detection.wiki

Microsoft-Windows-HealthCenter

EventTitleChannelSampleRule
1The check provider CLSID has been disabled.DebugNN
2Icon message received: Icon_message_received.DebugNN
3Notification already exists: Notification_already_exists.DebugNN
4An event specifying unknown check EventID (version EventVeresion) was found in …DebugNN
5An event specifying unknown state StateID for check with canonical name …DebugNN
6Failed to set state (StateID) for check with canonical name CanonicalName: …DebugNN
7Worker thread failure during initialization: HRESULT=HRESULT.DebugNN
8Failed to set icon state when adding new notification: HRESULT=HRESULT.DebugNN
9Icon processing of new notification failed: HRESULT=HRESULT.DebugNN
10Icon processing of notification removal failed: HRESULT=HRESULT.DebugNN
11Cache read for check provider CanonicalName: HRESULT=HRESULT.DebugNN
12Cache written for check provider CanonicalName: HRESULT=HRESULT.DebugNN
13Failed to process new crimson event from channel ChannelName: HRESULT=HRESULT.DebugNN
14Failed to set bookmark for channel ChannelName: HRESULT=HRESULT.DebugNN
15Error event in channel ChannelName.DebugNN
16Failed to process an existing event for channel ChannelName: HRESULT=HRESULT.DebugNN
17Failed failed while reading existing events for channel ChannelName: …DebugNN
18Failed to resolve InputString: HRESULT=HRESULT.DebugNN
19Failed to load settings for check with canonical name CanonicalName: …DebugNN
20Added notification with canonical name CanonicalName.DebugNN
21Removed notification with canonical name CanonicalName.DebugNN
100HealthCenter_StringExpansionStartPerformanceNN
101HealthCenter_StringExpansionStopPerformanceNN
102HealthCenter_StateChangeStartPerformanceNN
103HealthCenter_StateChangeStopPerformanceNN
104HealthCenter_LoadFromCacheStartPerformanceNN
105HealthCenter_LoadFromCacheStopPerformanceNN
106HealthCenter_SaveToCacheStartPerformanceNN
107HealthCenter_SaveToCacheStopPerformanceNN
108HealthCenter_StartupStartPerformanceNN
109HealthCenter_StartupStopPerformanceNN
110HealthCenter_ShutdownStartPerformanceNN
111HealthCenter_ShutdownStopPerformanceNN
112HealthCenter_IconBalloonStartPerformanceNN
113HealthCenter_IconBalloonStopPerformanceNN
114HealthCenter_IconToolTipStartPerformanceNN
115HealthCenter_IconToolTipStopPerformanceNN
116HealthCenter_IconFlyoutStartPerformanceNN
117HealthCenter_IconFlyoutStopPerformanceNN
120HealthCenter_IconProcessNotificationStartPerformanceNN
121HealthCenter_IconProcessNotificationStopPerformanceNN
122HealthCenter_ProviderInitializedStartPerformanceNN
123HealthCenter_ProviderInitializedStopPerformanceNN
124HealthCenter_CPLLaunchPerformanceNN
1000Perftrack_HealthCenter_IconInitializedStartPerformanceNN
1001Perftrack_HealthCenter_IconInitializedStopPerformanceNN
1002Perftrack_HealthCenter_OpenUsingIconFlyoutStopPerformanceNN

Event ID 1: The check provider CLSID has been disabled.

#
Channel
Debug
Task
HealthCenter_ProviderDisabled

Description

The check provider CLSID has been disabled. HRESULT=HRESULT.

Message #

The check provider %1 has been disabled.  HRESULT=%2.

Fields #

NameDescription
CLSID UnicodeString
HRESULT UInt32

Event ID 2: Icon message received: Icon_message_received.

#
Channel
Debug
Task
HealthCenter_IconMessage

Message #

Icon message received: %1.

Fields #

NameDescription
Message UnicodeString

Event ID 3: Notification already exists: Notification_already_exists.

#
Channel
Debug
Task
HealthCenter_IconNotificationCaching

Message #

Notification already exists: %1.

Fields #

NameDescription
CannonicalName UnicodeString

Event ID 4: An event specifying unknown check EventID (version EventVeresion) was found in the channel ChannelName.

#
Channel
Debug
Task
HealthCenter_UnknownCheck

Message #

An event specifying unknown check %1 (version %2) was found in the channel %3

Fields #

NameDescription
EventID UInt32
EventVeresion UInt8
ChannelName UnicodeString

Event ID 5: An event specifying unknown state StateID for check with canonical name CanonicalName was found.

#
Channel
Debug
Task
HealthCenter_SetState

Message #

An event specifying unknown state %1 for check with canonical name %2 was found

Fields #

NameDescription
StateID UInt32
CanonicalName UnicodeString

Event ID 6: Failed to set state (StateID) for check with canonical name CanonicalName: HRESULT = HRESULT.

#
Channel
Debug
Task
HealthCenter_SetState

Message #

Failed to set state (%1) for check with canonical name %2: HRESULT = %3.

Fields #

NameDescription
StateID UInt32
CanonicalName UnicodeString
HRESULT UInt32

Event ID 7: Worker thread failure during initialization: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_SSOInitialization

Message #

Worker thread failure during initialization: HRESULT=%1.

Fields #

NameDescription
HRESULT UInt32

Event ID 8: Failed to set icon state when adding new notification: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_IconNotificationCaching

Message #

Failed to set icon state when adding new notification: HRESULT=%1.

Fields #

NameDescription
HRESULT UInt32

Event ID 9: Icon processing of new notification failed: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_IconNotificationCaching

Message #

Icon processing of new notification failed: HRESULT=%1.

Fields #

NameDescription
HRESULT UInt32

Event ID 10: Icon processing of notification removal failed: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_IconNotificationCaching

Message #

Icon processing of notification removal failed: HRESULT=%1.

Fields #

NameDescription
HRESULT UInt32

Event ID 11: Cache read for check provider CanonicalName: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_LoadFromCache

Message #

Cache read for check provider %1: HRESULT=%2.

Fields #

NameDescription
CanonicalName UnicodeString
HRESULT UInt32

Event ID 12: Cache written for check provider CanonicalName: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_SaveToCache

Message #

Cache written for check provider %1: HRESULT=%2.

Fields #

NameDescription
CanonicalName UnicodeString
HRESULT UInt32

Event ID 13: Failed to process new crimson event from channel ChannelName: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_CrimsonProcessing

Message #

Failed to process new crimson event from channel %1: HRESULT=%2.

Fields #

NameDescription
ChannelName UnicodeString
HRESULT UInt32

Event ID 14: Failed to set bookmark for channel ChannelName: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_CrimsonProcessing

Message #

Failed to set bookmark for channel %1: HRESULT=%2.

Fields #

NameDescription
ChannelName UnicodeString
HRESULT UInt32

Event ID 15: Error event in channel ChannelName.

#
Channel
Debug
Task
HealthCenter_CrimsonProcessing

Message #

Error event in channel %1.

Fields #

NameDescription
ChannelName UnicodeString

Event ID 16: Failed to process an existing event for channel ChannelName: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_CrimsonProcessing

Message #

Failed to process an existing event for channel %1: HRESULT=%2.

Fields #

NameDescription
ChannelName UnicodeString
HRESULT UInt32

Event ID 17: Failed failed while reading existing events for channel ChannelName: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_CrimsonProcessing

Message #

Failed failed while reading existing events for channel %1: HRESULT=%2.

Fields #

NameDescription
ChannelName UnicodeString
HRESULT UInt32

Event ID 18: Failed to resolve InputString: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_CrimsonProcessing

Message #

Failed to resolve %1: HRESULT=%2.

Fields #

NameDescription
InputString UnicodeString
HRESULT UInt32

Event ID 19: Failed to load settings for check with canonical name CanonicalName: HRESULT=HRESULT.

#
Channel
Debug
Task
HealthCenter_LoadSettings

Message #

Failed to load settings for check with canonical name %1: HRESULT=%2.

Fields #

NameDescription
CanonicalName UnicodeString
HRESULT UInt32

Event ID 20: Added notification with canonical name CanonicalName.

#
Channel
Debug
Task
HealthCenter_NotificationProcessing

Message #

Added notification with canonical name %1.

Fields #

NameDescription
CanonicalName UnicodeString

Event ID 21: Removed notification with canonical name CanonicalName.

#
Channel
Debug
Task
HealthCenter_NotificationProcessing

Message #

Removed notification with canonical name %1.

Fields #

NameDescription
CanonicalName UnicodeString

Event ID 100: HealthCenter_StringExpansionStart

#
Channel
Performance
Task
HealthCenter_StringExpansion
Opcode
Start

Event ID 101: HealthCenter_StringExpansionStop

#
Channel
Performance
Task
HealthCenter_StringExpansion
Opcode
Stop

Event ID 102: HealthCenter_StateChangeStart

#
Channel
Performance
Task
HealthCenter_StateChange
Opcode
Start

Event ID 103: HealthCenter_StateChangeStop

#
Channel
Performance
Task
HealthCenter_StateChange
Opcode
Stop

Event ID 104: HealthCenter_LoadFromCacheStart

#
Channel
Performance
Task
HealthCenter_LoadFromCache
Opcode
Start

Event ID 105: HealthCenter_LoadFromCacheStop

#
Channel
Performance
Task
HealthCenter_LoadFromCache
Opcode
Stop

Event ID 106: HealthCenter_SaveToCacheStart

#
Channel
Performance
Task
HealthCenter_SaveToCache
Opcode
Start

Event ID 107: HealthCenter_SaveToCacheStop

#
Channel
Performance
Task
HealthCenter_SaveToCache
Opcode
Stop

Event ID 108: HealthCenter_StartupStart

#
Channel
Performance
Task
HealthCenter_Startup
Opcode
Start

Event ID 109: HealthCenter_StartupStop

#
Channel
Performance
Task
HealthCenter_Startup
Opcode
Stop

Event ID 110: HealthCenter_ShutdownStart

#
Channel
Performance
Task
HealthCenter_Shutdown
Opcode
Start

Event ID 111: HealthCenter_ShutdownStop

#
Channel
Performance
Task
HealthCenter_Shutdown
Opcode
Stop

Event ID 112: HealthCenter_IconBalloonStart

#
Channel
Performance
Task
HealthCenter_IconBalloon
Opcode
Start

Event ID 113: HealthCenter_IconBalloonStop

#
Channel
Performance
Task
HealthCenter_IconBalloon
Opcode
Stop

Event ID 114: HealthCenter_IconToolTipStart

#
Channel
Performance
Task
HealthCenter_IconToolTip
Opcode
Start

Event ID 115: HealthCenter_IconToolTipStop

#
Channel
Performance
Task
HealthCenter_IconToolTip
Opcode
Stop

Event ID 116: HealthCenter_IconFlyoutStart

#
Channel
Performance
Task
HealthCenter_IconFlyout
Opcode
Start

Event ID 117: HealthCenter_IconFlyoutStop

#
Channel
Performance
Task
HealthCenter_IconFlyout
Opcode
Stop

Event ID 120: HealthCenter_IconProcessNotificationStart

#
Channel
Performance
Task
HealthCenter_IconProcessNotification
Opcode
Start

Event ID 121: HealthCenter_IconProcessNotificationStop

#
Channel
Performance
Task
HealthCenter_IconProcessNotification
Opcode
Stop

Event ID 122: HealthCenter_ProviderInitializedStart

#
Channel
Performance
Task
HealthCenter_ProviderInitialized
Opcode
Start

Fields #

NameDescription
CLSID UnicodeString

Event ID 123: HealthCenter_ProviderInitializedStop

#
Channel
Performance
Task
HealthCenter_ProviderInitialized
Opcode
Stop

Fields #

NameDescription
CLSID UnicodeString

Event ID 124: HealthCenter_CPLLaunch

#
Channel
Performance
Task
HealthCenter_CPLLaunch

Event ID 1000: Perftrack_HealthCenter_IconInitializedStart

#
Channel
Performance
Task
Perftrack_HealthCenter_IconInitialized
Opcode
Start

Event ID 1001: Perftrack_HealthCenter_IconInitializedStop

#
Channel
Performance
Task
Perftrack_HealthCenter_IconInitialized
Opcode
Stop

Event ID 1002: Perftrack_HealthCenter_OpenUsingIconFlyoutStop

#
Channel
Performance
Task
Perftrack_HealthCenter_OpenUsingIconFlyout
Opcode
Stop

Provenance

ETW provider GUID 588c5c5a-ffc5-44a2-9a7f-d5e8dbe6efd7

Defined in actioncenter.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB