Microsoft-Windows-HttpEvent

Event	Title	Channel	Sample	Rule
15000	Unable to create log file	Operational	N	N
15001	Unable to create the log file for site W3SVC	Operational	N	N
15002	Unable to write to the log file LogFile for site W3SVC	Operational	N	N
15003	Unable to create the centralized binary log file	Operational	N	N
15004	Unable to write to the centralized binary log file	Operational	N	N
15005	Unable to bind to the underlying transport for	Operational	N	N
15006	Owner of the log file or directory Directory is invalid	Operational	N	N
15007	Reservation for namespace identified by URL prefix Url was successfully added	Operational	Y	N
15007	Reservation for namespace identified by URL prefix …	System	Y	N
15008	Reservation for namespace identified by URL prefix Url was successfully deleted	Operational	Y	N
15008	Reservation for namespace identified by URL prefix Url was successfully deleted	System	Y	N
15009	An error occurred while initializing namespace reservations	Operational	N	N
15010	An error occured while initializing namespace reservation identified by URL …	Operational	N	N
15011	Unable to create the error log file	Operational	N	N
15012	Unable to write to the error log file	Operational	N	N
15013	Error logging configuration failed	Operational	N	N
15014	Unable to convert IP Listen-Only list entry	Operational	N	N
15015	Unable to convert all entries on IP Listen-Only list	Operational	N	N
15016	Unable to initialize the security package SecurityPackage for server side …	Operational	N	N
15017	Unable to create the centralized W3C log file	Operational	N	N
15018	Unable to write to the centralized W3C log file	Operational	N	N
15019	The host Host has gone down as a result of the change in the IP Listen-Only list	Operational	N	N
15020	The host Host has come up as a result of the change in the IP Listen-Only list	Operational	N	N
15021	An error occurred while using SSL configuration for endpoint	Operational	N	N
15022	Http	Operational	N	N
15300	SSL Certificate Settings deleted for endpoint :	Operational	Y	N
15300	SSL Certificate Settings deleted for endpoint :	System	Y	N
15301	SSL Certificate Settings created by an admin process for endpoint :	Operational	Y	N
15301	SSL Certificate Settings created by an admin process for endpoint :	System	Y	N
15302	SSL Certificate Settings updated by an admin process for endpoint :	Operational	N	N
1073756831	Reservation for namespace identified by URL prefix Url was successfully added.	Operational	Y	N
1073756832	Reservation for namespace identified by URL prefix Url was successfully deleted.	Operational	Y	N
1073756839	Unable to convert all entries on IP Listen-Only list.	Operational	N	N
2147498667	The host Host has gone down as a result of the change in the IP Listen-Only …	Operational	N	N
2147498668	The host Host has come up as a result of the change in the IP Listen-Only list.	Operational	N	N
2147498948	SSL Certificate Settings deleted for endpoint : Endpoint .	Operational	Y	N
2147498949	SSL Certificate Settings created by an admin process for endpoint : Endpoint .	Operational	Y	N
2147498950	SSL Certificate Settings updated by an admin process for endpoint : Endpoint .	Operational	N	N
3221240472	Unable to create log file LogFile.	Operational	N	N
3221240473	Unable to create the log file for site W3SVCSiteId.	Operational	N	N
3221240474	Unable to write to the log file LogFile for site W3SVCSiteId.	Operational	N	N
3221240475	Unable to create the centralized binary log file.	Operational	N	N
3221240476	Unable to write to the centralized binary log file LogFile.	Operational	N	N
3221240477	Unable to bind to the underlying transport for Address.	Operational	N	N
3221240478	Owner of the log file or directory Directory is invalid.	Operational	N	N
3221240481	An error occurred while initializing namespace reservations.	Operational	N	N
3221240482	An error occured while initializing namespace reservation identified by URL …	Operational	N	N
3221240483	Unable to create the error log file.	Operational	N	N
3221240484	Unable to write to the error log file.	Operational	N	N
3221240485	Error logging configuration failed.	Operational	N	N
3221240486	Unable to convert IP Listen-Only list entry Address.	Operational	N	N
3221240488	Unable to initialize the security package SecurityPackage for server side …	Operational	N	N
3221240489	Unable to create the centralized W3C log file.	Operational	N	N
3221240490	Unable to write to the centralized W3C log file LogFile.	Operational	N	N
3221240491	The host {Host} has gone down as a result of the change in the IP Listen-Only …	Operational	N	N
3221240492	The host {Host} has come up as a result of the change in the IP Listen-Only …	Operational	N	N
3221240493	An error occurred while using SSL configuration for endpoint Endpoint.	Operational	N	N
3221240494	Http.	Operational	N	N

Event ID 15000: Unable to create log file

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15001: Unable to create the log file for site W3SVC

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`SiteId` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15002: Unable to write to the log file LogFile for site W3SVC

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`SiteId` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15003: Unable to create the centralized binary log file

Channel: Operational

Event ID 15004: Unable to write to the centralized binary log file

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15005: Unable to bind to the underlying transport for

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Address` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15006: Owner of the log file or directory Directory is invalid

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Directory` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15007: Reservation for namespace identified by URL prefix Url was successfully added

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15007,
    "level": "Information",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-17T19:25:10.8244079+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Url": "http://+:10246/MDEServer/"
  }
}

Event ID 15007: Reservation for namespace identified by URL prefix http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/ was successfully added.

Channel: System
Level: Informational

Fields #

Name	Description
`DeviceObject`
`Url`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "guid": "{7B6BC78C-898B-4170-BBF8-1A469EA43FC5}",
    "event_source_name": "",
    "event_id": 15007,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T13:40:08.0988810+00:00",
    "event_record_id": 4157,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1920
    },
    "channel": "System",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceObject": "",
    "Url": "https://+:443/kdcproxy/"
  },
  "message": "Reservation for namespace identified by URL prefix https://+:443/kdcproxy/ was successfully added."
}

Event ID 15008: Reservation for namespace identified by URL prefix Url was successfully deleted

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15008,
    "level": "Information",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-17T19:24:09.3352418+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Url": "http://+:3387/rdp/"
  }
}

Event ID 15008: Reservation for namespace identified by URL prefix Url was successfully deleted

Channel: System
Level: Informational

Fields #

Name	Description
`DeviceObject`
`Url`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "guid": "{7B6BC78C-898B-4170-BBF8-1A469EA43FC5}",
    "event_source_name": "",
    "event_id": 15008,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-18T00:31:16.0695318+00:00",
    "event_record_id": 436,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 400
    },
    "channel": "System",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceObject": "",
    "Url": "http://+:47001/wsman/"
  },
  "message": "Reservation for namespace identified by URL prefix http://+:47001/wsman/ was successfully deleted."
}

Event ID 15009: An error occurred while initializing namespace reservations

Channel: Operational

Event ID 15010: An error occured while initializing namespace reservation identified by URL prefix

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15011: Unable to create the error log file

Channel: Operational

Event ID 15012: Unable to write to the error log file

Channel: Operational

Event ID 15013: Error logging configuration failed

Channel: Operational

Event ID 15014: Unable to convert IP Listen-Only list entry

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Address` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15015: Unable to convert all entries on IP Listen-Only list

Channel: Operational

Event ID 15016: Unable to initialize the security package SecurityPackage for server side authentication

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`SecurityPackage` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15017: Unable to create the centralized W3C log file

Channel: Operational

Event ID 15018: Unable to write to the centralized W3C log file

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15019: The host Host has gone down as a result of the change in the IP Listen-Only list

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Host` UnicodeString

Event ID 15020: The host Host has come up as a result of the change in the IP Listen-Only list

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Host` UnicodeString

Event ID 15021: An error occurred while using SSL configuration for endpoint

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 15022: Http

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Event ID 15300: SSL Certificate Settings deleted for endpoint :

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15300,
    "level": "Warning",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-13T23:13:38.9703757+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Endpoint": "EnterpriseRegistration.ludus.domain:443"
  }
}

Event ID 15300: SSL Certificate Settings deleted for endpoint :

Channel: System
Level: Warning

Fields #

Name	Description
`DeviceObject`
`Endpoint`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "guid": "{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}",
    "event_source_name": "HTTP",
    "event_id": 15300,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T23:13:38.970375+00:00",
    "event_record_id": 12418,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 3408
    },
    "channel": "System",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceObject": "",
    "Endpoint": "adfs.ludus.domain:443"
  },
  "message": ""
}

Event ID 15301: SSL Certificate Settings created by an admin process for endpoint :

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15301,
    "level": "Warning",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-13T23:14:00.3907591+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Endpoint": "EnterpriseRegistration.ludus.domain:443"
  }
}

Event ID 15301: SSL Certificate Settings created by an admin process for endpoint :

Channel: System
Level: Warning

Fields #

Name	Description
`DeviceObject`
`Endpoint`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "guid": "{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}",
    "event_source_name": "HTTP",
    "event_id": 15301,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2025-12-31T19:35:47.955598+00:00",
    "event_record_id": 421,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 356
    },
    "channel": "System",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceObject": "",
    "Endpoint": "0.0.0.0:5986"
  },
  "message": ""
}

Event ID 15302: SSL Certificate Settings updated by an admin process for endpoint :

Channel: Operational

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Event ID 1073756831: Reservation for namespace identified by URL prefix Url was successfully added.

Channel: Operational

Message #

Reservation for namespace identified by URL prefix %2 was successfully added.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15007,
    "level": "Information",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-17T19:25:10.8244079+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Url": "http://+:10246/MDEServer/"
  }
}

Event ID 1073756832: Reservation for namespace identified by URL prefix Url was successfully deleted.

Channel: Operational

Message #

Reservation for namespace identified by URL prefix %2 was successfully deleted.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15008,
    "level": "Information",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-17T19:24:09.3352418+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Url": "http://+:3387/rdp/"
  }
}

Event ID 1073756839: Unable to convert all entries on IP Listen-Only list.

Channel: Operational

Description

Unable to convert all entries on IP Listen-Only list. Driver will listen on all available interfaces.

Message #

Unable to convert all entries on IP Listen-Only list.  Driver will listen on all available interfaces.

Event ID 2147498667: The host Host has gone down as a result of the change in the IP Listen-Only list.

Channel: Operational

Message #

The host %2 has gone down as a result of the change in the IP Listen-Only list.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Host` UnicodeString

Event ID 2147498668: The host Host has come up as a result of the change in the IP Listen-Only list.

Channel: Operational

Message #

The host %2 has come up as a result of the change in the IP Listen-Only list.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Host` UnicodeString

Event ID 2147498948: SSL Certificate Settings deleted for endpoint : Endpoint .

Channel: Operational

Message #

SSL Certificate Settings deleted for endpoint : %2 .

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15300,
    "level": "Warning",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-13T23:13:38.9703757+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Endpoint": "EnterpriseRegistration.ludus.domain:443"
  }
}

Event ID 2147498949: SSL Certificate Settings created by an admin process for endpoint : Endpoint .

Channel: Operational

Message #

SSL Certificate Settings created by an admin process for endpoint : %2 .

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-HttpEvent",
    "event_id": 15301,
    "level": "Warning",
    "task": null,
    "opcode": null,
    "time_created": "2026-03-13T23:14:00.3907591+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "DeviceObject": null,
    "Endpoint": "EnterpriseRegistration.ludus.domain:443"
  }
}

Event ID 2147498950: SSL Certificate Settings updated by an admin process for endpoint : Endpoint .

Channel: Operational

Message #

SSL Certificate Settings updated by an admin process for endpoint : %2 .

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString

Event ID 3221240472: Unable to create log file LogFile.

Channel: Operational

Description

Unable to create log file LogFile. Make sure that the logging directory is correct and this computer has write access to that directory.

Message #

Unable to create log file %2. Make sure that the logging directory is correct and this computer has write access to that directory.

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`binary` Binary

Event ID 3221240473: Unable to create the log file for site W3SVCSiteId.

Channel: Operational

Description

Unable to create the log file for site W3SVCSiteId. Make sure that the logging directory for the site is correct and this computer has write access to that directory.

Message #

Unable to create the log file for site W3SVC%2. Make sure that the logging directory for the site is correct and this computer has write access to that directory.

Fields #

Name	Description
`DeviceObject` UnicodeString
`SiteId` UnicodeString
`binary` Binary

Event ID 3221240474: Unable to write to the log file LogFile for site W3SVCSiteId.

Channel: Operational

Description

Unable to write to the log file LogFile for site W3SVCSiteId. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Message #

Unable to write to the log file %2 for site W3SVC%3. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`SiteId` UnicodeString
`binary` Binary

Event ID 3221240475: Unable to create the centralized binary log file.

Channel: Operational

Description

Unable to create the centralized binary log file. Make sure that the logging directory is correct and this computer has write access to that directory.

Message #

Unable to create the centralized binary log file. Make sure that the logging directory is correct and this computer has write access to that directory.

Event ID 3221240476: Unable to write to the centralized binary log file LogFile.

Channel: Operational

Description

Unable to write to the centralized binary log file LogFile. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Message #

Unable to write to the centralized binary log file %2. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`binary` Binary

Event ID 3221240477: Unable to bind to the underlying transport for Address.

Channel: Operational

Description

Unable to bind to the underlying transport for Address. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number.

Message #

Unable to bind to the underlying transport for %2. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine.  The data field contains the error number.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Address` UnicodeString
`binary` Binary

Event ID 3221240478: Owner of the log file or directory Directory is invalid.

Channel: Operational

Description

Owner of the log file or directory Directory is invalid. This could be because another user has already created the log file or the directory.

Message #

Owner of the log file or directory %2 is invalid. This could be because another user has already created the log file or the directory.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Directory` UnicodeString
`binary` Binary

Event ID 3221240481: An error occurred while initializing namespace reservations.

Channel: Operational

Description

An error occurred while initializing namespace reservations. The error status code is contained within the returned data.

Message #

An error occurred while initializing namespace reservations.  The error status code is contained within the returned data.

Event ID 3221240482: An error occured while initializing namespace reservation identified by URL prefix Url.

Channel: Operational

Description

An error occured while initializing namespace reservation identified by URL prefix Url. The error status code is contained within the returned data.

Message #

An error occured while initializing namespace reservation identified by URL prefix %2.  The error status code is contained within the returned data.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Url` UnicodeString
`binary` Binary

Event ID 3221240483: Unable to create the error log file.

Channel: Operational

Description

Unable to create the error log file. Make sure that the error logging directory is correct.

Message #

Unable to create the error log file. Make sure that the error logging directory is correct.

Event ID 3221240484: Unable to write to the error log file.

Channel: Operational

Description

Unable to write to the error log file. Disk may be full. The data field contains the error number.

Message #

Unable to write to the error log file. Disk may be full. The data field contains the error number.

Event ID 3221240485: Error logging configuration failed.

Channel: Operational

Description

Error logging configuration failed. The data field contains the error number.

Message #

Error logging configuration failed. The data field contains the error number.

Event ID 3221240486: Unable to convert IP Listen-Only list entry Address.

Channel: Operational

Description

Unable to convert IP Listen-Only list entry Address. The data field contains the error number.

Message #

Unable to convert IP Listen-Only list entry %2.  The data field contains the error number.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Address` UnicodeString
`binary` Binary

Event ID 3221240488: Unable to initialize the security package SecurityPackage for server side authentication.

Channel: Operational

Description

Unable to initialize the security package SecurityPackage for server side authentication. The data field contains the error number.

Message #

Unable to initialize the security package %2 for server side authentication.  The data field contains the error number.

Fields #

Name	Description
`DeviceObject` UnicodeString
`SecurityPackage` UnicodeString
`binary` Binary

Event ID 3221240489: Unable to create the centralized W3C log file.

Channel: Operational

Description

Unable to create the centralized W3C log file. Make sure that the logging directory is correct and this computer has write access to that directory.

Message #

Unable to create the centralized W3C log file. Make sure that the logging directory is correct and this computer has write access to that directory.

Event ID 3221240490: Unable to write to the centralized W3C log file LogFile.

Channel: Operational

Description

Unable to write to the centralized W3C log file LogFile. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Message #

Unable to write to the centralized W3C log file %2. Disk may be full. If this is a network path, make sure that network connectivity is not broken.

Fields #

Name	Description
`DeviceObject` UnicodeString
`LogFile` UnicodeString
`binary` Binary

Event ID 3221240491: The host {Host} has gone down as a result of the change in the IP Listen-Only list.

Channel: Operational

Fields #

Name	Description
`Host`

Event ID 3221240492: The host {Host} has come up as a result of the change in the IP Listen-Only list.

Channel: Operational

Fields #

Name	Description
`Host`

Event ID 3221240493: An error occurred while using SSL configuration for endpoint Endpoint.

Channel: Operational

Description

An error occurred while using SSL configuration for endpoint Endpoint. The error status code is contained within the returned data.

Message #

An error occurred while using SSL configuration for endpoint %2.  The error status code is contained within the returned data.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Endpoint` UnicodeString
`binary` Binary

Event ID 3221240494: Http.

Channel: Operational

Description

Http.sys failed to process a CPU hot-add event. Status: Status.

Message #

Http.sys failed to process a CPU hot-add event. Status: %2.

Fields #

Name	Description
`DeviceObject` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Provenance

ETW provider GUID 7b6bc78c-898b-4170-bbf8-1a469ea43fc5

Defined in http.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB