Microsoft-Windows-HttpEvent

58 events across 2 channels

Event	Title	Channel	Sample
15000	Unable to create log file	Operational	N
15001	Unable to create the log file for site W3SVC	Operational	N
15002	Unable to write to the log file LogFile for site W3SVC	Operational	N
15003	Unable to create the centralized binary log file	Operational	N
15004	Unable to write to the centralized binary log file	Operational	N
15005	Unable to bind to the underlying transport for	Operational	N
15006	Owner of the log file or directory Directory is invalid	Operational	N
15007	Reservation for namespace identified by URL prefix Url was successfully added	Operational	Y
15007	Reservation for namespace identified by URL prefix …	System	Y
15008	Reservation for namespace identified by URL prefix Url was successfully deleted	Operational	Y
15008	Reservation for namespace identified by URL prefix Url was successfully deleted	System	Y
15009	An error occurred while initializing namespace reservations	Operational	N
15010	An error occured while initializing namespace reservation identified by URL …	Operational	N
15011	Unable to create the error log file	Operational	N
15012	Unable to write to the error log file	Operational	N
15013	Error logging configuration failed	Operational	N
15014	Unable to convert IP Listen-Only list entry	Operational	N
15015	Unable to convert all entries on IP Listen-Only list	Operational	N
15016	Unable to initialize the security package SecurityPackage for server side …	Operational	N
15017	Unable to create the centralized W3C log file	Operational	N
15018	Unable to write to the centralized W3C log file	Operational	N
15019	The host Host has gone down as a result of the change in the IP Listen-Only list	Operational	N
15020	The host Host has come up as a result of the change in the IP Listen-Only list	Operational	N
15021	An error occurred while using SSL configuration for endpoint	Operational	N
15022	Http	Operational	N
15300	SSL Certificate Settings deleted for endpoint :	Operational	Y
15300	SSL Certificate Settings deleted for endpoint :	System	Y
15301	SSL Certificate Settings created by an admin process for endpoint :	Operational	Y
15301	SSL Certificate Settings created by an admin process for endpoint :	System	Y
15302	SSL Certificate Settings updated by an admin process for endpoint :	Operational	N
1073756831	Reservation for namespace identified by URL prefix Url was successfully added.	Operational	Y
1073756832	Reservation for namespace identified by URL prefix Url was successfully deleted.	Operational	Y
1073756839	Unable to convert all entries on IP Listen-Only list.	Operational	N
2147498667	The host Host has gone down as a result of the change in the IP Listen-Only …	Operational	N
2147498668	The host Host has come up as a result of the change in the IP Listen-Only list.	Operational	N
2147498948	SSL Certificate Settings deleted for endpoint : Endpoint .	Operational	Y
2147498949	SSL Certificate Settings created by an admin process for endpoint : Endpoint .	Operational	Y
2147498950	SSL Certificate Settings updated by an admin process for endpoint : Endpoint .	Operational	N
3221240472	Unable to create log file LogFile.	Operational	N
3221240473	Unable to create the log file for site W3SVCSiteId.	Operational	N
3221240474	Unable to write to the log file LogFile for site W3SVCSiteId.	Operational	N
3221240475	Unable to create the centralized binary log file.	Operational	N
3221240476	Unable to write to the centralized binary log file LogFile.	Operational	N
3221240477	Unable to bind to the underlying transport for Address.	Operational	N
3221240478	Owner of the log file or directory Directory is invalid.	Operational	N
3221240481	An error occurred while initializing namespace reservations.	Operational	N
3221240482	An error occured while initializing namespace reservation identified by URL …	Operational	N
3221240483	Unable to create the error log file.	Operational	N
3221240484	Unable to write to the error log file.	Operational	N
3221240485	Error logging configuration failed.	Operational	N
3221240486	Unable to convert IP Listen-Only list entry Address.	Operational	N
3221240488	Unable to initialize the security package SecurityPackage for server side …	Operational	N
3221240489	Unable to create the centralized W3C log file.	Operational	N
3221240490	Unable to write to the centralized W3C log file LogFile.	Operational	N
3221240491	The host {Host} has gone down as a result of the change in the IP Listen-Only …	Operational	N
3221240492	The host {Host} has come up as a result of the change in the IP Listen-Only …	Operational	N
3221240493	An error occurred while using SSL configuration for endpoint Endpoint.	Operational	N
3221240494	Http.	Operational	N

Event ID 15000: Unable to create log file

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15001: Unable to create the log file for site W3SVC

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`SiteId` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15002: Unable to write to the log file LogFile for site W3SVC

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`SiteId` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15003: Unable to create the centralized binary log file

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Event ID 15004: Unable to write to the centralized binary log file

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15005: Unable to bind to the underlying transport for

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Address` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15006: Owner of the log file or directory Directory is invalid

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Directory` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15007: Reservation for namespace identified by URL prefix Url was successfully added

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15007,
    "level": "Information",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-17T19:25:10.8244079+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Url": "http://+:10246/MDEServer/"
  }
}

Event ID 15007: Reservation for namespace identified by URL prefix http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/ was successfully added.

Provider: Microsoft-Windows-HttpEvent
Channel: System
Level: Informational

Fields #

Name	Description
`DeviceObject`
`Url`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "guid": "{7B6BC78C-898B-4170-BBF8-1A469EA43FC5}",
    "event_source_name": "",
    "event_id": 15007,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T13:40:08.0988810+00:00",
    "event_record_id": 4157,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1920
    },
    "channel": "System",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceObject": "",
    "Url": "https://+:443/kdcproxy/"
  },
  "message": "Reservation for namespace identified by URL prefix https://+:443/kdcproxy/ was successfully added."
}

Event ID 15008: Reservation for namespace identified by URL prefix Url was successfully deleted

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15008,
    "level": "Information",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-17T19:24:09.3352418+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Url": "http://+:3387/rdp/"
  }
}

Event ID 15008: Reservation for namespace identified by URL prefix Url was successfully deleted

Provider: Microsoft-Windows-HttpEvent
Channel: System
Level: Informational

Fields #

Name	Description
`DeviceObject`
`Url`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "guid": "{7B6BC78C-898B-4170-BBF8-1A469EA43FC5}",
    "event_source_name": "",
    "event_id": 15008,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-18T00:31:16.0695318+00:00",
    "event_record_id": 436,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 400
    },
    "channel": "System",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceObject": "",
    "Url": "http://+:47001/wsman/"
  },
  "message": "Reservation for namespace identified by URL prefix http://+:47001/wsman/ was successfully deleted."
}

Event ID 15009: An error occurred while initializing namespace reservations

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Event ID 15010: An error occured while initializing namespace reservation identified by URL prefix

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15011: Unable to create the error log file

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Event ID 15012: Unable to write to the error log file

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Event ID 15013: Error logging configuration failed

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Event ID 15014: Unable to convert IP Listen-Only list entry

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Address` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15015: Unable to convert all entries on IP Listen-Only list

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Event ID 15016: Unable to initialize the security package SecurityPackage for server side authentication

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`SecurityPackage` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15017: Unable to create the centralized W3C log file

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Event ID 15018: Unable to write to the centralized W3C log file

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15019: The host Host has gone down as a result of the change in the IP Listen-Only list

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Host` UnicodeString

Event ID 15020: The host Host has come up as a result of the change in the IP Listen-Only list

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Host` UnicodeString

Event ID 15021: An error occurred while using SSL configuration for endpoint

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15022: Http

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Event ID 15300: SSL Certificate Settings deleted for endpoint :

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15300,
    "level": "Warning",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-13T23:13:38.9703757+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Endpoint": "EnterpriseRegistration.ludus.domain:443"
  }
}

Event ID 15300: SSL Certificate Settings deleted for endpoint :

Provider: Microsoft-Windows-HttpEvent
Channel: System
Level: Warning

Fields #

Name	Description
`DeviceObject`
`Endpoint`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "guid": "{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}",
    "event_source_name": "HTTP",
    "event_id": 15300,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T23:13:38.970375+00:00",
    "event_record_id": 12418,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 3408
    },
    "channel": "System",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceObject": "",
    "Endpoint": "adfs.ludus.domain:443"
  },
  "message": ""
}

Event ID 15301: SSL Certificate Settings created by an admin process for endpoint :

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15301,
    "level": "Warning",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-13T23:14:00.3907591+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Endpoint": "EnterpriseRegistration.ludus.domain:443"
  }
}

Event ID 15301: SSL Certificate Settings created by an admin process for endpoint :

Provider: Microsoft-Windows-HttpEvent
Channel: System
Level: Warning

Fields #

Name	Description
`DeviceObject`
`Endpoint`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "guid": "{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}",
    "event_source_name": "HTTP",
    "event_id": 15301,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2025-12-31T19:35:47.955598+00:00",
    "event_record_id": 421,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 356
    },
    "channel": "System",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceObject": "",
    "Endpoint": "0.0.0.0:5986"
  },
  "message": ""
}

Event ID 15302: SSL Certificate Settings updated by an admin process for endpoint :

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Event ID 1073756831: Reservation for namespace identified by URL prefix Url was successfully added.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Reservation for namespace identified by URL prefix Url was successfully added.

Message #

Reservation for namespace identified by URL prefix %2 was successfully added.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15007,
    "level": "Information",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-17T19:25:10.8244079+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Url": "http://+:10246/MDEServer/"
  }
}

Event ID 1073756832: Reservation for namespace identified by URL prefix Url was successfully deleted.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Reservation for namespace identified by URL prefix Url was successfully deleted.

Message #

Reservation for namespace identified by URL prefix %2 was successfully deleted.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15008,
    "level": "Information",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-17T19:24:09.3352418+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Url": "http://+:3387/rdp/"
  }
}

Event ID 1073756839: Unable to convert all entries on IP Listen-Only list.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to convert all entries on IP Listen-Only list. Driver will listen on all available interfaces.

Message #

Unable to convert all entries on IP Listen-Only list.  Driver will listen on all available interfaces.

Event ID 2147498667: The host Host has gone down as a result of the change in the IP Listen-Only list.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

The host Host has gone down as a result of the change in the IP Listen-Only list.

Message #

The host %2 has gone down as a result of the change in the IP Listen-Only list.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Host` UnicodeString

Event ID 2147498668: The host Host has come up as a result of the change in the IP Listen-Only list.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

The host Host has come up as a result of the change in the IP Listen-Only list.

Message #

The host %2 has come up as a result of the change in the IP Listen-Only list.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Host` UnicodeString

Event ID 2147498948: SSL Certificate Settings deleted for endpoint : Endpoint .

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

SSL Certificate Settings deleted for endpoint : Endpoint .

Message #

SSL Certificate Settings deleted for endpoint : %2 .

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15300,
    "level": "Warning",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-13T23:13:38.9703757+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Endpoint": "EnterpriseRegistration.ludus.domain:443"
  }
}

Event ID 2147498949: SSL Certificate Settings created by an admin process for endpoint : Endpoint .

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

SSL Certificate Settings created by an admin process for endpoint : Endpoint .

Message #

SSL Certificate Settings created by an admin process for endpoint : %2 .

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15301,
    "level": "Warning",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-13T23:14:00.3907591+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Endpoint": "EnterpriseRegistration.ludus.domain:443"
  }
}

Event ID 2147498950: SSL Certificate Settings updated by an admin process for endpoint : Endpoint .

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

SSL Certificate Settings updated by an admin process for endpoint : Endpoint .

Message #

SSL Certificate Settings updated by an admin process for endpoint : %2 .

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Event ID 3221240472: Unable to create log file LogFile.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to create log file LogFile. Make sure that the logging directory is correct and this computer has write access to that directory.

Message #

Unable to create log file %2. Make sure that the logging directory is correct and this computer has write access to that directory.

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`binary` Binary

Event ID 3221240473: Unable to create the log file for site W3SVCSiteId.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to create the log file for site W3SVCSiteId. Make sure that the logging directory for the site is correct and this computer has write access to that directory.

Message #

Unable to create the log file for site W3SVC%2. Make sure that the logging directory for the site is correct and this computer has write access to that directory.

Fields #

Name	Description
`DeviceObject` UnicodeString
`SiteId` UnicodeString
`binary` Binary

Event ID 3221240474: Unable to write to the log file LogFile for site W3SVCSiteId.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to write to the log file LogFile for site W3SVCSiteId. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Message #

Unable to write to the log file %2 for site W3SVC%3. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`SiteId` UnicodeString
`binary` Binary

Event ID 3221240475: Unable to create the centralized binary log file.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to create the centralized binary log file. Make sure that the logging directory is correct and this computer has write access to that directory.

Message #

Unable to create the centralized binary log file. Make sure that the logging directory is correct and this computer has write access to that directory.

Event ID 3221240476: Unable to write to the centralized binary log file LogFile.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to write to the centralized binary log file LogFile. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Message #

Unable to write to the centralized binary log file %2. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`binary` Binary

Event ID 3221240477: Unable to bind to the underlying transport for Address.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to bind to the underlying transport for Address. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number.

Message #

Unable to bind to the underlying transport for %2. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine.  The data field contains the error number.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Address` UnicodeString
`binary` Binary

Event ID 3221240478: Owner of the log file or directory Directory is invalid.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Owner of the log file or directory Directory is invalid. This could be because another user has already created the log file or the directory.

Message #

Owner of the log file or directory %2 is invalid. This could be because another user has already created the log file or the directory.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Directory` UnicodeString
`binary` Binary

Event ID 3221240481: An error occurred while initializing namespace reservations.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

An error occurred while initializing namespace reservations. The error status code is contained within the returned data.

Message #

An error occurred while initializing namespace reservations.  The error status code is contained within the returned data.

Event ID 3221240482: An error occured while initializing namespace reservation identified by URL prefix Url.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

An error occured while initializing namespace reservation identified by URL prefix Url. The error status code is contained within the returned data.

Message #

An error occured while initializing namespace reservation identified by URL prefix %2.  The error status code is contained within the returned data.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString
`binary` Binary

Event ID 3221240483: Unable to create the error log file.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to create the error log file. Make sure that the error logging directory is correct.

Message #

Unable to create the error log file. Make sure that the error logging directory is correct.

Event ID 3221240484: Unable to write to the error log file.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to write to the error log file. Disk may be full. The data field contains the error number.

Message #

Unable to write to the error log file. Disk may be full. The data field contains the error number.

Event ID 3221240485: Error logging configuration failed.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Error logging configuration failed. The data field contains the error number.

Message #

Error logging configuration failed. The data field contains the error number.

Event ID 3221240486: Unable to convert IP Listen-Only list entry Address.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to convert IP Listen-Only list entry Address. The data field contains the error number.

Message #

Unable to convert IP Listen-Only list entry %2.  The data field contains the error number.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Address` UnicodeString
`binary` Binary

Event ID 3221240488: Unable to initialize the security package SecurityPackage for server side authentication.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to initialize the security package SecurityPackage for server side authentication. The data field contains the error number.

Message #

Unable to initialize the security package %2 for server side authentication.  The data field contains the error number.

Fields #

Name	Description
`DeviceObject` UnicodeString
`SecurityPackage` UnicodeString
`binary` Binary

Event ID 3221240489: Unable to create the centralized W3C log file.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to create the centralized W3C log file. Make sure that the logging directory is correct and this computer has write access to that directory.

Message #

Unable to create the centralized W3C log file. Make sure that the logging directory is correct and this computer has write access to that directory.

Event ID 3221240490: Unable to write to the centralized W3C log file LogFile.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Unable to write to the centralized W3C log file LogFile. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Message #

Unable to write to the centralized W3C log file %2. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`binary` Binary

Event ID 3221240491: The host {Host} has gone down as a result of the change in the IP Listen-Only list.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

The host {Host} has gone down as a result of the change in the IP Listen-Only list.

Message #

The host {Host} has gone down as a result of the change in the IP Listen-Only list.

Fields #

Name	Description
`Host`

Event ID 3221240492: The host {Host} has come up as a result of the change in the IP Listen-Only list.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

The host {Host} has come up as a result of the change in the IP Listen-Only list.

Message #

The host {Host} has come up as a result of the change in the IP Listen-Only list.

Fields #

Name	Description
`Host`

Event ID 3221240493: An error occurred while using SSL configuration for endpoint Endpoint.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

An error occurred while using SSL configuration for endpoint Endpoint. The error status code is contained within the returned data.

Message #

An error occurred while using SSL configuration for endpoint %2.  The error status code is contained within the returned data.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString
`binary` Binary

Event ID 3221240494: Http.

Provider: Microsoft-Windows-HttpEvent
Channel: Operational

Description

Http.sys failed to process a CPU hot-add event. Status: Status.

Message #

Http.sys failed to process a CPU hot-add event. Status: %2.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 7b6bc78c-898b-4170-bbf8-1a469ea43fc5

Defined in http.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)