Microsoft-Windows-Kernel-EventTracing

Event	Title	Channel	Sample	Rule
0	Session "SessionName" failed to write to log file "FileName" with the following …	Admin	Y	N
1	The backing-file for the real-time session "SessionName" has reached its maximum …	Admin	Y	N
2	Session "SessionName" failed to start with the following error: ErrorCode.	Admin	Y	N
3	Session "SessionName" stopped due to the following error: ErrorCode.	Admin	Y	N
4	The maximum file size for session "SessionName" has been reached.	Admin	Y	N
5	An error was encountered while tracing session "FileName" was switching to the …	Admin	N	N
8	Provider ProviderName was registered with Event Tracing for Windows.	Analytic	Y	N
9	Provider ProviderName was unregistered from Event Tracing for Windows.	Analytic	Y	N
10	Session "SessionName" was started.	Analytic	Y	N
11	Session "SessionName" was stopped.	Analytic	N	N
12	The configuration of session "SessionName" has been modified.	Analytic	N	N
13	The events from session "SessionName" have been flushed.	Analytic	Y	N
14	Provider ProviderName has been enabled to session "SessionName".	Analytic	Y	N
15	Provider ProviderName is no longer enabled to session "SessionName".	Analytic	Y	N
17	The security descriptor for session "SessionName" has been updated.	Analytic	N	N
18	Stack correlation event.	Operational	N	N
19	Lost Event	Operational	Y	N
20	Session	Operational	N	N
21	SavePersistedLoggerStart_8_1	Operational	N	N
22	SavePersistedLoggerStop_8_2_V1	Operational	N	N
23	Error saving soft restart persisted log "FileName" Error: Status.	Admin	N	N
24	GUID Entry	Operational	N	N
25	Provider Group Entry	Operational	N	N
26	Enable Info	Operational	N	N
27	Provider	Operational	N	N
28	Error setting traits on Provider ProviderGuid.	Admin	Y	N
29	A registration for Provider ProviderGuid has joined Provider Group …	Analytic	Y	N
30	Provider ProviderGuid from process ProcessId does not have permission to write …	Analytic	N	N
31	ETW_TASK_LOST_TLG_EVENT	Operational	Y	N
32	Failed to read debug info for WPP provider ProviderGuid from process ProcessId …	Admin	N	N
33	Lost WPP Event	Operational	N	N
34	Lost System Event	Operational	N	N
35	Session	Analytic	N	N
40	The enable state for Provider ProviderName is about to change on session …	Analytic	N	N
41	Provider ProviderName is about to be disabled from session "SessionName".	Analytic	Y	N
42	Capture state requested for provider GUID on session "LoggerId".	Analytic	N	N
43	Session "SessionName" could not be started because LOGGER_FLAG_LARGE_MDL_PAGES …	Analytic	N	N
44	Session "SessionName" could not be started because because the maximum …	Analytic	N	N
45	Session "SessionName" could not be started because because the maximum …	Analytic	N	N
46	Session "SessionName" could not be started because the process failed its access …	Analytic	N	N
47	Session "SessionName" could not be started because the Memory Partition Handle …	Analytic	N	N
48	Session "SessionName" failed to create file FileName with error ErrorCode.	Analytic	N	N
49	Session "SessionName" could not be started because the process lacks the …	Analytic	N	N
50	Group Mask could not be updated for Session "SessionName", because the requested …	Analytic	N	N

Event ID 0: Session "SessionName" failed to write to log file "FileName" with the following error: ErrorCode.

Channel: Admin
Level: Error
Task: Logging
Opcode: WriteBuffer

Message #

Session "%1" failed to write to log file "%2" with the following error: %3

Fields #

Name	Description
`SessionName` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`LoggingMode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 0,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 10,
    "keywords": -9223372036854775792,
    "time_created": "2026-04-17T19:54:29.0311308+00:00",
    "event_record_id": 218,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11212
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "SenseNdrEtw",
    "FileName": "C:\\Windows\\system32\\Logfiles\\WMI\\RtBackup\\EtwRTSenseNdrEtw.etl",
    "ErrorCode": "3221225626",
    "LoggingMode": "8388864"
  },
  "message": "Session \"SenseNdrEtw\" failed to write to log file \"C:\\Windows\\system32\\Logfiles\\WMI\\RtBackup\\EtwRTSenseNdrEtw.etl\" with the following error: 0xC000009A"
}

Event ID 1: The backing-file for the real-time session "SessionName" has reached its maximum size.

Channel: Admin
Level: Warning
Task: Logging
Opcode: WriteBuffer

Description

The backing-file for the real-time session "SessionName" has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without having any real-time consumers.

Message #

The backing-file for the real-time session "%1" has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without having any real-time consumers.

Fields #

Name	Description
`SessionName` UnicodeString
`ErrorCode` UInt32
`LoggingMode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 10,
    "keywords": 9223372036854775824,
    "time_created": "2023-11-06T00:46:15.355055+00:00",
    "event_record_id": 16,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 5348
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "EventLog-Microsoft-Windows-Sysmon-Operational",
    "ErrorCode": 3221225864,
    "LoggingMode": 427819392
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2: Session "SessionName" failed to start with the following error: ErrorCode.

Channel: Admin
Level: Error
Task: Session
Opcode: Start

Message #

Session "%1" failed to start with the following error: %3

Fields #

Name	Description
`SessionName` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32	1" failed to start with the following error.
`LoggingMode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 2,
    "task": 2,
    "opcode": 12,
    "keywords": -9223372036854775792,
    "time_created": "2026-06-13T14:24:32.2104962+00:00",
    "event_record_id": 225,
    "correlation": {},
    "execution": {
      "process_id": 3336,
      "thread_id": 3004
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "NetCfgTrace",
    "FileName": "",
    "ErrorCode": "3221225626",
    "LoggingMode": "276824069"
  },
  "message": "Session \"NetCfgTrace\" failed to start with the following error: 0xC000009A"
}

Event ID 3: Session "SessionName" stopped due to the following error: ErrorCode.

Channel: Admin
Level: Error
Task: Session
Opcode: Stop

Message #

Session "%1" stopped due to the following error: %3

Fields #

Name	Description
`SessionName` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`LoggingMode` UInt32
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 3,
    "version": 1,
    "level": 2,
    "task": 2,
    "opcode": 14,
    "keywords": 9223372036854775824,
    "time_created": "2026-02-10T00:59:54.686730+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 280
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "ReadyBoot",
    "FileName": "C:\\Windows\\Prefetch\\ReadyBoot\\ReadyBoot.etl",
    "ErrorCode": 3221225864,
    "LoggingMode": 276824064,
    "FailureReason": 0
  },
  "message": ""
}

Event ID 4: The maximum file size for session "SessionName" has been reached.

Channel: Admin
Level: Warning
Task: Logging
Opcode: WriteBuffer

Description

The maximum file size for session "SessionName" has been reached. As a result, events might be lost (not logged) to file "FileName". The maximum files size is currently set to MaxFileSize bytes.

Message #

The maximum file size for session "%1" has been reached. As a result, events might be lost (not logged) to file "%2". The maximum files size is currently set to %5 bytes.

Fields #

Name	Description
`SessionName` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`LoggingMode` UInt32
`MaxFileSize` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 10,
    "keywords": 9223372036854775824,
    "time_created": "2026-02-10T00:59:54.686726+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 280
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SessionName": "ReadyBoot",
    "FileName": "C:\\Windows\\Prefetch\\ReadyBoot\\ReadyBoot.etl",
    "ErrorCode": 3221225864,
    "LoggingMode": 276824064,
    "MaxFileSize": 20971520
  },
  "message": ""
}

Event ID 5: An error was encountered while tracing session "FileName" was switching to the "SessionName" event log file.

Channel: Admin
Task: Logging
Opcode: FileSwitch

Description

An error was encountered while tracing session "FileName" was switching to the "SessionName" event log file. Error: ErrorCode.

Message #

An error was encountered while tracing session "%2" was switching to the "%1" event log file. Error: %3

Fields #

Name	Description
`SessionName` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`LoggingMode` UInt32

Event ID 8: Provider ProviderName was registered with Event Tracing for Windows.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Provider
Opcode: Register

Message #

Provider %1 was registered with Event Tracing for Windows.

Fields #

Name	Description
`ProviderName` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 8,
    "version": 0,
    "level": 5,
    "task": 3,
    "opcode": 16,
    "keywords": "0x4000000000000220",
    "time_created": "2026-06-02T05:26:17.676+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 22588,
      "thread_id": 5920
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProviderName": "{DB00DFB6-29F9-4A9C-9B3B-1F4F9E7D9770}"
  },
  "message": "ETW_TASK_PROVIDER"
}

Event ID 9: Provider ProviderName was unregistered from Event Tracing for Windows.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Provider
Opcode: Unregister

Message #

Provider %1 was unregistered from Event Tracing for Windows.

Fields #

Name	Description
`ProviderName` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 5,
    "task": 3,
    "opcode": 17,
    "keywords": "0x4000000000000220",
    "time_created": "2026-06-02T05:26:17.665+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 22880,
      "thread_id": 17520
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProviderName": "{C1160D05-83A4-4285-B67A-CC3BA2E3E05F}"
  },
  "message": "ETW_TASK_PROVIDER"
}

Event ID 10: Session "SessionName" was started.

Channel: Analytic
Level: Verbose
Task: Session
Opcode: Start

Message #

Session "%3" was started.

Fields #

Name	Description
`SessionGuid` GUID
`LoggerMode` UInt32
`SessionName` UnicodeString
`LogFileName` UnicodeString
`MinimumBuffers` UInt32
`MaximumBuffers` UInt32
`BufferSize` UInt32
`PeakBuffersCount` UInt32
`CurrentBuffersCount` UInt32
`FlushThreshold` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-EventTracing/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 10,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7948,
      "thread_id": 2760
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:07:46.919Z",
    "version": 0
  },
  "event_data": {
    "BufferSize": 65536,
    "CurrentBuffersCount": 2,
    "FlushThreshold": 0,
    "LogFileName": "C:\\Windows\\Logs\\NetSetup\\service.0.etl",
    "LoggerMode": 276824069,
    "MaximumBuffers": 24,
    "MinimumBuffers": 2,
    "PeakBuffersCount": 2,
    "SessionGuid": "{B6C2B638-4F86-4095-9446-DFC044E0663A}",
    "SessionName": "NetCfgTrace"
  },
  "message": ""
}

Event ID 11: Session "SessionName" was stopped.

Channel: Analytic
Task: Session
Opcode: Stop

Message #

Session "%3" was stopped.

Fields #

Name	Description
`SessionGuid` GUID
`LoggerMode` UInt32
`SessionName` UnicodeString
`LogFileName` UnicodeString
`MinimumBuffers` UInt32
`MaximumBuffers` UInt32
`BufferSize` UInt32
`PeakBuffersCount` UInt32
`CurrentBuffersCount` UInt32
`FlushThreshold` UInt32
`EventsLost` UInt32
`BuffersLost` UInt32
`RealTimeBuffersLost` UInt32
`LoggerId` UInt32

Event ID 12: The configuration of session "SessionName" has been modified.

Channel: Analytic
Task: Session
Opcode: Configure

Message #

The configuration of session "%3" has been modified.

Fields #

Name	Description
`SessionGuid` GUID
`LoggerMode` UInt32
`SessionName` UnicodeString
`LogFileName` UnicodeString

Event ID 13: The events from session "SessionName" have been flushed.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Session
Opcode: Flush

Message #

The events from session "%3" have been flushed.

Fields #

Name	Description
`SessionGuid` GUID
`LoggerMode` UInt32
`SessionName` UnicodeString
`LogFileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 13,
    "version": 0,
    "level": 5,
    "task": 2,
    "opcode": 15,
    "keywords": "0x4000000000000010",
    "time_created": "2026-06-02T05:26:17.847+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4656,
      "thread_id": 23320
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "LogFileName": "C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MpWppCoreTracing-20260530-164425-00000003-100000000.bin",
    "LoggerMode": 8388610,
    "SessionGuid": "{C5883C74-5C46-11F1-9665-E6B5BF8AE55F}",
    "SessionName": "MpWppCoreTracing-20260530-164425-00000003-100000000"
  },
  "message": "ETW_TASK_SESSION"
}

Event ID 14: Provider ProviderName has been enabled to session "SessionName".

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Provider
Opcode: Enable

Message #

Provider %1 has been enabled to session "%2".

Fields #

Name	Description
`ProviderName` GUID
`SessionName` UnicodeString
`MatchAnyKeyword` UInt64
`MatchAllKeyword` UInt64
`EnableProperty` UInt32
`Level` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 14,
    "version": 1,
    "level": 5,
    "task": 3,
    "opcode": 18,
    "keywords": "0x4000000000000420",
    "time_created": "2026-06-02T05:26:17.480+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 19624,
      "thread_id": 23376
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EnableProperty": 65,
    "Level": 255,
    "MatchAllKeyword": 0,
    "MatchAnyKeyword": 18446744073709551615,
    "ProviderName": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "SessionName": "etw-cap-driven-b19010"
  },
  "message": "ETW_TASK_PROVIDER"
}

Event ID 15: Provider ProviderName is no longer enabled to session "SessionName".

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Provider
Opcode: Disable

Message #

Provider %1 is no longer enabled to session "%2".

Fields #

Name	Description
`ProviderName` GUID
`SessionName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 5,
    "task": 3,
    "opcode": 19,
    "keywords": "0x4000000000000420",
    "time_created": "2026-06-02T05:26:27.724+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 11436,
      "thread_id": 15308
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProviderName": "{17D2A329-4539-5F4D-3435-F510634CE3B9}",
    "SessionName": "etw-cap-driven-b19010"
  },
  "message": "ETW_TASK_PROVIDER"
}

Event ID 17: The security descriptor for session "SessionName" has been updated.

Channel: Analytic
Task: Session
Opcode: Configure

Message #

The security descriptor for session "%3" has been updated.

Fields #

Name	Description
`SessionGuid` GUID
`LoggerMode` UInt32
`SessionName` UnicodeString
`LogFileName` UnicodeString

Event ID 18: Stack correlation event.

Channel: Operational
Task: StackTrace
Opcode: UserModeStackTrace

Description

Stack correlation event. This event contains a call stack which is associated with a prior event which is correlated by the MatchId.

Message #

Stack correlation event. This event contains a call stack which is associated with a prior event which is correlated by the MatchId.

Event ID 19: Lost Event

Channel: Operational
Also via: realtime ETW trace
Level: Error
Task: LostEvent
Opcode: win:Info

Fields #

Name	Description
`ProviderId` GUID
`StatusCode` UInt32	NTSTATUS reference
`EventId` UInt16
`SessionName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 19,
    "version": 0,
    "level": 2,
    "task": 7,
    "opcode": 0,
    "keywords": "0x0000000000000040",
    "time_created": "2026-06-02T05:26:17.481+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 22588,
      "thread_id": 5920
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventId": 8,
    "ProviderId": "{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}",
    "SessionName": "etw-smoke",
    "StatusCode": 3221225495
  },
  "message": "ETW_TASK_LOST_EVENT"
}

Event ID 20: Session

Channel: Operational
Task: Session

Fields #

Name	Description
`SessionGuid` GUID
`LoggerMode` UInt32
`SessionName` UnicodeString
`LogFileName` UnicodeString
`MinimumBuffers` UInt32
`MaximumBuffers` UInt32
`BufferSize` UInt32
`PeakBuffersCount` UInt32
`CurrentBuffersCount` UInt32
`FlushThreshold` UInt32
`EventsLost` UInt32
`BuffersLost` UInt32
`RealTimeBuffersLost` UInt32
`LoggerId` UInt32

Event ID 21: SavePersistedLoggerStart_8_1

Channel: Operational
Task: SavePersistedLogger
Opcode: Start_8_1

Event ID 22: SavePersistedLoggerStop_8_2_V1

Channel: Operational
Task: SavePersistedLogger
Opcode: Stop_8_2

Fields #

Name	Description
`FileName` UnicodeString
`BufferSize` UInt32
`BuffersPersisted` UInt32
`BuffersWritten` UInt32
`Status` UInt32	NTSTATUS reference
`BuffersLost` UInt32

Event ID 23: Error saving soft restart persisted log "FileName" Error: Status.

Channel: Admin
Task: SavePersistedLogger

Message #

Error saving soft restart persisted log "%1" Error: %5

Fields #

Name	Description
`FileName` UnicodeString
`BufferSize` UInt32
`BuffersPersisted` UInt32
`BuffersWritten` UInt32
`Status` UInt32	NTSTATUS reference
`BuffersLost` UInt32

Event ID 24: GUID Entry

Channel: Operational
Task: GUIDEntry

Fields #

Name	Description
`GUID` GUID
`FilterFlags` UInt32
`LastEnableLoggerId` UInt16

Event ID 25: Provider Group Entry

Channel: Operational
Task: ProviderGroupEntry

Fields #

Name	Description
`GUID` GUID
`FilterFlags` UInt32
`LastEnableLoggerId` UInt16

Event ID 26: Enable Info

Channel: Operational
Task: EnableInfo

Fields #

Name	Description
`GUID` GUID
`Index` UInt8
`LoggerId` UInt16
`MatchAnyKeyword` UInt64
`MatchAllKeyword` UInt64
`Level` UInt8
`EnableProperty` UInt32

Event ID 27: Provider

Channel: Operational
Task: Provider

Fields #

Name	Description
`ProviderGUID` GUID
`GroupGUID` GUID
`Flags` UInt16
`EnableMask` UInt8
`GroupEnableMask` UInt8
`ProcessId` UInt32

Event ID 28: Error setting traits on Provider ProviderGuid.

Channel: Admin
Level: Error
Task: Provider
Opcode: SetProviderTraits

Description

Error setting traits on Provider ProviderGuid. Error: ErrorCode.

Message #

Error setting traits on Provider %1. Error: %2

Fields #

Name	Description
`ProviderGuid` GUID
`ErrorCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2",
    "event_source_name": "",
    "event_id": 28,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 25,
    "keywords": 9223372036854778400,
    "time_created": "2026-03-11T06:27:22.550118+00:00",
    "event_record_id": 54,
    "correlation": {},
    "execution": {
      "process_id": 740,
      "thread_id": 808
    },
    "channel": "Microsoft-Windows-Kernel-EventTracing/Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProviderGuid": "77811378-E885-4AC2-A580-BC86E4F1BC93",
    "ErrorCode": 3221225477
  },
  "message": ""
}

Event ID 29: A registration for Provider ProviderGuid has joined Provider Group ProviderGroupGuid.

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Provider
Opcode: JoinProviderGroup

Message #

A registration for Provider %1 has joined Provider Group %2

Fields #

Name	Description
`ProviderGuid` GUID
`ProviderGroupGuid` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 29,
    "version": 0,
    "level": 5,
    "task": 3,
    "opcode": 26,
    "keywords": "0x4000000000000A20",
    "time_created": "2026-06-02T05:26:17.679+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 22588,
      "thread_id": 5920
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProviderGroupGuid": "{4F50731A-89CF-4782-B3E0-DCE8C90476BA}",
    "ProviderGuid": "{44E18DB2-6CFD-4A07-8FE7-6073794C531A}"
  },
  "message": "ETW_TASK_PROVIDER"
}

Event ID 30: Provider ProviderGuid from process ProcessId does not have permission to write events to session "SessionName".

Channel: Analytic
Task: Provider

Description

Provider ProviderGuid from process ProcessId does not have permission to write events to session "SessionName". Error: Status.

Message #

Provider %1 from process %3 does not have permission to write events to session "%2". Error: %4

Fields #

Name	Description
`ProviderGuid` GUID
`SessionName` UnicodeString
`ProcessId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 31: ETW_TASK_LOST_TLG_EVENT

Channel: Operational
Also via: realtime ETW trace
Level: Error
Task: LostTraceLoggingEvent
Opcode: win:Info

Fields #

Name	Description
`ProviderId` GUID
`StatusCode` UInt32	NTSTATUS reference
`EventName` AnsiString
`SessionName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 31,
    "version": 0,
    "level": 2,
    "task": 10,
    "opcode": 0,
    "keywords": "0x0000000000000040",
    "time_created": "2026-06-02T05:54:45.135+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 9204,
      "thread_id": 14120
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventName": "DCsInUseOnProcessExit",
    "ProviderId": "{7E6B69B9-2AEC-4FB3-9426-69A0F2B61A86}",
    "SessionName": "WinDiag-Realtime-Session",
    "StatusCode": 3221225495
  },
  "message": "ETW_TASK_LOST_TLG_EVENT"
}

Event ID 32: Failed to read debug info for WPP provider ProviderGuid from process ProcessId for session "SessionName".

Channel: Admin
Task: Provider

Description

Failed to look up debug info for provider ProviderGuid from process ProcessId for session "SessionName". Error: Status. Either the debug data could not be found, or the debug data is inaccessible because the image registering the provider is malformed.

Message #

Failed to read debug info for WPP provider %1 from process %3 for session "%2". Error: %4. The image registering the provider may be malformed or may be an unsupported format (e.g. managed C++). ETW traces for this session will not include the image's debug information.

Fields #

Name	Description
`ProviderGuid` GUID
`SessionName` UnicodeString
`ProcessId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 33: Lost WPP Event

Channel: Operational
Task: LostWPPEvent

Fields #

Name	Description
`MessageGuid` GUID
`MessageNumber` UInt16
`StatusCode` UInt32	NTSTATUS reference
`SessionName` UnicodeString

Event ID 34: Lost System Event

Channel: Operational
Task: LostSystemEvent

Fields #

Name	Description
`HookId` UInt16
`StatusCode` UInt32	NTSTATUS reference
`SessionName` UnicodeString

Event ID 35: Session

Channel: Analytic
Task: Session

Fields #

Name	Description
`LoggerSlotsUsed` UInt64

Event ID 40: The enable state for Provider ProviderName is about to change on session "SessionName".

Channel: Analytic
Task: Provider
Opcode: Enable

Message #

The enable state for Provider %1 is about to change on session "%2".

Fields #

Name	Description
`ProviderName` GUID
`SessionName` UnicodeString
`MatchAnyKeyword` UInt64
`MatchAllKeyword` UInt64
`EnableProperty` UInt32
`Level` UInt8

Event ID 41: Provider ProviderName is about to be disabled from session "SessionName".

Channel: Analytic
Also via: realtime ETW trace
Level: Verbose
Task: Provider
Opcode: Disable

Message #

Provider %1 is about to be disabled from session "%2".

Fields #

Name	Description
`ProviderName` GUID
`SessionName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-EventTracing",
    "guid": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "event_source_name": "",
    "event_id": 41,
    "version": 0,
    "level": 5,
    "task": 3,
    "opcode": 19,
    "keywords": "0x4000000000000420",
    "time_created": "2026-06-02T05:26:27.724+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 11436,
      "thread_id": 15308
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProviderName": "{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}",
    "SessionName": "etw-cap-driven-b19010"
  },
  "message": "ETW_TASK_PROVIDER"
}

Event ID 42: Capture state requested for provider GUID on session "LoggerId".

Channel: Analytic
Task: Provider
Opcode: CaptureState

Message #

Capture state requested for provider %1 on session "%2".

Fields #

Name	Description
`GUID` GUID
`LoggerId` UInt16
`MatchAnyKeyword` UInt64
`MatchAllKeyword` UInt64
`Level` UInt8
`EnableProperty` UInt32

Event ID 43: Session "SessionName" could not be started because LOGGER_FLAG_LARGE_MDL_PAGES is not supported.

Channel: Analytic
Task: Session
Opcode: Start

Message #

Session "%3" could not be started because LOGGER_FLAG_LARGE_MDL_PAGES is not supported.

Fields #

Name	Description
`SessionGuid` GUID
`LoggerMode` UInt32
`SessionName` UnicodeString
`LogFileName` UnicodeString

Event ID 44: Session "SessionName" could not be started because because the maximum MaximumAllowed logging sessions are already active on the system.

Channel: Analytic
Task: Session
Opcode: Start

Message #

Session "%1" could not be started because because the maximum %2 logging sessions are already active on the system.

Fields #

Name	Description
`SessionName` UnicodeString
`MaximumAllowed` UInt32

Event ID 45: Session "SessionName" could not be started because because the maximum MaximumAllowed EVENT_TRACE_SYSTEM_LOGGER_MODE logging sessions are already active on the system.

Channel: Analytic
Task: Session
Opcode: Start

Message #

Session "%1" could not be started because because the maximum %2 EVENT_TRACE_SYSTEM_LOGGER_MODE logging sessions are already active on the system.

Fields #

Name	Description
`SessionName` UnicodeString
`MaximumAllowed` UInt32

Event ID 46: Session "SessionName" could not be started because the process failed its access check to the SessionGuid.

Channel: Analytic
Task: Session
Opcode: Start

Message #

Session "%1" could not be started because the process failed its access check to the SessionGuid.

Fields #

Name	Description
`SessionName` UnicodeString
`SessionGuid` GUID
`DesiredAccess` UInt32	Process access rights reference

Event ID 47: Session "SessionName" could not be started because the Memory Partition Handle MemoryPartitionHandle is invalid.

Channel: Analytic
Task: Session
Opcode: Start

Message #

Session "%1" could not be started because the Memory Partition Handle %2 is invalid.

Fields #

Name	Description
`SessionName` UnicodeString
`MemoryPartitionHandle` Pointer

Event ID 48: Session "SessionName" failed to create file FileName with error ErrorCode.

Channel: Analytic
Task: Session

Message #

Session "%1" failed to create file %2 with error %3.

Fields #

Name	Description
`SessionName` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`LoggingMode` UInt32

Event ID 49: Session "SessionName" could not be started because the process lacks the profiling privilege.

Channel: Analytic
Task: Session
Opcode: Start

Message #

Session "%1" could not be started because the process lacks the profiling privilege.

Fields #

Name	Description
`SessionName` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`LoggingMode` UInt32

Event ID 50: Group Mask could not be updated for Session "SessionName", because the requested Group Mask is not supported.

Channel: Analytic
Task: Session
Opcode: Enable

Message #

Group Mask could not be updated for Session "%1", because the requested Group Mask is not supported.

Fields #

Name	Description
`SessionName` UnicodeString
`RequestedGroupMask` UInt32
`PermittedGroupMask` UInt32

Provenance

ETW provider GUID {B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB