Microsoft-Windows-FltMgrTrace

175 events across 1 channel

Event	Title	Channel	Sample
10	[TL_%!	Operational	N
11	[TL_%!	Operational	N
12	[TL_%!	Operational	N
13	[TL_%!	Operational	N
14	[TL_%!	Operational	N
15	[TL_%!	Operational	N
16	[TL_%!	Operational	N
17	[TL_%!	Operational	N
18	[TL_%!	Operational	N
19	[TL_%!	Operational	N
20	[TL_%!	Operational	N
22	[TL_%!	Operational	N
23	[TL_%!	Operational	N
24	[TL_%!	Operational	N
31	[TL_%!	Operational	N
36	[TL_%!	Operational	N
37	[TL_%!	Operational	N
38	[TL_%!	Operational	N
39	[TL_%!	Operational	N
40	[TL_%!	Operational	N
41	[TL_%!	Operational	N
42	[TL_%!	Operational	N
43	[TL_%!	Operational	N
44	[TL_%!	Operational	N
45	[TL_%!	Operational	N
46	[TL_%!	Operational	N
47	[TL_%!	Operational	N
48	[TL_%!	Operational	N
49	[TL_%!	Operational	N
50	[TL_%!	Operational	N
51	[TL_%!	Operational	N
52	[TL_%!	Operational	N
53	[TL_%!	Operational	N
54	[TL_%!	Operational	N
55	[TL_%!	Operational	N
56	[TL_%!	Operational	N
57	[TL_%!	Operational	N
58	[TL_%!	Operational	N
59	[TL_%!	Operational	N
60	[TL_%!	Operational	N
61	[TL_%!	Operational	N
62	[TL_%!	Operational	N
63	[TL_%!	Operational	N
64	[TL_%!	Operational	N
65	[TL_%!	Operational	N
66	[TL_%!	Operational	N
67	[TL_%!	Operational	N
68	[TL_%!	Operational	N
69	[TL_%!	Operational	N
70	[TL_%!	Operational	N
71	[TL_%!	Operational	N
72	[TL_%!	Operational	N
73	[TL_%!	Operational	N
74	[TL_%!	Operational	N
76	[TL_%!	Operational	N
77	[TL_%!	Operational	N
78	[TL_%!	Operational	N
79	[TL_%!	Operational	N
80	[TL_%!	Operational	N
81	[TL_%!	Operational	N
82	[TL_%!	Operational	N
83	[TL_%!	Operational	N
84	[TL_%!	Operational	N
85	[TL_%!	Operational	N
86	[TL_%!	Operational	N
87	[TL_%!	Operational	N
88	[TL_%!	Operational	N
89	[TL_%!	Operational	N
90	[TL_%!	Operational	N
91	[TL_%!	Operational	N
92	[TL_%!	Operational	N
93	[TL_%!	Operational	N
94	[TL_%!	Operational	N
95	[TL_%!	Operational	N
96	[TL_%!	Operational	N
97	[TL_%!	Operational	N
98	[TL_%!	Operational	N
99	[TL_%!	Operational	N
100	[TL_%!	Operational	N
101	[TL_%!	Operational	N
103	[TL_%!	Operational	N
105	[TL_%!	Operational	N
106	[TL_%!	Operational	N
107	[TL_%!	Operational	N
109	[TL_%!	Operational	N
111	[TL_%!	Operational	N
112	[TL_%!	Operational	N
113	[TL_%!	Operational	N
117	[TL_%!	Operational	N
118	[TL_%!	Operational	N
119	[TL_%!	Operational	N
120	[TL_%!	Operational	N
124	[TL_%!	Operational	N
125	[TL_%!	Operational	N
126	[TL_%!	Operational	N
127	[TL_%!	Operational	N
135	[TL_%!	Operational	N
136	[TL_%!	Operational	N
137	[TL_%!	Operational	N
138	[TL_%!	Operational	N
139	[TL_%!	Operational	N
140	[TL_%!	Operational	N
141	[TL_%!	Operational	N
142	[TL_%!	Operational	N
143	[TL_%!	Operational	N
144	[TL_%!	Operational	N
145	[TL_%!	Operational	N
146	[TL_%!	Operational	N
147	[TL_%!	Operational	N
148	[TL_%!	Operational	N
149	[TL_%!	Operational	N
150	[TL_%!	Operational	N
151	[TL_%!	Operational	N
152	[TL_%!	Operational	N
153	[TL_%!	Operational	N
154	[TL_%!	Operational	N
155	[TL_%!	Operational	N
156	[TL_%!	Operational	N
157	[TL_%!	Operational	N
158	[TL_%!	Operational	N
159	[TL_%!	Operational	N
160	[TL_%!	Operational	N
161	[TL_%!	Operational	N
162	[TL_%!	Operational	N
163	[TL_%!	Operational	N
164	[TL_%!	Operational	N
165	[TL_%!	Operational	N
166	[TL_%!	Operational	N
167	[TL_%!	Operational	N
168	[TL_%!	Operational	N
169	[TL_%!	Operational	N
170	[TL_%!	Operational	N
171	[TL_%!	Operational	N
172	[TL_%!	Operational	N
173	[TL_%!	Operational	N
174	[TL_%!	Operational	N
175	[TL_%!	Operational	N
176	[TL_%!	Operational	N
180	[TL_%!	Operational	N
181	[TL_%!	Operational	N
182	[TL_%!	Operational	N
190	[TL_%!	Operational	N
191	[TL_%!	Operational	N
192	[TL_%!	Operational	N
193	[TL_%!	Operational	N
196	[TL_%!	Operational	N
202	[TL_%!	Operational	N
206	[TL_%!	Operational	N
207	[TL_%!	Operational	N
208	[TL_%!	Operational	N
209	[TL_%!	Operational	N
210	[TL_%!	Operational	N
214	[TL_%!	Operational	N
216	[TL_%!	Operational	N
217	[TL_%!	Operational	N
218	[TL_%!	Operational	N
219	[TL_%!	Operational	N
220	[TL_%!	Operational	N
221	[TL_%!	Operational	N
222	[TL_%!	Operational	N
223	[TL_%!	Operational	N
224	[TL_%!	Operational	N
225	[TL_%!	Operational	N
226	[TL_%!	Operational	N
229	[TL_%!	Operational	N
230	[TL_%!	Operational	N
231	[TL_%!	Operational	N
232	[TL_%!	Operational	N
233	[TL_%!	Operational	N
234	[TL_%!	Operational	N
235	[TL_%!	Operational	N
236	[TL_%!	Operational	N
237	[TL_%!	Operational	N
238	[TL_%!	Operational	N
239	[TL_%!	Operational	N

Event ID 10: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(342) %!FUNC!:Forcing small completion stack size of {A10_stackSize}!d! instead of {A11_oldStackSize}!d!

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(342) %!FUNC!:Forcing small completion stack size of {A10_stackSize}!d! instead of {A11_oldStackSize}!d!

Fields #

Name	Description
`A10_stackSize`
`A11_oldStackSize`

Event ID 11: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1362) %!FUNC!:Extending completion stack from {A10_IrpCtrl->CompletionStackLength}!d! to {A11_newStackSize}!d! (irpCtrl={A12_IrpCtrl}!p!).

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1362) %!FUNC!:Extending completion stack from {A10_IrpCtrl->CompletionStackLength}!d! to {A11_newStackSize}!d! (irpCtrl={A12_IrpCtrl}!p!)

Fields #

Name	Description
`A11_newStackSize`
`A12_IrpCtrl`

Event ID 12: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1445) %!FUNC!:CN Insert Active (extend) IrpCtrl={A10_newCNode->IrpCtrl}!p! CompNode={A11_newCNode}!p!; [{A12_newCNode->DataSnapshot.MajorFunction}!d!].

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1445) %!FUNC!:CN Insert Active (extend) IrpCtrl={A10_newCNode->IrpCtrl}!p! CompNode={A11_newCNode}!p!; [{A12_newCNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A11_newCNode`

Event ID 13: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1460) %!FUNC!:CN Insert Waiting (extend) IrpCtrl={A10_newCNode->IrpCtrl}!p! CompNode={A11_newCNode}!p!; [{A12_newCNode->DataSnapshot.MajorFunction}!d!].

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1460) %!FUNC!:CN Insert Waiting (extend)  IrpCtrl={A10_newCNode->IrpCtrl}!p! CompNode={A11_newCNode}!p!; [{A12_newCNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A11_newCNode`

Event ID 14: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1486) %!FUNC!:While extending; hit non-tracked completion node; IrpCtrl={A10_IrpCtrl}!p! [{A11_(CHAR)newCNode->DataSnapshot.MajorFunction}!d!;{A12_(CHAR)newCNode->DataSnapshot.MinorFunction}!d!]

Fields #

Name	Description
`A10_IrpCtrl`

Event ID 15: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1508) %!FUNC!:Extending an already extended stack.

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1508) %!FUNC!:Extending an already extended stack

Event ID 16: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1834) %!FUNC!:Allocated type {A10_OpType}!d! IrpCtrl ({A11_irpCtrl}!p!) for thread ({A12_Frame->ReserveIrpCtrls.StaticOwningThread[OpType]}!p!).

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1834) %!FUNC!:Allocated type {A10_OpType}!d! IrpCtrl ({A11_irpCtrl}!p!) for thread ({A12_Frame->ReserveIrpCtrls.StaticOwningThread[OpType]}!p!)

Fields #

Name	Description
`A10_OpType`
`A11_irpCtrl`

Event ID 17: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1893) %!FUNC!:Freeing type {A10_OpType}!d! IrpCtrl ({A11_IrpCtrl}!p!) for thread ({A12_Frame->ReserveIrpCtrls.StaticOwningThread[OpType]}!p!).

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(1893) %!FUNC!:Freeing type {A10_OpType}!d! IrpCtrl ({A11_IrpCtrl}!p!) for thread ({A12_Frame->ReserveIrpCtrls.StaticOwningThread[OpType]}!p!)

Fields #

Name	Description
`A10_OpType`
`A11_IrpCtrl`

Event ID 18: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2037) %!FUNC!:Allocated BackPocket IrpCtrl-1: ({A10_irpCtrl}!p!) for thread ({A11_th}!p!); count={A12_Frame->ReserveIrpCtrls.Entries[i].Count}!d! index={A13_i}!d!

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2037) %!FUNC!:Allocated BackPocket IrpCtrl-1: ({A10_irpCtrl}!p!) for thread ({A11_th}!p!); count={A12_Frame->ReserveIrpCtrls.Entries[i].Count}!d! index={A13_i}!d!

Fields #

Name	Description
`A10_irpCtrl`
`A11_th`
`A13_i`

Event ID 19: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2109) %!FUNC!:Allocated BackPocket IrpCtrl-2: ({A10_irpCtrl}!p!) for thread ({A11_th}!p!); count={A12_Frame->ReserveIrpCtrls.Entries[i].Count}!d! index={A13_i}!d!

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2109) %!FUNC!:Allocated BackPocket IrpCtrl-2: ({A10_irpCtrl}!p!) for thread ({A11_th}!p!); count={A12_Frame->ReserveIrpCtrls.Entries[i].Count}!d! index={A13_i}!d!

Fields #

Name	Description
`A10_irpCtrl`
`A11_th`
`A13_i`

Event ID 20: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] AllocateIrpCtrlSup.c(2206) %!FUNC!:Freeing BackPocket IrpCtrl ({A10_IrpCtrl}!p!) for thread ({A11_IrpCtrl->Data.Thread}!p!); count={A12_Frame->ReserveIrpCtrls.Entries[i].Count}!d! index={A13_i}!d!

Fields #

Name	Description
`A10_IrpCtrl`
`A13_i`

Event ID 22: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(1818) %!FUNC!:Error creating control device object; status={A10_status}.

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1818) %!FUNC!:Error creating control device object; status={A10_status}

Fields #

Name	Description
`A10_status`

Event ID 23: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(1956) %!FUNC!:Error creating volume device object; status={A10_status}.

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1956) %!FUNC!:Error creating volume device object; status={A10_status}

Fields #

Name	Description
`A10_status`

Event ID 24: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] AttachDetachSup.c(1992) %!FUNC!:Error initializing Volume structure; status={A10_status}.

Message #

[TL_%!LEVEL!] AttachDetachSup.c(1992) %!FUNC!:Error initializing Volume structure; status={A10_status}

Fields #

Name	Description
`A10_status`

Event ID 31: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(377) %!FUNC!:Buffer Swap Detected:      oldB={A10_*origBufferPtr}!p! oldMdl={A11_origMdlAddressPtr ? *origMdlAddressPtr : NULL}!p! newB={A12_*newBufferPtr}!p! newMdl={A13_newMdlAddressPtr ? *newMdlAddressPtr : NULL}!p!

Event ID 36: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(841) %!FUNC!:File System returned an error: Irp {A10_event.IrpPtr}!p!; MajorFunction {A11_event.MajorFunction}!S!; InitiatingInstance {A12_IrpCtrl->InitiatingInstance}!p!; FileObject {A13_event.FileObject}!p!; FsContext {A14_event.FsContext}!p!; Status {A15_status}!S!

Fields #

Name	Description
`A15_status`

Event ID 37: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(860) %!FUNC!:File System returned an error: Irp {A10_event.IrpPtr}!p!; MajorFunction {A11_event.MajorFunction}!S!; InitiatingInstance {A12_IrpCtrl->InitiatingInstance}!p!; FileObject {A13_event.FileObject}!p!; FsContext {A14_event.FsContext}!p!; Status {A15_status}!S!

Fields #

Name	Description
`A15_status`

Event ID 38: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(1262) %!FUNC!:Hiding operation in FltpPerformPreCallbacks:  T={A10_KeGetCurrentThread()}!p! FO={A11_irpCtrl->FileObject}!p! Vol={A12_volume}!p! Major={A13_(CHAR)irpMajorId}!d! ({A14_FltGetIrpName(irpMajorId)}!S!)

Fields #

Name	Description
`A12_volume`

Event ID 39: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CallbackSup.c(1884) %!FUNC!:Pending operation:         {A10_irpMajorId}!x!; Irpctrl={A11_irpCtrl}!p!; callbackNode={A12_callbackNode}!p! ({A13_FlagOn(irpCtrlFlags;IRPCTRFL_SYNCHRONIZE) ? 'SYNC' : 'NotSYNC'}!S!)

Fields #

Name	Description
`A10_irpMajorId`
`A11_irpCtrl`
`A12_callbackNode`

Event ID 40: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(335) %!FUNC!:Freeing completion node tracking structure {A10_TrackingCtrl->PointerToFree}!p!

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(335) %!FUNC!:Freeing completion node tracking structure {A10_TrackingCtrl->PointerToFree}!p!

Event ID 41: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(401) %!FUNC!:CN Not Tracking IrpCtrl={A10_CompNode->IrpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(401) %!FUNC!:CN Not Tracking   IrpCtrl={A10_CompNode->IrpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A11_CompNode`

Event ID 42: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(440) %!FUNC!:CN Insert Active IrpCtrl={A10_CompNode->IrpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(440) %!FUNC!:CN Insert Active  IrpCtrl={A10_CompNode->IrpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A11_CompNode`

Event ID 43: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(480) %!FUNC!:CN Insert Waiting IrpCtrl={A10_irpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(480) %!FUNC!:CN Insert Waiting IrpCtrl={A10_irpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A10_irpCtrl`
`A11_CompNode`

Event ID 44: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(506) %!FUNC!:Linking; swapped buffers; canceling IRP {A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction}!d!;{A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction}!d! ({A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)}!S!)

Event ID 45: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(514) %!FUNC!:Linking; swapped buffers; wait for non-IRP operation {A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction}!d!;{A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction}!d! ({A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)}!S!)

Event ID 46: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(548) %!FUNC!:CN Insert Waiting (non-drainable) IrpCtrl={A10_irpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(548) %!FUNC!:CN Insert Waiting (non-drainable) IrpCtrl={A10_irpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A10_irpCtrl`
`A11_CompNode`

Event ID 47: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(559) %!FUNC!:Linking; wait for non-drainable operation {A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction}!d!;{A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction}!d! ({A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)}!S!) IrpCtrl={A13_irpCtrl}!p!

Fields #

Name	Description
`A13_irpCtrl`

Event ID 48: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(596) %!FUNC!:CN Delete IrpCtrl={A10_CompNode->IrpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!].

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(596) %!FUNC!:CN Delete         IrpCtrl={A10_CompNode->IrpCtrl}!p! CompNode={A11_CompNode}!p! [{A12_(CHAR)CompNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A11_CompNode`

Event ID 49: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] CompletionNodeSup.c(780) %!FUNC!:Draining; IRP Cancel routine called.

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(780) %!FUNC!:Draining; IRP Cancel routine called

Event ID 50: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(965) %!FUNC!:Draining operation {A10_(CHAR)localIrpCtrl.Data.Iopb->MajorFunction}!d!;{A11_(CHAR)localIrpCtrl.Data.Iopb->MinorFunction}!d! ({A12_FltGetIrpName(localIrpCtrl.Data.Iopb->MajorFunction)}!S!) IrpCtrl={A13_localCompNode.IrpCtrl}!p!

Event ID 51: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1130) %!FUNC!:CN Insert Waiting (bufSwaped) IrpCtrl={A10_completionNode->IrpCtrl}!p! CompNode={A11_completionNode}!p! [{A12_(CHAR)completionNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A11_completionNode`

Event ID 52: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1153) %!FUNC!:Draining; Swapped buffers; canceling IRP {A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction}!d!;{A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction}!d! ({A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)}!S!) IrpCtrl={A13_irpCtrl}!p!

Fields #

Name	Description
`A13_irpCtrl`

Event ID 53: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1216) %!FUNC!:Draining; Swapped buffers; waiting for non-IRP operation {A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction}!d!;{A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction}!d! ({A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)}!S!) IrpCtrl={A13_irpCtrl}!p!

Fields #

Name	Description
`A13_irpCtrl`

Event ID 54: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1249) %!FUNC!:CN Insert Waiting (NotDrainable) IrpCtrl={A10_completionNode->IrpCtrl}!p! CompNode={A11_completionNode}!p! [{A12_(CHAR)completionNode->DataSnapshot.MajorFunction}!d!]

Fields #

Name	Description
`A11_completionNode`

Event ID 55: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] CompletionNodeSup.c(1264) %!FUNC!:Draining; Waiting for non-drainable operation {A10_(CHAR)irpCtrl->Data.Iopb->MajorFunction}!d!;{A11_(CHAR)irpCtrl->Data.Iopb->MinorFunction}!d! ({A12_FltGetIrpName(irpCtrl->Data.Iopb->MajorFunction)}!S!) IrpCtrl={A13_irpCtrl}!p!

Fields #

Name	Description
`A13_irpCtrl`

Event ID 56: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] EnumerationSup.c(1127) %!FUNC!:Wrong type of device object passed in: devobj {A10_DeviceObject}!p!

Message #

[TL_%!LEVEL!] EnumerationSup.c(1127) %!FUNC!:Wrong type of device object passed in: devobj {A10_DeviceObject}!p!

Fields #

Name	Description
`A10_DeviceObject`

Event ID 57: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] ExceptionSup.c(62) %!FUNC!:Caught exception ({A10_ExceptionPointer->ExceptionRecord->ExceptionCode}!08x!; {A11_ExceptionPointer->ContextRecord}!p!; {A12_ExceptionPointer->ExceptionRecord}!p!; {A13_ExceptionPointer->ExceptionRecord->ExceptionAddress}!p!)

Event ID 58: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(337) %!FUNC!:passing through FAST_IO_CHECK_IF_POSSIBLE.

Message #

[TL_%!LEVEL!] FastIoSup.c(337) %!FUNC!:passing through FAST_IO_CHECK_IF_POSSIBLE

Event ID 59: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(362) %!FUNC!:passing through FAST_IO_READ.

Message #

[TL_%!LEVEL!] FastIoSup.c(362) %!FUNC!:passing through FAST_IO_READ

Event ID 60: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(387) %!FUNC!:passing through FAST_IO_WRITE.

Message #

[TL_%!LEVEL!] FastIoSup.c(387) %!FUNC!:passing through FAST_IO_WRITE

Event ID 61: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(411) %!FUNC!:passing through FAST_IO_QUERY_BASIC_INFO.

Message #

[TL_%!LEVEL!] FastIoSup.c(411) %!FUNC!:passing through FAST_IO_QUERY_BASIC_INFO

Event ID 62: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(436) %!FUNC!:passing through FAST_IO_QUERY_STANDARD_INFO.

Message #

[TL_%!LEVEL!] FastIoSup.c(436) %!FUNC!:passing through FAST_IO_QUERY_STANDARD_INFO

Event ID 63: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(457) %!FUNC!:passing through FAST_IO_QUERY_NETWORK_OPEN_INFO.

Message #

[TL_%!LEVEL!] FastIoSup.c(457) %!FUNC!:passing through FAST_IO_QUERY_NETWORK_OPEN_INFO

Event ID 64: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(496) %!FUNC!:passing through FAST_IO_LOCK.

Message #

[TL_%!LEVEL!] FastIoSup.c(496) %!FUNC!:passing through FAST_IO_LOCK

Event ID 65: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(521) %!FUNC!:passing through FAST_IO_UNLOCK_SINGLE.

Message #

[TL_%!LEVEL!] FastIoSup.c(521) %!FUNC!:passing through FAST_IO_UNLOCK_SINGLE

Event ID 66: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(544) %!FUNC!:passing through FAST_IO_UNLOCK_ALL.

Message #

[TL_%!LEVEL!] FastIoSup.c(544) %!FUNC!:passing through FAST_IO_UNLOCK_ALL

Event ID 67: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(565) %!FUNC!:passing through FAST_IO_UNLOCK_ALL_BY_KEY.

Message #

[TL_%!LEVEL!] FastIoSup.c(565) %!FUNC!:passing through FAST_IO_UNLOCK_ALL_BY_KEY

Event ID 68: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(594) %!FUNC!:passing through FAST_IO_DEVICE_CONTROL.

Message #

[TL_%!LEVEL!] FastIoSup.c(594) %!FUNC!:passing through FAST_IO_DEVICE_CONTROL

Event ID 69: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(622) %!FUNC!:passing through FAST_IO_QUERY_OPEN.

Message #

[TL_%!LEVEL!] FastIoSup.c(622) %!FUNC!:passing through FAST_IO_QUERY_OPEN

Event ID 70: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(684) %!FUNC!:passing through FAST_IO_MDL_READ.

Message #

[TL_%!LEVEL!] FastIoSup.c(684) %!FUNC!:passing through FAST_IO_MDL_READ

Event ID 71: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(708) %!FUNC!:passing through FAST_IO_MDL_READ_COMPLETE.

Message #

[TL_%!LEVEL!] FastIoSup.c(708) %!FUNC!:passing through FAST_IO_MDL_READ_COMPLETE

Event ID 72: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(728) %!FUNC!:passing through FAST_IO_PREPARE_MDL_WRITE.

Message #

[TL_%!LEVEL!] FastIoSup.c(728) %!FUNC!:passing through FAST_IO_PREPARE_MDL_WRITE

Event ID 73: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FastIoSup.c(752) %!FUNC!:passing through FAST_IO_MDL_WRITE_COMPLETE.

Message #

[TL_%!LEVEL!] FastIoSup.c(752) %!FUNC!:passing through FAST_IO_MDL_WRITE_COMPLETE

Event ID 74: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(198) %!FUNC!:Starting ({A10__localHead}!p!).

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(198) %!FUNC!:Starting ({A10__localHead}!p!)

Fields #

Name	Description
`A10__localHead`

Event ID 76: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(274) %!FUNC!:FSDelete ({A10_fileList}!p!) Fl={A11_fileList->Flags}!03x! Use={A12_fileList->UseCount}!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(274) %!FUNC!:FSDelete  ({A10_fileList}!p!)              Fl={A11_fileList->Flags}!03x! Use={A12_fileList->UseCount}!d!

Fields #

Name	Description
`A10_fileList`

Event ID 77: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(445) %!FUNC!:Found ({A10_fileList}!p!) Fl={A11_fileList->Flags}!03x! Use={A12_fileList->UseCount}!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(445) %!FUNC!:Found     ({A10_fileList}!p!)              Fl={A11_fileList->Flags}!03x! Use={A12_fileList->UseCount}!d!

Fields #

Name	Description
`A10_fileList`

Event ID 78: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(565) %!FUNC!:Created ({A10_newFileList}!p!) Fl={A11_newFileList->Flags}!03x! Use={A12_newFileList->UseCount}!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(565) %!FUNC!:Created   ({A10_newFileList}!p!)              Fl={A11_newFileList->Flags}!03x! Use={A12_newFileList->UseCount}!d!

Fields #

Name	Description
`A10_newFileList`

Event ID 79: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(588) %!FUNC!:Found New ({A10_fileList}!p!) Fl={A11_fileList->Flags}!03x! Use={A12_fileList->UseCount}!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(588) %!FUNC!:Found New ({A10_fileList}!p!)              Fl={A11_fileList->Flags}!03x! Use={A12_fileList->UseCount}!d!

Fields #

Name	Description
`A10_fileList`

Event ID 80: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(732) %!FUNC!:Allocate ({A10_newFileList}!p!) Fl={A11_newFileList->Flags}!03x! Use={A12_newFileList->UseCount}!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(732) %!FUNC!:Allocate  ({A10_newFileList}!p!)              Fl={A11_newFileList->Flags}!03x! Use={A12_newFileList->UseCount}!d!

Fields #

Name	Description
`A10_newFileList`

Event ID 81: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(769) %!FUNC!:Release ({A10_FileList}!p!) Fl={A11_FileList->Flags}!03x! Use={A12_FileList->UseCount}!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(769) %!FUNC!:Release   ({A10_FileList}!p!)              Fl={A11_FileList->Flags}!03x! Use={A12_FileList->UseCount}!d!

Fields #

Name	Description
`A10_FileList`

Event ID 82: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(792) %!FUNC!:DEFFERED ({A10_FileList}!p!) Fl={A11_FileList->Flags}!03x! Use={A12_FileList->UseCount}!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(792) %!FUNC!:DEFFERED  ({A10_FileList}!p!)              Fl={A11_FileList->Flags}!03x! Use={A12_FileList->UseCount}!d!

Fields #

Name	Description
`A10_FileList`

Event ID 83: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FileListCtrlSup.c(827) %!FUNC!:Cleanup ({A10_FileList}!p!) Fl={A11_FileList->Flags}!03x! Use={A12_FileList->UseCount}!d!

Message #

[TL_%!LEVEL!] FileListCtrlSup.c(827) %!FUNC!:Cleanup   ({A10_FileList}!p!)              Fl={A11_FileList->Flags}!03x! Use={A12_FileList->UseCount}!d!

Fields #

Name	Description
`A10_FileList`

Event ID 84: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(996) %!FUNC!:DriverEntry: Error EtwRegister; status={A10_status}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(996) %!FUNC!:DriverEntry: Error EtwRegister; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 85: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1033) %!FUNC!:Failed to start notification for dynamic settings. status={A10_status}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1033) %!FUNC!:Failed to start notification for dynamic settings. status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 86: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1096) %!FUNC!:Num processors={A10_FltGlobals.NumProcessors}!d!

Message #

[TL_%!LEVEL!] fltmgr.c(1096) %!FUNC!:Num processors={A10_FltGlobals.NumProcessors}!d!

Event ID 87: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1100) %!FUNC!:Max processors={A10_KeQueryMaximumProcessorCountEx( ALL_PROCESSOR_GROUPS )}!d!

Message #

[TL_%!LEVEL!] fltmgr.c(1100) %!FUNC!:Max processors={A10_KeQueryMaximumProcessorCountEx( ALL_PROCESSOR_GROUPS )}!d!

Event ID 88: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1104) %!FUNC!:CacheLine size={A10_FltGlobals.CacheLineSize}!d! (0x{A11_FltGlobals.CacheLineSize}!x!).

Message #

[TL_%!LEVEL!] fltmgr.c(1104) %!FUNC!:CacheLine size={A10_FltGlobals.CacheLineSize}!d! (0x{A11_FltGlobals.CacheLineSize}!x!)

Event ID 89: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1111) %!FUNC!:Breaking on errors.

Message #

[TL_%!LEVEL!] fltmgr.c(1111) %!FUNC!:Breaking on errors

Event ID 90: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1117) %!FUNC!:Attaching to File System Recognizers.

Message #

[TL_%!LEVEL!] fltmgr.c(1117) %!FUNC!:Attaching to File System Recognizers

Event ID 91: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1123) %!FUNC!:Randomly using STATIC IrpCtrl.

Message #

[TL_%!LEVEL!] fltmgr.c(1123) %!FUNC!:Randomly using STATIC IrpCtrl

Event ID 92: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1129) %!FUNC!:Randomly using short CompletionNode stacks.

Message #

[TL_%!LEVEL!] fltmgr.c(1129) %!FUNC!:Randomly using short CompletionNode stacks

Event ID 93: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1189) %!FUNC!:DriverEntry: Error creating device; status={A10_status}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1189) %!FUNC!:DriverEntry: Error creating device; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 94: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1219) %!FUNC!:DriverEntry: Error creating symbolic link for control device; status={A10_status}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1219) %!FUNC!:DriverEntry: Error creating symbolic link for control device; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 95: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1270) %!FUNC!:DriverEntry: Failed query for perf trace routines; status={A10_status}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1270) %!FUNC!:DriverEntry: Failed query for perf trace routines; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 96: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1412) %!FUNC!:DriverEntry: Error Initializing Messaging Support; status={A10_status}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(1412) %!FUNC!:DriverEntry: Error Initializing Messaging Support; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 97: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1678) %!FUNC!:Unloading driver ({A10_DriverObject}!p!).

Message #

[TL_%!LEVEL!] fltmgr.c(1678) %!FUNC!:Unloading driver ({A10_DriverObject}!p!)

Fields #

Name	Description
`A10_DriverObject`

Event ID 98: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1958) %!FUNC!:Waiting for {A10_i}!d! Zombied FltObject(s) to be freed.

Message #

[TL_%!LEVEL!] fltmgr.c(1958) %!FUNC!:Waiting for {A10_i}!d! Zombied FltObject(s) to be freed

Fields #

Name	Description
`A10_i`

Event ID 99: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1966) %!FUNC!:Rundown wait complete.

Message #

[TL_%!LEVEL!] fltmgr.c(1966) %!FUNC!:Rundown wait complete

Event ID 100: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1990) %!FUNC!:Waiting for {A10_i}!d! outstanding IrpCtrl(s) to complete.

Message #

[TL_%!LEVEL!] fltmgr.c(1990) %!FUNC!:Waiting for {A10_i}!d! outstanding IrpCtrl(s) to complete

Fields #

Name	Description
`A10_i`

Event ID 101: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(1999) %!FUNC!:Rundown wait complete.

Message #

[TL_%!LEVEL!] fltmgr.c(1999) %!FUNC!:Rundown wait complete

Event ID 103: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(2271) %!FUNC!:Paging File operation; {A10_FltGetIrpName(irpSp->MajorFunction)}({A11_irpSp->MajorFunction}!d!).

Message #

[TL_%!LEVEL!] fltmgr.c(2271) %!FUNC!:Paging File operation; {A10_FltGetIrpName(irpSp->MajorFunction)}({A11_irpSp->MajorFunction}!d!)

Event ID 105: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(4518) %!FUNC!:Posting Irp {A10_IrpCtrl->Irp}!p! major={A11_IrpCtrl->Data.Iopb->MajorFunction}!d!

Message #

[TL_%!LEVEL!] fltmgr.c(4518) %!FUNC!:Posting Irp {A10_IrpCtrl->Irp}!p! major={A11_IrpCtrl->Data.Iopb->MajorFunction}!d!

Event ID 106: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(4846) %!FUNC!:Posting Irp {A10_Irp}!p!

Message #

[TL_%!LEVEL!] fltmgr.c(4846) %!FUNC!:Posting Irp {A10_Irp}!p!

Fields #

Name	Description
`A10_Irp`

Event ID 107: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(5015) %!FUNC!:TopLevelIrp set with unknown Irp 0x{A10_irpSp->MajorFunction}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(5015) %!FUNC!:TopLevelIrp set with unknown Irp 0x{A10_irpSp->MajorFunction}!x!

Event ID 109: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(5930) %!FUNC!:Calling InstanceSetup on CreateIrp.

Message #

[TL_%!LEVEL!] fltmgr.c(5930) %!FUNC!:Calling InstanceSetup on CreateIrp

Event ID 111: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] fltmgr.c(6237) %!FUNC!:Reset thread hiding in FltpCreatePostCompl:   T={A10_KeGetCurrentThread()}!p! FO={A11_IrpCtrl->FileObject}!p! Vol={A12_volume}!p! status={A13_IrpCtrl->Data.IoStatus.Status}!S!

Fields #

Name	Description
`A12_volume`

Event ID 112: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] fltmgr.c(6245) %!FUNC!:Continue Thread hiding in FltpCreatePostCompl:T={A10_KeGetCurrentThread()}!p! FO={A11_IrpCtrl->FileObject}!p! Vol={A12_volume}!p! status={A13_IrpCtrl->Data.IoStatus.Status}!S!

Fields #

Name	Description
`A12_volume`

Event ID 113: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(6386) %!FUNC!:Calling InstanceSetup on CreateIrp.

Message #

[TL_%!LEVEL!] fltmgr.c(6386) %!FUNC!:Calling InstanceSetup on CreateIrp

Event ID 117: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(11225) %!FUNC!:Calling InstanceSetup on FastIoQueryOpen.

Message #

[TL_%!LEVEL!] fltmgr.c(11225) %!FUNC!:Calling InstanceSetup on FastIoQueryOpen

Event ID 118: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(12559) %!FUNC!:Failed to restart registry watch; Context={A10_Context}!p!; status={A11_regWatchContext->NotificationStatus}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(12559) %!FUNC!:Failed to restart registry watch; Context={A10_Context}!p!; status={A11_regWatchContext->NotificationStatus}!x!

Fields #

Name	Description
`A10_Context`

Event ID 119: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] fltmgr.c(13405) %!FUNC!:Resetting notification for dynamic registry settings failed. Context={A10_regWatchContext}!p!; status={A11_regWatchContext->NotificationStatus}!x!

Message #

[TL_%!LEVEL!] fltmgr.c(13405) %!FUNC!:Resetting notification for dynamic registry settings failed. Context={A10_regWatchContext}!p!; status={A11_regWatchContext->NotificationStatus}!x!

Fields #

Name	Description
`A10_regWatchContext`

Event ID 120: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(549) %!FUNC!:Error registering FS change notification; status={A10_status}!x!

Message #

[TL_%!LEVEL!] FrameSup.c(549) %!FUNC!:Error registering FS change notification; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 124: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(1647) %!FUNC!:Failed allocating timer.

Message #

[TL_%!LEVEL!] FrameSup.c(1647) %!FUNC!:Failed allocating timer

Event ID 125: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(1659) %!FUNC!:Starting timer.

Message #

[TL_%!LEVEL!] FrameSup.c(1659) %!FUNC!:Starting timer

Event ID 126: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(1762) %!FUNC!:FltpManualDeviceAttachWorker: Delaying: fl={A10_ctxFlags}!Ix!; dl={A11_FltGlobals.ManualAttachDelayCounter}!d! ({A12_FltGlobals.ManualDeviceAttachLimit}!d!).

Message #

[TL_%!LEVEL!] FrameSup.c(1762) %!FUNC!:FltpManualDeviceAttachWorker: Delaying: fl={A10_ctxFlags}!Ix!; dl={A11_FltGlobals.ManualAttachDelayCounter}!d! ({A12_FltGlobals.ManualDeviceAttachLimit}!d!)

Fields #

Name	Description
`A10_ctxFlags`

Event ID 127: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] FrameSup.c(1778) %!FUNC!:FltpManualDeviceAttachWorker: Checking: fl={A10_ctxFlags}!Ix!; dl={A11_FltGlobals.ManualAttachDelayCounter}!d! ({A12_FltGlobals.ManualDeviceAttachLimit}!d!).

Message #

[TL_%!LEVEL!] FrameSup.c(1778) %!FUNC!:FltpManualDeviceAttachWorker: Checking: fl={A10_ctxFlags}!Ix!; dl={A11_FltGlobals.ManualAttachDelayCounter}!d! ({A12_FltGlobals.ManualDeviceAttachLimit}!d!)

Fields #

Name	Description
`A10_ctxFlags`

Event ID 135: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(4573) %!FUNC!:Attemping Fastio (no lower minifilters) from FltReadFile: Buffer={A10_Buffer}!p!; offset={A11_fileOffset.QuadPart}!I64x!; length={A12_Length}!x!

Message #

[TL_%!LEVEL!] IoSup.c(4573) %!FUNC!:Attemping Fastio (no lower minifilters) from FltReadFile: Buffer={A10_Buffer}!p!; offset={A11_fileOffset.QuadPart}!I64x!; length={A12_Length}!x!

Fields #

Name	Description
`A10_Buffer`
`A12_Length`

Event ID 136: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(4623) %!FUNC!:Attemping Fastio from FltReadFile: Buffer={A10_Buffer}!p!; offset={A11_fileOffset.QuadPart}!I64x!; length={A12_Length}!x!

Message #

[TL_%!LEVEL!] IoSup.c(4623) %!FUNC!:Attemping Fastio from FltReadFile: Buffer={A10_Buffer}!p!; offset={A11_fileOffset.QuadPart}!I64x!; length={A12_Length}!x!

Fields #

Name	Description
`A10_Buffer`
`A12_Length`

Event ID 137: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(4729) %!FUNC!:Fastio attempt from FltReadFile failed.

Message #

[TL_%!LEVEL!] IoSup.c(4729) %!FUNC!:Fastio attempt from FltReadFile failed

Event ID 138: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5145) %!FUNC!:Attemping Fastio (no lower minifilters) from FltWriteFile: Buffer={A10_Buffer}!p!; offset={A11_fileOffset.QuadPart}!I64x!; length={A12_Length}!x!

Message #

[TL_%!LEVEL!] IoSup.c(5145) %!FUNC!:Attemping Fastio (no lower minifilters) from FltWriteFile: Buffer={A10_Buffer}!p!; offset={A11_fileOffset.QuadPart}!I64x!; length={A12_Length}!x!

Fields #

Name	Description
`A10_Buffer`
`A12_Length`

Event ID 139: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5196) %!FUNC!:Attemping Fastio from FltWriteFile: Buffer={A10_Buffer}!p!; offset={A11_fileOffset.QuadPart}!I64x!; length={A12_Length}!x!

Message #

[TL_%!LEVEL!] IoSup.c(5196) %!FUNC!:Attemping Fastio from FltWriteFile: Buffer={A10_Buffer}!p!; offset={A11_fileOffset.QuadPart}!I64x!; length={A12_Length}!x!

Fields #

Name	Description
`A10_Buffer`
`A12_Length`

Event ID 140: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5303) %!FUNC!:Fastio attempt from FltWriteFile failed.

Message #

[TL_%!LEVEL!] IoSup.c(5303) %!FUNC!:Fastio attempt from FltWriteFile failed

Event ID 141: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5505) %!FUNC!:(No lower minifilters).

Message #

[TL_%!LEVEL!] IoSup.c(5505) %!FUNC!:(No lower minifilters)

Event ID 142: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5580) %!FUNC!:(Lower minifilter(s) exist).

Message #

[TL_%!LEVEL!] IoSup.c(5580) %!FUNC!:(Lower minifilter(s) exist)

Event ID 143: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5718) %!FUNC!:Attemping Fastio from FltFastIoMdlRead: MDLChain={A10_MdlChain}!p!; offset={A11_FileOffset->QuadPart}!I64x!; length={A12_Length}!x!

Message #

[TL_%!LEVEL!] IoSup.c(5718) %!FUNC!:Attemping Fastio from FltFastIoMdlRead: MDLChain={A10_MdlChain}!p!; offset={A11_FileOffset->QuadPart}!I64x!; length={A12_Length}!x!

Fields #

Name	Description
`A10_MdlChain`
`A12_Length`

Event ID 144: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5736) %!FUNC!:Fastio attempt from FltReadFile failed.

Message #

[TL_%!LEVEL!] IoSup.c(5736) %!FUNC!:Fastio attempt from FltReadFile failed

Event ID 145: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5757) %!FUNC!:Attemping Fastio from FltFastIoMdlReadComplete: MDLChain={A10_MdlChain}!p!

Message #

[TL_%!LEVEL!] IoSup.c(5757) %!FUNC!:Attemping Fastio from FltFastIoMdlReadComplete: MDLChain={A10_MdlChain}!p!

Fields #

Name	Description
`A10_MdlChain`

Event ID 146: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5772) %!FUNC!:Fastio attempt from FltFastIoMdlReadComplete failed.

Message #

[TL_%!LEVEL!] IoSup.c(5772) %!FUNC!:Fastio attempt from FltFastIoMdlReadComplete failed

Event ID 147: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5797) %!FUNC!:Attemping Fastio from FltFastIoPrepareMdlWrite: MDLChain={A10_MdlChain}!p!; offset={A11_FileOffset->QuadPart}!I64x!; length={A12_Length}!x!

Message #

[TL_%!LEVEL!] IoSup.c(5797) %!FUNC!:Attemping Fastio from FltFastIoPrepareMdlWrite: MDLChain={A10_MdlChain}!p!; offset={A11_FileOffset->QuadPart}!I64x!; length={A12_Length}!x!

Fields #

Name	Description
`A10_MdlChain`
`A12_Length`

Event ID 148: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5815) %!FUNC!:Fastio attempt from FltFastIoPrepareMdlWrite failed.

Message #

[TL_%!LEVEL!] IoSup.c(5815) %!FUNC!:Fastio attempt from FltFastIoPrepareMdlWrite failed

Event ID 149: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5838) %!FUNC!:Attemping Fastio from FltFastIoMdlWriteComplete: MDLChain={A10_MdlChain}!p!; offset={A11_FileOffset->QuadPart}!I64x!

Message #

[TL_%!LEVEL!] IoSup.c(5838) %!FUNC!:Attemping Fastio from FltFastIoMdlWriteComplete: MDLChain={A10_MdlChain}!p!; offset={A11_FileOffset->QuadPart}!I64x!

Fields #

Name	Description
`A10_MdlChain`

Event ID 150: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] IoSup.c(5855) %!FUNC!:Fastio attempt from FltFastIoMdlWriteComplete failed.

Message #

[TL_%!LEVEL!] IoSup.c(5855) %!FUNC!:Fastio attempt from FltFastIoMdlWriteComplete failed

Event ID 151: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(1888) %!FUNC!:Timed out waiting for listener.

Message #

[TL_%!LEVEL!] MessageSup.c(1888) %!FUNC!:Timed out waiting for listener.

Event ID 152: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(1901) %!FUNC!:Port is disconncted: abandoning listener.

Message #

[TL_%!LEVEL!] MessageSup.c(1901) %!FUNC!:Port is disconncted: abandoning listener

Event ID 153: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(1909) %!FUNC!:Thread is Terminating.

Message #

[TL_%!LEVEL!] MessageSup.c(1909) %!FUNC!:Thread is Terminating.

Event ID 154: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(1985) %!FUNC!:Timed out waiting for listener.

Message #

[TL_%!LEVEL!] MessageSup.c(1985) %!FUNC!:Timed out waiting for listener.

Event ID 155: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(1998) %!FUNC!:Port is disconncted: abandoning listener.

Message #

[TL_%!LEVEL!] MessageSup.c(1998) %!FUNC!:Port is disconncted: abandoning listener

Event ID 156: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2006) %!FUNC!:Thread is Terminating.

Message #

[TL_%!LEVEL!] MessageSup.c(2006) %!FUNC!:Thread is Terminating.

Event ID 157: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2039) %!FUNC!:Found waiter IRP ({A10_irp}!p!); dequeued it.

Message #

[TL_%!LEVEL!] MessageSup.c(2039) %!FUNC!:Found waiter IRP ({A10_irp}!p!); dequeued it

Fields #

Name	Description
`A10_irp`

Event ID 158: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2140) %!FUNC!:Found waiter; but could not map user's buffer; IRP={A10_irp}!p!

Message #

[TL_%!LEVEL!] MessageSup.c(2140) %!FUNC!:Found waiter; but could not map user's buffer; IRP={A10_irp}!p!

Fields #

Name	Description
`A10_irp`

Event ID 159: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2264) %!FUNC!:Queueing replyWaiter ({A10__replyWaiter}!p!).

Message #

[TL_%!LEVEL!] MessageSup.c(2264) %!FUNC!:Queueing replyWaiter ({A10__replyWaiter}!p!)

Fields #

Name	Description
`A10__replyWaiter`

Event ID 160: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2317) %!FUNC!:Wait for reply status {A10_status}!x!

Message #

[TL_%!LEVEL!] MessageSup.c(2317) %!FUNC!:Wait for reply status {A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 161: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2325) %!FUNC!:Thread is Terminating Thread timed out Port disconnected.

Message #

[TL_%!LEVEL!] MessageSup.c(2325) %!FUNC!:Thread is Terminating Thread timed out Port disconnected

Event ID 162: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2686) %!FUNC!:Found waiter {A10_currentWaiter}!p!; dequeued it.

Message #

[TL_%!LEVEL!] MessageSup.c(2686) %!FUNC!:Found waiter {A10_currentWaiter}!p!; dequeued it

Fields #

Name	Description
`A10_currentWaiter`

Event ID 163: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2749) %!FUNC!:Setting reply event.

Message #

[TL_%!LEVEL!] MessageSup.c(2749) %!FUNC!:Setting reply event

Event ID 164: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2766) %!FUNC!:No waiter for reply; messageId: 0x{A10_(ULONG) replyMessageId}!X!

Message #

[TL_%!LEVEL!] MessageSup.c(2766) %!FUNC!:No waiter for reply; messageId: 0x{A10_(ULONG) replyMessageId}!X!

Event ID 165: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2815) %!FUNC!:Allocated {A10_Irp}!p!; enqueueing it (async).

Message #

[TL_%!LEVEL!] MessageSup.c(2815) %!FUNC!:Allocated {A10_Irp}!p!; enqueueing it (async)

Fields #

Name	Description
`A10_Irp`

Event ID 166: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2878) %!FUNC!:Dequeued waiter {A10_irp}!p!

Message #

[TL_%!LEVEL!] MessageSup.c(2878) %!FUNC!:Dequeued waiter {A10_irp}!p!

Fields #

Name	Description
`A10_irp`

Event ID 167: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2930) %!FUNC!:Verifying waiter list for Queue: {A10_Queue}!p! --.

Message #

[TL_%!LEVEL!] MessageSup.c(2930) %!FUNC!:Verifying waiter list for Queue: {A10_Queue}!p! --

Fields #

Name	Description
`A10_Queue`

Event ID 168: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(2940) %!FUNC!: -- currentLink {A10_currentLink}!p!

Message #

[TL_%!LEVEL!] MessageSup.c(2940) %!FUNC!:                    -- currentLink {A10_currentLink}!p!

Fields #

Name	Description
`A10_currentLink`

Event ID 169: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3041) %!FUNC!:Error creating server port object type; status={A10_status}!x!

Message #

[TL_%!LEVEL!] MessageSup.c(3041) %!FUNC!:Error creating server port object type; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 170: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3106) %!FUNC!:Error creating connection port object type; status={A10_status}!x!

Message #

[TL_%!LEVEL!] MessageSup.c(3106) %!FUNC!:Error creating connection port object type; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 171: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3128) %!FUNC!:Error creating msg device object; status={A10_status}!x!

Message #

[TL_%!LEVEL!] MessageSup.c(3128) %!FUNC!:Error creating msg device object; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 172: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3146) %!FUNC!:Error creating symbolic link to msg device object; status={A10_status}!x!

Message #

[TL_%!LEVEL!] MessageSup.c(3146) %!FUNC!:Error creating symbolic link to msg device object; status={A10_status}!x!

Fields #

Name	Description
`A10_status`

Event ID 173: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3248) %!FUNC!:Setting MessageWaiter event.

Message #

[TL_%!LEVEL!] MessageSup.c(3248) %!FUNC!:Setting MessageWaiter event

Event ID 174: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3260) %!FUNC!:Setting MessageWaiter semaphore.

Message #

[TL_%!LEVEL!] MessageSup.c(3260) %!FUNC!:Setting MessageWaiter semaphore

Event ID 175: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3318) %!FUNC!:Cancelling MessageWaiter {A10_Irp}!p!

Message #

[TL_%!LEVEL!] MessageSup.c(3318) %!FUNC!:Cancelling MessageWaiter {A10_Irp}!p!

Fields #

Name	Description
`A10_Irp`

Event ID 176: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] MessageSup.c(3367) %!FUNC!:Removed MessageWaiter {A10_Irp}!p! from queue.

Message #

[TL_%!LEVEL!] MessageSup.c(3367) %!FUNC!:Removed MessageWaiter {A10_Irp}!p! from queue

Fields #

Name	Description
`A10_Irp`

Event ID 180: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(3717) %!FUNC!:Getting NORMALIZED name for fo: {A10_GenCtx->FileObject}!p!

Message #

[TL_%!LEVEL!] NameCacheSup.c(3717) %!FUNC!:Getting NORMALIZED name for fo: {A10_GenCtx->FileObject}!p!

Event ID 181: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(3726) %!FUNC!:Getting OPENED name for fo: {A10_GenCtx->FileObject}!p!

Message #

[TL_%!LEVEL!] NameCacheSup.c(3726) %!FUNC!:Getting OPENED name for fo: {A10_GenCtx->FileObject}!p!

Event ID 182: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(3736) %!FUNC!:Getting SHORT name for fo: {A10_GenCtx->FileObject}!p!

Message #

[TL_%!LEVEL!] NameCacheSup.c(3736) %!FUNC!:Getting SHORT name for fo: {A10_GenCtx->FileObject}!p!

Event ID 190: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6006) %!FUNC!:Refcounting file name information: {A10_FileNameInformation}!p! cnt={A11_nameCacheNode->UseCount}!d!

Message #

[TL_%!LEVEL!] NameCacheSup.c(6006) %!FUNC!:Refcounting file name information: {A10_FileNameInformation}!p! cnt={A11_nameCacheNode->UseCount}!d!

Fields #

Name	Description
`A10_FileNameInformation`

Event ID 191: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6067) %!FUNC!:Releasing fni {A10_FileNameInformation}!p!

Message #

[TL_%!LEVEL!] NameCacheSup.c(6067) %!FUNC!:Releasing fni {A10_FileNameInformation}!p!

Fields #

Name	Description
`A10_FileNameInformation`

Event ID 192: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6096) %!FUNC!: *FREEING FNI*.

Message #

[TL_%!LEVEL!] NameCacheSup.c(6096) %!FUNC!: *FREEING FNI*

Event ID 193: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(6105) %!FUNC!

Message #

[TL_%!LEVEL!] NameCacheSup.c(6105) %!FUNC!:

Event ID 196: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameCacheSup.c(7448) %!FUNC!:Failed to invalidate name cache for POSIX delete: {A10_status}.

Message #

[TL_%!LEVEL!] NameCacheSup.c(7448) %!FUNC!:Failed to invalidate name cache for POSIX delete: {A10_status}

Fields #

Name	Description
`A10_status`

Event ID 202: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(5963) %!FUNC!:Expanding path for fo: {A10_GenCtx->FileObject}!p!

Message #

[TL_%!LEVEL!] NameSup.c(5963) %!FUNC!:Expanding path for fo: {A10_GenCtx->FileObject}!p!

Event ID 206: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] NameSup.c(7345) %!FUNC!:UNKNOWN FORMAT for name in ({A10_FileNameInformation}!p!).

Message #

[TL_%!LEVEL!] NameSup.c(7345) %!FUNC!:UNKNOWN FORMAT for name in ({A10_FileNameInformation}!p!)

Fields #

Name	Description
`A10_FileNameInformation`

Event ID 207: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] PendingSup.c(626) %!FUNC!:Resumed Pending operation: {A10_CallbackData->Iopb->MajorFunction}!x!; Irpctrl={A11_icc.IrpCtrl}!p!; callbackNode={A12_icc.IrpCtrl->PendingCallbackNode}!p! ({A13_FlagOn(icc.IrpCtrl->Flags;IRPCTRFL_SYNCHRONIZE) ? 'SYNC' : 'NotSYNC'}!S!)

Event ID 208: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] queuesup.c(686) %!FUNC!:Posting --- Irp:{A10_irpCtrl->Irp}!p! MajorFunction:{A11_irpCtrl->Data.Iopb->MajorFunction}!d!

Message #

[TL_%!LEVEL!] queuesup.c(686) %!FUNC!:Posting --- Irp:{A10_irpCtrl->Irp}!p! MajorFunction:{A11_irpCtrl->Data.Iopb->MajorFunction}!d!

Event ID 209: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] queuesup.c(712) %!FUNC!:Could not post -- Irp:{A10_irpCtrl->Irp}!p! MajorFunction:{A11_irpCtrl->Data.Iopb->MajorFunction}!d!

Message #

[TL_%!LEVEL!] queuesup.c(712) %!FUNC!:Could not post -- Irp:{A10_irpCtrl->Irp}!p! MajorFunction:{A11_irpCtrl->Data.Iopb->MajorFunction}!d!

Event ID 210: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] queuesup.c(723) %!FUNC!:Processing inline -- Irp:{A10_irpCtrl->Irp}!p! MajorFunction: {A11_irpCtrl->Data.Iopb->MajorFunction}!d!

Message #

[TL_%!LEVEL!] queuesup.c(723) %!FUNC!:Processing inline -- Irp:{A10_irpCtrl->Irp}!p! MajorFunction: {A11_irpCtrl->Data.Iopb->MajorFunction}!d!

Event ID 214: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(177) %!FUNC!:Starting ({A10__localHead}!p!).

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(177) %!FUNC!:Starting ({A10__localHead}!p!)

Fields #

Name	Description
`A10__localHead`

Event ID 216: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(256) %!FUNC!:FSDelete ({A10_streamList}!p!) Fl={A11_streamList->Flags}!03x! Use={A12_streamList->UseCount}!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(256) %!FUNC!:FSDelete  ({A10_streamList}!p!)              Fl={A11_streamList->Flags}!03x! Use={A12_streamList->UseCount}!d!

Fields #

Name	Description
`A10_streamList`

Event ID 217: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(409) %!FUNC!:Found ({A10_streamList}!p!) Fl={A11_streamList->Flags}!03x! Use={A12_streamList->UseCount}!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(409) %!FUNC!:Found     ({A10_streamList}!p!)              Fl={A11_streamList->Flags}!03x! Use={A12_streamList->UseCount}!d!

Fields #

Name	Description
`A10_streamList`

Event ID 218: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(540) %!FUNC!:Created ({A10_newStreamList}!p!) Fl={A11_newStreamList->Flags}!03x! Use={A12_newStreamList->UseCount}!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(540) %!FUNC!:Created   ({A10_newStreamList}!p!)              Fl={A11_newStreamList->Flags}!03x! Use={A12_newStreamList->UseCount}!d!

Fields #

Name	Description
`A10_newStreamList`

Event ID 219: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(572) %!FUNC!:Found New ({A10_streamList}!p!) Fl={A11_streamList->Flags}!03x! Use={A12_streamList->UseCount}!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(572) %!FUNC!:Found New ({A10_streamList}!p!)              Fl={A11_streamList->Flags}!03x! Use={A12_streamList->UseCount}!d!

Fields #

Name	Description
`A10_streamList`

Event ID 220: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(715) %!FUNC!:Allocate ({A10_newStreamList}!p!) Fl={A11_newStreamList->Flags}!03x! Use={A12_newStreamList->UseCount}!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(715) %!FUNC!:Allocate  ({A10_newStreamList}!p!)              Fl={A11_newStreamList->Flags}!03x! Use={A12_newStreamList->UseCount}!d!

Fields #

Name	Description
`A10_newStreamList`

Event ID 221: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(754) %!FUNC!:Release ({A10_StreamList}!p!) Fl={A11_StreamList->Flags}!03x! Use={A12_StreamList->UseCount}!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(754) %!FUNC!:Release   ({A10_StreamList}!p!)              Fl={A11_StreamList->Flags}!03x! Use={A12_StreamList->UseCount}!d!

Fields #

Name	Description
`A10_StreamList`

Event ID 222: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(807) %!FUNC!:DEFFERED ({A10_StreamList}!p!) Fl={A11_StreamList->Flags}!03x! Use={A12_StreamList->UseCount}!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(807) %!FUNC!:DEFFERED  ({A10_StreamList}!p!)              Fl={A11_StreamList->Flags}!03x! Use={A12_StreamList->UseCount}!d!

Fields #

Name	Description
`A10_StreamList`

Event ID 223: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] StreamListCtrlSup.c(843) %!FUNC!:Cleanup ({A10_StreamList}!p!) Fl={A11_StreamList->Flags}!03x! Use={A12_StreamList->UseCount}!d!

Message #

[TL_%!LEVEL!] StreamListCtrlSup.c(843) %!FUNC!:Cleanup   ({A10_StreamList}!p!)              Fl={A11_StreamList->Flags}!03x! Use={A12_StreamList->UseCount}!d!

Fields #

Name	Description
`A10_StreamList`

Event ID 224: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] SyncSup.c(260) %!FUNC!:PointerRef: {A10_FltObject}!p! ({A11_((PFLT_OBJECT)FltObject)->PointerCount}!d!) {A12_reason}!S!

Message #

[TL_%!LEVEL!] SyncSup.c(260) %!FUNC!:PointerRef:   {A10_FltObject}!p! ({A11_((PFLT_OBJECT)FltObject)->PointerCount}!d!) {A12_reason}!S!

Fields #

Name	Description
`A10_FltObject`
`A12_reason`

Event ID 225: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] SyncSup.c(302) %!FUNC!:PointerDeRef: {A10_FltObject}!p! ({A11_((PFLT_OBJECT)FltObject)->PointerCount}!d!) {A12_reason}!S!

Message #

[TL_%!LEVEL!] SyncSup.c(302) %!FUNC!:PointerDeRef: {A10_FltObject}!p! ({A11_((PFLT_OBJECT)FltObject)->PointerCount}!d!) {A12_reason}!S!

Fields #

Name	Description
`A10_FltObject`
`A12_reason`

Event ID 226: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] TargetedIoSup.c(1924) %!FUNC!:Wrong type of device object passed in: devobj {A10_deviceObject}!p!

Message #

[TL_%!LEVEL!] TargetedIoSup.c(1924) %!FUNC!:Wrong type of device object passed in: devobj {A10_deviceObject}!p!

Fields #

Name	Description
`A10_deviceObject`

Event ID 229: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Description

[TL_%!LEVEL!] VolumeSup.c(2606) %!FUNC!:Cleared thread hiding in FltpClearHiddenOp...: T={A10_KeGetCurrentThread()}!p! FO={A11_FileObject}!p! Vol={A12_Volume}!p! IrpMaj={A13_IrpMajor}!d!

Message #

[TL_%!LEVEL!] VolumeSup.c(2606) %!FUNC!:Cleared thread hiding in FltpClearHiddenOp...: T={A10_KeGetCurrentThread()}!p! FO={A11_FileObject}!p! Vol={A12_Volume}!p! IrpMaj={A13_IrpMajor}!d!

Fields #

Name	Description
`A11_FileObject`
`A12_Volume`
`A13_IrpMajor`

Event ID 230: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(193) %!FUNC!:Work={A10_FltWork}!p! QueType={A11_QueueType}!d! Count={A12_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningCount}!d! Limit={A13_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningLimit}!d!; QUEUED

Fields #

Name	Description
`A10_FltWork`
`A11_QueueType`

Event ID 231: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(214) %!FUNC!:Work={A10_FltWork}!p! QType={A11_QueueType}!d! Count={A12_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningCount}!d! Limit={A13_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningLimit}!d!; THROTTLED

Fields #

Name	Description
`A10_FltWork`
`A11_QueueType`

Event ID 232: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(290) %!FUNC!:Work={A10_fltWork}!p! QType={A11_QueueType}!d! Count={A12_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningCount}!d! Limit={A13_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningLimit}!d!; UnTHROTTLED

Fields #

Name	Description
`A10_fltWork`
`A11_QueueType`

Event ID 233: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(319) %!FUNC!:Work={A10_NULL}!p! QType={A11_QueueType}!d! Count={A12_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningCount}!d! Limit={A13_FltGlobals.ThrottledWorkCtrl.Queues[QueueType].RunningLimit}!d!; UnQUEUED

Fields #

Name	Description
`A10_NULL`
`A11_QueueType`

Event ID 234: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(457) %!FUNC!:Work={A10_GenericWorkItem}!p! QType={A11_qtype}!d! FltObj={A12_fltObject}!p! Routine={A13_GenericWorkItem->GenericWorkerRoutine}!p! Context={A14_GenericWorkItem->Context}!p! IoPriority={A15_GenericWorkItem->IoPriorityInfo.IoPriority}!d!

Fields #

Name	Description
`A10_GenericWorkItem`
`A11_qtype`
`A12_fltObject`

Event ID 235: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(569) %!FUNC!:Work={A10_DeferredWorkItem}!p! QType={A11_qtype}!d! Instnc={A12_instance}!p! Routine={A13_DeferredWorkItem->DeferredWorkerRoutine}!p! Context={A14_DeferredWorkItem->Context}!p! IoPriority={A15_DeferredWorkItem->IoPriorityInfo.IoPriority}!d!

Fields #

Name	Description
`A10_DeferredWorkItem`
`A11_qtype`
`A12_instance`

Event ID 236: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(666) %!FUNC!:Work={A10_FltWorkItem}!p! QType={A11_FltWorkItem->QueueType}!d! FltObj={A12_FltWorkItem->FltObject}!p! Routine={A13_FltWorkItem->GenericWorkerRoutine}!p! Context={A14_FltWorkItem->Context}!p!

Fields #

Name	Description
`A10_FltWorkItem`

Event ID 237: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(714) %!FUNC!:Work={A10_FltWorkItem}!p! QType={A11_FltWorkItem->QueueType}!d! Instnc={A12_FltWorkItem->Instance}!p! Routine={A13_FltWorkItem->DeferredWorkerRoutine}!p! Context={A14_FltWorkItem->Context}!p!

Fields #

Name	Description
`A10_FltWorkItem`

Event ID 238: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(841) %!FUNC!:Work={A10_FltWorkItem}!p! QType={A11_QueueType}!d! FltObj={A12_FltObject}!p! Routine={A13_WorkerRoutine}!p! Context={A14_Context}!p! IoPriority={A15_FltWorkItem->IoPriorityInfo.IoPriority}!d!

Fields #

Name	Description
`A10_FltWorkItem`
`A11_QueueType`
`A12_FltObject`
`A13_WorkerRoutine`
`A14_Context`

Event ID 239: [TL_%!

Provider: Microsoft-Windows-FltMgrTrace
Channel: Operational

Message #

[TL_%!LEVEL!] WorkSup.c(1022) %!FUNC!:Work={A10_FltWorkItem}!p! QType={A11_QueueType}!d! Instnc={A12_FltWorkItem->Instance}!p! Routine={A13_WorkerRoutine}!p! Context={A14_Context}!p! IoPriority={A15_FltWorkItem->IoPriorityInfo.IoPriority}!d!

Fields #

Name	Description
`A10_FltWorkItem`
`A11_QueueType`
`A13_WorkerRoutine`
`A14_Context`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)