Microsoft-Windows-FTPSVC
63 events across 2 channels
Event ID 1: The server did not create a data channel connection to a client on local interface:
#Fields #
| Name | Description |
|---|---|
LocalNetworkInterface UnicodeString | |
FTPDataPort UnicodeString |
Event ID 2: The FTP Service configuration for the passive port range is invalid
#Fields #
| Name | Description |
|---|---|
LowPort UnicodeString | |
HighPort UnicodeString | |
ConfigFile UnicodeString | |
SitesSectionLineNumber UnicodeString |
Event ID 3: The server certificate for instance 'Instance' has expired or is not yet valid
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 4: The server certificate for instance 'Instance' has been revoked
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 5: The server certificate chain does not include a trusted root certificate
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 6: A certificate in the server certificate chain has an invalid signature
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 7: The FTP Service did not retrieve the server certificate for instance 'Instance' because the certificate could not be found in a certificate store
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 8: The FTP Service did not create logging directory 'Directory'
#Fields #
| Name | Description |
|---|---|
Occurence UnicodeString | |
Interval UnicodeString | |
Directory UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 9: Virtual site 'SiteID' is configured to truncate its log every 'LogFileTruncateBytes' bytes
#Fields #
| Name | Description |
|---|---|
SiteID UnicodeString | |
LogFileTruncateBytes UnicodeString |
Event ID 10: The 'param1' 'param2' failed range validation for property 'Property'
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
Property UnicodeString | |
Value UnicodeString | |
RangeLow UnicodeString | |
RangeHigh UnicodeString | |
DefaultValue UnicodeString |
Event ID 11: The virtual site 'Site' is invalid because the site binding 'Binding' could not be configured
#Fields #
| Name | Description |
|---|---|
Occurence UnicodeString | |
Interval UnicodeString | |
Site UnicodeString | |
Binding UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 12: The FTP Service did not create or write to the log file 'File'
#Fields #
| Name | Description |
|---|---|
Occurence UnicodeString | |
Interval UnicodeString | |
File UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 13: The virtual site 'Site' is invalid because the site binding 'Binding' is already being used by another virtual site
#Fields #
| Name | Description |
|---|---|
Occurence UnicodeString | |
Interval UnicodeString | |
Site UnicodeString | |
Binding UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 23: The FTP Service received a change notification, but was unable to process it correctly
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 24: Centralized logging is configured to truncate its log every 'Bytes' bytes
#Fields #
| Name | Description |
|---|---|
Bytes UnicodeString |
Event ID 25: The FTP Service encountered an error attempting to configure centralized logging
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 26: The FTP Service property 'Property' failed range validation
#Fields #
| Name | Description |
|---|---|
Property UnicodeString | |
Value UnicodeString | |
RangeLow UnicodeString | |
RangeHigh UnicodeString | |
DefaultValue UnicodeString |
Event ID 27: FTP Service did not create site
#Fields #
| Name | Description |
|---|---|
SiteID UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 28: The FTP Publishing Service did not delete site 'SiteID'
#Fields #
| Name | Description |
|---|---|
SiteID UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 29: The FTP Service did not modify site 'SiteID'
#Fields #
| Name | Description |
|---|---|
SiteID UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 30: The FTP Service encountered an error trying to read configuration data from file File, line number
#Fields #
| Name | Description |
|---|---|
Occurence UnicodeString | |
Interval UnicodeString | |
File UnicodeString | |
LineNumber UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 30: The FTP Service encountered an error trying to read configuration data from file \\?
#Fields #
| Name | Description |
|---|---|
Occurence | |
Interval | |
File | |
LineNumber | |
Error | |
__binLength | |
binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FTPSVC",
"guid": "{de0d3420-9914-43db-8917-7e0c98465891}",
"event_source_name": "FTPSVC",
"event_id": 30,
"version": 0,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-09 10:58:56.098770+00:00",
"event_record_id": 4027,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "System",
"computer": "tel2-DC01-2022.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"Occurence": "1",
"Interval": "5",
"File": "\\\\?\\C:\\Windows\\system32\\inetsrv\\config\\applicationHost.config",
"LineNumber": "1402",
"Error": "The configuration section 'gen_evtx-bad-tag' cannot be read because it is missing a section declaration\n",
"Binary": "MgAHgA=="
},
"message": "The FTP Service encountered an error trying to read configuration data from file \\\\?\\C:\\Windows\\system32\\inetsrv\\config\\applicationHost.config, line number 1402. The error message is: The configuration section 'gen_evtx-bad-tag' cannot be read because it is missing a section declaration\n. The problem occurred at least 1 times in the last 5 minutes. The data field contains the error number."
}
Event ID 31: The FTP Service encountered an error trying to read configuration data for config section 'ConfigSection' from file 'File', line number 'LineNumber'
#Fields #
| Name | Description |
|---|---|
ConfigSection UnicodeString | |
File UnicodeString | |
LineNumber UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 32: The 'param1' 'param2' has an invalid value for property 'Property'
#Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
Property UnicodeString | |
Value UnicodeString | |
DefaultValue UnicodeString |
Event ID 33: The config node 'ConfigNode' has an invalid value for property 'Property'
#Fields #
| Name | Description |
|---|---|
ConfigNode UnicodeString | |
Property UnicodeString | |
Value UnicodeString | |
DefaultValue UnicodeString |
Event ID 34: The config node 'ConfigNode' has an invalid value for property 'Property'
#Fields #
| Name | Description |
|---|---|
ConfigNode UnicodeString | |
Property UnicodeString | |
Value UnicodeString | |
DefaultValue UnicodeString | |
ValidValues UnicodeString |
Event ID 35: The FTP Service did not configure logging for site
#Fields #
| Name | Description |
|---|---|
SiteID UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 36: The COM Application 'ComPlusApplication' at 'Path' did not activate out of process
#Fields #
| Name | Description |
|---|---|
ComPlusApplication UnicodeString | |
Path UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 37: ETW Tracing support did not intialize
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 38: The FTP service requires that the Configuration APIs from the Windows Process Activation Service feature be installed on this server
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 39: The Configuration APIs required by FTP Service did not intialize
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 40: The FTP service encountered an error while handling migration
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 2147483649: The server did not create a data channel connection to a client on local interface.
#Event ID 2147483651: The server certificate for instance 'Instance' has expired or is not yet valid.
#Event ID 2147483652: The server certificate for instance 'Instance' has been revoked.
#Event ID 2147483653: The server certificate chain does not include a trusted root certificate.
#Event ID 2147483654: A certificate in the server certificate chain has an invalid signature.
#Event ID 2147483655: The FTP Service did not retrieve the server certificate for instance 'Instance' because the certificate could not be found in a certificate store.
#Event ID 2147483656: The FTP Service did not create logging directory 'Directory'.
#Description
The FTP Service did not create logging directory 'Directory'. No logs will be generated until this condition is corrected. The problem occurred at least Occurence times in the last Interval minutes. The data field contains the error number.
Message #
Fields #
| Name | Description |
|---|---|
Occurence | |
Interval | |
Directory | |
__binLength | |
binary |
Event ID 2147483657: Virtual site 'SiteID' is configured to truncate its log every 'LogFileTruncateBytes' bytes.
#Event ID 2147483658: The 'param1' 'param2' failed range validation for property 'Property'.
#Event ID 2147483659: The virtual site 'Site' is invalid because the site binding 'Binding' could not be configured.
#Description
The virtual site 'Site' is invalid because the site binding 'Binding' could not be configured. The problem occurred at least Occurence times in the last Interval minutes. The data field contains the error number.
Message #
Fields #
| Name | Description |
|---|---|
Occurence | |
Interval | |
Site | |
Binding | |
__binLength | |
binary |
Event ID 2147483660: The FTP Service did not create or write to the log file 'File'.
#Event ID 2147483661: The virtual site 'Site' is invalid because the site binding 'Binding' is already being used by another virtual site.
#Description
The virtual site 'Site' is invalid because the site binding 'Binding' is already being used by another virtual site. The problem occurred at least Occurence times in the last Interval minutes. The data field contains the error number.
Message #
Fields #
| Name | Description |
|---|---|
Occurence | |
Interval | |
Site | |
Binding | |
__binLength | |
binary |
Event ID 2147483672: Centralized logging is configured to truncate its log every 'Bytes' bytes.
#Event ID 2147483674: The FTP Service property 'Property' failed range validation.
#Event ID 2147483683: The FTP Service did not configure logging for site SiteID.
#Event ID 2147483685: ETW Tracing support did not intialize.
#Event ID 3221225474: The FTP Service configuration for the passive port range is invalid.
#Description
The FTP Service configuration for the passive port range is invalid. The range is set to: LowPort-HighPort. A subset of 1025-65535 range or 0-0 is expected. Check the 'lowDataChannelPort' and 'highDataChannelPort' attributes under the 'system.ftpServer\firewallSupport' section in configuration file 'ConfigFile' around line 'SitesSectionLineNumber'.
Message #
Fields #
| Name | Description |
|---|---|
LowPort | |
HighPort | |
ConfigFile | |
SitesSectionLineNumber |
Event ID 3221225495: The FTP Service received a change notification, but was unable to process it correctly.
#Event ID 3221225497: The FTP Service encountered an error attempting to configure centralized logging.
#Event ID 3221225499: FTP Service did not create site SiteID.
#Event ID 3221225500: The FTP Publishing Service did not delete site 'SiteID'.
#Event ID 3221225501: The FTP Service did not modify site 'SiteID'.
#Event ID 3221225502: The FTP Service encountered an error trying to read configuration data from file File, line number LineNumber.
#Description
The FTP Service encountered an error trying to read configuration data from file File, line number LineNumber. The error message is: Error. The problem occurred at least Occurence times in the last Interval minutes. The data field contains the error number.
Message #
Fields #
| Name | Description |
|---|---|
Occurence | |
Interval | |
File | |
LineNumber | |
Error | |
__binLength | |
binary |
Event ID 3221225503: The FTP Service encountered an error trying to read configuration data for config section 'ConfigSection' from file 'File', line number 'LineNumber'.
#Description
The FTP Service encountered an error trying to read configuration data for config section 'ConfigSection' from file 'File', line number 'LineNumber'. The error message is: 'Error'. The data field contains the error number.
Message #
Fields #
| Name | Description |
|---|---|
ConfigSection | |
File | |
LineNumber | |
Error | |
__binLength | |
binary |
Event ID 3221225504: The 'param1' 'param2' has an invalid value for property 'Property'.
#Event ID 3221225505: The config node 'ConfigNode' has an invalid value for property 'Property'.
#Event ID 3221225506: The config node 'ConfigNode' has an invalid value for property 'Property'.
#Event ID 3221225508: The COM Application 'ComPlusApplication' at 'Path' did not activate out of process.
#Event ID 3221225510: The FTP service requires that the Configuration APIs from the Windows Process Activation Service feature be installed on this server.
#Description
The FTP service requires that the Configuration APIs from the Windows Process Activation Service feature be installed on this server. Open Server Manager and install the Windows Process Activation Service feature.The data field contains the error number.
Message #
Fields #
| Name | Description |
|---|---|
__binLength | |
binary |