detection.wiki

Microsoft-Windows-MsLbfoEventProvider

EventTitleChannelSampleRule
1Replacing Member OldMember with new Member NewMember for load balancing.OperationalNN
2Excluding Member Member from load balancing.OperationalNN
3Using Member Member for load balancing.OperationalNN
4Starting ConnectTimer for Member Member.OperationalNN
5Stopping to use Member Member for load balancing.OperationalNN
6Priming Switch for TeamNic TeamNic using Member Member.OperationalNN
7Failing NBL send on Member Member.OperationalNN
8Failing NBL send on TeamNic TeamNic.OperationalNN
9Dropping NBLs on Member Member.OperationalNN
10DriverEntry exiting, Status = Status.OperationalNN
11Member Member created.OperationalNN
12Aggregator Aggregator created.OperationalNN
13Member Member placed in Team TeamNic, Status = Status.OperationalNN
14Indicating new link state for TeamNic TeamNic.OperationalNN
15Default Aggregator for TeamNic TeamNic changed to Receiver.OperationalNN
16BroadcastReceiver for TeamNic TeamNic changed to Receiver.OperationalNN
17Initializing TeamNic TeamNic, Status = Status.OperationalNN
18Removing Aggregator Aggregator from TeamNic TeamNic.OperationalNN
19Removed Member Member from TeamNic TeamNic.OperationalNN
20Removing TeamNic TeamNic.OperationalNN
21MsLbfoProvider driver is unloading.OperationalNN
22Changing Aggregator for Member Member from OldAggregator to NewAggregator.OperationalNN
23LACP Initializing for Member Member, Status = Status.OperationalNN
24LACP de-initialized for Member Member.OperationalNN
25Received LACPDU on Member Member.OperationalNN
26LBFO LACP Member Member; ReceiveMachine: OldState->NewState.OperationalNN
27LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.OperationalNN
28LBFO LACP Member Member; Mux Machine: OldState->NewState.OperationalNN
29Sending LACPDU on Member Member.OperationalNN
30LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.OperationalNN
31LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: …OperationalNN
32LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.OperationalNN

Event ID 1: Replacing Member OldMember with new Member NewMember for load balancing.

#
Channel
Operational

Message #

Replacing Member %1 with new Member %2 for load balancing

Fields #

NameDescription
OldMember GUID
NewMember GUID

Event ID 2: Excluding Member Member from load balancing.

#
Channel
Operational

Message #

Excluding Member %1 from load balancing

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 3: Using Member Member for load balancing.

#
Channel
Operational

Message #

Using Member %1 for load balancing

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 4: Starting ConnectTimer for Member Member.

#
Channel
Operational

Message #

Starting ConnectTimer for Member %1

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 5: Stopping to use Member Member for load balancing.

#
Channel
Operational

Message #

Stopping to use Member %1 for load balancing

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 6: Priming Switch for TeamNic TeamNic using Member Member.

#
Channel
Operational

Message #

Priming Switch for TeamNic %1 using Member %2

Fields #

NameDescription
TeamNic Pointer
Member GUID

Event ID 7: Failing NBL send on Member Member.

#
Channel
Operational

Message #

Failing NBL send on Member %1

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 8: Failing NBL send on TeamNic TeamNic.

#
Channel
Operational

Message #

Failing NBL send on TeamNic %1

Fields #

NameDescription
TeamNic Pointer
Status Int32NTSTATUS reference

Event ID 9: Dropping NBLs on Member Member.

#
Channel
Operational

Message #

Dropping NBLs on Member %1

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 10: DriverEntry exiting, Status = Status.

#
Channel
Operational

Message #

DriverEntry exiting, Status = %1

Fields #

NameDescription
Status Int32NTSTATUS reference

Event ID 11: Member Member created.

#
Channel
Operational

Message #

Member %1 created.

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 12: Aggregator Aggregator created.

#
Channel
Operational

Message #

Aggregator %1 created.

Fields #

NameDescription
Aggregator Pointer

Event ID 13: Member Member placed in Team TeamNic, Status = Status.

#
Channel
Operational

Message #

Member %2 placed in Team %1, Status = %3.

Fields #

NameDescription
TeamNic Pointer
Member GUID
Status Int32NTSTATUS reference

Event ID 14: Indicating new link state for TeamNic TeamNic.

#
Channel
Operational

Description

Indicating new link state for TeamNic TeamNic. StatusBuffer = StatusBuffer.

Message #

Indicating new link state for TeamNic %1. StatusBuffer = %3.

Fields #

NameDescription
TeamNic Pointer
StatusBufferLen UInt32
StatusBuffer Binary

Event ID 15: Default Aggregator for TeamNic TeamNic changed to Receiver.

#
Channel
Operational

Message #

Default Aggregator for TeamNic %1 changed to %2.

Fields #

NameDescription
TeamNic Pointer
Receiver Pointer

Event ID 16: BroadcastReceiver for TeamNic TeamNic changed to Receiver.

#
Channel
Operational

Message #

BroadcastReceiver for TeamNic %1 changed to %2.

Fields #

NameDescription
TeamNic Pointer
Receiver Pointer

Event ID 17: Initializing TeamNic TeamNic, Status = Status.

#
Channel
Operational

Message #

Initializing TeamNic %1, Status = %2.

Fields #

NameDescription
TeamNic Pointer
Status Int32NTSTATUS reference

Event ID 18: Removing Aggregator Aggregator from TeamNic TeamNic.

#
Channel
Operational

Message #

Removing Aggregator %2 from TeamNic %1.

Fields #

NameDescription
TeamNic Pointer
Aggregator Pointer

Event ID 19: Removed Member Member from TeamNic TeamNic.

#
Channel
Operational

Message #

Removed Member %2 from TeamNic %1.

Fields #

NameDescription
TeamNic Pointer
Member GUID
Status Int32NTSTATUS reference

Event ID 20: Removing TeamNic TeamNic.

#
Channel
Operational

Message #

Removing TeamNic %1.

Fields #

NameDescription
TeamNic Pointer
Status Int32NTSTATUS reference

Event ID 21: MsLbfoProvider driver is unloading.

#
Channel
Operational

Event ID 22: Changing Aggregator for Member Member from OldAggregator to NewAggregator.

#
Channel
Operational

Message #

Changing Aggregator for Member %1 from %2 to %3.

Fields #

NameDescription
Member GUID
OldAggregator Pointer
NewAggregator Pointer

Event ID 23: LACP Initializing for Member Member, Status = Status.

#
Channel
Operational

Message #

LACP Initializing for Member %1, Status = %2.

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 24: LACP de-initialized for Member Member.

#
Channel
Operational

Message #

LACP de-initialized for Member %1.

Fields #

NameDescription
Member GUID
Status Int32NTSTATUS reference

Event ID 25: Received LACPDU on Member Member.

#
Channel
Operational

Description

Received LACPDU on Member Member. Buffer= Buffer.

Message #

Received LACPDU on Member %1. Buffer= %3.

Fields #

NameDescription
Member GUID
BufferLen UInt32
Buffer Binary

Event ID 26: LBFO LACP Member Member; ReceiveMachine: OldState->NewState.

#
Channel
Operational

Message #

LBFO LACP Member %1; ReceiveMachine: %2->%3.

Fields #

NameDescription
Member GUID
OldState HexInt32
NewState HexInt32

Event ID 27: LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.

#
Channel
Operational

Message #

LBFO LACP Member %1; Periodic Transmission Machine: %2->%3.

Fields #

NameDescription
Member GUID
OldState HexInt32
NewState HexInt32

Event ID 28: LBFO LACP Member Member; Mux Machine: OldState->NewState.

#
Channel
Operational

Message #

LBFO LACP Member %1; Mux Machine: %2->%3.

Fields #

NameDescription
Member GUID
OldState HexInt32
NewState HexInt32

Event ID 29: Sending LACPDU on Member Member.

#
Channel
Operational

Description

Sending LACPDU on Member Member. Buffer= Buffer.

Message #

Sending LACPDU on Member %1. Buffer= %3.

Fields #

NameDescription
Member GUID
BufferLen UInt32
Buffer Binary

Event ID 30: LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.

#
Channel
Operational

Message #

LBFO LACP Member %1; Selected NewAgg: %3, Ready:%4.

Fields #

NameDescription
Member GUID
OldAggregator Pointer
NewAggregator Pointer
Ready Boolean

Event ID 31: LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: NewAggregator.

#
Channel
Operational

Message #

LBFO LACP Member %1; UnSelected, OldAgg: %2 NewAgg: %3.

Fields #

NameDescription
Member GUID
OldAggregator Pointer
NewAggregator Pointer
Ready Boolean

Event ID 32: LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.

#
Channel
Operational

Message #

LBFO LACP Member %1; Churn Type (%2): %3->%4.

Fields #

NameDescription
Member GUID
ChurnType Int32
OldState Int32
NewState Int32

Provenance

ETW provider GUID b72c6994-9fe0-45ad-83b3-8f5885f20e0e

Defined in MsLbfoProvider.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB