Microsoft-Windows-Kernel-WHEA

33 events across 3 channels

Event	Title	Channel	Sample
1	A non-fatal hardware error occurred.	System	N
2	A fatal hardware error occurred.	System	N
3	A non-fatal hardware error occurred.	Errors	N
4	A fatal hardware error occurred.	Errors	N
5	WHEA successfully initialized.	Operational	Y
6	Machine Check Event reported is a fatal memory hierarchy error.	System	N
7	Machine Check Event reported is a memory hierarchy error.	Errors	N
8	Machine Check Event reported is a fatal TLB error.	System	N
9	Machine Check Event reported is a TLB error.	Errors	N
10	Machine Check Event reported is a fatal Bus or Interconnect error.	System	N
11	Machine Check Event reported is a Bus or Interconnect error.	Errors	N
12	Machine Check Event reported is a fatal Bus or Interconnect timeout error.	System	N
13	Machine Check Event reported is a Bus or Interconnect timeout error.	Errors	N
14	Machine Check Event reported is a fatal internal watchdog timer error.	System	N
15	Machine Check Event reported is a fatal microcode ROM parity error.	Errors	N
16	Machine Check Event reported is a fatal condition.	System	N
17	Machine Check Event reported is a fatal functional redundancy check error.	System	N
18	PCI Express reported a fatal error.	System	N
19	PCI Express reported a non-fatal error.	Errors	N
20	WHEA Event	Errors	N
21	WHEA Event	Errors	N
31	The memory page located at physical address PhysicalAddress Pending …	System	N
32	task_032	Operational	N
33	task_033	Operational	N
34	task_034	Operational	N
35	task_0Stop	Operational	N
36	task_036	Operational	N
37	task_037	Operational	N
38	task_038	Operational	N
39	task_039	Operational	N
40	task_040	Operational	N
41	A processs was terminated due to an uncorrected hardware error.	System	N
42	WHEA event log entry	Operational	Y

Event ID 1: A non-fatal hardware error occurred.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

A non-fatal hardware error occurred.

Message #

A non-fatal hardware error occurred.

Fields #

Name	Description
`Signature` UInt32
`Revision` UInt16
`Reserved1` UInt16
`Reserved2` UInt16
`SectionCount` UInt16
`Severity` UInt32
`ValidationBits` UInt32
`Length` UInt32
`Timestamp` UInt64
`PlatformId` GUID
`PartitionId` GUID
`CreatorId` GUID
`NotifyType` GUID
`RecordId` UInt64
`Flags` UInt32
`RawData` Binary

Event ID 2: A fatal hardware error occurred.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

A fatal hardware error occurred.

Message #

A fatal hardware error occurred.

Fields #

Name	Description
`Signature` UInt32
`Revision` UInt16
`Reserved1` UInt16
`Reserved2` UInt16
`SectionCount` UInt16
`Severity` UInt32
`ValidationBits` UInt32
`Length` UInt32
`Timestamp` UInt64
`PlatformId` GUID
`PartitionId` GUID
`CreatorId` GUID
`NotifyType` GUID
`RecordId` UInt64
`Flags` UInt32
`RawData` Binary

Event ID 3: A non-fatal hardware error occurred.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

A non-fatal hardware error occurred.

Message #

A non-fatal hardware error occurred.

Fields #

Name	Description
`Signature` UInt32
`Revision` UInt16
`Reserved1` UInt16
`Reserved2` UInt16
`SectionCount` UInt16
`Severity` UInt32
`ValidationBits` UInt32
`Length` UInt32
`Timestamp` UInt64
`PlatformId` GUID
`PartitionId` GUID
`CreatorId` GUID
`NotifyType` GUID
`RecordId` UInt64
`Flags` UInt32
`RawData` Binary

Event ID 4: A fatal hardware error occurred.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

A fatal hardware error occurred.

Message #

A fatal hardware error occurred.

Fields #

Name	Description
`Signature` UInt32
`Revision` UInt16
`Reserved1` UInt16
`Reserved2` UInt16
`SectionCount` UInt16
`Severity` UInt32
`ValidationBits` UInt32
`Length` UInt32
`Timestamp` UInt64
`PlatformId` GUID
`PartitionId` GUID
`CreatorId` GUID
`NotifyType` GUID
`RecordId` UInt64
`Flags` UInt32
`RawData` Binary

Event ID 5: WHEA successfully initialized.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational
Level: Informational

Description

WHEA successfully initialized.

Message #

WHEA successfully initialized.
   %1 error sources are active
   Error record format version is %2.

Fields #

Name	Description
`ErrorSourceCount` UInt32
`ErrorRecordFormat` UInt32
`ErrorSourceTableLength` UInt32
`ErrorSourceTable` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-WHEA",
    "guid": "{7B563579-53C8-44E7-8236-0F87B9FE6594}",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-05-29T16:32:45.1995745+00:00",
    "event_record_id": 79,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-Kernel-WHEA/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorSourceCount": "5",
    "ErrorRecordFormat": "10",
    "ErrorSourceTableLength": "5360",
    "ErrorSourceTable": "209A313A85D3FFFF28B8AE5A03F8FFFF00000000000000000000000001000000F82900005768656110000000000000000000293885D3FFFF0000000000000000030000007C0D0000000000000000000000000000000000000000000000000000CC0300000B00000010000000020000002C0D00000100000003000000010000000000000000000000000000003C60C1835215A74887D114D9467D776550530000D80E0000010000001090283885D3FFFFC0ECFA5C03F8FFFFD0ECFA5C03F8FFFF50F1175A03F8FFFF8D7C2157665EFB4480339B74CACEDF5B00000000000000000000000000000000640400000100000090E1323885D3FFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000208A313A85D3FFFFB063303885D3FFFF00000000000000000000000008000000481000005768656100000000000000000050363A85D3FFFF00000000000000000900000074010000000000000000000000000000000000000000000000000000CC0300000A000000000000000200000041010000080000000900000002000000000000000000008000000106000000000000000000000000FFFFFFFFFFFFFFFF0001000000040000010400000204000003040000FFFFFFFFFFFFFFFF0101000004040000050400000604000007040000FFFFFFFFFFFFFFFF0201000008040000090400000A0400000B040000FFFFFFFFFFFFFFFF030100000C0400000D0400000E0400000F040000FFFFFFFFFFFFFFFF0401000010040000110400001204000013040000FFFFFFFFFFFFFFFF0501000014040000150400001604000017040000FFFFFFFFFFFFFFFF0601000018040000190400001A0400001B040000FFFFFFFFFFFFFFFF070100001C0400001D0400001E0400001F040000FFFFFFFFFFFFFFFF0801000020040000210400002204000023040000FFFFFFFFFFFFFFFF0901000024040000250400002604000027040000FFFFFFFFFFFFFFFF0A01000028040000290400002A0400002B040000FFFFFFFFFFFFFFFF0B0100002C0400002D0400002E0400002F040000FFFFFFFFFFFFFFFF0C01000030040000310400003204000033040000FFFFFFFFFFFFFFFF0D01000034040000350400003604000037040000FFFFFFFFFFFFFFFF0E01000038040000390400003A0400003B040000FFFFFFFFFFFFFFFF0F0100003C0400003D0400003E0400003F040000FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E029303885D3FFFF209A313A85D3FFFF000000000000000000000000030000004810000057686561010000000000000000A0203885D3FFFF00000000000000000900000074010000000000000000000000000000000000000000000000000000CC0300000A00000001000000020000004101000003000000090000000300000000000000000000800100010600000000001C000060EA000000000000000000000000000000000000000000000001000000040000010400000204000003040000FFFFFFFFFFFFFFFF0101000004040000050400000604000007040000FFFFFFFFFFFFFFFF0201000008040000090400000A0400000B040000FFFFFFFFFFFFFFFF030100000C0400000D0400000E0400000F040000FFFFFFFFFFFFFFFF0401000010040000110400001204000013040000FFFFFFFFFFFFFFFF0501000014040000150400001604000017040000FFFFFFFFFFFFFFFF0601000018040000190400001A0400001B040000FFFFFFFFFFFFFFFF070100001C0400001D0400001E0400001F040000FFFFFFFFFFFFFFFF0801000020040000210400002204000023040000FFFFFFFFFFFFFFFF0901000024040000250400002604000027040000FFFFFFFFFFFFFFFF0A01000028040000290400002A0400002B040000FFFFFFFFFFFFFFFF0B0100002C0400002D0400002E0400002F040000FFFFFFFFFFFFFFFF0C01000030040000310400003204000033040000FFFFFFFFFFFFFFFF0D01000034040000350400003604000037040000FFFFFFFFFFFFFFFF0E01000038040000390400003A0400003B040000FFFFFFFFFFFFFFFF0F0100003C0400003D0400003E0400003F040000FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E099D73785D3FFFF208A313A85D3FFFF00000000000000000000000001000000C006000057686561030000000000000060D2363A85D3FFFF000000000000000001000000C0010000000000000000000000000000000000000000000000000000CC0300000A000000030000000200000000010000010000000300000004000000000000000000008002000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028B8AE5A03F8FFFFE029303885D3FFFF0000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000CC0300000A0000000700000002000000001000000100000008000000050000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  },
  "message": "WHEA successfully initialized.\r\n   5 error sources are active\r\n   Error record format version is 10."
}

Event ID 6: Machine Check Event reported is a fatal memory hierarchy error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal memory hierarchy error.

Message #

Machine Check Event reported is a fatal memory hierarchy error.
 Trasaction Type: %1
 Memory Hierarchy Level: %5
 Request Type: %3
 Address: %6

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 7: Machine Check Event reported is a memory hierarchy error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a memory hierarchy error.

Message #

Machine Check Event reported is a memory hierarchy error.
 Trasaction Type: %1
 Memory Hierarchy Level: %5
 Request Type: %3
 Address: %6

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 8: Machine Check Event reported is a fatal TLB error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal TLB error.

Message #

Machine Check Event reported is a fatal TLB error.
 Transaction Type: %1
 Memory Hierarchy Level: %5
 Address: %6

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 9: Machine Check Event reported is a TLB error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a TLB error.

Message #

Machine Check Event reported is a TLB error.
 Transaction Type: %1
 Memory Hierarchy Level: %5
 Address: %6

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 10: Machine Check Event reported is a fatal Bus or Interconnect error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal Bus or Interconnect error.

Message #

Machine Check Event reported is a fatal Bus or Interconnect error.
 Memory Hierarchy Level: %5
 Participation: %2
 Request Type: %3
 Memory/IO: %4
 Address: %6

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 11: Machine Check Event reported is a Bus or Interconnect error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a Bus or Interconnect error.

Message #

Machine Check Event reported is a Bus or Interconnect error.
 Memory Hierarchy Level: %5
 Participation: %2
 Request Type: %3
 Memory/IO: %4
 Address: %6

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 12: Machine Check Event reported is a fatal Bus or Interconnect timeout error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal Bus or Interconnect timeout error.

Message #

Machine Check Event reported is a fatal Bus or Interconnect timeout error.
 Memory Hierarchy Level: %5
 Participation: %2
 Request Type: %3
 Memory/IO: %4
 Address: %6

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 13: Machine Check Event reported is a Bus or Interconnect timeout error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a Bus or Interconnect timeout error.

Message #

Machine Check Event reported is a Bus or Interconnect timeout error.
 Memory Hierarchy Level: %5
 Participation: %2
 Request Type: %3
 Memory/IO: %4
 Address: %6

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 14: Machine Check Event reported is a fatal internal watchdog timer error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal internal watchdog timer error.

Message #

Machine Check Event reported is a fatal internal watchdog timer error.

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 15: Machine Check Event reported is a fatal microcode ROM parity error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

Machine Check Event reported is a fatal microcode ROM parity error.

Message #

Machine Check Event reported is a fatal microcode ROM parity error.

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 16: Machine Check Event reported is a fatal condition.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal condition. A processor received an external signal that an unrecoverable error has occurred.

Message #

Machine Check Event reported is a fatal condition. A processor received an external signal that an unrecoverable error has occurred.

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 17: Machine Check Event reported is a fatal functional redundancy check error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

Machine Check Event reported is a fatal functional redundancy check error.

Message #

Machine Check Event reported is a fatal functional redundancy check error.

Fields #

Name	Description
`TransactionType` UInt32
`Participation` UInt32
`RequestType` UInt32
`MemorIO` UInt32
`MemHierarchyLvl` UInt32
`Address` UInt64
`Length` UInt32
`RawData` Binary

Event ID 18: PCI Express reported a fatal error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

PCI Express reported a fatal error.

Message #

PCI Express reported a fatal error.
 Device Identifier: Bus %1 Device %2 Function %3
 Uncorrectable Error Status: %4
 Correctable Error Status: %5
 Header Log: %6 %7 %8 %9

Fields #

Name	Description
`SourceIdBus` UInt32
`SourceIdDev` UInt32
`SourceIdFun` UInt32
`UncorrectableErrorStatus` UInt32
`CorrectableErrorStatus` UInt32
`HeaderLog0` UInt32
`HeaderLog1` UInt32
`HeaderLog2` UInt32
`HeaderLog3` UInt32
`Length` UInt32
`RawData` Binary

Event ID 19: PCI Express reported a non-fatal error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

PCI Express reported a non-fatal error.

Message #

PCI Express reported a non-fatal error.
 Device Identifier: Bus %1 Device %2 Function %3
 Uncorrectable Error Status: %4
 Correctable Error Status: %5
 Header Log: %6 %7 %8 %9

Fields #

Name	Description
`SourceIdBus` UInt32
`SourceIdDev` UInt32
`SourceIdFun` UInt32
`UncorrectableErrorStatus` UInt32
`CorrectableErrorStatus` UInt32
`HeaderLog0` UInt32
`HeaderLog1` UInt32
`HeaderLog2` UInt32
`HeaderLog3` UInt32
`Length` UInt32
`RawData` Binary

Event ID 20: WHEA Event

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

WHEA Event.

Message #

WHEA Event

Fields #

Name	Description
`Length` UInt32
`RawData` Binary

Event ID 21: WHEA Event

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Errors

Description

WHEA Event.

Message #

WHEA Event

Fields #

Name	Description
`RecordId` UInt32
`SeqNum` UInt32
`Length` UInt32
`RawData` Binary

Event ID 31: The memory page located at physical address PhysicalAddress Pending PlatformDirected Uncorrected.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

The memory page located at physical address PhysicalAddress Pending PlatformDirected Uncorrected. Persisted.

Message #

The memory page located at physical address %1 %2 %3 %4. %5

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Pending` UInt8
`PlatformDirected` UInt8
`Uncorrected` UInt8
`Persisted` UInt8

Event ID 32: task_032

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmSid` SID
`SqmWindowsSessionId` UInt32
`SqmSessionFlags` UInt32

Event ID 33: task_033

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID

Event ID 34: task_034

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 35: task_0Stop

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational
Opcode: Stop

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 36: task_036

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 37: task_037

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 38: task_038

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 39: task_039

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmStringDatapointValue` UnicodeString

Event ID 40: task_040

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmStreamRowLength` UInt32
`SqmStreamRow` Int16

Event ID 41: A processs was terminated due to an uncorrected hardware error.

Provider: Microsoft-Windows-Kernel-WHEA
Channel: System

Description

A processs was terminated due to an uncorrected hardware error.

Message #

A processs was terminated due to an uncorrected hardware error.
 Process ID: %1
 Image name: %2

Fields #

Name	Description
`ProcessId` UInt32
`ProcessName` UnicodeString

Event ID 42: WHEA event log entry

Provider: Microsoft-Windows-Kernel-WHEA
Channel: Operational
Level: Informational

Description

WHEA event log entry.

Message #

WHEA event log entry

Fields #

Name	Description
`Type` UInt32
`Owner` UInt32
`Id` UInt32
`Flags` UInt32
`Length` UInt32
`RawData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-WHEA",
    "guid": "{7B563579-53C8-44E7-8236-0F87B9FE6594}",
    "event_source_name": "",
    "event_id": 42,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213694976,
    "time_created": "2026-05-29T16:32:45.1995790+00:00",
    "event_record_id": 80,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "Microsoft-Windows-Kernel-WHEA/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Type": "0",
    "Owner": "1280201291",
    "Id": "2147483650",
    "Flags": "2",
    "Length": "5392",
    "RawData": "57684C670100000010150000000000004B524E4C0200008002000000F0140000209A313A85D3FFFF28B8AE5A03F8FFFF00000000000000000000000001000000F82900005768656110000000000000000000293885D3FFFF0000000000000000030000007C0D0000000000000000000000000000000000000000000000000000CC0300000B00000010000000020000002C0D00000100000003000000010000000000000000000000000000003C60C1835215A74887D114D9467D776550530000D80E0000010000001090283885D3FFFFC0ECFA5C03F8FFFFD0ECFA5C03F8FFFF50F1175A03F8FFFF8D7C2157665EFB4480339B74CACEDF5B00000000000000000000000000000000640400000100000090E1323885D3FFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000208A313A85D3FFFFB063303885D3FFFF00000000000000000000000008000000481000005768656100000000000000000050363A85D3FFFF00000000000000000900000074010000000000000000000000000000000000000000000000000000CC0300000A000000000000000200000041010000080000000900000002000000000000000000008000000106000000000000000000000000FFFFFFFFFFFFFFFF0001000000040000010400000204000003040000FFFFFFFFFFFFFFFF0101000004040000050400000604000007040000FFFFFFFFFFFFFFFF0201000008040000090400000A0400000B040000FFFFFFFFFFFFFFFF030100000C0400000D0400000E0400000F040000FFFFFFFFFFFFFFFF0401000010040000110400001204000013040000FFFFFFFFFFFFFFFF0501000014040000150400001604000017040000FFFFFFFFFFFFFFFF0601000018040000190400001A0400001B040000FFFFFFFFFFFFFFFF070100001C0400001D0400001E0400001F040000FFFFFFFFFFFFFFFF0801000020040000210400002204000023040000FFFFFFFFFFFFFFFF0901000024040000250400002604000027040000FFFFFFFFFFFFFFFF0A01000028040000290400002A0400002B040000FFFFFFFFFFFFFFFF0B0100002C0400002D0400002E0400002F040000FFFFFFFFFFFFFFFF0C01000030040000310400003204000033040000FFFFFFFFFFFFFFFF0D01000034040000350400003604000037040000FFFFFFFFFFFFFFFF0E01000038040000390400003A0400003B040000FFFFFFFFFFFFFFFF0F0100003C0400003D0400003E0400003F040000FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E029303885D3FFFF209A313A85D3FFFF000000000000000000000000030000004810000057686561010000000000000000A0203885D3FFFF00000000000000000900000074010000000000000000000000000000000000000000000000000000CC0300000A00000001000000020000004101000003000000090000000300000000000000000000800100010600000000001C000060EA000000000000000000000000000000000000000000000001000000040000010400000204000003040000FFFFFFFFFFFFFFFF0101000004040000050400000604000007040000FFFFFFFFFFFFFFFF0201000008040000090400000A0400000B040000FFFFFFFFFFFFFFFF030100000C0400000D0400000E0400000F040000FFFFFFFFFFFFFFFF0401000010040000110400001204000013040000FFFFFFFFFFFFFFFF0501000014040000150400001604000017040000FFFFFFFFFFFFFFFF0601000018040000190400001A0400001B040000FFFFFFFFFFFFFFFF070100001C0400001D0400001E0400001F040000FFFFFFFFFFFFFFFF0801000020040000210400002204000023040000FFFFFFFFFFFFFFFF0901000024040000250400002604000027040000FFFFFFFFFFFFFFFF0A01000028040000290400002A0400002B040000FFFFFFFFFFFFFFFF0B0100002C0400002D0400002E0400002F040000FFFFFFFFFFFFFFFF0C01000030040000310400003204000033040000FFFFFFFFFFFFFFFF0D01000034040000350400003604000037040000FFFFFFFFFFFFFFFF0E01000038040000390400003A0400003B040000FFFFFFFFFFFFFFFF0F0100003C0400003D0400003E0400003F040000FFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E099D73785D3FFFF208A313A85D3FFFF00000000000000000000000001000000C006000057686561030000000000000060D2363A85D3FFFF000000000000000001000000C0010000000000000000000000000000000000000000000000000000CC0300000A000000030000000200000000010000010000000300000004000000000000000000008002000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028B8AE5A03F8FFFFE029303885D3FFFF0000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000CC0300000A0000000700000002000000001000000100000008000000050000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  },
  "message": "WHEA event log entry"
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 7b563579-53c8-44e7-8236-0f87b9fe6594

Defined in PSHED.DLL, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4647, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)