Microsoft-Windows-MiStreamProvider

Event	Title	Channel	Sample	Rule
1000	Provider loaded.	Operational	N	N
1001	Provider unloaded.	Operational	N	N
1010	Collect started.	Operational	N	N
1011	Collect error.	Operational	N	N
1012	Collect stopped.	Operational	N	N
1013	Collect pipeline error started.	Operational	N	N
1014	Collect pipeline error.	Operational	N	N
1015	Collect pipeline OnComplete started.	Operational	N	N
1016	Collect pipeline OnComplete stopped.	Operational	N	N
1017	Collect pipeline OnNext started.	Operational	N	N
1018	Collect pipeline OnNext stopped.	Operational	N	N
1019	Collect pipeline release started.	Operational	N	N
1020	Collect pipeline release stopped.	Operational	N	N
1030	Push started.	Operational	N	N
1031	Push error.	Operational	N	N
1032	Push stopped.	Operational	N	N
1033	Push pipeline error started.	Operational	N	N
1034	Push pipeline error.	Operational	N	N
1035	Push pipeline release started.	Operational	N	N
1036	Push pipeline release stopped.	Operational	N	N
1040	Flush started.	Operational	N	N
1041	Flush error.	Operational	N	N
1042	Flush stopped.	Operational	N	N
1050	Flush started.	Operational	N	N
1051	Flush stopped.	Operational	N	N
1052	Connection info.	Operational	N	N
1053	Getting filename for KVP write.	Operational	N	N
1054	Filename for KVP write: message.	Operational	N	N
1055	Cleaning up cached files older than result days.	Operational	N	N
1056	Deleting cached file: message.	Operational	N	N
1057	Data is being collected locally because the Target URI and/or Certificate …	Operational	N	N
1060	Creating pipeline from .	Operational	N	N
1061	Creating pipeline from.	Operational	N	N
1062	Creating push pipeline started.	Operational	N	N
1063	Creating push pipeline stopped.	Operational	N	N
1501	Http client loaded.	Operational	N	N
1502	Http client unloaded.	Operational	N	N
1503	Http Session opened.	Debug	N	N
1504	Failed to enumerate directory to upload.	Debug	N	N
1505	Failed to read file.	Operational	N	N
1506	Failed to add headers to HTTP request.	Operational	N	N
1507	Failed to load certificates.	Operational	N	N
1508	Failed to send Http request.	Operational	N	N
1509	Failed to delete file.	Operational	N	N
1510	Invalid status received from server.	Operational	N	N
1511	callback status request error.	Operational	N	N
1512	Failed to write file stream.	Operational	N	N
1513	Cannot use the client certificate specified.	Operational	N	N
1514	One or more errors were found in the Secure Sockets Layer (SSL) certificate sent …	Operational	N	N

Event ID 1000: Provider loaded.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1001: Provider unloaded.

Channel: Operational
Task: Lifetime
Opcode: Stop

Event ID 1010: Collect started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1011: Collect error.

Channel: Operational
Task: Lifetime

Description

Collect error. Error code: error, Message: message.

Message #

Collect error. Error code: %1, Message: %2

Fields #

Name	Description
`error` UInt32
`message` UnicodeString

Event ID 1012: Collect stopped.

Channel: Operational
Task: Lifetime
Opcode: Stop

Event ID 1013: Collect pipeline error started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1014: Collect pipeline error.

Channel: Operational
Task: Lifetime

Description

Collect pipeline error. Error code: error, Message: message.

Message #

Collect pipeline error. Error code: %1, Message: %2

Fields #

Name	Description
`error` UInt32
`message` UnicodeString

Event ID 1015: Collect pipeline OnComplete started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1016: Collect pipeline OnComplete stopped.

Channel: Operational
Task: Lifetime
Opcode: Stop

Event ID 1017: Collect pipeline OnNext started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1018: Collect pipeline OnNext stopped.

Channel: Operational
Task: Lifetime
Opcode: Stop

Event ID 1019: Collect pipeline release started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1020: Collect pipeline release stopped.

Channel: Operational
Task: Lifetime
Opcode: Stop

Event ID 1030: Push started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1031: Push error.

Channel: Operational
Task: Lifetime

Description

Push error. Error code: error, Message: message.

Message #

Push error. Error code: %1, Message: %2

Fields #

Name	Description
`error` UInt32
`message` UnicodeString

Event ID 1032: Push stopped.

Channel: Operational
Task: Lifetime
Opcode: Stop

Event ID 1033: Push pipeline error started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1034: Push pipeline error.

Channel: Operational
Task: Lifetime

Description

Push pipeline error. Error code: error, Message: message.

Message #

Push pipeline error. Error code: %1, Message: %2

Fields #

Name	Description
`error` UInt32
`message` UnicodeString

Event ID 1035: Push pipeline release started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1036: Push pipeline release stopped.

Channel: Operational
Task: Lifetime
Opcode: Stop

Event ID 1040: Flush started.

Channel: Operational
Task: Lifetime
Opcode: Start

Event ID 1041: Flush error.

Channel: Operational
Task: Lifetime

Description

Flush error. Error code: error, Message: message.

Message #

Flush error. Error code: %1, Message: %2

Fields #

Name	Description
`error` UInt32
`message` UnicodeString

Event ID 1042: Flush stopped.

Channel: Operational
Task: Lifetime
Opcode: Stop

Event ID 1050: Flush started.

Channel: Operational
Task: Flush
Opcode: Start

Event ID 1051: Flush stopped.

Channel: Operational
Task: Flush
Opcode: Stop

Event ID 1052: Connection info.

Channel: Operational
Task: Flush

Description

Connection info. Target URI: message.

Message #

Connection info. Target URI: %1

Fields #

Name	Description
`message` UnicodeString

Event ID 1053: Getting filename for KVP write.

Channel: Operational
Task: Flush
Opcode: Start

Description

Getting filename for KVP write. Is guest server: result.

Message #

Getting filename for KVP write. Is guest server: %1

Fields #

Name	Description
`result` UInt32

Event ID 1054: Filename for KVP write: message.

Channel: Operational
Task: Flush

Message #

Filename for KVP write: %1

Fields #

Name	Description
`message` UnicodeString

Event ID 1055: Cleaning up cached files older than result days.

Channel: Operational
Task: Flush

Message #

Cleaning up cached files older than %1 days.

Fields #

Name	Description
`result` UInt32

Event ID 1056: Deleting cached file: message.

Channel: Operational
Task: Flush

Message #

Deleting cached file: %1

Fields #

Name	Description
`message` UnicodeString

Event ID 1057: Data is being collected locally because the Target URI and/or Certificate Thumbprint is not set.

Channel: Operational
Task: Flush

Event ID 1060: Creating pipeline from .

Channel: Operational
Task: Lifetime

Description

Creating pipeline from .mof started. Filename: message.

Message #

Creating pipeline from .mof started. Filename: %1

Fields #

Name	Description
`message` UnicodeString

Event ID 1061: Creating pipeline from.

Channel: Operational
Task: Lifetime

Description

Creating pipeline from .mof stopped.

Message #

Creating pipeline from .mof stopped.

Event ID 1062: Creating push pipeline started.

Channel: Operational
Task: Lifetime

Event ID 1063: Creating push pipeline stopped.

Channel: Operational
Task: Lifetime

Event ID 1501: Http client loaded.

Channel: Operational
Task: HttpClient
Opcode: Start

Event ID 1502: Http client unloaded.

Channel: Operational
Task: HttpClient
Opcode: Start

Event ID 1503: Http Session opened.

Channel: Debug
Task: HttpClient
Opcode: Start

Event ID 1504: Failed to enumerate directory to upload.

Channel: Debug
Task: HttpClient

Event ID 1505: Failed to read file.

Channel: Operational
Task: HttpClient

Description

Failed to read file. Error: error, File: fileName.

Message #

Failed to read file. Error: %1, File: %2

Fields #

Name	Description
`error` UInt32
`fileName` UnicodeString

Event ID 1506: Failed to add headers to HTTP request.

Channel: Operational
Task: HttpClient

Description

Failed to add headers to HTTP request. Error: error.

Message #

Failed to add headers to HTTP request. Error: %1

Fields #

Name	Description
`error` UInt32

Event ID 1507: Failed to load certificates.

Channel: Operational
Task: HttpClient

Description

Failed to load certificates. Error: error.

Message #

Failed to load certificates. Error: %1

Fields #

Name	Description
`error` UInt32

Event ID 1508: Failed to send Http request.

Channel: Operational
Task: HttpClient

Description

Failed to send Http request. Error: error.

Message #

Failed to send Http request. Error: %1

Fields #

Name	Description
`error` UInt32

Event ID 1509: Failed to delete file.

Channel: Operational
Task: HttpClient

Description

Failed to delete file. Error: error, File: fileName.

Message #

Failed to delete file. Error: %1, File: %2

Fields #

Name	Description
`error` UInt32
`fileName` UnicodeString

Event ID 1510: Invalid status received from server.

Channel: Operational
Task: HttpClient

Description

Invalid status received from server. Error: error.

Message #

Invalid status received from server. Error: %1

Fields #

Name	Description
`error` UInt32

Event ID 1511: callback status request error.

Channel: Operational
Task: HttpClient

Description

callback status request error. Error: error.

Message #

callback status request error. Error: %1

Fields #

Name	Description
`error` UInt32

Event ID 1512: Failed to write file stream.

Channel: Operational
Task: HttpClient

Description

Failed to write file stream. Error: error.

Message #

Failed to write file stream. Error: %1

Fields #

Name	Description
`error` UInt32

Event ID 1513: Cannot use the client certificate specified.

Channel: Operational
Task: HttpClient

Description

Cannot use the client certificate specified. Error: Certificate expired.

Message #

Cannot use the client certificate specified. Error: Certificate expired.

Event ID 1514: One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server.

Channel: Operational
Task: HttpClient

Description

One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server. The errors are: message.

Message #

One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server. The errors are: %1

Fields #

Name	Description
`message` UnicodeString

Provenance

ETW provider GUID 018c05b7-0e3b-4c5a-9ab2-553ba1489332

Defined in mistreamprov.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB