	Operational	N
231	Event ID 231	Operational	N
232	Event ID 232	Operational	N
233	Event ID 233	Operational	N
234	Event ID 234	Operational	N
235	Event ID 235	Operational	N
236	Event ID 236	Operational	N
237	Event ID 237	Operational	N
238	Event ID 238	Operational	N
239	Event ID 239	Operational	N
240	Event ID 240	Operational	N
241	Event ID 241	Operational	N
242	Event ID 242	Operational	N
243	Event ID 243	Operational	N
244	Event ID 244	Operational	N
245	Event ID 245	Operational	N
246	Event ID 246	Operational	N

Event ID 10

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_stackSize` Int32
`A11_oldStackSize` Int32

Event ID 11

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrlCompletionStackLength` Int32
`A11_newStackSize` Int32
`A12_IrpCtrl` Pointer

Event ID 12

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_newCNodeIrpCtrl` Pointer
`A11_newCNode` Pointer
`A12_newCNodeDataSnapshotMajorFunction` Int32

Event ID 13

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_newCNodeIrpCtrl` Pointer
`A11_newCNode` Pointer
`A12_newCNodeDataSnapshotMajorFunction` Int32

Event ID 14

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrl` Pointer
`A11_CHARnewCNodeDataSnapshotMajorFunction` Int32
`A12_CHARnewCNodeDataSnapshotMinorFunction` Int32

Event ID 15

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 16

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_OpType` Int32
`A11_irpCtrl` Pointer
`A12_FrameReserveIrpCtrlsStaticOwningThreadOpType` Pointer

Event ID 17

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_OpType` Int32
`A11_IrpCtrl` Pointer
`A12_FrameReserveIrpCtrlsStaticOwningThreadOpType` Pointer

Event ID 18

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_th` Pointer
`A12_FrameReserveIrpCtrlsEntriesiCount` Int32
`A13_i` Int32

Event ID 19

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_th` Pointer
`A12_FrameReserveIrpCtrlsEntriesiCount` Int32
`A13_i` Int32

Event ID 20

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrl` Pointer
`A11_IrpCtrlDataThread` Pointer
`A12_FrameReserveIrpCtrlsEntriesiCount` Int32
`A13_i` Int32

Event ID 21

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FsControlDeviceObject` Pointer
`A11_NULL` Pointer
`A12_ControlDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMEFsControlDeviceObjectDeviceType` AnsiString

Event ID 22

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 23

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 24

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 25

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_NewDeviceObject` Pointer
`A11_NULL` Pointer
`A12__cdoDevExtControlDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMENewDeviceObjectDeviceType` AnsiString

Event ID 26

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_NewDeviceObject` Pointer
`A11_volume` Pointer
`A12__volumeDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMENewDeviceObjectDeviceType` AnsiString
`A14_DeviceObjectToAttachTo` Pointer

Event ID 27

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer
`A11_NULL` Pointer
`A12__cdoDevExtControlDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMEDeviceObjectDeviceType` AnsiString
`A14_NotifyFlags` HexInt32

Event ID 28

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer
`A11_volume` Pointer
`A12__volumeDeviceName` CountedUtf16String
`A13_GET_DEVICE_TYPE_NAMEDeviceObjectDeviceType` AnsiString
`A14_NotifyFlags` HexInt32
`A15_devExtHeaderAttachedToDeviceObject` Pointer

Event ID 29

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String

Event ID 30

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String

Event ID 31

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_origBufferPtr` Pointer
`A11_origMdlAddressPtrorigMdlAddressPtrNULL` Pointer
`A12_newBufferPtr` Pointer
`A13_newMdlAddressPtrnewMdlAddressPtrNULL` Pointer

Event ID 32

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_CallbackNodeInstance` Pointer
`A13__CallbackNodeInstanceAltitude` CountedUtf16String
`A14_CallbackNodeInstanceFilter` Pointer
`A15__CallbackNodeInstanceFilterName` CountedUtf16String
`A16_IrpCtrlInitiatingInstance` Pointer
`A17_eventFileObject` Pointer
`A18_eventFsContext` Pointer
`A19_status` HexInt32
`A20_IrpCtrlTraceStatus` HexInt32

Event ID 33

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_CallbackNodeInstance` Pointer
`A13__CallbackNodeInstanceAltitude` CountedUtf16String
`A14_CallbackNodeInstanceFilter` Pointer
`A15__CallbackNodeInstanceFilterName` CountedUtf16String
`A16_IrpCtrlInitiatingInstance` Pointer
`A17_eventFileObject` Pointer
`A18_eventFsContext` Pointer
`A19_status` HexInt32
`A20_IrpCtrlTraceStatus` HexInt32

Event ID 34

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_CallbackNodeInstance` Pointer
`A13__CallbackNodeInstanceAltitude` CountedUtf16String
`A14_CallbackNodeInstanceFilter` Pointer
`A15__CallbackNodeInstanceFilterName` CountedUtf16String
`A16_IrpCtrlInitiatingInstance` Pointer
`A17_eventFileObject` Pointer
`A18_eventFsContext` Pointer
`A19_status` HexInt32

Event ID 35

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_CallbackNodeInstance` Pointer
`A13__CallbackNodeInstanceAltitude` CountedUtf16String
`A14_CallbackNodeInstanceFilter` Pointer
`A15__CallbackNodeInstanceFilterName` CountedUtf16String
`A16_IrpCtrlInitiatingInstance` Pointer
`A17_eventFileObject` Pointer
`A18_eventFsContext` Pointer
`A19_status` HexInt32

Event ID 36

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_IrpCtrlInitiatingInstance` Pointer
`A13_eventFileObject` Pointer
`A14_eventFsContext` Pointer
`A15_status` HexInt32

Event ID 37

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_eventIrpPtr` Pointer
`A11_eventMajorFunction` UInt32
`A12_IrpCtrlInitiatingInstance` Pointer
`A13_eventFileObject` Pointer
`A14_eventFsContext` Pointer
`A15_status` HexInt32

Event ID 38

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_irpCtrlFileObject` Pointer
`A12_volume` Pointer
`A13_CHARirpMajorId` Int32
`A14_FltGetIrpNameirpMajorId` AnsiString

Event ID 39

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpMajorId` HexInt32
`A11_irpCtrl` Pointer
`A12_callbackNode` Pointer
`A13_FlagOnirpCtrlFlagsIRPCTRFL_SYNCHRONIZESYNCNotSYNC` AnsiString

Event ID 40

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_TrackingCtrlPointerToFree` Pointer

Event ID 41

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CompNodeIrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 42

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CompNodeIrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 43

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 44

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString

Event ID 45

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString

Event ID 46

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 47

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 48

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CompNodeIrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 49

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 50

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString

Event ID 51

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString

Event ID 52

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 53

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 54

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CompNodeIrpCtrl` Pointer
`A11_CompNode` Pointer
`A12_CHARCompNodeDataSnapshotMajorFunction` Int32

Event ID 55

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 56

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARlocalIrpCtrlDataIopbMajorFunction` Int32
`A11_CHARlocalIrpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNamelocalIrpCtrlDataIopbMajorFunction` AnsiString
`A13_localCompNodeIrpCtrl` Pointer

Event ID 57

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_completionNodeIrpCtrl` Pointer
`A11_completionNode` Pointer
`A12_CHARcompletionNodeDataSnapshotMajorFunction` Int32

Event ID 58

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 59

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 60

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_completionNodeIrpCtrl` Pointer
`A11_completionNode` Pointer
`A12_CHARcompletionNodeDataSnapshotMajorFunction` Int32

Event ID 61

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CHARirpCtrlDataIopbMajorFunction` Int32
`A11_CHARirpCtrlDataIopbMinorFunction` Int32
`A12_FltGetIrpNameirpCtrlDataIopbMajorFunction` AnsiString
`A13_irpCtrl` Pointer

Event ID 62

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer

Event ID 63

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer

Event ID 64

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_ExceptionPointerExceptionRecordExceptionCode` HexInt32
`A11_ExceptionPointerContextRecord` Pointer
`A12_ExceptionPointerExceptionRecord` Pointer
`A13_ExceptionPointerExceptionRecordExceptionAddress` Pointer

Event ID 65

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 66

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 67

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 68

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 69

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 70

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 71

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 72

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 73

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 74

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 75

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 76

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 77

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 78

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 79

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 80

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 81

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__localHead` Pointer

Event ID 82

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String

Event ID 83

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_fileList` Pointer
`A11_fileListFlags` HexInt32
`A12_fileListUseCount` Int32

Event ID 84

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_fileList` Pointer
`A11_fileListFlags` HexInt32
`A12_fileListUseCount` Int32

Event ID 85

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_newFileList` Pointer
`A11_newFileListFlags` HexInt32
`A12_newFileListUseCount` Int32

Event ID 86

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_fileList` Pointer
`A11_fileListFlags` HexInt32
`A12_fileListUseCount` Int32

Event ID 87

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_newFileList` Pointer
`A11_newFileListFlags` HexInt32
`A12_newFileListUseCount` Int32

Event ID 88

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileList` Pointer
`A11_FileListFlags` HexInt32
`A12_FileListUseCount` Int32

Event ID 89

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileList` Pointer
`A11_FileListFlags` HexInt32
`A12_FileListUseCount` Int32

Event ID 90

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileList` Pointer
`A11_FileListFlags` HexInt32
`A12_FileListUseCount` Int32

Event ID 91

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 92

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 93

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltGlobalsNumProcessors` Int32

Event ID 94

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeQueryMaximumProcessorCountExALL_PROCESSOR_GROUPS` Int32

Event ID 95

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltGlobalsCacheLineSize` Int32
`A11_FltGlobalsCacheLineSize` HexInt32

Event ID 96

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 97

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 98

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 99

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 100

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 101

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 102

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 103

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 104

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_DriverObject` Pointer

Event ID 105

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_i` Int32

Event ID 106

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 107

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_i` Int32

Event ID 108

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 109

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FsActiveActivatingfilesystemDeactivatingfilesystem` AnsiString
`A11_FsControlDeviceObject` Pointer
`A12_NULL` Pointer
`A13__controlDeviceNameCtrlName` CountedUtf16String
`A14_GET_DEVICE_TYPE_NAMEFsControlDeviceObjectDeviceType` AnsiString

Event ID 110

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltGetIrpNameirpSpMajorFunction` AnsiString
`A11_irpSpMajorFunction` Int32

Event ID 111

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpSpFileObject` Pointer
`A11__irpSpFileObjectFileName` CountedUtf16String

Event ID 112

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrlIrp` Pointer
`A11_IrpCtrlDataIopbMajorFunction` Int32

Event ID 113

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Irp` Pointer

Event ID 114

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpSpMajorFunction` HexInt32

Event ID 115

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_fileObject` Pointer
`A12_iccVolume` Pointer
`A13_fileObjectFileName` CountedUtf16String

Event ID 116

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 117

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_fileObject` Pointer
`A11__fileObjectFileName` CountedUtf16String

Event ID 118

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_IrpCtrlFileObject` Pointer
`A12_volume` Pointer
`A13_IrpCtrlDataIoStatusStatus` HexInt32

Event ID 119

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_IrpCtrlFileObject` Pointer
`A12_volume` Pointer
`A13_IrpCtrlDataIoStatusStatus` HexInt32

Event ID 120

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 121

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_newDeviceObject` Pointer
`A11_volume` Pointer
`A12__volumeDeviceName` CountedUtf16String
`A13_status` HexInt32
`A14_FltpGetFsDeviceObjectAfterMountdiskDeviceObject` Pointer
`A15_FsControlDeviceObject` Pointer

Event ID 122

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer
`A11__devExtControlDeviceName` CountedUtf16String

Event ID 123

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeviceObject` Pointer
`A11_NULL` Pointer
`A12__devExtControlDeviceName` CountedUtf16String
`A13_IrpIoStatusStatus` HexInt32

Event ID 124

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 125

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Context` Pointer
`A11_regWatchContextNotificationStatus` HexInt32

Event ID 126

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_regWatchContext` Pointer
`A11_regWatchContextNotificationStatus` HexInt32

Event ID 127

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 128

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32
`A11__tempString` CountedUtf16String

Event ID 129

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32
`A11__tempString` CountedUtf16String

Event ID 130

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_frameFrameID` Int32
`A11__frameAltitudeIntervalLow` CountedUtf16String
`A12__frameAltitudeIntervalHigh` CountedUtf16String

Event ID 131

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 132

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 133

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_ctxFlags` Pointer
`A11_FltGlobalsManualAttachDelayCounter` Int32
`A12_FltGlobalsManualDeviceAttachLimit` Int32

Event ID 134

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_ctxFlags` Pointer
`A11_FltGlobalsManualAttachDelayCounter` Int32
`A12_FltGlobalsManualDeviceAttachLimit` Int32

Event ID 135

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_TopFrameFrameID` Int32
`A11__TopFrameAltitudeIntervalLow` CountedUtf16String
`A12__TopFrameAltitudeIntervalHigh` CountedUtf16String
`A13__TopFrameAltitudeIntervalLow` CountedUtf16String
`A14_legacyAltitude` CountedUtf16String

Event ID 136

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__DriverObjDriverExtensionServiceKeyName` CountedUtf16String
`A11_PCWCHARvalueInfoData` UnicodeString

Event ID 137

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Filter` Pointer
`A11__FilterName` CountedUtf16String
`A12_instance` Pointer
`A13_Volume` Pointer
`A14__VolumeDeviceName` CountedUtf16String

Event ID 138

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Filter` Pointer
`A11__FilterName` CountedUtf16String
`A12_instance` Pointer
`A13_Volume` Pointer
`A14__VolumeDeviceName` CountedUtf16String

Event ID 139

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_InstanceFilter` Pointer
`A11__InstanceFilterName` CountedUtf16String
`A12__InstanceAltitude` CountedUtf16String
`A13_Volume` Pointer
`A14__VolumeDeviceName` CountedUtf16String

Event ID 140

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_currentInstance` Pointer
`A11_currentInstanceFilter` Pointer
`A12__currentInstanceFilterName` CountedUtf16String
`A13__InstanceAltitude` CountedUtf16String

Event ID 141

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_filter` Pointer
`A11__filterName` CountedUtf16String
`A12_Instance` Pointer
`A13_volume` Pointer
`A14__volumeDeviceName` CountedUtf16String
`A15_Reason` HexInt32

Event ID 142

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Buffer` Pointer
`A11_fileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 143

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Buffer` Pointer
`A11_fileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 144

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 145

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Buffer` Pointer
`A11_fileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 146

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Buffer` Pointer
`A11_fileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 147

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 148

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 149

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 150

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 151

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 152

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_MdlChain` Pointer

Event ID 153

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 154

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffsetQuadPart` HexInt64
`A12_Length` HexInt32

Event ID 155

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 156

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_MdlChain` Pointer
`A11_FileOffsetQuadPart` HexInt64

Event ID 157

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 158

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 159

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 160

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 161

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 162

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 163

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 164

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irp` Pointer

Event ID 165

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irp` Pointer

Event ID 166

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__replyWaiter` Pointer

Event ID 167

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 168

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 169

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_currentWaiter` Pointer

Event ID 170

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 171

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_ULONGreplyMessageId` HexInt32

Event ID 172

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Irp` Pointer

Event ID 173

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irp` Pointer

Event ID 174

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Queue` Pointer

Event ID 175

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_currentLink` Pointer

Event ID 176

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 177

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 178

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 179

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 180

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 181

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 182

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Irp` Pointer

Event ID 183

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Irp` Pointer

Event ID 184

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 185

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_nameCacheNodeTreeLinkFlagsflagToClear` HexInt32
`A12_nameCacheNodeUseCount` Int32
`A13__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 186

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_FlagOnnameCacheNodeTreeLinkFlags0x0ffff` HexInt32
`A12__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 187

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenCtxFileObject` Pointer

Event ID 188

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenCtxFileObject` Pointer

Event ID 189

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenCtxFileObject` Pointer

Event ID 190

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 191

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 192

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 193

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_foundNameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_foundNameCacheNodeTreeLinkFlags` HexInt32
`A13_foundNameCacheNodeUseCount` Int32
`A14__foundNameCacheNodeNameInfoName` CountedUtf16String

Event ID 194

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_nameCacheNode` Pointer
`A11_GenCtxFileObject` Pointer
`A12_nameCacheNodeTreeLinkFlags` HexInt32
`A13_nameCacheNodeUseCount` Int32
`A14__nameCacheNodeNameInfoName` CountedUtf16String

Event ID 195

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrlNULLIrpCtrlDataIopbMajorFunction0xff` HexInt32
`A11_IrpCtrlNULLIrpCtrlDataIopbMinorFunction0xff` HexInt32
`A12__VolumeDeviceName` CountedUtf16String
`A13__FileObjectFileName` CountedUtf16String
`A14_FileObject` Pointer

Event ID 196

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_IrpCtrlNULLIrpCtrlDataIopbMajorFunction0xff` HexInt32
`A11_IrpCtrlNULLIrpCtrlDataIopbMinorFunction0xff` HexInt32
`A12__VolumeDeviceName` CountedUtf16String
`A13__FileObjectFileName` CountedUtf16String
`A14_FileObject` Pointer

Event ID 197

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer
`A11_nameCacheNodeUseCount` Int32

Event ID 198

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer

Event ID 199

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 200

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString

Event ID 201

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__GenCtxShortFileName` CountedUtf16String
`A11__localGenCtxFileNameInformationName` CountedUtf16String

Event ID 202

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String
`A11__FileObjectFileName` CountedUtf16String
`A12_FileObject` Pointer

Event ID 203

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32

Event ID 204

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_NameCtrl` Pointer
`A11_NameCtrlNameGenerationFlags` HexInt32
`A12_NameCtrlError` HexInt32
`A13_NameCtrlShareNameLength` HexInt32
`A14_NameCtrlStreamNameLength` HexInt32
`A15__NameCtrlName` CountedUtf16String
`A16__NameCtrlCurrentShortName` CountedUtf16String

Event ID 205

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_NameCtrl` Pointer
`A11_NameCtrlBufferSize` HexInt32
`A12_NewSize` HexInt32
`A13__NameCtrlName` CountedUtf16String
`A14_NameCtrlFlags` HexInt32
`A15_FlagsToSet` HexInt32

Event ID 206

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_GET_NAME_SUPPORT_VOLUME_DEVICE_NAMEGenCtx` CountedUtf16String
`A11_GenCtxFileObjectFileNameBuffer0` HexInt32
`A12_GenCtxFileObjectFileNameBuffer1` HexInt32
`A13_GenCtxFileObjectFileNameBuffer2` HexInt32
`A14_GenCtxFileObjectFileNameBuffer3` HexInt32

Event ID 207

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__GenCtxShortFileName` CountedUtf16String
`A11__GenCtxExpandedFileName` CountedUtf16String

Event ID 208

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__GenCtxNameCtrlName` CountedUtf16String

Event ID 209

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenCtxFileObject` Pointer

Event ID 210

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer
`A11__FileNameInformationName` CountedUtf16String
`A12__FileNameInformationVolume` CountedUtf16String
`A13__FileNameInformationFinalComponent` CountedUtf16String
`A14__FileNameInformationExtension` CountedUtf16String
`A15__FileNameInformationStream` CountedUtf16String
`A16__FileNameInformationParentDir` CountedUtf16String

Event ID 211

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer
`A11__FileNameInformationName` CountedUtf16String
`A12__FileNameInformationVolume` CountedUtf16String
`A13__FileNameInformationFinalComponent` CountedUtf16String
`A14__FileNameInformationExtension` CountedUtf16String
`A15__FileNameInformationStream` CountedUtf16String
`A16__FileNameInformationParentDir` CountedUtf16String

Event ID 212

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer
`A11__FileNameInformationName` CountedUtf16String
`A12__FileNameInformationVolume` CountedUtf16String
`A13__FileNameInformationFinalComponent` CountedUtf16String
`A14__FileNameInformationExtension` CountedUtf16String
`A15__FileNameInformationStream` CountedUtf16String
`A16__FileNameInformationParentDir` CountedUtf16String

Event ID 213

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FileNameInformation` Pointer

Event ID 214

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CallbackDataIopbMajorFunction` HexInt32
`A11_iccIrpCtrl` Pointer
`A12_iccIrpCtrlPendingCallbackNode` Pointer
`A13_FlagOniccIrpCtrlFlagsIRPCTRFL_SYNCHRONIZESYNCNotSYNC` AnsiString

Event ID 215

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrlIrp` Pointer
`A11_irpCtrlDataIopbMajorFunction` Int32

Event ID 216

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrlIrp` Pointer
`A11_irpCtrlDataIopbMajorFunction` Int32

Event ID 217

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_irpCtrlIrp` Pointer
`A11_irpCtrlDataIopbMajorFunction` Int32

Event ID 218

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_status` HexInt32
`A11__filterName` CountedUtf16String

Event ID 219

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__filterName` CountedUtf16String
`A11__filterDefaultAltitude` CountedUtf16String

Event ID 220

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__FilterName` CountedUtf16String

Event ID 221

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__localHead` Pointer

Event ID 222

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10__VolumeDeviceName` CountedUtf16String

Event ID 223

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_streamList` Pointer
`A11_streamListFlags` HexInt32
`A12_streamListUseCount` Int32

Event ID 224

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_streamList` Pointer
`A11_streamListFlags` HexInt32
`A12_streamListUseCount` Int32

Event ID 225

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_newStreamList` Pointer
`A11_newStreamListFlags` HexInt32
`A12_newStreamListUseCount` Int32

Event ID 226

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_streamList` Pointer
`A11_streamListFlags` HexInt32
`A12_streamListUseCount` Int32

Event ID 227

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_newStreamList` Pointer
`A11_newStreamListFlags` HexInt32
`A12_newStreamListUseCount` Int32

Event ID 228

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_StreamList` Pointer
`A11_StreamListFlags` HexInt32
`A12_StreamListUseCount` Int32

Event ID 229

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_StreamList` Pointer
`A11_StreamListFlags` HexInt32
`A12_StreamListUseCount` Int32

Event ID 230

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_StreamList` Pointer
`A11_StreamListFlags` HexInt32
`A12_StreamListUseCount` Int32

Event ID 231

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltObject` Pointer
`A11_PFLT_OBJECTFltObjectPointerCount` Int32
`A12_reason` AnsiString

Event ID 232

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltObject` Pointer
`A11_PFLT_OBJECTFltObjectPointerCount` Int32
`A12_reason` AnsiString

Event ID 233

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_deviceObject` Pointer

Event ID 234

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_CDODriverName` CountedUtf16String

Event ID 235

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_Volume` Pointer
`A11__VolumeDeviceName` CountedUtf16String

Event ID 236

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_KeGetCurrentThread` Pointer
`A11_FileObject` Pointer
`A12_Volume` Pointer
`A13_IrpMajor` Int32

Event ID 237

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningCount` Int32
`A13_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningLimit` Int32

Event ID 238

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningCount` Int32
`A13_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningLimit` Int32

Event ID 239

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_fltWork` Pointer
`A11_QueueType` Int32
`A12_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningCount` Int32
`A13_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningLimit` Int32

Event ID 240

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_NULL` Pointer
`A11_QueueType` Int32
`A12_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningCount` Int32
`A13_FltGlobalsThrottledWorkCtrlQueuesQueueTypeRunningLimit` Int32

Event ID 241

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_GenericWorkItem` Pointer
`A11_qtype` Int32
`A12_fltObject` Pointer
`A13_GenericWorkItemGenericWorkerRoutine` Pointer
`A14_GenericWorkItemContext` Pointer
`A15_GenericWorkItemIoPriorityInfoIoPriority` Int32

Event ID 242

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_DeferredWorkItem` Pointer
`A11_qtype` Int32
`A12_instance` Pointer
`A13_DeferredWorkItemDeferredWorkerRoutine` Pointer
`A14_DeferredWorkItemContext` Pointer
`A15_DeferredWorkItemIoPriorityInfoIoPriority` Int32

Event ID 243

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWorkItem` Pointer
`A11_FltWorkItemQueueType` Int32
`A12_FltWorkItemFltObject` Pointer
`A13_FltWorkItemGenericWorkerRoutine` Pointer
`A14_FltWorkItemContext` Pointer

Event ID 244

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWorkItem` Pointer
`A11_FltWorkItemQueueType` Int32
`A12_FltWorkItemInstance` Pointer
`A13_FltWorkItemDeferredWorkerRoutine` Pointer
`A14_FltWorkItemContext` Pointer

Event ID 245

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWorkItem` Pointer
`A11_QueueType` Int32
`A12_FltObject` Pointer
`A13_WorkerRoutine` Pointer
`A14_Context` Pointer
`A15_FltWorkItemIoPriorityInfoIoPriority` Int32

Event ID 246

Provider: Microsoft-Windows-FltMgrTrace_ea03a1fb6ae035732e424f45e3f31acf
Channel: Operational

Fields #

Name	Description
`FUNC` AnsiString
`A10_FltWorkItem` Pointer
`A11_QueueType` Int32
`A12_FltWorkItemInstance` Pointer
`A13_WorkerRoutine` Pointer
`A14_Context` Pointer
`A15_FltWorkItemIoPriorityInfoIoPriority` Int32

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)