Microsoft-Windows-FMS

Event	Title	Channel	Sample	Rule
1000	FMS DLL initialization failed	System	N	N
2015	FMS API entry for: ApiName.	Analytic	N	N
2016	FMS API exit for: ApiName.	Analytic	N	N
30000	PerfTrack_DisplayFmsInitStart	Analytic	N	N
30001	PerfTrack_DisplayFmsInitStop	Analytic	N	N
40000	FMS ETW.	Analytic	N	N
40001	FMS ETW.	Analytic	N	N
40002	FMS ETW.	Analytic	N	N
40003	FMS ETW.	Analytic	N	N
40004	FMS ETW.	Analytic	N	N
40005	FMS ETW.	Analytic	N	N
40006	FMS ETW.	Analytic	N	N
40007	FMS ETW.	Analytic	N	N
40008	FMS ETW.	Analytic	N	N
40009	FMS ETW.	Analytic	N	N
40010	FMS ETW.	Analytic	N	N
40011	FMS ETW.	Analytic	N	N

Event ID 1000: FMS DLL initialization failed

Channel: System
Task: FMSDLLinitialization
Opcode: Start

Event ID 2015: FMS API entry for: ApiName.

Channel: Analytic
Task: FMSAPIentrycall

Message #

FMS API entry for: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 2016: FMS API exit for: ApiName.

Channel: Analytic
Task: FMSAPIexitcall

Message #

FMS API exit for: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 30000: PerfTrack_DisplayFmsInitStart

Channel: Analytic
Task: PerfTrack_DisplayFmsInit
Opcode: Start

Event ID 30001: PerfTrack_DisplayFmsInitStop

Channel: Analytic
Task: PerfTrack_DisplayFmsInit
Opcode: Stop

Event ID 40000: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: NameResolution

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40001: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GetFontNameTableStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40002: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GetFontNameTableStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40003: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GetNameRecordStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40004: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GetNameRecordStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40005: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GetNameStringsStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40006: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GetNameStringsStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40007: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GetFontDataStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40008: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GetFontDataStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40009: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GdiGetFontRealizationInfoStart

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40010: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: GdiGetFontRealizationInfoStop

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Event ID 40011: FMS ETW.

Channel: Analytic
Task: ETWDebugMsg
Opcode: FmsErrorMessage

Description

FMS ETW: ApiName

Message #

FMS ETW: %1

Fields #

Name	Description
`ApiName` UnicodeString

Provenance

ETW provider GUID dea07764-0790-44de-b9c4-49677b17174f

Defined in fms.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB