Microsoft-Windows-NtfsLog_a7a8d4b5051e3de1574b6c625a6a54cc
707 events across 1 channel
Event ID 10: NtfsLookupRealAllocation: Vcn A10_Vcn!
#Description
NtfsLookupRealAllocation: Vcn A10_Vcn!I64x!, LowestVcn A11_Attribute->Form.Nonresident.LowestVcn!I64x!, HighestVcn A12_Attribute->Form.Nonresident.HighestVcn!I64x!, AllocationClusters A13_AllocationClusters!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcn HexInt64 | |
A11_Attribute->Form.Nonresident.LowestVcn HexInt64 | |
A12_Attribute->Form.Nonresident.HighestVcn HexInt64 | |
A13_AllocationClusters HexInt64 |
Event ID 11: NtfsAllocateAttribute MaxAlloc for Mft's AttrList IC:A10_IrpContext, Scb:A11_Scb.
#Event ID 12: FileObject: A10_FileObject, Scb: A11_Scb, StaringVcn: A12_StartingVcn!
#Description
FileObject: A10_FileObject, Scb: A11_Scb, StaringVcn: A12_StartingVcn!I64x!, ClusterCount: A13_ClusterCount!I64x!, Flags: A14_Flags!08x!, CcbForWriteExtend: A15_CcbForWriteExtend.
Message #
Fields #
| Name | Description |
|---|---|
A10_FileObject Pointer | |
A11_Scb Pointer | |
A12_StartingVcn HexInt64 | |
A13_ClusterCount HexInt64 | |
A14_Flags HexInt32 | |
A15_CcbForWriteExtend Pointer |
Event ID 13: NtfsAddAllocation IC:A10_IrpContext, FileObject:A11_FileObject, Scb:A12_Scb, StaringVcn:A13_StartingVcn!
#Description
NtfsAddAllocation IC:A10_IrpContext, FileObject:A11_FileObject, Scb:A12_Scb, StaringVcn:A13_StartingVcn!I64x!, ClusterCount:A14_ClusterCount!I64x!, Flags:A15_Flags!08x!, CcbForWriteExtend:A16_CcbForWriteExtend.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileObject Pointer | |
A12_Scb Pointer | |
A13_StartingVcn HexInt64 | |
A14_ClusterCount HexInt64 | |
A15_Flags HexInt32 | |
A16_CcbForWriteExtend Pointer |
Event ID 14: Purge failed: Scb: A10_Scb, PurgeOffset: 0xA11_PurgeOffset!
#Event ID 15: Purge failed: Scb: A10_Scb, PurgeOffset: 0xA11_PurgeOffset!
#Event ID 16: NtfsGetLastVcnForNewMappingPairSize IC:A10_IrpContext, Using LastVcn:A11_*LastVcn!
#Event ID 17: Can't find StdInfo in FileRef A10_NtfsFullFileRefNumber( _Fcb->FileReference )!
#Event ID 18: Can't find StdInfo in FileRef A10_NtfsFullFileRefNumber( _Fcb->FileReference )!
#Event ID 19: NtfsCreateNonresidentWithValue Create Mft's NonResident Attribute List IC:A10_IrpContextValueLength:A11_ValueLength, AttrFlags=A12_AttributeFlags.
#Event ID 20: NtfsAddAttributeAllocation(A10_Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
NtfsAddAttributeAllocation(A10_Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, LastVcn A14_LastVcn!I64x!, NewHighestVcn A15_NewHighestVcn!I64x!, PassCount A16_PassCount - step 6.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_LastVcn HexInt64 | |
A15_NewHighestVcn HexInt64 | |
A16_PassCount HexInt32 |
Event ID 21: NtfsAddAttributeAllocation(A10_Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
NtfsAddAttributeAllocation(!p!,!p!): Scb !p!, FileRef !I64x!, LowestVcn !I64x!, HighestVcn !I64x!, ALE.LowestVcn !I64x! - try to merge backward.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_Context->FoundAttribute.Attribute->Form.Nonresident.LowestVcn HexInt64 | |
A15_Context->FoundAttribute.Attribute->Form.Nonresident.HighestVcn HexInt64 | |
A16_Context->AttributeList.Entry->LowestVcn HexInt64 |
Event ID 22: NtfsAddAttributeAllocation(A10_Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
NtfsAddAttributeAllocation(!p!,!p!): Scb !p!, FileRef !I64x!, LowestVcn !I64x!, HighestVcn !I64x!, ALE.LowestVcn !I64x! - after merge backward.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_Context->FoundAttribute.Attribute->Form.Nonresident.LowestVcn HexInt64 | |
A15_Context->FoundAttribute.Attribute->Form.Nonresident.HighestVcn HexInt64 | |
A16_Context->AttributeList.Entry->LowestVcn HexInt64 |
Event ID 23: NtfsAddAttributeAllocation(A10_Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
NtfsAddAttributeAllocation(!p!,!p!): Scb !p!, FileRef !I64x!, LowestVcn !I64x!, HighestVcn !I64x!, ALE.LowestVcn !I64x!, PassCount !x! - before last merge after step 6.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_Context->FoundAttribute.Attribute->Form.Nonresident.LowestVcn HexInt64 | |
A15_Context->FoundAttribute.Attribute->Form.Nonresident.HighestVcn HexInt64 | |
A16_Context->AttributeList.Entry->LowestVcn HexInt64 | |
A17_PassCount HexInt32 |
Event ID 24: NtfsAddAttributeAllocation(A10_Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
NtfsAddAttributeAllocation(!p!,!p!): Scb !p!, FileRef !I64x!, LowestVcn !I64x!, HighestVcn !I64x!, ALE.LowestVcn !I64x! - after last merge after step 6.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_Context->FoundAttribute.Attribute->Form.Nonresident.LowestVcn HexInt64 | |
A15_Context->FoundAttribute.Attribute->Form.Nonresident.HighestVcn HexInt64 | |
A16_Context->AttributeList.Entry->LowestVcn HexInt64 |
Event ID 25: NtfsAddAttributeAllocation(A10_Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
NtfsAddAttributeAllocation(A10_Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, MergeSkipCt A14_NtfsFrsConsolidationStatistics.MergeSkipCount - done.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NtfsFrsConsolidationStatistics.MergeSkipCount HexInt32 |
Event ID 26: NtfsRestartRemoveAttribute FileRef:0xA10_FileRecord->SegmentNumberHighPart!
#Description
NtfsRestartRemoveAttribute FileRef:0xA10_FileRecord->SegmentNumberHighPart!04x!_A11_FileRecord->SegmentNumberLowPart!08x!, BaseFRS:0xA12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )!012I64x!, Attrib:0xA13_Attribute->TypeCode.
Message #
Fields #
| Name | Description |
|---|---|
A10_FileRecord->SegmentNumberHighPart HexInt32 | |
A11_FileRecord->SegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 | |
A13_Attribute->TypeCode HexInt32 |
Event ID 27: NtfsRestartChangeValue FileRef:0xA10_FileRecord->SegmentNumberHighPart!
#Description
NtfsRestartChangeValue FileRef:0xA10_FileRecord->SegmentNumberHighPart!04x!_A11_FileRecord->SegmentNumberLowPart!08x!, BaseFRS:0xA12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )!012I64x!, Attrib:0xA13_Attribute->TypeCode.
Message #
Fields #
| Name | Description |
|---|---|
A10_FileRecord->SegmentNumberHighPart HexInt32 | |
A11_FileRecord->SegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 | |
A13_Attribute->TypeCode HexInt32 |
Event ID 28: AddToAttributeList(A10_Fcb->Vcb,A11_IrpContext): FRef A12_*(PULONGLONG)_Fcb->FileReference!
#Description
AddToAttributeList(A10_Fcb->Vcb,A11_IrpContext): FRef A12_*(PULONGLONG)_Fcb->FileReference!I64x!, OldSig A13_StdInfoAttrListEntry->Signature, OldLCS A14_StdInfoAttrListEntry->LastCompactedSize, NewLCS A15_CurrentAttributeListSize.
Message #
Fields #
| Name | Description |
|---|---|
A10_Fcb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_*(PULONGLONG)_Fcb->FileReference HexInt64 | |
A13_StdInfoAttrListEntry->Signature HexInt32 | |
A14_StdInfoAttrListEntry->LastCompactedSize HexInt32 | |
A15_CurrentAttributeListSize HexInt32 |
Event ID 29: DeleteFromAttributeList(A10_Fcb->Vcb,A11_IrpContext): FRef A12_*(PULONGLONG)_Fcb->FileReference!
#Description
DeleteFromAttributeList(A10_Fcb->Vcb,A11_IrpContext): FRef A12_*(PULONGLONG)_Fcb->FileReference!I64x!, OldSig A13_StdInfoAttrListEntry->Signature, OldLCS A14_StdInfoAttrListEntry->LastCompactedSize, NewLCS A15_NewStdInfoAttrListEntry.LastCompactedSize.
Message #
Fields #
| Name | Description |
|---|---|
A10_Fcb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_*(PULONGLONG)_Fcb->FileReference HexInt64 | |
A13_StdInfoAttrListEntry->Signature HexInt32 | |
A14_StdInfoAttrListEntry->LastCompactedSize HexInt32 | |
A15_NewStdInfoAttrListEntry.LastCompactedSize HexInt32 |
Event ID 30: MakeRoomForAttribute Moving Mft's attribute IC:A10_IrpContext, Moving Attrib A11_i/A12_MAX_MOVEABLE_ATTRIBUTES, Type=A13_Attribute->TypeCode, RecLengh=A14_Attribute->RecordLength, Instance:A15_Attr...
#Description
MakeRoomForAttribute Moving Mft's attribute IC:A10_IrpContext, Moving Attrib A11_i/A12_MAX_MOVEABLE_ATTRIBUTES, Type=A13_Attribute->TypeCode, RecLengh=A14_Attribute->RecordLength, Instance:A15_Attribute->Instance.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_i HexInt32 | |
A12_MAX_MOVEABLE_ATTRIBUTES HexInt32 | |
A13_Attribute->TypeCode HexInt32 | |
A14_Attribute->RecordLength HexInt32 | |
A15_Attribute->Instance HexInt32 |
Event ID 31: MoveAttributeToOwnRecord Moving Mft's $BITMAP IC:A10_IrpContext, SizeNeeded:A11_SizeNeeded, TypeCode:A12_Attribute->TypeCode, RecLen:A13_Attribute->RecordLength, Form:A14_Attribute->FormCode, Insta...
#Description
MoveAttributeToOwnRecord Moving Mft's $BITMAP IC:A10_IrpContext, SizeNeeded:A11_SizeNeeded, TypeCode:A12_Attribute->TypeCode, RecLen:A13_Attribute->RecordLength, Form:A14_Attribute->FormCode, Instance:A15_Attribute->Instance.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_SizeNeeded HexInt32 | |
A12_Attribute->TypeCode HexInt32 | |
A13_Attribute->RecordLength HexInt32 | |
A14_Attribute->FormCode HexInt32 | |
A15_Attribute->Instance HexInt32 |
Event ID 32: MoveAttributeToOwnRecord IC:A10_IrpContext, SizeNeeded:A11_SizeNeeded, Bytes2Free:A12_BytesToFree, OldMappingSize:A13_MappingPairSize, NewMappingSize:A14_NewMappingPairSize.
#Description
MoveAttributeToOwnRecord IC:A10_IrpContext, SizeNeeded:A11_SizeNeeded, Bytes2Free:A12_BytesToFree, OldMappingSize:A13_MappingPairSize, NewMappingSize:A14_NewMappingPairSize.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_SizeNeeded HexInt32 | |
A12_BytesToFree HexInt32 | |
A13_MappingPairSize HexInt32 | |
A14_NewMappingPairSize HexInt32 |
Event ID 33: NtfsRestartZeroEndOfFileRecord FileRef:0xA10_FileRecord->SegmentNumberHighPart!
#Description
NtfsRestartZeroEndOfFileRecord FileRef:0xA10_FileRecord->SegmentNumberHighPart!04x!_A11_FileRecord->SegmentNumberLowPart!08x!, BaseFRS:0xA12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )!012I64x!, Start:0xA13_StartZero, Len:0xA14_ZeroLength.
Message #
Fields #
| Name | Description |
|---|---|
A10_FileRecord->SegmentNumberHighPart HexInt32 | |
A11_FileRecord->SegmentNumberLowPart HexInt32 | |
A12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 | |
A13_StartZero HexInt32 | |
A14_ZeroLength HexInt32 |
Event ID 34: MergeFRS2.
#Description
MergeFRS2(!p!,!p!): Scb !p!, FileRef !I64x!, TypeCode !x!, AttrName !S!, LowVcn !I64x!, HalfWayVcn !I64x!, FinalVcn !I64x!, PackedMode !x!, TryPrior !x! - about to merge.
Message #
Event ID 35: MergeFRS2.
#Description
MergeFRS2(!p!,!p!): Scb !p!, FileRef !I64x!, TypeCode !x!, AttrName !S!, DeleteFileRef !x!0000!08x!, LowVcn !I64x!, LastVcn !I64x!, FinalVcn !I64x! - all fit in one so get rid of the second one.
Message #
Event ID 37: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, Vcn A14_NewFinalVcn!I64x! - initial RangePtr query.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NewFinalVcn HexInt64 |
Event ID 38: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, Vcn A14_NewHalfWayVcn!I64x!, Rptr A15_RangePtr - secondary RangePtr query.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NewHalfWayVcn HexInt64 | |
A15_RangePtr Pointer |
Event ID 39: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, Vcn A14_NewHalfWayVcn!I64x!, Rptr A15_RangePtr - calling lookup runs range.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NewHalfWayVcn HexInt64 | |
A15_RangePtr Pointer |
Event ID 40: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, McbArray A14_NtfsMcbArray (A15_NtfsMcbArray->StartingVcn!I64x!, A16_NtfsMcbArray->EndingVcn!I64x!) - current McbArray.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArray->StartingVcn HexInt64 | |
A16_NtfsMcbArray->EndingVcn HexInt64 |
Event ID 41: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, McbArray A14_NtfsMcbArray (A15_NtfsMcbArray->StartingVcn!I64x!, A16_NtfsMcbArray->EndingVcn!I64x!) - previous McbArray.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArray->StartingVcn HexInt64 | |
A16_NtfsMcbArray->EndingVcn HexInt64 |
Event ID 42: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, McbArray A14_NtfsMcbArray (A15_NtfsMcbArray->StartingVcn!I64x!, A16_NtfsMcbArray->EndingVcn!I64x!) - prev prev McbArray.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArray->StartingVcn HexInt64 | |
A16_NtfsMcbArray->EndingVcn HexInt64 |
Event ID 43: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, McbArray A14_NtfsMcbArray (A15_NtfsMcbArray->StartingVcn!I64x!, A16_NtfsMcbArray->EndingVcn!I64x!) - next McbArray.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NtfsMcbArray Pointer | |
A15_NtfsMcbArray->StartingVcn HexInt64 | |
A16_NtfsMcbArray->EndingVcn HexInt64 |
Event ID 44: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, NewFinalVcnInMcb A14_NewFinalVcnInMcb!I64x! > NewFinalVcn A15_NewFinalVcn!I64x! - NewFinalVcn is smaller.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NewFinalVcnInMcb HexInt64 | |
A15_NewFinalVcn HexInt64 |
Event ID 45: MergeFRS2.
#Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NewStartVcn HexInt64 | |
A15_LastVcn HexInt64 | |
A16_NewFinalVcn HexInt64 | |
A17_NewFinalVcnInMcb HexInt64 | |
A18_NumberOfRanges HexInt32 | |
A19_DeletedNextAttribute HexInt32 | |
A20_Mcb1StartWithNewStartVcn HexInt32 | |
A21_Mcb1HoldNewStartVcn HexInt32 | |
A22_Mcb2StartWithNewStartVcn HexInt32 | |
A23_Mcb2HoldNewStartVcn HexInt32 | |
A24_McbArraySizeInUseChange Int32 |
Event ID 46: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, StartingVcn A14_NewStartVcn!I64x!, EndingVcn A15_DeletedNextAttribute ? NewFinalVcnInMcb : (LastVcn-1)!I64x! - redefined mcb range1.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_NewStartVcn HexInt64 | |
A15_DeletedNextAttribute ? NewFinalVcnInMcb : (LastVcn-1) HexInt64 |
Event ID 47: MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
MergeFRS2(A10_Scb->Vcb,A11_IrpContext): Scb A12_Scb, FileRef A13_*(PULONGLONG)_Scb->Fcb->FileReference!I64x!, StartingVcn A14_LastVcn!I64x!, EndingVcn A15_NewFinalVcnInMcb!I64x! - redefined mcb range2.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A14_LastVcn HexInt64 | |
A15_NewFinalVcnInMcb HexInt64 |
Event ID 48: RedoAttribute.
#Description
RedoAttribute(!p!,!p!): Scb !p!, FileRef !I64x!, TypeCode !x!, AttrName !S!, FileRef !I64x!, OldLowVcn !I64x!, NewLowVcn !I64x!, Instance !x! - updating LowestVcn in attribute list entry.
Message #
Event ID 49: RedoAttribute.
#Description
RedoAttribute(!p!,!p!): Scb !p!, FileRef !I64x!, TypeCode !x!, AttrName !S!, OldLowVcn !I64x!, NewLowVcn !I64x!, OldHighVcn !I64x!, NewHighVcn !I64x!, ChildRef !x!0000!08x! - done.
Message #
Event ID 50: NtfsConsolidateAllFileRecords: Invalid Vcb.
#Event ID 51: NtfsConsolidateAllFileRecords: Volume is locked.
#Description
NtfsConsolidateAllFileRecords: Volume is locked. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Volume Id: !S!, Vcb State: 0x!08x!.
Message #
Event ID 52: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!
#Description
NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!I64x!, FirstRequest A14_AllFlags.FirstRequest - opened fcb.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_*(PULONGLONG)_Fcb->FileReference HexInt64 | |
A14_AllFlags.FirstRequest HexInt32 |
Event ID 53: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!
#Event ID 54: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!
#Event ID 56: NtfsConsolidateAllFileRecords.
#Description
NtfsConsolidateAllFileRecords(!p!,!p!): Fcb !p!, FileRef !I64x!, TypeCode !x!, AttrName !S!, Vcn !I64x!, Instance !x!, RstrAttrListEntryOffset !x!, AttrListLength !I64x! - breaking up 1.
Message #
Event ID 57: NtfsConsolidateAllFileRecords.
#Description
NtfsConsolidateAllFileRecords(!p!,!p!): Fcb !p!, FileRef !I64x!, TypeCode !x!, AttrName !S!, Vcn !I64x!, Instance !x!, RstrAttrListEntryOffset !x!, AttrListLength !I64x! - breaking up 2.
Message #
Event ID 58: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!
#Description
NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!I64x!, Scb A14_Scb - completed this Scb.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_*(PULONGLONG)_Fcb->FileReference HexInt64 | |
A14_Scb Pointer |
Event ID 59: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!
#Event ID 60: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): FileRef A12_*(PULONGLONG)_FrsConsolidationContext->FileReference!
#Description
NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): FileRef A12_*(PULONGLONG)_FrsConsolidationContext->FileReference!I64x!, Status A13_IrpContext->ExceptionStatus - Abnormal Termination.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_*(PULONGLONG)_FrsConsolidationContext->FileReference HexInt64 | |
A13_IrpContext->ExceptionStatus HexInt32 |
Event ID 61: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!
#Event ID 62: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_*(PULONGLONG)_Fcb->FileReference!
#Event ID 63: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_FileRef!
#Event ID 64: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_FileRef!
#Description
NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): Fcb A12_Fcb, FileRef A13_FileRef!I64x!, RemovedFcb A14_RemovedFcb, AllFlags.FcbAcquired A15_AllFlags.FcbAcquired, TransId A16_IrpContext->TransactionId - no release.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Fcb Pointer | |
A13_FileRef HexInt64 | |
A14_RemovedFcb HexInt32 | |
A15_AllFlags.FcbAcquired HexInt32 | |
A16_IrpContext->TransactionId HexInt32 |
Event ID 65: NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): DeltaTime A12_(EndTime.QuadPart*1000)/NtfsPerformanceFrequency.QuadPart!
#Description
NtfsConsolidateAllFileRecords(A10_Vcb,A11_IrpContext): DeltaTime A12_(EndTime.QuadPart*1000)/NtfsPerformanceFrequency.QuadPart!I64d! (ms), TotalTime A13_(FrsConsolidationContext->TotalTime*1000)/NtfsPerformanceFrequency.QuadPart!I64d! (ms).
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_(EndTime.QuadPart*1000)/NtfsPerformanceFrequency.QuadPart Int64 | |
A13_(FrsConsolidationContext->TotalTime*1000)/NtfsPerformanceFrequency.QuadPart Int64 |
Event ID 66: UpdateLCS: Vcb A10_Fcb->Vcb, IC A11_IrpContext, FRef A12_*(PULONGLONG)_Fcb->FileReference!
#Description
UpdateLCS: Vcb A10_Fcb->Vcb, IC A11_IrpContext, FRef A12_*(PULONGLONG)_Fcb->FileReference!I64x!, OldSig A13_StdInfoAttrListEntry->Signature, OldLCS A14_StdInfoAttrListEntry->LastCompactedSize, NewLCS A15_AttributeListSize.
Message #
Fields #
| Name | Description |
|---|---|
A10_Fcb->Vcb Pointer | |
A11_IrpContext Pointer | |
A12_*(PULONGLONG)_Fcb->FileReference HexInt64 | |
A13_StdInfoAttrListEntry->Signature HexInt32 | |
A14_StdInfoAttrListEntry->LastCompactedSize HexInt32 | |
A15_AttributeListSize HexInt32 |
Event ID 67: NtfsAllocateClustersPriv IC: A10_IrpContext, Vcb: A11_Vcb, Scb: A12_Scb, Mcb: A13__Scb->Mcb, Vcn: 0xA14_OriginalStartingVcn!
#Description
NtfsAllocateClustersPriv IC: !p!, Vcb: !p!, Scb: !p!, Mcb: !p!, Vcn: 0x!I64x!, Length: 0x!I64x!, AllocateAll: !S!, TargetLcn: 0x!I64x!, PreAllocated: !S!, DelayedAllocation: !S!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__Scb->Mcb Pointer | |
A14_OriginalStartingVcn HexInt64 | |
A15_ClusterCount HexInt64 | |
A16_AllocateAll UInt32 | |
A17_(TargetLcn != NULL) ? *TargetLcn : (ULONGLONG)-1 HexInt64 | |
A18_PreAllocated UInt32 | |
A19_UseDelayedAllocation UInt32 |
Event ID 68: NtfsAllocateClustersPriv IC: A10_IrpContext, Vcb: A11_Vcb, Scb: A12_Scb, Mcb: A13__Scb->Mcb, Vcn: 0xA14_OriginalStartingVcn!
#Description
NtfsAllocateClustersPriv IC: !p!, Vcb: !p!, Scb: !p!, Mcb: !p!, Vcn: 0x!I64x!, Length: 0x!I64x!, AllocateAll: !S!, TargetLcn: 0x!I64x!, PreAllocated: !S!, DelayedAllocation: !S!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__Scb->Mcb Pointer | |
A14_OriginalStartingVcn HexInt64 | |
A15_ClusterCount HexInt64 | |
A16_AllocateAll UInt32 | |
A17_(TargetLcn != NULL) ? *TargetLcn : (ULONGLONG)-1 HexInt64 | |
A18_PreAllocated UInt32 | |
A19_UseDelayedAllocation UInt32 |
Event ID 69: NtfsAllocateClustersPriv: Incremented TotalAllocated by 0xA10_FoundClusterCount!
#Event ID 70: NtfsAllocateClustersPriv: Skipped incrementing TotalAllocated by 0xA10_FoundClusterCount!
#Description
NtfsAllocateClustersPriv: Skipped incrementing TotalAllocated by 0xA10_FoundClusterCount!I64x! clusters, Scb: A11_Scb, TotalAllocated: 0xA12_Scb->TotalAllocated!I64x!ScbState: A13_Scb->State!08x!, IrpContextState2: A14_IrpContext->State2!08x!, AllocateWithNoHole: A15_AllocateWithNoHole.
Message #
Fields #
| Name | Description |
|---|---|
A10_FoundClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_Scb->TotalAllocated HexInt64 | |
A13_Scb->State HexInt32 | |
A14_IrpContext->State2 HexInt32 | |
A15_AllocateWithNoHole Int32 |
Event ID 71: NtfsAllocateClustersPriv IC: A10_IrpContext, ClustersAllocated: A11_ClustersAllocated.
#Event ID 72: NtfsAllocateClustersPriv IC: A10_IrpContext, ClustersAllocated: A11_ClustersAllocated.
#Event ID 73: NtfsDeallocateClusters IC: A10_IrpContext, Vcb: A11_Vcb, Scb: A12_Scb, Mcb: A13__Scb->Mcb, StartVcn: 0xA14_StartingVcn!
#Description
NtfsDeallocateClusters IC: A10_IrpContext, Vcb: A11_Vcb, Scb: A12_Scb, Mcb: A13__Scb->Mcb, StartVcn: 0xA14_StartingVcn!I64x!, EndVcn: 0xA15_EndingVcn!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__Scb->Mcb Pointer | |
A14_StartingVcn HexInt64 | |
A15_EndingVcn HexInt64 |
Event ID 74: NtfsDeallocateClusters: Vcb A10_Vcb - deleting FR A11_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
NtfsDeallocateClusters: Vcb A10_Vcb - deleting FR A11_*(PULONGLONG)_Scb->Fcb->FileReference!I64x! from clusters A12_StartingVcn!I64x! to A13_EndingVcn!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A12_StartingVcn HexInt64 | |
A13_EndingVcn HexInt64 |
Event ID 75: NtfsDeallocateClusters IC: A10_IrpContext, Vcb: A11_Vcb, Scb: A12_Scb, Mcb: A13__Scb->Mcb, StartVcn: 0xA14_StartingVcn!
#Description
NtfsDeallocateClusters IC: A10_IrpContext, Vcb: A11_Vcb, Scb: A12_Scb, Mcb: A13__Scb->Mcb, StartVcn: 0xA14_StartingVcn!I64x!, EndVcn: 0xA15_EndingVcn!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Scb Pointer | |
A13__Scb->Mcb Pointer | |
A14_StartingVcn HexInt64 | |
A15_EndingVcn HexInt64 |
Event ID 76: NtfsDeallocateClusters: Vcb A10_Vcb - deleting FR A11_*(PULONGLONG)_Scb->Fcb->FileReference!
#Description
NtfsDeallocateClusters: Vcb A10_Vcb - deleting FR A11_*(PULONGLONG)_Scb->Fcb->FileReference!I64x! starting at A12_AdjLcn!I64x! for A13_AdjClusterCount!I64x! clusters.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_*(PULONGLONG)_Scb->Fcb->FileReference HexInt64 | |
A12_AdjLcn HexInt64 | |
A13_AdjClusterCount HexInt64 |
Event ID 77: NtfsDeallocateClusters: Vcb A10_Vcb - raising logfile full.
#Event ID 78: NtfsDeallocateClusters: Vcb A10_Vcb - adding clusters to DeallocatedClusters: A11_DeallocatedClusters ==> Lsn: A12_DeallocatedClusters->Lsn.QuadPart!
#Description
NtfsDeallocateClusters: Vcb !p! - adding clusters to DeallocatedClusters: !p! ==> Lsn: !I64x!, ClusterCount: !I64x!, Flags: !08x!; Vcb's DeallocatedClustersCount old: !I64x! new: !I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_DeallocatedClusters Pointer | |
A12_DeallocatedClusters->Lsn.QuadPart HexInt64 | |
A13_DeallocatedClusters->ClusterCount HexInt64 | |
A14_DeallocatedClusters->Flags HexInt32 | |
A15_Vcb->DeallocatedClusters HexInt64 | |
A16_Vcb->DeallocatedClusters + AdjClusterCount HexInt64 |
Event ID 79: NtfsDeallocateClusters: Decremented TotalAllocated by 0xA10_ClusterCount!
#Description
NtfsDeallocateClusters: Decremented TotalAllocated by 0xA10_ClusterCount!I64x! clusters, Scb: A11_Scb, TotalAllocated: 0xA12_*TotalAllocated!I64x!Addr(TotalAllocated): A13_TotalAllocated.
Message #
Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_*TotalAllocated HexInt64 | |
A13_TotalAllocated Pointer |
Event ID 80: NtfsDeallocateClusters: Skipped decrementing TotalAllocated by 0xA10_ClusterCount!
#Description
NtfsDeallocateClusters: Skipped decrementing TotalAllocated by 0xA10_ClusterCount!I64x! clusters, Scb: A11_ScbAddr(TotalAllocated): A12_TotalAllocated, ScbState: A13_Scb->State!08x!, IrpContextState2: A14_IrpContext->State2!08x!
Message #
Fields #
| Name | Description |
|---|---|
A10_ClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_TotalAllocated Pointer | |
A13_Scb->State HexInt32 | |
A14_IrpContext->State2 HexInt32 |
Event ID 81: NtfsDeallocateClusters: Vcb A10_Vcb - Undoing some changes to DeallocatedClustersCount from A11_Vcb->DeallocatedClusters!
#Description
NtfsDeallocateClusters: Vcb A10_Vcb - Undoing some changes to DeallocatedClustersCount from A11_Vcb->DeallocatedClusters!I64x! to A12_Vcb->DeallocatedClusters-ClustersRemoved!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Vcb->DeallocatedClusters HexInt64 | |
A12_Vcb->DeallocatedClusters-ClustersRemoved HexInt64 |
Event ID 82: NtfsDeallocateClusters IC: A10_IrpContext, ClustersDeallocated: A11_ClustersDeallocated.
#Event ID 83: NtfsDeallocateClusters IC: A10_IrpContext, ClustersDeallocated: A11_ClustersDeallocated.
#Event ID 84: NtfsModifyBitsInBitmap IC: A10_IrpContext, Vcb: A11_Vcb, FirstBit: 0xA12_FirstBit!
#Description
NtfsModifyBitsInBitmap IC: A10_IrpContext, Vcb: A11_Vcb, FirstBit: 0xA12_FirstBit!I64x!, BeyondLastBit: 0xA13_BeyondFinalBit!I64x!, Redo: 0xA14_RedoOperation, Undo: 0xA15_UndoOperation.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_FirstBit HexInt64 | |
A13_BeyondFinalBit HexInt64 | |
A14_RedoOperation HexInt32 | |
A15_UndoOperation HexInt32 |
Event ID 85: NtfsModifyBitsInBitmap IC: A10_IrpContext, Bitmap: A11__Bitmap, BaseLcn: 0xA12_BaseLcn!
#Event ID 86: NtfsAllocateBitmapRun IC: A10_IrpContext, Vcb: A11_Vcb, StartingLcn: 0xA12_StartingLcn!
#Event ID 87: NtfsAllocateBitmapRun IC: A10_IrpContext, Bitmap: A11__Bitmap, BaseLcn: 0xA12_BaseLcn!
#Event ID 88: NtfsRestartSetBitsInBitMap IC: A10_IrpContext, Bitmap: A11_Bitmap, BitMapOffset: 0xA12_BitMapOffset!
#Event ID 89: NtfsFreeBitmapRun IC: A10_IrpContext, Vcb: A11_Vcb, StartingLcn: 0xA12_StartingLcn!
#Event ID 90: NtfsFreeBitmapRun IC: A10_IrpContext, Bitmap: A11__Bitmap, BaseLcn: 0xA12_BaseLcn!
#Event ID 91: NtfsRestartClearBitsInBitMap IC: A10_IrpContext, Bitmap: A11_Bitmap, BitMapOffset: 0xA12_BitMapOffset!
#Event ID 92: NtfsSetOrClearBitsUsingBaseMcb IC: A10_IrpContext, Vcb: A11_Vcb, Bitmap: A12_Bitmap, StartingBitmapLcn: 0xA13_StartingBitmapLcn!
#Description
NtfsSetOrClearBitsUsingBaseMcb IC: A10_IrpContext, Vcb: A11_Vcb, Bitmap: A12_Bitmap, StartingBitmapLcn: 0xA13_StartingBitmapLcn!I64x!, SetBits: A14_SetBits.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Vcb Pointer | |
A12_Bitmap Pointer | |
A13_StartingBitmapLcn HexInt64 | |
A14_SetBits UInt32 |
Event ID 93: NtfsSetOrClearBitsUsingBaseMcb IC: A10_IrpContext, Bitmap: A11_Bitmap, StartLcn: 0xA12_StartingBit!
#Event ID 94: NtfsSetOrClearBitsUsingBaseMcb IC: A10_IrpContext, Result: A11_Results.
#Event ID 95: System files not marked as in use in the MFT bitmap.
#Event ID 96: Length: 0 --> BinIndex : 0 - Unexpected length
#Description
Length: 0 --> BinIndex : 0 - Unexpected length.
Message #
Event ID 97: Length: A10_Length!
#Description
Length: A10_Length!8I64d! --> BinIndex : A11_BinIndex!8u! - Key: A12_Key, BitPosition: A13_BitPosition, GroupIndex: A14_GroupIndex, GroupShiftFactor: A15_GroupShiftFactor.
Message #
Fields #
| Name | Description |
|---|---|
A10_Length Int64 | |
A11_BinIndex UInt32 | |
A12_Key UInt32 | |
A13_BitPosition Int32 | |
A14_GroupIndex Int32 | |
A15_GroupShiftFactor Int32 |
Event ID 98: Length: A10_Length!
#Event ID 99: BinIndex: A10_BinIndex!
#Event ID 100: BinIndex: A10_BinIndex!
#Event ID 101: BinGroupShift: A10_NtfsCachedRunBinGroupShift!
#Description
BinGroupShift: A10_NtfsCachedRunBinGroupShift!8ld!, BinGroupSize: A11_NtfsCachedRunBinGroupSize!8u!, BinGroupMask: A12_NtfsCachedRunBinGroupMask!8x!
Message #
Fields #
| Name | Description |
|---|---|
A10_NtfsCachedRunBinGroupShift Int32 | |
A11_NtfsCachedRunBinGroupSize UInt32 | |
A12_NtfsCachedRunBinGroupMask HexInt32 |
Event ID 102: BinIndex: A10_BinIndex!
#Event ID 103: Searched committed allocations but didnt find enough free space.
#Description
Searched committed allocations but didnt find enough free space. StartingCluster A10_StartingCluster!I64x!, ClusterCount A11_ClusterCount!I64x!, Committed A12_Vcb->TotalClustersCommitted!I64x!, Total A13_Vcb->TotalClusters!I64x!, Free A14_Vcb->FreeClusters!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_StartingCluster HexInt64 | |
A11_ClusterCount HexInt64 | |
A12_Vcb->TotalClustersCommitted HexInt64 | |
A13_Vcb->TotalClusters HexInt64 | |
A14_Vcb->FreeClusters HexInt64 |
Event ID 104: NtfsRemoveClustersFromTPMap: Vcb A10_Vcb - Clearing TP map bit(s): first bit 0xA11_FirstBitToClear, last bit 0xA12_BeyondLastBitToClear - 1.
#Event ID 105: NtfsRemoveClustersFromTPMap: Vcb A10_Vcb - Clearing TP map bit(s): no leading partial slab.
#Event ID 106: NtfsRemoveClustersFromTPMap: Vcb A10_Vcb - Clearing TP map bit(s): leading partial slab returned - LCN A11_*FreeClusterBase1!
#Event ID 107: NtfsRemoveClustersFromTPMap: Vcb A10_Vcb - Clearing TP map bit(s): no trailing partial slab.
#Event ID 108: NtfsRemoveClustersFromTPMap: Vcb A10_Vcb - Clearing TP map bit(s): trailing partial slab returned - lcn A11_*FreeClusterBase2!
#Event ID 109: NtfsValidateTotalClustersCommitted(A10_Vcb,A11_PsGetCurrentThread()): TCC A12_Vcb->TotalClustersCommitted!
#Description
NtfsValidateTotalClustersCommitted(A10_Vcb,A11_PsGetCurrentThread()): TCC A12_Vcb->TotalClustersCommitted!I64x!, TC A13_Vcb->TotalClusters!I64x!, BMSize A14_Vcb->TPMap.SizeOfBitMap.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_PsGetCurrentThread() Pointer | |
A12_Vcb->TotalClustersCommitted HexInt64 | |
A13_Vcb->TotalClusters HexInt64 | |
A14_Vcb->TPMap.SizeOfBitMap HexInt32 |
Event ID 110: Illegal MDL Complete for major code A10_IrpContext->MajorFunction.
#Event ID 111: Entering: Scb: A10_Scb, StartingZero: 0xA11_StartingZero!
#Description
Entering: Scb: !p!, StartingZero: 0x!016I64x!, ByteCount: 0x!016I64x!, ExtentsDescriptor: !p!, ExtentsDescriptorIndex: !d!, ExtentsDescriptorStartOffset: 0x!016I64x!, Offset: 0x!016I64x!, MaxRuns: !d!
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingZero HexInt64 | |
A12_ByteCount HexInt64 | |
A13_ExtentsDescriptor Pointer | |
A14_*ExtentsDescriptorIndex Int32 | |
A15_*ExtentsDescriptorStartOffset HexInt64 | |
A16_Offset HexInt64 | |
A17_MaxRuns Int32 |
Event ID 112: RunEntry ==> A10_RunIndex!
#Description
RunEntry ==> A10_RunIndex!4d!: [0xA11_ExtentsDescriptor->Run[RunIndex].BasePage!016I64x!, 0xA12_ExtentsDescriptor->Run[RunIndex].PageCount!016I64x!], ExtentLength: 0xA13_ExtentLength!016I64x!, Offset: 0xA14_Offset!016I64x!, RunIndexStartOffset: 0xA15_RunIndexStartOffset!016I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_RunIndex Int32 | |
A11_ExtentsDescriptor->Run[RunIndex].BasePage HexInt64 | |
A12_ExtentsDescriptor->Run[RunIndex].PageCount HexInt64 | |
A13_ExtentLength HexInt64 | |
A14_Offset HexInt64 | |
A15_RunIndexStartOffset HexInt64 |
Event ID 113: Offset is beyond this extent skipping the extent.
#Description
Offset is beyond this extent skipping the extent.
Message #
Event ID 114: Shrinking LengthInExtent.
#Event ID 115: Zeroing: StartingPhysicalAddr: 0xA10_StartingPhysicalAddr.QuadPart!
#Event ID 116: Exiting: ExtentsDescriptorIndex: A10_*ExtentsDescriptorIndex ExtentsDescriptorStartOffset: 0xA11_*ExtentsDescriptorStartOffset!
#Event ID 117: Entering: Scb: A10_Scb, StartingZero: 0xA11_StartingOffset!
#Event ID 118: Dsm Ranges[A10_DataSetRangeIndex]: StartingOffset: 0xA11_DsmBuffer->DataSetRanges[DataSetRangeIndex].StartingOffset!
#Description
Dsm Ranges[A10_DataSetRangeIndex]: StartingOffset: 0xA11_DsmBuffer->DataSetRanges[DataSetRangeIndex].StartingOffset!016I64x!, LengthInBytes: 0xA12_DsmBuffer->DataSetRanges[DataSetRangeIndex].LengthInBytes!016I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_DataSetRangeIndex Int32 | |
A11_DsmBuffer->DataSetRanges[DataSetRangeIndex].StartingOffset HexInt64 | |
A12_DsmBuffer->DataSetRanges[DataSetRangeIndex].LengthInBytes HexInt64 |
Event ID 119: RemainingClusterCount: 0xA10_RemainingClusterCount!
#Event ID 120: Dsm: TotalNumberOfRanges: A10_DsmByteAddressRanges->TotalNumberOfRanges, NumberOfRangesReturned: A11_DsmByteAddressRanges->NumberOfRangesReturned.
#Event ID 121: DsmOut Ranges[A10_Index]: StartingAddress: 0xA11_DsmByteAddressRanges->Ranges[Index].StartAddress!
#Description
DsmOut Ranges[A10_Index]: StartingAddress: 0xA11_DsmByteAddressRanges->Ranges[Index].StartAddress!016I64x!, LengthInBytes: 0xA12_DsmByteAddressRanges->Ranges[Index].LengthInBytes!016I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Index Int32 | |
A11_DsmByteAddressRanges->Ranges[Index].StartAddress HexInt64 | |
A12_DsmByteAddressRanges->Ranges[Index].LengthInBytes HexInt64 |
Event ID 122: Zeroing: StartingPhysicalAddr: 0xA10_StartingPhysicalAddr.QuadPart!
#Event ID 123: Updating ExtentsDescriptor Index and StartOffset from Locals: ExtentsDescriptorIndex: A10_*ExtentsDescriptorIndex, ExtentsDescriptorStartOffset: 0xA11_*ExtentsDescriptorStartOffset!
#Description
Updating ExtentsDescriptor Index and StartOffset from Locals: ExtentsDescriptorIndex: A10_*ExtentsDescriptorIndex, ExtentsDescriptorStartOffset: 0xA11_*ExtentsDescriptorStartOffset!016I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_*ExtentsDescriptorIndex Int32 | |
A11_*ExtentsDescriptorStartOffset HexInt64 |
Event ID 124: Entering: Scb: A10_Scb, StartingZero: 0xA11_StartingZero!
#Description
Entering: Scb: !p!, StartingZero: 0x!016I64x!, BeyondEndOffset: 0x!016I64x!, ByteCount: 0x!016I64x!, ExtentsDescriptor: !p!, ExtentsDescriptorIndex: !d!, ExtentsDescriptorStartOffset: 0x!016I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingZero HexInt64 | |
A12_BeyondEndOffset HexInt64 | |
A13_ByteCount HexInt64 | |
A14_ExtentsDescriptor Pointer | |
A15_ExtentsDescriptorIndex ? *ExtentsDescriptorIndex : 0 Int32 | |
A16_ExtentsDescriptorStartOffset ? *ExtentsDescriptorStartOffset : 0 HexInt64 |
Event ID 125: Updating ExtentsDescriptor Index and StartOffset from Locals: ExtentsDescriptorIndex: A10_*ExtentsDescriptorIndex, ExtentsDescriptorStartOffset: 0xA11_*ExtentsDescriptorStartOffset!
#Description
Updating ExtentsDescriptor Index and StartOffset from Locals: ExtentsDescriptorIndex: A10_*ExtentsDescriptorIndex, ExtentsDescriptorStartOffset: 0xA11_*ExtentsDescriptorStartOffset!016I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_*ExtentsDescriptorIndex Int32 | |
A11_*ExtentsDescriptorStartOffset HexInt64 |
Event ID 126: IrpContext: A10_IrpContext; Scb: A11_Scb; StartOffset: 0xA12_StartOffset!
#Event ID 127: Return.
#Event ID 128: Unexpected open type received: A10_TypeOfOpen.
#Event ID 129: Raising STATUS_SUCCESS from NtfsCommonCleanup: A10_Status.
#Event ID 130: Raising STATUS_SUCCESS from NtfsCommonCleanup: 0xA10_Status.
#Event ID 131: Raising STATUS_SUCCESS from NtfsCommonCleanup: 0xA10_Status.
#Event ID 132: Irp.
#Description
Irp: !p!, IC: !p!, Vcb: !p!, FileObject: !p!, RelatedFileObject: !p!, FileIdBuffer: !S!, Options: 0x!08x!, FileAttributes: 0x!04x!, DesiredAccess: 0x!08x!, ShareAccess: 0x!04x!, EaLength: 0x!08x!
Message #
Event ID 133: Irp.
#Description
Irp: !p!, IC: !p!, Vcb: !p!, FileObject: !p!, RelatedFileObject: !p!, Path: !S!, Options: 0x!08x!, FileAttributes: 0x!04x!, DesiredAccess: 0x!08x!, ShareAccess: 0x!04x!, EaLength: 0x!08x!
Message #
Event ID 134: NtfsCommonVolumeOpen: Invalid create disposition for volume open.
#Event ID 135: NtfsCommonVolumeOpen: Volume is locked or we have performed a dismount.
#Description
NtfsCommonVolumeOpen: Volume is locked or we have performed a dismount. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Vcb State: 0x!08x!.
Message #
Event ID 136: NtfsCommonVolumeOpen: Thread.
#Description
NtfsCommonVolumeOpen: Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Requested ShareAccess: 0x!08x!, Vcb->CleanupCount: !d!, BiasedCleanupCount: !d!.
Message #
Event ID 137: NtfsCommonVolumeOpen: Volume is locked or we have performed a dismount.
#Description
NtfsCommonVolumeOpen: Volume is locked or we have performed a dismount.Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Vcb State: 0x!08x!.
Message #
Event ID 139: NtfsHandlePagingFile: Paging file already open, paging files can only be opened once.
#Message #
Event ID 140: NtfsHandlePagingFile: Cannot open system file as paging file.
#Description
NtfsHandlePagingFile: Cannot open system file as paging file. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Fcb->FcbState: 0x!08x!, IrpSp->Flags: 0x!08x!.
Message #
Event ID 141: NtfsHandlePagingFile: Persisted paging file already exists.
#Description
NtfsHandlePagingFile: Persisted paging file already exists. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, IrpContext->State: 0x!08x!, IrpSp->Flags: 0x!08x!.
Message #
Event ID 143: NtfsOpenExistingPrefixFcb: Can not directly open txf directory.
#Description
NtfsOpenExistingPrefixFcb: Can not directly open txf directory. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, FileAttributes: 0x!08x!, Rmstate: 0x!08x!.
Message #
Event ID 145: NtfsOpenFile: Unsafe to acquire parent directory after acquiring a txf-system file.
#Description
NtfsOpenFile: Unsafe to acquire parent directory after acquiring a txf-system file. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, FcbState: 0x!08x!.
Message #
Event ID 146: NtfsOpenFile: Invalid system file access.
#Description
NtfsOpenFile: Invalid system file access. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, FcbState: 0x!08x!, CreateDisposition: 0x!08x!, DesiredAccess: 0x!08x!.
Message #
Event ID 147: NtfsOpenFile: Deny open when txf rm is active.
#Description
NtfsOpenFile: Deny open when txf rm is active. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, TxfRmcb Rmstate: 0x!08x!.
Message #
Event ID 149: NtfsCreateNewFile: Unable to create Ea for the file.
#Description
NtfsCreateNewFile: Unable to create Ea for the file. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Create options: 0x!08x!, Ccb flags: 0x!08x!.
Message #
Event ID 151: NtfsOpenSubdirectory: Denying access to $Txf file when the RM is active.
#Description
NtfsOpenSubdirectory: Denying access to $Txf file when the RM is active. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, TxfRmcb state: 0x!08x!.
Message #
Event ID 152: NtfsOpenAttributeInExistingFile: Denying access due to caller being Ea blind.
#Message #
Event ID 154: NtfsOpenAttributeInExistingFile: Denying access for volume root directory.
#Description
NtfsOpenAttributeInExistingFile: Denying access for volume root directory. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, CreateDisposition: 0x!08x!.
Message #
Event ID 155: NtfsCreateNewFile: Not allowed to create streams on system files.
#Description
NtfsCreateNewFile: Not allowed to create streams on system files. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, FcbState: 0x!08x!, AttrTypeCode: 0x!x!.
Message #
Event ID 156: NtfsOverwriteAttr: Cannot overwrite hidden or system attribute for a non-paging file.
#Message #
Event ID 157: NtfsOverwriteAttr: Denying access due to user being Ea blind.
#Description
NtfsOverwriteAttr: Denying access due to user being Ea blind. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Create options: 0x!08x!.
Message #
Event ID 159: NtfsCheckValidAttributeAccess: Supersede or overwrite is not allowed on this type of named attribute.
#Message #
Event ID 160: NtfsCheckValidAttributeAccess: Only read attributes access is supported on this attribute.
#Description
NtfsCheckValidAttributeAccess: Only read attributes access is supported on this attribute. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, AttributeTypeCode: 0x!x!, DesiredAccess: 0x!08x!.
Message #
Event ID 161: NtfsCheckValidAttributeAccess: Deny access for protected system attributes.
#Event ID 163: NtfsOpenAttributeCheck: Deny access for online encryption backup data stream.
#Message #
Event ID 164: NtfsOpenAttributeCheck: File was granted write access but has image section.
#Message #
Event ID 171: NtfsOpenExistingEncryptedStream: No encryption driver found.
#Description
NtfsOpenExistingEncryptedStream: No encryption driver found. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, FileAttributes: 0x!08x!, NtfsData flags: 0x!08x!.
Message #
Event ID 172: NtfsOpenExistingEncryptedStream: Opening for read/write access not allowed on compressed file.
#Message #
Event ID 173: NtfsEncryptionCreateCallback: Encrytion engine fail to encrypt all streams for file with open handle.
#Message #
Event ID 174: NtfsFindStartingNode: Opening not allowed for txf name when RM is active.
#Description
NtfsFindStartingNode: Opening not allowed for txf name when RM is active. Thread: A10_PsGetCurrentThread(), Fcb: A11_CurrentFcb, FileRef: 0xA12_NtfsFullFileRefNumber( _CurrentFcb->FileReference )!I64x!, TxfRmcb RM state: A13_CurrentFcb->TxfRmcb->RmState.
Message #
Fields #
| Name | Description |
|---|---|
A10_PsGetCurrentThread() Pointer | |
A11_CurrentFcb Pointer | |
A12_NtfsFullFileRefNumber( _CurrentFcb->FileReference ) HexInt64 | |
A13_CurrentFcb->TxfRmcb->RmState HexInt32 |
Event ID 179: %1:%2 Status: %3 ProcessName: %4.
#Description
:!d! Status: !S! ProcessName: !S!
Message #
Event ID 180: %1:%2 Status: %3 ProcessName: %4.
#Description
:!d! Status: !S! ProcessName: !S!
Message #
Event ID 181: %1:%2 Status: %3 ProcessName: %4.
#Description
:!d! Status: !S! ProcessName: !S!
Message #
Event ID 182: %1:%2 Status: %3 ProcessName: %4.
#Description
:!d! Status: !S! ProcessName: !S!
Message #
Event ID 183: NtfsSendUnusedClustersHint: Vcb A10_Vcb - Will tell storage we are freeing at A11_StartingCluster!
#Event ID 184: NtfsSendUnusedClustersHint: Vcb A10_Vcb - Flush requested.
#Event ID 185: NtfsSendUnusedClustersHint: Vcb A10_Vcb - Created new MarkUnusedContext A11_*MarkUnusedContext, DEALLOCATED_CLUSTERS A12_(*MarkUnusedContext)->DeallocatedClusters, MCB A13__(*MarkUnusedContext)->De...
#Description
NtfsSendUnusedClustersHint: Vcb A10_Vcb - Created new MarkUnusedContext A11_*MarkUnusedContext, DEALLOCATED_CLUSTERS A12_(*MarkUnusedContext)->DeallocatedClusters, MCB A13__(*MarkUnusedContext)->DeallocatedClusters->Mcb.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_*MarkUnusedContext Pointer | |
A12_(*MarkUnusedContext)->DeallocatedClusters Pointer | |
A13__(*MarkUnusedContext)->DeallocatedClusters->Mcb Pointer |
Event ID 186: NtfsSendUnusedClustersHint: Vcb A10_Vcb - Successfully added clusters starting at A11_StartingCluster!
#Description
NtfsSendUnusedClustersHint: Vcb A10_Vcb - Successfully added clusters starting at A11_StartingCluster!I64x! for A12_RunLength into MCB A13__(*MarkUnusedContext)->DeallocatedClusters->Mcb.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingCluster HexInt64 | |
A12_RunLength HexInt32 | |
A13__(*MarkUnusedContext)->DeallocatedClusters->Mcb Pointer |
Event ID 187: NtfsSendUnusedClustersHint: Vcb A10_Vcb - MCB A11__(*MarkUnusedContext)->DeallocatedClusters->Mcb is full.
#Event ID 188: NtfsSendUnusedClustersHint: Vcb A10_Vcb - Queuing request to IC pre-trim list, MUC A11_*MarkUnusedContext, IC A12_IrpContext.
#Event ID 189: NtfsSendUnusedClustersHint: Vcb A10_Vcb - Failed to allocate/initial MarkUnusedContext.
#Event ID 190: NtfsTransferMaxDataSetRanges: Src A10_Src, Dst A11_Dst, SrcRemainClusCt A12_Src->ClustersCount!
#Description
NtfsTransferMaxDataSetRanges: Src A10_Src, Dst A11_Dst, SrcRemainClusCt A12_Src->ClustersCount!I64x!, SrcOrigClusCt A13_Src->DeallocatedClusters->ClusterCount!I64x!, SrcDSRL A14_SrcDsmAttr->DataSetRangesLength - Entering.
Message #
Fields #
| Name | Description |
|---|---|
A10_Src Pointer | |
A11_Dst Pointer | |
A12_Src->ClustersCount HexInt64 | |
A13_Src->DeallocatedClusters->ClusterCount HexInt64 | |
A14_SrcDsmAttr->DataSetRangesLength HexInt32 |
Event ID 191: NtfsTransferMaxDataSetRanges: Src A10_Src, Dst A11_Dst, SrcRemainClusCt A12_Src->ClustersCount!
#Description
NtfsTransferMaxDataSetRanges: Src !p!, Dst !p!, SrcRemainClusCt !I64x!, DstClusCt !I64x!, DstDSRL !x!, DstLIB !I64x!, DstSOff !I64x! - Leaving.
Message #
Fields #
| Name | Description |
|---|---|
A10_Src Pointer | |
A11_Dst Pointer | |
A12_Src->ClustersCount HexInt64 | |
A13_Dst->ClustersCount HexInt64 | |
A14_DstDsmAttr->DataSetRangesLength HexInt32 | |
A15_DstFirstDataSetRangePtr->LengthInBytes HexInt64 | |
A16_DstFirstDataSetRangePtr->StartingOffset HexInt64 |
Event ID 192: NtfsMarkUnusedContextPostTrimProcessing: Entering
#Description
NtfsMarkUnusedContextPostTrimProcessing: Entering.
Message #
Event ID 193: NtfsMarkUnusedContextPostTrimProcessing: Vcb A10_Vcb, MUC A11_MarkUnusedContext - DC A12_Vcb->DeallocatedClusters!
#Description
NtfsMarkUnusedContextPostTrimProcessing: Vcb A10_Vcb, MUC A11_MarkUnusedContext - DC A12_Vcb->DeallocatedClusters!I64x!, DCIT A13_Vcb->DeallocatedClustersListLengthInTrim, DCTD A14_Vcb->DeallocatedClustersListLengthToDrain, CC A15_Clusters->ClusterCount!I64x!, IR A16_InitialRanges.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_Vcb->DeallocatedClusters HexInt64 | |
A13_Vcb->DeallocatedClustersListLengthInTrim HexInt32 | |
A14_Vcb->DeallocatedClustersListLengthToDrain HexInt32 | |
A15_Clusters->ClusterCount HexInt64 | |
A16_InitialRanges HexInt32 |
Event ID 194: NtfsMarkUnusedContextPostTrimProcessing: Vcb A10_Vcb, MUC A11_MarkUnusedContext - Removed interior slab(s) from TP map - [LCN A12_StartingLcn!
#Description
NtfsMarkUnusedContextPostTrimProcessing: Vcb !p!, MUC !p! - Removed interior slab(s) from TP map - [LCN !I64X!, len !I64X!] => [LCN !I64X!, len !I64X!], [LCN !I64X!, len !I64X!].
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_StartingLcn HexInt64 | |
A13_ClusterCount HexInt64 | |
A14_FreeClusterBase1 HexInt64 | |
A15_FreeClusterCount1 HexInt64 | |
A16_FreeClusterBase2 HexInt64 | |
A17_FreeClusterCount2 HexInt64 |
Event ID 195: NtfsMarkUnusedContextPostTrimProcessing: Vcb A10_Vcb - Releasing bitmap.
#Event ID 196: NtfsMarkUnusedContextPostTrimProcessing: Vcb A10_Vcb - CloseCount A11_Vcb->CloseCount.
#Event ID 197: NtfsMarkUnusedContextPostTrimProcessing: Leaving
#Description
NtfsMarkUnusedContextPostTrimProcessing: Leaving.
Message #
Event ID 198: NtfsAsyncSendUnusedClustersHintCompletionRoutine: Irp A10_Irp.
#Event ID 199: NtfsMarkUnusedContextPreTrimProcessing: Vcb A10_Vcb, IC A11_IrpContext - Entering.
#Event ID 200: NtfsMarkUnusedContextPreTrimProcessing: Vcb A10_Vcb - Kicked off DelayedWorkQueue.
#Event ID 201: NtfsMarkUnusedContextPreTrimProcessing: Vcb A10_Vcb - Leaving.
#Event ID 202: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Entering Vcb A10_Vcb.
#Event ID 203: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb - Small MUC A11_SmallMarkUnusedContext instead of MUC A12_MarkUnusedContext.
#Event ID 204: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb - Failed to allocate small MUC so use MUC A11_MarkUnusedContext.
#Event ID 205: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb - Sending storage ioctl down.
#Event ID 206: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb, MUC A11_MarkUnusedContext - [A12_TrimEntryCount++] Offset A13_DataSetRangePtr->StartingOffset!
#Description
NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb, MUC A11_MarkUnusedContext - [A12_TrimEntryCount++] Offset A13_DataSetRangePtr->StartingOffset!I64x!, Length A14_DataSetRangePtr->LengthInBytes!I64x! - trim entry.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_TrimEntryCount++ HexInt32 | |
A13_DataSetRangePtr->StartingOffset HexInt64 | |
A14_DataSetRangePtr->LengthInBytes HexInt64 |
Event ID 207: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb, MUC A11_MarkUnusedContext, Irp A12_IrpUsed - Completed.
#Event ID 208: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb, MUC A11_MarkUnusedContext - A12_Status - failed to send.
#Event ID 209: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb - Add MUC A11_MarkUnusedContext to post trim list.
#Event ID 210: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb - Free small MUC A11_MarkUnusedContext.
#Event ID 211: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb - Sending storage ioctl down failed with A11_Status.
#Description
NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb A10_Vcb - Sending storage ioctl down failed with A11_Status. MUC A12_MarkUnusedContext, Count A13_((MarkUnusedContext != NULL) __ (MarkUnusedContext->DeallocatedClusters != NULL)) ? MarkUnusedContext->DeallocatedClusters->ClusterCount : -1LL!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Status HexInt32 | |
A12_MarkUnusedContext Pointer | |
A13_((MarkUnusedContext != NULL) __ (MarkUnusedContext->DeallocatedClusters != NULL)) ? MarkUnusedContext->DeallocatedClusters->ClusterCount : -1LL HexInt64 |
Event ID 212: NtfsMarkUnusedContextPreTrimWorkItemProcessing: Leaving
#Description
NtfsMarkUnusedContextPreTrimWorkItemProcessing: Leaving.
Message #
Event ID 213: NtfsWakeupDeallocatedClustersWaiters: Vcb A10_Vcb - There are waiters for DC A11_DeallocatedClusters.
#Event ID 214: NtfsWakeupDeallocatedClustersWaiters: Vcb A10_Vcb - Waking up waiter for DC A11_DeallocatedClusters.
#Event ID 215: NtfsWakeupDeallocatedClustersWaiters: Vcb A10_Vcb - Done waking up DC A11_DeallocatedClusters.
#Event ID 216: NtfsWaitForDeallocatedClustersToDrain: Vcb A10_Vcb, All A11_All - Entering.
#Event ID 217: NtfsWaitForDeallocatedClustersToDrain: Vcb A10_Vcb - Waiting to drain.
#Event ID 218: NtfsWaitForDeallocatedClustersToDrain: Vcb A10_Vcb - Waiting for partial drain.
#Event ID 219: NtfsWaitForDeallocatedClustersToDrain: Vcb A10_Vcb - Leaving.
#Event ID 220: NtfsPrepareToWaitForDeallocatedClustersToDrain: Vcb A10_Vcb - Entering.
#Event ID 221: NtfsPrepareToWaitForDeallocatedClustersToDrain: Vcb A10_Vcb - Inserted A11_DeallocatedClustersToWaitFor->DeallocatedClusters.
#Event ID 222: NtfsPrepareToWaitForDeallocatedClustersToDrain: Vcb A10_Vcb - Leaving.
#Event ID 223: NtfsWaitForDeallocatedClustersToDrainAfterPrepare: Vcb A10_IrpContext->Vcb - Wait for DC A11_DeallocatedClustersToWaitFor->DeallocatedClusters.
#Event ID 224: NtfsWaitForDeallocatedClustersToDrainAfterPrepare: Waited for A10_WaitInSeconds (s), Exceeded by A11_((CurrentTime.QuadPart > DeallocatedClustersToWaitFor->EndTime.QuadPart) ? ...
#Description
NtfsWaitForDeallocatedClustersToDrainAfterPrepare: Waited for !d! (s), Exceeded by !d! (s), IC !p!, Vcb !p!, DC !p!
Message #
Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | |
A11_((CurrentTime.QuadPart > DeallocatedClustersToWaitFor->EndTime.QuadPart) ? (ULONG)(((CurrentTime.QuadPart - DeallocatedClustersToWaitFor->EndTime.QuadPart) * NtfsData.SystemTimeIncrement)/INTERVAL_ONE_SECOND) : 0) Int32 | |
A12_IrpContext Pointer | |
A13_IrpContext->Vcb Pointer | |
A14_DeallocatedClusters Pointer |
Event ID 225: NtfsWaitForDeallocatedClustersToDrainAfterPrepare: Waited for A10_WaitInSeconds (s), Exceeded by A11_((CurrentTime.QuadPart > DeallocatedClustersToWaitFor->EndTime.QuadPart) ? ...
#Description
NtfsWaitForDeallocatedClustersToDrainAfterPrepare: Waited for !d! (s), Exceeded by !d! (s), IC !p!, Vcb !p!, DC !p!
Message #
Fields #
| Name | Description |
|---|---|
A10_WaitInSeconds Int32 | |
A11_((CurrentTime.QuadPart > DeallocatedClustersToWaitFor->EndTime.QuadPart) ? (ULONG)(((CurrentTime.QuadPart - DeallocatedClustersToWaitFor->EndTime.QuadPart) * NtfsData.SystemTimeIncrement)/INTERVAL_ONE_SECOND) : 0) Int32 | |
A12_IrpContext Pointer | |
A13_IrpContext->Vcb Pointer | |
A14_DeallocatedClusters Pointer |
Event ID 226: NtfsCheckForTrimThrottling: Vcb A10_Vcb - hitting trim threshold A11_Vcb->DeallocatedClustersListLengthInTrim.
#Event ID 227: NtfsUpdateSmartTrimState: Vcb A10_Vcb - Entering.
#Event ID 228: NtfsUpdateSmartTrimState: Vcb A10_Vcb - Precondition checks failed.
#Event ID 229: NtfsUpdateSmartTrimState: Vcb A10_Vcb - Precondition checks failed; AcquiredSyncResource A11_AcquiredVcb.
#Event ID 230: NtfsUpdateSmartTrimState: Vcb A10_Vcb, MUC A11_MarkUnusedContext - Skipping deallocated clusters gen'd by smart trim.
#Event ID 231: NtfsUpdateSmartTrimState: Vcb A10_Vcb, MUC A11_MarkUnusedContext - MCB run A12_RunIndex; offs 0xA13_StartingOffset!
#Description
NtfsUpdateSmartTrimState: Vcb A10_Vcb, MUC A11_MarkUnusedContext - MCB run A12_RunIndex; offs 0xA13_StartingOffset!I64X!, len 0xA14_LengthInBytes!I64X!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_RunIndex UInt32 | |
A13_StartingOffset HexInt64 | |
A14_LengthInBytes HexInt64 |
Event ID 232: NtfsUpdateSmartTrimState: Vcb A10_Vcb - MUC A11_MarkUnusedContext, DSR count A12_DataSetRangeCount, MCB count A13_McbRunCount, ST free slots A14_SmartTrimFreeRangeCount.
#Description
NtfsUpdateSmartTrimState: Vcb A10_Vcb - MUC A11_MarkUnusedContext, DSR count A12_DataSetRangeCount, MCB count A13_McbRunCount, ST free slots A14_SmartTrimFreeRangeCount.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_DataSetRangeCount UInt32 | |
A13_McbRunCount UInt32 | |
A14_SmartTrimFreeRangeCount UInt32 |
Event ID 233: NtfsUpdateSmartTrimState: Vcb A10_Vcb, MUC A11_MarkUnusedContext - DSR range A12_RunIndex; offs 0xA13_DataSetRange->StartingOffset!
#Description
NtfsUpdateSmartTrimState: Vcb A10_Vcb, MUC A11_MarkUnusedContext - DSR range A12_RunIndex; offs 0xA13_DataSetRange->StartingOffset!I64X!, len 0xA14_DataSetRange->LengthInBytes!I64X!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_MarkUnusedContext Pointer | |
A12_RunIndex UInt32 | |
A13_DataSetRange->StartingOffset HexInt64 | |
A14_DataSetRange->LengthInBytes HexInt64 |
Event ID 234: NtfsUpdateSmartTrimState: Vcb A10_Vcb - MCB lcn A11_StartingLcn!
#Description
NtfsUpdateSmartTrimState: Vcb A10_Vcb - MCB lcn A11_StartingLcn!I64X! len A12_ClusterCount!I64X! maps to TP map bits [0xA13_FirstTpMapBit, 0xA14_LastTpMapBit].
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_StartingLcn HexInt64 | |
A12_ClusterCount HexInt64 | |
A13_FirstTpMapBit HexInt32 | |
A14_LastTpMapBit HexInt32 |
Event ID 235: NtfsUpdateSmartTrimState: Vcb A10_Vcb - Smart trim state on exit; A11_SmartTrimState->SlabRangesCount ranges.
#Event ID 236: NtfsUpdateSmartTrimState: Vcb A10_Vcb - Range A11_SlabRangeIndex: FirstTPMapBit 0xA12_SlabRange->FirstTPMapBit, LastTPMapBit 0xA13_SlabRange->LastTPMapBit.
#Description
NtfsUpdateSmartTrimState: Vcb A10_Vcb - Range A11_SlabRangeIndex: FirstTPMapBit 0xA12_SlabRange->FirstTPMapBit, LastTPMapBit 0xA13_SlabRange->LastTPMapBit.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_SlabRangeIndex UInt32 | |
A12_SlabRange->FirstTPMapBit HexInt32 | |
A13_SlabRange->LastTPMapBit HexInt32 |
Event ID 237: NtfsUpdateSmartTrimState: Vcb A10_Vcb - Leaving.
#Event ID 238: NtfsEvalSmartTrimState: Vcb A10_Vcb - Entering.
#Event ID 239: NtfsEvalSmartTrimState: Vcb A10_Vcb - Precondition checks failed.
#Event ID 240: NtfsEvalSmartTrimState: Vcb A10_Vcb - Precondition checks failed; AcquiredBitmap A11_AcquiredBitmap.
#Event ID 241: NtfsEvalSmartTrimState: Vcb A10_Vcb - Checking slab 0xA11_TpMapBit for allocations.
#Event ID 242: NtfsEvalSmartTrimState: Vcb A10_Vcb - Slab 0xA11_TpMapBit has allocations, will not trim.
#Event ID 243: NtfsEvalSmartTrimState: Vcb A10_Vcb - Free slab found - TP map bit 0xA11_TpMapBit, lcn A12_SlabBaseLcn!
#Event ID 244: NtfsEvalSmartTrimState: Vcb A10_Vcb - Leaving.
#Event ID 245: NtfsFlushAllTrimHintsSynchronous (A10_Vcb): Calling NtfsFreeRecentlyDeallocated.
#Event ID 246: NtfsFlushAllTrimHintsSynchronous (A10_Vcb): Done calling NtfsFreeRecentlyDeallocated.
#Event ID 247: NtfsCommonDeviceControl: IOCTL_DISK_COPY_DATA is not allowed on unlocked volume.
#Description
NtfsCommonDeviceControl: IOCTL_DISK_COPY_DATA is not allowed on unlocked volume. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, VcbState: 0x!08x!, SL control flags: 0x!08x!.
Message #
Event ID 248: NtfsVolumeDasdIo: Data section blocking flush.
#Description
NtfsVolumeDasdIo: Data section blocking flush. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Flush status: !S!.
Message #
Event ID 250: Could not find paging file MCB entry.
#Description
Could not find paging file MCB entry.
Message #
Event ID 252: Writing to $Bitmap.
#Event ID 253: NTFS: Posting hotfix on file object: A10_FileObject.
#Event ID 254: NTFS: Freeing Bad Vcn: A10_((ULONG)BadVcn)!
#Event ID 255: NTFS: Retiring Bad Lcn: A10_((ULONG)BadLcn)!
#Event ID 258: IrpContext: A10_IrpContext; Vcb: A11_Vcb; NewBufferSize: 0xA12_NewBufferSize!
#Event ID 259: Compression buffers are already big enough.
#Event ID 261: IrpContext: A10_IrpContext; Vcb: A11_Vcb; NewBufferSize: 0xA12_NewBufferSize!
#Event ID 262: Compression buffers are already big enough.
#Event ID 265: NtfsDefragFileInternal: Vcb A10_Vcb - Calling FRD.
#Event ID 266: NtfsDefragFileInternal: Vcb A10_Vcb - Done calling FRD.
#Event ID 268: NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!
#Description
NtfsDefragFileInternal(!p!,!p!): Scb !p!, FRef !I64x!, Vcn !I64x!, CC !I64x!, CurrLcn !I64x!, NewLcn !I64x!, Len !x!, DA !d!, Status !x! - copy offload.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference ) HexInt64 | |
A14_MoveData->StartingVcn.QuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveData->StartingLcn.QuadPart HexInt64 | |
A18_CopyLength HexInt32 | |
A19_Flags.UseDelayedAllocation Int32 | |
A20_Status HexInt32 |
Event ID 269: NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!
#Description
NtfsDefragFileInternal(!p!,!p!): Scb !p!, FRef !I64x!, Vcn !I64x!, CC !I64x!, CurrLcn !I64x!, NewLcn !I64x!, Len !x!, DA !d!, Status !x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference ) HexInt64 | |
A14_MoveData->StartingVcn.QuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveData->StartingLcn.QuadPart HexInt64 | |
A18_CopyLength HexInt32 | |
A19_Flags.UseDelayedAllocation Int32 | |
A20_MyStatus HexInt32 |
Event ID 270: NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!
#Description
NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!I64x!, CurrLcn A14_Lcn!I64x!, Len A15_CopyLength, Status A16_MyStatus - read completed.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference ) HexInt64 | |
A14_Lcn HexInt64 | |
A15_CopyLength HexInt32 | |
A16_MyStatus HexInt32 |
Event ID 271: NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!
#Description
NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!I64x!, NewLcn A14_MoveData->StartingLcn.QuadPart!I64x!, Len A15_CopyLength, Status A16_MyStatus - write completed.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference ) HexInt64 | |
A14_MoveData->StartingLcn.QuadPart HexInt64 | |
A15_CopyLength HexInt32 | |
A16_MyStatus HexInt32 |
Event ID 272: NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!
#Description
NtfsDefragFileInternal(!p!,!p!): Scb !p!, FRef !I64x!, Vcn !I64x!, CC !I64x!, CurrLcn !I64x!, NewLcn !I64x!, DA !d!, ValidClusters !I64x! - beyond VDL.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference ) HexInt64 | |
A14_MoveData->StartingVcn.QuadPart HexInt64 | |
A15_TransferClusters HexInt64 | |
A16_Lcn HexInt64 | |
A17_MoveData->StartingLcn.QuadPart HexInt64 | |
A18_Flags.UseDelayedAllocation Int32 | |
A19_ValidClusters HexInt64 |
Event ID 273: NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!
#Description
NtfsDefragFileInternal(A10_Vcb,A11_IrpContext): Scb A12_Scb, FRef A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )!I64x!, Vcn A14_MoveData->StartingVcn.QuadPart!I64x!, CC A15_TransferClusters!I64x! - committed.
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference ) HexInt64 | |
A14_MoveData->StartingVcn.QuadPart HexInt64 | |
A15_TransferClusters HexInt64 |
Event ID 274: NtfsDefragFile: Defrag is denied without manage volume access.
#Description
NtfsDefragFile: Defrag is denied without manage volume access. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Ccb flags: 0x!08x!.
Message #
Event ID 276: NtfsEncryptDecryptOnline: Vcb A10_Vcb - Calling FRD.
#Event ID 277: NtfsEncryptDecryptOnline: Vcb A10_Vcb - Done calling FRD.
#Event ID 279: SCB: A10_Scb, VDL=0xA11_Scb->Header.ValidDataLength.QuadPart!
#Description
SCB: A10_Scb, VDL=0xA11_Scb->Header.ValidDataLength.QuadPart!I64x!, FS=0xA12_Scb->Header.FileSize.QuadPart!I64x!, StartOff=0xA13_QueryDaxExtents->FileOffset!I64x!, StartVcn=0xA14_StartingVcn!I64x!, Length=0xA15_QueryDaxExtents->Length!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_Scb->Header.ValidDataLength.QuadPart HexInt64 | |
A12_Scb->Header.FileSize.QuadPart HexInt64 | |
A13_QueryDaxExtents->FileOffset HexInt64 | |
A14_StartingVcn HexInt64 | |
A15_QueryDaxExtents->Length HexInt64 |
Event ID 280: StartOff=0xA10_QueryDaxExtents->FileOffset!
#Description
StartOff=0x!I64x!, Length=0x!I64x!, EffectiveLength=0x!I64x! StartVcn=0x!I64x!, BeyondEndVcn=0x!I64x!, Clusters=0x!I64x!, LastVcnInFile=0x!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_QueryDaxExtents->FileOffset HexInt64 | |
A11_QueryDaxExtents->Length HexInt64 | |
A12_EffectiveInputFileRegionLength HexInt64 | |
A13_StartingVcn HexInt64 | |
A14_BeyondEndVcn HexInt64 | |
A15_RemainingClusterCount HexInt64 | |
A16_LastVcnInFile HexInt64 |
Event ID 282: RemainingClusterCount: 0xA10_RemainingClusterCount!
#Event ID 283: STATUS_BUFFER_TOO_SMALL from FsLib.
#Description
STATUS_BUFFER_TOO_SMALL from FsLib. NumberOfValidRuns: 0xA10_ExtentsDescriptor->NumberOfValidRuns, MaxRuns: 0xA11_MaxRuns, BytesReturned: 0xA12_*BytesReturned!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptor->NumberOfValidRuns HexInt32 | |
A11_MaxRuns HexInt32 | |
A12_*BytesReturned HexInt64 |
Event ID 284: Made an educated guess for remaining runs.
#Event ID 285: Made a wild guess for remaining runs.
#Event ID 286: NumberOfValidRuns: 0xA10_ExtentsDescriptor->NumberOfValidRuns!
#Description
NumberOfValidRuns: 0xA10_ExtentsDescriptor->NumberOfValidRuns!08x!, MaxRuns: 0xA11_MaxRuns!08x!, Status: 0xA12_Status!08x!, BytesReturned: 0xA13_*BytesReturned!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_ExtentsDescriptor->NumberOfValidRuns HexInt32 | |
A11_MaxRuns HexInt32 | |
A12_Status HexInt32 | |
A13_*BytesReturned HexInt64 |
Event ID 287: BasePage: 0xA10_ExtentsDescriptor->Run[Index].BasePage!
#Event ID 288: About to zero range - ZeroStart: 0xA10_ZeroStart!
#Event ID 289: Zeroed range - ZeroStart: 0xA10_ZeroStart!
#Event ID 290: NtfsCommonQueryInformation: File information query not allowed as file was opened by ID without traversal privilege.
#Message #
Event ID 291: NtfsQueryCaseSensitiveInfo: Case sensitive info query not allowed without read attributes access.
#Message #
Event ID 292: NtfsQueryNameInfo: Name info query not allowed as file was opened without traverse privilege.
#Message #
Event ID 293: NtfsQueryLinksInfo: Link info query not allowed as file was opened without traverse privilege.
#Message #
Event ID 294: NtfsSetCaseSensitiveInfo: Cannot mark root directory of a volume case-sensitive.
#Message #
Event ID 295: NtfsRemoveSupersededTarget: Can not do a superseding rename over a system file.
#Description
NtfsRemoveSupersededTarget: Can not do a superseding rename over a system file. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Fcb state: !x!.
Message #
Event ID 296: NtfsRemoveSupersededTarget: Can not do a superseding rename over a file with open handles.
#Message #
Event ID 297: NtfsRemoveSupersededTarget: Can not do a superseding rename over a file with open handles.
#Message #
Event ID 298: NtfsRemoveSupersededTarget: Can not do a superseding rename over a file opened by ID.
#Description
NtfsRemoveSupersededTarget: Can not do a superseding rename over a file opened by ID. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Cleanup count: !d!.
Message #
Event ID 299: NtfsRemoveSupersededTarget: Can not do a superseding rename over a file with open handles via either part of the long/short pair.
#Message #
Event ID 301: NtfsSetRenameInfo: Can not rename a txf directory.
#Description
NtfsSetRenameInfo: Can not rename a txf directory. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, File attributes: 0x!08x!.
Message #
Event ID 302: NtfsSetRenameInfo: Can not rename into a system directory.
#Description
NtfsSetRenameInfo: Can not rename into a system directory. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, FcbState: 0x!08x!.
Message #
Event ID 304: NtfsSetRenameInfo: The file should not have in-memory directory descendents.
#Description
NtfsSetRenameInfo: The file should not have in-memory directory descendents. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!.
Message #
Event ID 305: NtfsSetRenameInfo: Child Scb mismatch.
#Description
NtfsSetRenameInfo: Child Scb mismatch. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Potential child FileRef: !I64x!.
Message #
Event ID 306: NtfsSetLinkInfo: Set link info is not allowed on txf directory.
#Description
NtfsSetLinkInfo: Set link info is not allowed on txf directory. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, FileName: !S!.
Message #
Event ID 307: NtfsSetLinkInfo: Set link info is not allowed on a file in a TxF transaction.
#Message #
Event ID 308: NtfsSetLinkInfo: Set link info failed due to caller not having FILE_WRITE_ATTRIBUTES access.
#Message #
Event ID 309: NtfsSetLinkInfo: Creating a link in system directory is not allowed.
#Description
NtfsSetLinkInfo: Creating a link in system directory is not allowed. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, NewLinkName: !S!.
Message #
Event ID 310: NtfsSetLinkInfo: Creating a link in $txf is not allowed if the RM is running.
#Message #
Event ID 311: NtfsSetShortNameInfo: Can not set a short name on a deleted file.
#Description
NtfsSetShortNameInfo: Can not set a short name on a deleted file. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Lcb: !p!, Link Name: !S!.
Message #
Event ID 312: NtfsSetShortNameInfo: Can not set a short name on a file under the $TxF directory.
#Message #
Event ID 313: NtfsCheckScbForLinkRemoval: Existing handles are not allowed if Txf transaction is doing the rename.
#Message #
Event ID 314: NtfsCheckScbForLinkRemoval: Not all open handles for the stream are by-id opens.
#Message #
Event ID 316: NtfsProcessTreeForRename: Deny access due to number of batch oplocks has grown.
#Message #
Event ID 317: NtfsFlushVolumeFlushSingleFcb: Thread: A10_PsGetCurrentThread(), Vcb: A11_Vcb, Fcb: A12_Fcb, LocalFlags: A13_LocalFlags->EntireFlags!
#Event ID 318: NtfsFlushVolumeFlushSingleFcb: Thread: A10_PsGetCurrentThread(), Scb: A11_Scb.
#Event ID 319: NtfsFlushVolume: Thread: A10_PsGetCurrentThread(), Vcb: A11_Vcb, LocalFlags: A12_LocalFlags.EntireFlags!
#Event ID 320: NtfsFlushVolume setting SCB_PERSIST_VOLUME_DISMOUNTED on BitmapScb Scb: A10_Vcb->BitmapScb Vcb: A11_Vcb.
#Event ID 321: NtfsFlushVolume setting SCB_PERSIST_VOLUME_DISMOUNTED on MftScb Scb: A10_Vcb->MftScb Vcb: A11_Vcb.
#Event ID 322: NtfsFlushCompletionRoutine: Vcb A10_((PNTFS_DISK_FLUSH_CONTEXT)Context)->Vcb - Add context A11_Context into completion queue.
#Event ID 323: NtfsFlushCompletionRoutine: Vcb A10_((PNTFS_DISK_FLUSH_CONTEXT)Context)->Vcb - Add context A11_Context into WorkQueue - Flink A12_NtfsData.DiskFlushContextCompletedWorkItem.List.Flink.
#Description
NtfsFlushCompletionRoutine: Vcb A10_((PNTFS_DISK_FLUSH_CONTEXT)Context)->Vcb - Add context A11_Context into WorkQueue - Flink A12_NtfsData.DiskFlushContextCompletedWorkItem.List.Flink.
Message #
Fields #
| Name | Description |
|---|---|
A10_((PNTFS_DISK_FLUSH_CONTEXT)Context)->Vcb Pointer | |
A11_Context Pointer | |
A12_NtfsData.DiskFlushContextCompletedWorkItem.List.Flink Pointer |
Event ID 324: NtfsDiskFlushContextWorkItemProcessing: Process work item
#Description
NtfsDiskFlushContextWorkItemProcessing: Process work item.
Message #
Event ID 325: NtfsDiskFlushContextWorkItemProcessing: Nothing to work on
#Description
NtfsDiskFlushContextWorkItemProcessing: Nothing to work on.
Message #
Event ID 326: Irp: A10_Irp, IC: A11_IrpContext, Vcb: A12_IrpContext->Vcb, MinorCode: A13_IrpSp->MinorFunction!
#Description
Irp: A10_Irp, IC: A11_IrpContext, Vcb: A12_IrpContext->Vcb, MinorCode: A13_IrpSp->MinorFunction!02x!, FsControlCode: 0xA14_FsControlCode!08x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Irp Pointer | |
A11_IrpContext Pointer | |
A12_IrpContext->Vcb Pointer | |
A13_IrpSp->MinorFunction HexInt32 | |
A14_FsControlCode HexInt32 |
Event ID 328: NtfsLockVolumeInternal: Volume is already locked.
#Description
NtfsLockVolumeInternal: Volume is already locked.Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Vcb State: 0x!08x!.
Message #
Event ID 329: NtfsLockVolumeInternal: Failed to flush system files on the volume.
#Description
NtfsLockVolumeInternal: Failed to flush system files on the volume. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Flush Status: !S!.
Message #
Event ID 330: NtfsLockVolumeInternal: Failed to flush system files on the volume.
#Description
NtfsLockVolumeInternal: Failed to flush system files on the volume.Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Flush Status: !S!.
Message #
Event ID 332: NtfsLockVolume: Cannot lock volume due to caller does not have manage volume privilege.
#Description
NtfsLockVolume: Cannot lock volume due to caller does not have manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 333: NtfsLockVolume: Cannot lock volume due to active secondary RMs on the volume.
#Description
NtfsLockVolume: Cannot lock volume due to active secondary RMs on the volume. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Active RM count: !d!, Default RM Active: !d!.
Message #
Event ID 334: A10___FUNCTION__: Setting RM at 0xA11_(PVOID)Vcb->TxfVcb.DefaultRm ({A12_(Vcb->TxfVcb.DefaultRm != NULL) ? _Vcb->TxfVcb.DefaultRm->RmId : ...
#Description
A10___FUNCTION__: Setting RM at 0xA11_(PVOID)Vcb->TxfVcb.DefaultRm ({A12_(Vcb->TxfVcb.DefaultRm != NULL) ? _Vcb->TxfVcb.DefaultRm->RmId : NULL}) up for auto-restart.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)Vcb->TxfVcb.DefaultRm Pointer | |
A12_(Vcb->TxfVcb.DefaultRm != NULL) ? _Vcb->TxfVcb.DefaultRm->RmId : NULL GUID |
Event ID 335: NtfsUnlockVolume: Cannot unlock volume due to caller does not have manage volume privilege.
#Description
NtfsUnlockVolume: Cannot unlock volume due to caller does not have manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 336: NtfsDismountVolume: IC.
#Description
NtfsDismountVolume: IC: !p!, Vcb: !p!, Label: !S!, DeviceName: !S!
Message #
Event ID 337: NtfsDismountVolume: Cannot dismount volume due to system/pagefiles being open for write access.
#Description
NtfsDismountVolume: Cannot dismount volume due to system/pagefiles being open for write access. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 338: NtfsDismountVolume: Cannot dismount volume due to volume being locked.
#Description
NtfsDismountVolume: Cannot dismount volume due to volume being locked. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, VcbState: 0x!08x!.
Message #
Event ID 339: NtfsDismountVolume: Cannot dismount volume due to system/pagefiles being open for write access.
#Message #
Event ID 340: NtfsDismountVolume: Could not flush trim hints.
#Description
NtfsDismountVolume: Could not flush trim hints. Couldn't make progress flushing log.Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, VcbState: 0x!08x!.
Message #
Event ID 341: NtfsMarkVolumeDirty: Cannot mark volume dirty due to caller not having manage volume privilege.
#Description
NtfsMarkVolumeDirty: Cannot mark volume dirty due to caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 342: NtfsGetVolumeBitmap: Cannot get volume bitmap due to caller not having manage volume privilege.
#Description
NtfsGetVolumeBitmap: Cannot get volume bitmap due to caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 343: NtfsGetBootAreaInfo: Cannot get boot area info due to caller not having manage volume privilege.
#Description
NtfsGetBootAreaInfo: Cannot get boot area info due to caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 344: NtfsGetRetrievalPointers: Cannot get retrieval pointers due to caller not having manage volume privilege.
#Description
NtfsGetRetrievalPointers: Cannot get retrieval pointers due to caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 345: NtfsGetRetrievalPointerBase: Cannot get revrieval pointer base info due to caller not having manage volume privilege.
#Message #
Event ID 346: NtfsGetRetrievalPointerBase: Cannot get revrieval pointer base info due to caller not having manage volume privilege or this is not a volume open.
#Message #
Event ID 347: NtfsCreateUsnJournal: Cannot create Usn journal due to caller not having manage volume privilege.
#Message #
Event ID 348: NtfsUsnTrackModifiedRanges: Cannot enable range tracking due to caller not having manage volume privilege.
#Description
NtfsUsnTrackModifiedRanges: Cannot enable range tracking due to caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 349: NtfsEnumerateUsnData: Cannot enumerate Usn data due to caller not having manage volume privilege.
#Description
NtfsEnumerateUsnData: Cannot enumerate Usn data due to caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 350: NtfsFindFilesOwnedBySid: Caller not having manage volume privilege, backup access or can bypass traverse checks.
#Message #
Event ID 351: NtfsFindFilesOwnedBySid: Caller not having manage volume privilege or backup access and is not admin.
#Message #
Event ID 354: NtfsZeroRange: User mode caller not allowed.
#Event ID 355: IC: A10_IrpContext, Scb: A11_Scb, FileObject: A12_IrpSp->FileObject.
#Event ID 356: IC: A10_IrpContext, EncryptionOperation: 0xA11_EncryptionOperation!
#Event ID 357: NtfsReadRawEncrypted: Caller does not have backup access or read data access.
#Message #
Event ID 358: NtfsWriteRawEncrypted: Caller does not have write data access or restore access.
#Message #
Event ID 359: NtfsWriteRawEncrypted: Caller not having manage volume privilege.
#Description
NtfsWriteRawEncrypted: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 360: NtfsLookupStreamFromCluster: Caller not having manage volume privilege.
#Description
NtfsLookupStreamFromCluster: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 361: NtfsChangeVolumeSize: Caller not having manage volume privilege.
#Description
NtfsChangeVolumeSize: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 362: NtfsChangeVolumeSize (A10_Vcb): Calling NtfsFreeRecentlyDeallocated.
#Event ID 363: NtfsChangeVolumeSize (A10_Vcb): Done calling NtfsFreeRecentlyDeallocated.
#Event ID 364: NtfsMarkHandle: Caller does not have a valid volume handle or manage volume access or is not kernel model caller.
#Message #
Event ID 365: NtfsMarkHandle: Caller not having manage volume privilege.
#Description
NtfsMarkHandle: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 369: NtfsMarkHandle: Mark handle is not allowed on system files.
#Description
NtfsMarkHandle: Mark handle is not allowed on system files. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, FcbState: 0x!08x!, HandleInfo flags: !x!.
Message #
Event ID 371: NtfsMarkHandle: File was granted write access previously but no oplocks were broken.
#Message #
Event ID 373: NtfsSetZeroOnDeallocate: Only allowed on regular user files opened for write.
#Message #
Event ID 374: NtfsSetShortNameBehavior: Caller not having manage volume privilege.
#Description
NtfsSetShortNameBehavior: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 375: Setting VCB_EXT_CHAR_STATE_ALLOW_EXT_CHAR for volume 0xA10_(PVOID)Vcb to A11_InputParameter.
#Event ID 376: NtfsQueryPagefileEncryption: Caller not having manage volume privilege.
#Description
NtfsQueryPagefileEncryption: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 377: NtfsQueryPagefileEncryption: Caller not having manage volume privilege.
#Description
NtfsQueryPagefileEncryption: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 378: NtfsResetVolsnapBehaviorForVolume: Volsnap hints are disabled by registry.
#Description
NtfsResetVolsnapBehaviorForVolume: Volsnap hints are disabled by registry. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, NtfsData Flags: !x!.
Message #
Event ID 379: NtfsResetVolsnapBehaviorForVolume: Caller not having manage volume privilege.
#Description
NtfsResetVolsnapBehaviorForVolume: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 380: Resetting Volsnap behavior for VCB = 0xA10_Vcb.
#Event ID 381: NtfsResetVolsnapBehaviorForVolume: Caller not having manage volume privilege.
#Description
NtfsResetVolsnapBehaviorForVolume: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 382: NtfsCorruptionHandling: Caller not having manage volume privilege.
#Description
NtfsCorruptionHandling: Caller not having manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 383: NtfsGlobalCorruptionHandling: Caller does not have manage volume privilege.
#Description
NtfsGlobalCorruptionHandling: Caller does not have manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!.
Message #
Event ID 384: Scrub resume from SystemScbIndex: A10_ScrubResumeContext.SystemScbIndex Vcn: A11_ScrubResumeContext.ResumeVcn!
#Description
Scrub resume from SystemScbIndex: A10_ScrubResumeContext.SystemScbIndex Vcn: A11_ScrubResumeContext.ResumeVcn!#I64x! + A12_ScrubResumeContext.ResumeVcnOffset!#x!
Message #
Fields #
| Name | Description |
|---|---|
A10_ScrubResumeContext.SystemScbIndex UInt32 | |
A11_ScrubResumeContext.ResumeVcn HexInt64 | |
A12_ScrubResumeContext.ResumeVcnOffset HexInt32 |
Event ID 385: Scb:A10_Scb Scrub resume from Vcn: A11_ScrubResumeContext.ResumeVcn!
#Event ID 386: Scrub SystemScbIndex: A10_ScrubResumeContext.SystemScbIndex.
#Event ID 388: Scrub not supported for Txf file, Scb: A10_Scb, TxfScb: A11_Scb->TxfScb.
#Event ID 389: Scrub SCRUB_DATA_INPUT_FLAG_SKIP_NON_INTEGRITY_DATA is request.
#Description
Scrub SCRUB_DATA_INPUT_FLAG_SKIP_NON_INTEGRITY_DATA is request. noop.
Message #
Event ID 390: Scb:A10_Scb ScrubInternal OperationStatus: A11_ScrubContext.OperationStatus Repaired: A12_ScrubContext.NumberOfBytesRepaired!
#Description
Scb:!p! ScrubInternal OperationStatus: !S! Repaired: !#I64x! Failed: !#I64x! FileOffset: !#I64x! Length: !#I64x! ParityExtentCount: !u!
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubContext.OperationStatus HexInt32 | |
A12_ScrubContext.NumberOfBytesRepaired HexInt64 | |
A13_ScrubContext.NumberOfBytesFailed HexInt64 | |
A14_ScrubContext.ErrorFileOffset HexInt64 | |
A15_ScrubContext.ErrorLength HexInt64 | |
A16_ScrubContext.ParityExtentData->NumberOfParityExtents UInt32 |
Event ID 391: Scb:A10_Scb ScrubInternal Status: A11_Status Repaired: A12_ScrubContext.NumberOfBytesRepaired!
#Description
Scb:A10_Scb ScrubInternal Status: A11_Status Repaired: A12_ScrubContext.NumberOfBytesRepaired!#I64x! Failed: A13_ScrubContext.NumberOfBytesFailed!#I64x! ParityExtentCount: A14_ScrubContext.ParityExtentData->NumberOfParityExtents.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_Status HexInt32 | |
A12_ScrubContext.NumberOfBytesRepaired HexInt64 | |
A13_ScrubContext.NumberOfBytesFailed HexInt64 | |
A14_ScrubContext.ParityExtentData->NumberOfParityExtents UInt32 |
Event ID 392: InternalFileReference: A10_InternalFileReference.
#Event ID 393: InternalFileReference:A10_InternalFileReference.
#Event ID 394: Scb:A10_Scb Incomplete IoCount:A11_ScrubIoCount Cancel:A12_Irp->Cancel ParityExtentCount:A13_ScrubContext.ParityExtentData->NumberOfParityExtents.
#Description
Scb:A10_Scb Incomplete IoCount:A11_ScrubIoCount Cancel:A12_Irp->Cancel ParityExtentCount:A13_ScrubContext.ParityExtentData->NumberOfParityExtents.
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_ScrubIoCount UInt32 | |
A12_Irp->Cancel UInt32 | |
A13_ScrubContext.ParityExtentData->NumberOfParityExtents UInt32 |
Event ID 397: Scb:A10_Scb Scrub StartingVcn.
#Event ID 398: Scb:A10_Scb Scrub starting vcn is beyond VDL.
#Event ID 399: Scb:A10_Scb Scrub no more Mcb entries from StartingVcn:A11_StartingVcn!
#Event ID 400: Scb:A10_Scb Scrub skipping UNUSED_LCN Vcn: A11_StartingVcn!
#Event ID 401: Scb:A10_Scb StartingVcn:A11_StartingVcn!
#Event ID 402: Scb:A10_Scb ScrubDsmRange [A11_DsmRange.StartingOffset!
#Description
Scb:A10_Scb ScrubDsmRange [A11_DsmRange.StartingOffset!#I64x!,A12_DsmRange.StartingOffset + DsmRange.LengthInBytes!#I64x!) Length:A13_DsmRange.LengthInBytes!#I64x! (Bytes) StartingVcn:A14_StartingVcn!#I64x! + A15_StartingVcnOffset!#x! SectorAlignedVdl:A16_SectorAlignedVdl!#I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_DsmRange.StartingOffset HexInt64 | |
A12_DsmRange.StartingOffset + DsmRange.LengthInBytes HexInt64 | |
A13_DsmRange.LengthInBytes HexInt64 | |
A14_StartingVcn HexInt64 | |
A15_StartingVcnOffset HexInt32 | |
A16_SectorAlignedVdl HexInt64 |
Event ID 403: Scrub found problems Scb: A10_Scb Vcn A11_StartingVcn!
#Description
Scrub found problems Scb: !p! Vcn !#I64x! FileOffset: !#I64x! Length: !#I64x! Status: !S! BytesFailed: !#I64x! BytesRepaired: !#I64x! NewParityExtents: !u!
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_StartingVcn HexInt64 | |
A12_ScrubContext->ErrorFileOffset HexInt64 | |
A13_ScrubbedLength HexInt64 | |
A14_ScrubContext->OperationStatus HexInt32 | |
A15_ScrubContext->NumberOfBytesFailed HexInt64 | |
A16_ScrubContext->NumberOfBytesRepaired HexInt64 | |
A17_NewParityExtentCount UInt32 |
Event ID 404: Scb:A10_Scb DsmAction_Scrub call failed, Status: A11_Status.
#Event ID 405: Scb:A10_Scb DsmAction_Scrub operation failed, Status: A11_Status.
#Event ID 406: FSCTL_REPAIR_COPIES not supported for Txf file, Scb: A10_Scb, TxfScb: A11_Scb->TxfScb.
#Event ID 407: Scb.
#Description
Scb:!p! FSCTL_REPAIR_COPIES skipping resident attribute (d) (!S!).
Message #
Event ID 408: Scb.
#Description
Scb:!p! FSCTL_REPAIR_COPIES skipping resident attribute (!S!).
Message #
Event ID 409: FSCTL_REPAIR_COPIES interrupted by thread termination.
#Description
FSCTL_REPAIR_COPIES interrupted by thread termination.
Message #
Event ID 411: Scb:A10_Scb FSCTL_REPAIR_COPIES no more Mcb entries from StartingVcn:A11_StartingVcn!
#Event ID 412: Scb:A10_Scb FSCTL_REPAIR_COPIES No more Mcb entries (unallocated) from StartingVcn:A11_StartingVcn!
#Event ID 413: Scb:A10_Scb FSCTL_REPAIR_COPIES skipping UNUSED_LCN Vcn: A11_StartingVcn!
#Event ID 414: Scb:A10_Scb RepairDsmRange [A11_RepairDataSetRange->StartingOffset!
#Description
Scb:A10_Scb RepairDsmRange [A11_RepairDataSetRange->StartingOffset!#I64x!,A12_RepairDataSetRange->StartingOffset + RepairDataSetRange->LengthInBytes!#I64x!) Length:A13_RepairDataSetRange->LengthInBytes!#I64x! (Bytes) FileOffset: A14_RepairFileOffset!#I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Scb Pointer | |
A11_RepairDataSetRange->StartingOffset HexInt64 | |
A12_RepairDataSetRange->StartingOffset + RepairDataSetRange->LengthInBytes HexInt64 | |
A13_RepairDataSetRange->LengthInBytes HexInt64 | |
A14_RepairFileOffset HexInt64 |
Event ID 415: Scb:A10_Scb DsmAction_Repair call failed, Status: A11_Status.
#Event ID 416: Scb:A10_Scb DsmAction_Repair operation failed, Status: A11_IrpStatus.
#Event ID 417: Scb:A10_Scb DsmAction_Repair completed, IrpStatus: A11_RepairCopiesOutput->Status.
#Event ID 422: NtfsCheckForSection: File already has image section.
#Description
NtfsCheckForSection: File already has image section. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Scb: !p!, Scb Type Code: 0x!x!, Scb Name: !S!.
Message #
Event ID 423: NtfsShuffleFile: User mode caller is not allowed.
#Description
NtfsShuffleFile: User mode caller is not allowed. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, TypeOfOpen: !d!, Fcb: !p!, FileRef: 0x!I64x!, Ccb FullFileName: !S!, Irp RequestorMode: !d!.
Message #
Event ID 424: NtfsShuffleFile: Denying access due to volume is locked.
#Description
NtfsShuffleFile: Denying access due to volume is locked. Thread: !p!, TypeOfOpen: !d!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Ccb FullFileName: !S!, VcbState: 0x!08x!.
Message #
Event ID 427: NtfsRearrangeFile: User mode caller is not allowed.
#Description
NtfsRearrangeFile: User mode caller is not allowed. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Ccb FullFileName: !S!, Irp RequestorMode: !d!.
Message #
Event ID 428: NtfsRearrangeFile: Denying access due to volume is locked.
#Description
NtfsRearrangeFile: Denying access due to volume is locked. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Ccb FullFileName: !S!, VcbState: 0x!08x!.
Message #
Event ID 431: NtfsSparseOverAllocate: Caller does not have appropriate write access.
#Description
NtfsSparseOverAllocate: Caller does not have appropriate write access. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, FileRef: !I64x!, FullFileName: !S!, Ccb access flags: !x!.
Message #
Event ID 432: NtfsInitiateFileMetadataOptimization: Only allowed on regular user files/directories opened for write.
#Message #
Event ID 433: NtfsQueryFileMetadataOptimization: Only allowed on regular user files/directories opened for read.
#Message #
Event ID 435: NtfsEnumOnMountToDeleteWorker.
#Description
NtfsEnumOnMountToDeleteWorker(!p!,!p!): Open status=0x!x!, path="!S!".
Message #
Event ID 436: NtfsEnumOnMountToDeleteWorker(A10_Vcb,A11_PsGetCurrentThread()): Enumerate status=0xA12_Status.
#Event ID 437: NtfsEnumMountWorker.
#Description
NtfsEnumMountWorker(!p!,!p!): Open status=0x!x!, file="!S!".
Message #
Event ID 438: NtfsEnumMountWorker(A10_Vcb,A11_PsGetCurrentThread()): Close status=0xA12_Status.
#Event ID 439: NtfsEnumOnMountToDeleteWorker(A10_Vcb,A11_PsGetCurrentThread()): Close dir status=0xA12_Status.
#Event ID 441: SCB: A10_Scb, StartOffset: 0xA11_StartOffset!
#Event ID 442: FsLibGetBadAddressRanges returned Status: A10_Status, NumBadRanges: 0xA11_Output->NumBadRanges.
#Event ID 443: FsInputRangeIndex: A10_FsInputRangeIndex, FileOffset: 0xA11_FsInputRanges[FsInputRangeIndex].FileOffset!
#Description
FsInputRangeIndex: A10_FsInputRangeIndex, FileOffset: 0xA11_FsInputRanges[FsInputRangeIndex].FileOffset!I64x!, VolumeOffset: 0xA12_FsInputRanges[FsInputRangeIndex].VolumeOffset!I64x!, LengthInBytes: 0xA13_FsInputRanges[FsInputRangeIndex].LengthInBytes!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_FsInputRangeIndex UInt32 | |
A11_FsInputRanges[FsInputRangeIndex].FileOffset HexInt64 | |
A12_FsInputRanges[FsInputRangeIndex].VolumeOffset HexInt64 | |
A13_FsInputRanges[FsInputRangeIndex].LengthInBytes HexInt64 |
Event ID 444: Scb: A10_Scb, Status: A11_Status, AbnormalTermination: A12_(BOOLEAN)AbnormalTermination().
#Event ID 445: Scb: A10_Scb, Status: A11_Status.
#Event ID 446: NtfsEncryptionKeyCtl: Caller does not have SE_TCB_PRIVILEGE.
#Description
NtfsEncryptionKeyCtl: Caller does not have SE_TCB_PRIVILEGE. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!.
Message #
Event ID 447: Logic error of posting close to work queue.
#Description
Logic error of posting close to work queue.
Message #
Event ID 448: NtfsFindPrefixHashEntry: {Hash table.
#Description
NtfsFindPrefixHashEntry: {Hash table: !p!} {ParentScb: !p!, '!S!'} {RemainingName: '!S!'}.
Message #
Event ID 449: NtfsFindPrefixHashEntry: {Lcb: NULL}
#Description
NtfsFindPrefixHashEntry: {Lcb: NULL}.
Message #
Event ID 450: NtfsFindPrefixHashEntry: {Lcb.
#Description
NtfsFindPrefixHashEntry: {Lcb: !p!, '!S!'}.
Message #
Event ID 451: NtfsFindPrefixHashEntry: {Lcb not found}
#Description
NtfsFindPrefixHashEntry: {Lcb not found}.
Message #
Event ID 452: NtfsInsertHashEntry: {Hash table.
#Description
NtfsInsertHashEntry: {Hash table: !p!} {HashValue: !08x!} {FullNameLength: !d!} {Lcb: !p!, '!S!'}.
Message #
Event ID 453: NtfsRemoveHashEntry: {Hash table.
#Description
NtfsRemoveHashEntry: {Hash table: !p!} {HashValue: !08x!} {HashLcb: !p!, '!S!'}.
Message #
Event ID 454: Vcb A10_Vcb.
#Event ID 455: Vcb A10_Vcb.
#Event ID 456: Vcb A10_Vcb.
#Event ID 457: Vcb A10_Vcb.
#Event ID 458: Vcb A10_Vcb.
#Event ID 459: Vcb A10_Vcb.
#Event ID 460: Vcb A10_Vcb.
#Event ID 461: Vcb A10_Vcb.
#Event ID 462: Vcb A10_Vcb.
#Event ID 463: Vcb A10_Vcb.
#Event ID 464: Vcb A10_Vcb.
#Event ID 465: NtfsCheckpointForVolumeSnapshot: Denying access due to volume is locked.
#Description
NtfsCheckpointForVolumeSnapshot: Denying access due to volume is locked. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, VcbState: 0x!08x!.
Message #
Event ID 466: Vcb A10_Vcb.
#Event ID 467: Vcb A10_Vcb.
#Event ID 468: NtfsCommitCurrentTransaction IC: A10_IrpContext, TransactionId: 0xA11_IrpContext->TransactionId!
#Event ID 469: NtfsCommitCurrentTransaction IC: A10_IrpContext, TransactionId: 0xA11_IrpContext->TransactionId!
#Event ID 470: NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Pre NtfsWriteLog failure A13_IrpContext->ExceptionStatus.
#Description
NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Pre NtfsWriteLog failure A13_IrpContext->ExceptionStatus.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContext->OriginatingIrp Pointer | |
A12_PsGetCurrentThread() Pointer | |
A13_IrpContext->ExceptionStatus HexInt32 |
Event ID 471: NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Post NtfsWriteLog failure A13_IrpContext->ExceptionStatus.
#Description
NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Post NtfsWriteLog failure A13_IrpContext->ExceptionStatus.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContext->OriginatingIrp Pointer | |
A12_PsGetCurrentThread() Pointer | |
A13_IrpContext->ExceptionStatus HexInt32 |
Event ID 472: NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): LfsFlushToLsn failure A13_IrpContext->ExceptionStatus Count A14_FailedFlushCount.
#Description
NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): LfsFlushToLsn failure A13_IrpContext->ExceptionStatus Count A14_FailedFlushCount.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContext->OriginatingIrp Pointer | |
A12_PsGetCurrentThread() Pointer | |
A13_IrpContext->ExceptionStatus HexInt32 | |
A14_FailedFlushCount Int32 |
Event ID 473: NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Pre NtfsProcessNewLengthQueue failure A13_IrpContext->ExceptionStatus.
#Description
NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Pre NtfsProcessNewLengthQueue failure A13_IrpContext->ExceptionStatus.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContext->OriginatingIrp Pointer | |
A12_PsGetCurrentThread() Pointer | |
A13_IrpContext->ExceptionStatus HexInt32 |
Event ID 474: NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Post NtfsProcessNewLengthQueue failure A13_IrpContext->ExceptionStatus.
#Description
NtfsCommitCurrentTransaction (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Post NtfsProcessNewLengthQueue failure A13_IrpContext->ExceptionStatus.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContext->OriginatingIrp Pointer | |
A12_PsGetCurrentThread() Pointer | |
A13_IrpContext->ExceptionStatus HexInt32 |
Event ID 475: NtfsCommitCurrentTransaction IC: A10_IrpContext, TransactionId: 0xA11_IrpContext->TransactionId!
#Event ID 476: NtfsCommitCurrentTransaction IC: A10_IrpContext, TransactionId: 0xA11_IrpContext->TransactionId!
#Event ID 477: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Entering - ActiveLsn: A11_ActiveLsn->QuadPart!
#Event ID 478: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb empty list - Leaving.
#Event ID 479: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb empty list - Leaving.
#Event ID 480: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Found frozen deallocated clusters with A11_Clusters->ClusterCount!
#Event ID 481: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - No actionable deallocated clusters.
#Event ID 482: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - No actionable deallocated clusters.
#Event ID 483: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Found a deallocated clusters A11_Clusters with A12_Clusters->ClusterCount!
#Description
NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Found a deallocated clusters A11_Clusters with A12_Clusters->ClusterCount!I64x! clusters, Lsn: A13_Clusters->Lsn.QuadPart!I64x!, Flags: A14_Clusters->Flags!08x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_Clusters Pointer | |
A12_Clusters->ClusterCount HexInt64 | |
A13_Clusters->Lsn.QuadPart HexInt64 | |
A14_Clusters->Flags HexInt32 |
Event ID 484: Vcb: A10_Vcb, Processing range.
#Event ID 486: FsLibGroupSubExtentsByDanglingMdl failed: A10_Status.
#Event ID 487: FsLibAddBaseMcbEntryEx failed: A10_Status.
#Event ID 488: NtfsAddToMatchingDeallocatedClusters( ExtentsWithoutDanglingMdl ) failed: A10_Status.
#Event ID 489: NtfsAddToMatchingDeallocatedClusters( ExtentsWithDanglingMdl ) failed: A10_Status.
#Event ID 491: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Telling volsnap freeing at A11_StartingLcn!
#Event ID 492: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Volsnap responsed with freeing at A11_StartingLcn + StartingIndex!
#Event ID 493: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Got error 0xA11_Status from below.
#Event ID 494: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Deleting MarkUnusedContext A11_MarkUnusedContext.
#Event ID 495: NtfsFreeRecentlyDeallocated: Vcb A10_Vcb - Leaving.
#Event ID 496: NtfsRemoveNtfsMcbEntry Scb: A10_Mcb->Scb, Mcb: A11_Mcb, Vcn: 0xA12_StartingVcn!
#Event ID 497: NtfsRemoveNtfsMcbEntry Mcb: A10_Mcb Completed.
#Event ID 498: NtfsAddNtfsMcbEntry Scb: A10_Mcb->Scb, Mcb: A11_Mcb, Vcn: 0xA12_Vcn!
#Event ID 499: NtfsAddNtfsMcbEntry Mcb: A10_Mcb, Result: A11_Result.
#Event ID 500: NtfsUnloadNtfsMcbRange Scb: A10_Mcb->Scb, Mcb: A11_Mcb, StartVcn: 0xA12_StartingVcn!
#Description
NtfsUnloadNtfsMcbRange Scb: A10_Mcb->Scb, Mcb: A11_Mcb, StartVcn: 0xA12_StartingVcn!I64x!, EndVcn: 0xA13_EndingVcn!I64x!, TruncateOnly: A14_TruncateOnly.
Message #
Fields #
| Name | Description |
|---|---|
A10_Mcb->Scb Pointer | |
A11_Mcb Pointer | |
A12_StartingVcn HexInt64 | |
A13_EndingVcn HexInt64 | |
A14_TruncateOnly UInt32 |
Event ID 501: NtfsUnloadNtfsMcbRange Mcb: A10_Mcb Completed.
#Event ID 502: Valid NTFS boot sector.
#Event ID 503: Not an NTFS boot sector.
#Event ID 504: NtfsMountVolume: Vcb:A10_Vcb, IC:A11_IrpContext, Growing allocation for Mft's Attribute List failed with exception:0xA12_IrpContext->ExceptionStatus.
#Event ID 505: NtfsMountVolume: IC.
#Description
NtfsMountVolume: IC: !p!, Vcb: !p!, Label: !S!, DeviceName: !S!
Message #
Event ID 506: Mounting DAX partition.
#Event ID 507: DAX volume mounted without DAX support because storage is not DAX capable.
#Event ID 508: NtfsGrowMftsAttributeListAllocation Vcb:A10_Vcb, IC:A11_IrpContext Mft AttributeList not found, skipping growth.
#Event ID 509: NtfsGrowMftsAttributeListAllocation Vcb:A10_Vcb, IC:A11_IrpContext Converting Resident AttributeList.
#Event ID 510: NtfsGrowMftsAttributeListAllocation Vcb:A10_Vcb, IC:A11_IrpContext, AttrListScb:A12_Scb Added Allocation for NonResident AttributeList.
#Description
NtfsGrowMftsAttributeListAllocation Vcb:A10_Vcb, IC:A11_IrpContext, AttrListScb:A12_Scb Added Allocation for NonResident AttributeList (old size:0xA13_AttrListAllocationSize!I64x!).
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Scb Pointer | |
A13_AttrListAllocationSize HexInt64 |
Event ID 511: Unexpected exception code of 0xA10_ExceptionCode received.
#Event ID 512: Exception code of 0xA10_ExceptionCode received during mount.
#Event ID 513: Unexpected exception code of 0xA10_ExceptionCode received.
#Event ID 514: LogFileFull A10_IrpContext->LogFullReason BackTrace: ln A11_BackTrace[0]; ln A12_BackTrace[1]; ln A13_BackTrace[2]; ln A14_BackTrace[3]; ln A15_BackTrace[4]; ln A16_BackTrace[5]; ln A17_BackTrace[6...
#Description
LogFileFull BackTrace: ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!; ln !p!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext->LogFullReason UInt32 | |
A11_BackTrace[0] Pointer | |
A12_BackTrace[1] Pointer | |
A13_BackTrace[2] Pointer | |
A14_BackTrace[3] Pointer | |
A15_BackTrace[4] Pointer | |
A16_BackTrace[5] Pointer | |
A17_BackTrace[6] Pointer | |
A18_BackTrace[7] Pointer | |
A19_BackTrace[8] Pointer | |
A20_BackTrace[9] Pointer | |
A21_BackTrace[10] Pointer | |
A22_BackTrace[11] Pointer | |
A23_BackTrace[12] Pointer | |
A24_BackTrace[13] Pointer | |
A25_BackTrace[14] Pointer | |
A26_BackTrace[15] Pointer | |
A27_BackTrace[16] Pointer | |
A28_BackTrace[17] Pointer | |
A29_BackTrace[18] Pointer | |
A30_BackTrace[19] Pointer |
Event ID 515: Unexpected raise of 0xA10_ExceptionCode during critical non-raise code.
#Event ID 516: NtfsProcessException IC: A10_IrpContext, ExceptionCode: 0xA11_ExceptionCode!
#Event ID 517: NtfsProcessException IC: A10_IrpContext, ExceptionCode: 0xA11_ExceptionCode!
#Event ID 518: Failed to abort - IrpContext A10_IrpContext, Irp A11_Irp, Vcb A12_IrpContext->Vcb, Count A13_NtfsFailedAborts, Status A14_GetExceptionCode().
#Description
Failed to abort - IrpContext A10_IrpContext, Irp A11_Irp, Vcb A12_IrpContext->Vcb, Count A13_NtfsFailedAborts, Status A14_GetExceptionCode().
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Irp Pointer | |
A12_IrpContext->Vcb Pointer | |
A13_NtfsFailedAborts HexInt32 | |
A14_GetExceptionCode() HexInt32 |
Event ID 519: Failed to abort - IrpContext A10_IrpContext, Irp A11_Irp, Vcb A12_IrpContext->Vcb, Scb A13_NextScb, FileRef A14_*(PULONGLONG)_NextScb->Fcb->FileReference!
#Description
Failed to abort - IrpContext A10_IrpContext, Irp A11_Irp, Vcb A12_IrpContext->Vcb, Scb A13_NextScb, FileRef A14_*(PULONGLONG)_NextScb->Fcb->FileReference!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Irp Pointer | |
A12_IrpContext->Vcb Pointer | |
A13_NextScb Pointer | |
A14_*(PULONGLONG)_NextScb->Fcb->FileReference HexInt64 |
Event ID 520: Setting STATUS_CANT_WAIT in top-level exception status for write @ 0xA10_IrpSp->Parameters.Write.ByteOffset.HighPart!
#Description
Setting STATUS_CANT_WAIT in top-level exception status for write @ 0xA10_IrpSp->Parameters.Write.ByteOffset.HighPart!08x!A11_IrpSp->Parameters.Write.ByteOffset.LowPart!08x!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpSp->Parameters.Write.ByteOffset.HighPart HexInt32 | |
A11_IrpSp->Parameters.Write.ByteOffset.LowPart HexInt32 |
Event ID 521: Setting 0xA10_ExceptionCode in top-level exception status for write @ 0xA11_IrpSp->Parameters.Write.ByteOffset.HighPart!
#Description
Setting 0xA10_ExceptionCode in top-level exception status for write @ 0xA11_IrpSp->Parameters.Write.ByteOffset.HighPart!08x!A12_IrpSp->Parameters.Write.ByteOffset.LowPart!08x!
Message #
Fields #
| Name | Description |
|---|---|
A10_ExceptionCode HexInt32 | |
A11_IrpSp->Parameters.Write.ByteOffset.HighPart HexInt32 | |
A12_IrpSp->Parameters.Write.ByteOffset.LowPart HexInt32 |
Event ID 522: [A10_IrpSp->MajorFunction, A11_IrpSp->MinorFunction!
#Event ID 523: [A10_IrpSp->MajorFunction, A11_IrpSp->MinorFunction!
#Event ID 524: Can't handle invalid bitmap in a positive way.
#Description
Can't handle invalid bitmap in a positive way.
Message #
Event ID 526: Updating NtfsMinTrimTotalSize to A10_MinTrimTotalSize.
#Event ID 527: Updating NtfsMaxTrimTotalSize to A10_MaxTrimTotalSize.
#Event ID 531: A10___FUNCTION__: Setting RM at 0xA11_(PVOID)Vcb->TxfVcb.DefaultRm ({A12__Vcb->TxfVcb.DefaultRm->RmId}) up for auto-restart.
#Event ID 532: NtfsFsQuotaSetInfo: Denying access due to administrator limit.
#Description
NtfsFsQuotaSetInfo: Denying access due to administrator limit. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!.
Message #
Event ID 533: NtfsCommonSetQuota: Caller does not have manage volume privilege and it's not quota file.
#Message #
Event ID 534: Unexpected Paging-Read on DAX mappable stream, Scb=A10_Scb.
#Event ID 538: NtfsReleaseVcbCheckDelete - NtfsDeleteVcb() returned FALSE; scheduling checkpoint.
#Event ID 539: NtfsReleaseVcbCheckDelete - deleted Vcb: A10_Vcb, IC: A11_IrpContext.
#Event ID 540: NtfsReleaseVcbCheckDelete - Scheduling checkpoint due to dismounted Vcb: A10_Vcb, Vcb->LogFileObject: A11_Vcb->LogFileObject, IC: A12_IrpContext.
#Event ID 541: NtfsAbortTransaction IC: A10_IrpContext, TransactionId: 0xA11_IrpContext->TransactionId!
#Event ID 542: NtfsAbortTransaction IC: A10_IrpContext, TransactionId: 0xA11_IrpContext->TransactionId!
#Event ID 543: DoAction::InitializeFRS IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!
#Description
DoAction::InitializeFRS IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!04x!_A12_FileRecord->SegmentNumberLowPart!08x!, BaseFRS:0xA13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )!012I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecord->SegmentNumberHighPart HexInt32 | |
A12_FileRecord->SegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 |
Event ID 544: DoAction::DeallocateFRS IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!
#Description
DoAction::DeallocateFRS IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!04x!_A12_FileRecord->SegmentNumberLowPart!08x!, BaseFRS:0xA13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )!012I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecord->SegmentNumberHighPart HexInt32 | |
A12_FileRecord->SegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 |
Event ID 545: DoAction::WriteEndOfFRS IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!
#Description
DoAction::WriteEndOfFRS IC:!p!, FileRef:0x!04x!_!08x!, BaseFRS:0x!012I64x!, Attrib:0x!x! Off:0x!x!, Len:0x!x!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecord->SegmentNumberHighPart HexInt32 | |
A12_FileRecord->SegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 | |
A14_Attribute->TypeCode HexInt32 | |
A15_LogRecord->RecordOffset HexInt32 | |
A16_Length HexInt32 |
Event ID 546: DoAction::CreateAttribute IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!
#Description
DoAction::CreateAttribute IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!04x!_A12_FileRecord->SegmentNumberLowPart!08x!, BaseFRS:0xA13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )!012I64x!, Attrib:0xA14_((PATTRIBUTE_RECORD_HEADER)Data)->TypeCode.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecord->SegmentNumberHighPart HexInt32 | |
A12_FileRecord->SegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 | |
A14_((PATTRIBUTE_RECORD_HEADER)Data)->TypeCode HexInt32 |
Event ID 547: NtfsRestartChangeValue IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!
#Description
NtfsRestartChangeValue IC:A10_IrpContext, FileRef:0xA11_FileRecord->SegmentNumberHighPart!04x!_A12_FileRecord->SegmentNumberLowPart!08x!, BaseFRS:0xA13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )!012I64x!, FileRef:0xA14_NtfsFullSegmentNumber( _FileReference )!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecord->SegmentNumberHighPart HexInt32 | |
A12_FileRecord->SegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 | |
A14_NtfsFullSegmentNumber( _FileReference ) HexInt64 |
Event ID 548: DoAction::SetNewAttributeSizes IC.
#Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_FileRecord->SegmentNumberHighPart HexInt32 | |
A12_FileRecord->SegmentNumberLowPart HexInt32 | |
A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) HexInt64 | |
A14_Attribute->Form.Nonresident.AllocatedLength HexInt64 | |
A15_Attribute->Form.Nonresident.FileSize HexInt64 | |
A16_Attribute->Form.Nonresident.ValidDataLength HexInt64 | |
A17_Attribute->Form.Nonresident.TotalAllocated HexInt64 | |
A18_Sizes->AllocationSize HexInt64 | |
A19_Sizes->FileSize HexInt64 | |
A20_Sizes->ValidDataLength HexInt64 | |
A21_Sizes->TotalAllocated HexInt64 |
Event ID 549: DoAction(SetBitsInNonresidentBitMap) IC: A10_IrpContext, Vcb: A11_Vcb, Bitmap: A12__Bitmap.
#Event ID 550: DoAction(ClearBitsInNonresidentBitMap) IC: A10_IrpContext, Vcb: A11_Vcb, Bitmap: A12__Bitmap.
#Event ID 551: NtfsUpgradeFileSecurity: Denying access due to volume does not support Txf.
#Description
NtfsUpgradeFileSecurity: Denying access due to volume does not support Txf. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!.
Message #
Event ID 553: NtfsCaseSensitiveInfoAccessCheck: Caller does not have appropriate access.
#Description
NtfsCaseSensitiveInfoAccessCheck: Caller does not have appropriate access. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Ccb FullFileName: !S!.
Message #
Event ID 554: NtfsCheckFileForDelete: Denying access due to there are same-tx handles open to this file.
#Description
NtfsCheckFileForDelete: Denying access due to there are same-tx handles open to this file. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Txf Writers Count: !d!.
Message #
Event ID 555: NtfsCheckFileForDelete: Denying access due to TxfCheckForLockConflict failed.
#Description
NtfsCheckFileForDelete: Denying access due to TxfCheckForLockConflict failed. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Original status: !S!.
Message #
Event ID 556: NtfsCheckFileForDelete: Denying access due to superseding view indexes are not allowed.
#Description
NtfsCheckFileForDelete: Denying access due to superseding view indexes are not allowed. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, File Attributes: 0x!08x!.
Message #
Event ID 557: NtfsCheckFileForDelete: Denying access due to non-posix delete of target directory open is not allowed.
#Message #
Event ID 558: NtfsCheckFileForDelete: Denying access due to file is not deleteable.
#Description
NtfsCheckFileForDelete: Denying access due to file is not deleteable. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!.
Message #
Event ID 560: NtfsCheckFileForDelete: Caller does not have write attributes access (TxfAccessCheck failed).
#Message #
Event ID 561: NtfsCheckFileForDelete: Denying access due to failing to remove image section.
#Message #
Event ID 562: NtfsGlobalSdUpdate: Caller does not have manage volume privilege.
#Description
NtfsGlobalSdUpdate: Caller does not have manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Ccb FullFileName: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 563: NtfsRepairItem: Denying access due to volume is locked.
#Description
NtfsRepairItem: Denying access due to volume is locked. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, VcbState: 0x!08x!.
Message #
Event ID 564: NtfsSetRepairState: Caller does not have manage volume privilege.
#Description
NtfsSetRepairState: Caller does not have manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Ccb FullFileName: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 565: NtfsInitiateRepair: Caller does not have manage volume privilege.
#Description
NtfsInitiateRepair: Caller does not have manage volume privilege. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Ccb FullFileName: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 566: NTFS ETW tracing is shutting down.
#Description
NTFS ETW tracing is shutting down.
Message #
Event ID 570: NtfsSetStorageReserveIdInfo: System files are not allowed to be part of a storage reserve.
#Message #
Event ID 573: NtfsChangeStorageReserveId: Caller does not have manage volume privilege to explicitly setting reserve ID to/from a "restricted area".
#Message #
Event ID 574: Failed to get a non-volatile token for Vcb: A10_Vcb, Status: A11_Status.
#Event ID 575: Failed to free non-volatile token for Vcb: A10_Vcb, Status: A11_Status.
#Event ID 576: NtfsRestoreScbSnapshots: Restored TotalAllocated, Scb: A10_Scb, TotalAllocated: 0xA11_Scb->TotalAllocated!
#Event ID 577: NtfsGetDeallocatedClusters: Lsn updated for DeallocatedClusters: A10_CurrentClusters, Lsn: A11_CurrentClusters->Lsn.QuadPart!
#Event ID 578: ClustersLinkAsHead: A10_ClustersLinkAsHead, FlagsToMatch: 0xA11_FlagsToMatch, InsertAfter: A12_InsertAfter.
#Event ID 579: Clusters: A10_Clusters, Flags: 0xA11_Clusters->Flags.
#Event ID 580: Matching cluster: A10_Clusters, NumberOfRuns: 0xA11_NumberOfRuns.
#Event ID 581: Clusters: A10_Clusters.
#Event ID 582: Allocated new deallocated clusters
#Description
Allocated new deallocated clusters.
Message #
Event ID 583: Need to add Range.
#Description
Need to add Range. DanglingMdl: DanglingMdl, DeallocatedClusters: A11_Clusters, Lcn: A12_Lcn!I64x!, ClusterCount: A13_ClusterCount!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_!FlagOn( Clusters->Flags, DEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL ) UInt32 | |
A11_Clusters Pointer | |
A12_Lcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 584: Added range.
#Description
Added range. DanglingMdl: DanglingMdl, DeallocatedClusters: A11_Clusters, Lcn: A12_Lcn!I64x!, ClusterCount: A13_ClusterCount!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_!FlagOn( Clusters->Flags, DEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL ) UInt32 | |
A11_Clusters Pointer | |
A12_Lcn HexInt64 | |
A13_ClusterCount HexInt64 |
Event ID 585: TxfCheckForLockConflict: File locked for modify transaction.
#Description
TxfCheckForLockConflict: File locked for modify transaction. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!,Fcb: !p!, FileRef: 0x!I64x!, TxfFcb Flags: 0x!08x!, ShareMode: 0x!08x!.
Message #
Event ID 586: TxfCheckForLockConflict: Locking transaction is doomed and caller is non-trans or different trans who wants to modify.
#Message #
Event ID 587: TxfCheckForLockConflict: Modification access desired.
#Description
TxfCheckForLockConflict: Modification access desired. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, Granted Access: 0x!08x!.
Message #
Event ID 588: TxfCheckForLockConflict: File has user handle opened on one of the versions or user-mapping on a section.
#Message #
Event ID 589: A10___FUNCTION__: from A11_CallerFunction (A12_CallerFile:A13_CallerLineNumber) RM at 0xA14_(PVOID)TxfRmcb {A15__TxfRmcb->RmId}, Tx at 0xA16_(PVOID)TxfTrans {A17__TxfTrans->KtmUow}, Status was 0xA1...
#Description
A10___FUNCTION__: from A11_CallerFunction (A12_CallerFile:A13_CallerLineNumber) RM at 0xA14_(PVOID)TxfRmcb {A15__TxfRmcb->RmId}, Tx at 0xA16_(PVOID)TxfTrans {A17__TxfTrans->KtmUow}, Status was 0xA18_AbortReasonStatus.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallerFunction AnsiString | |
A12_CallerFile AnsiString | |
A13_CallerLineNumber Int32 | |
A14_(PVOID)TxfRmcb Pointer | |
A15__TxfRmcb->RmId GUID | |
A16_(PVOID)TxfTrans Pointer | |
A17__TxfTrans->KtmUow GUID | |
A18_AbortReasonStatus HexInt32 |
Event ID 590: A10___FUNCTION__: from A11_CallerFunction (A12_CallerFile:A13_CallerLineNumber) RM at 0xA14_(PVOID)TxfRmcb {A15__TxfRmcb->RmId}, Tx at 0xA16_(PVOID)TxfTrans {A17__TxfTrans->KtmUow}, Status was 0xA1...
#Description
A10___FUNCTION__: from A11_CallerFunction (A12_CallerFile:A13_CallerLineNumber) RM at 0xA14_(PVOID)TxfRmcb {A15__TxfRmcb->RmId}, Tx at 0xA16_(PVOID)TxfTrans {A17__TxfTrans->KtmUow}, Status was 0xA18_Status.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallerFunction AnsiString | |
A12_CallerFile AnsiString | |
A13_CallerLineNumber Int32 | |
A14_(PVOID)TxfRmcb Pointer | |
A15__TxfRmcb->RmId GUID | |
A16_(PVOID)TxfTrans Pointer | |
A17__TxfTrans->KtmUow GUID | |
A18_Status HexInt32 |
Event ID 591: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} aborting transaction at 0xA13_TxfTrans {A14__TxfTrans->KtmUow}.
#Event ID 592: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} aborting transaction at 0xA13_TxfTrans {A14__TxfTrans->KtmUow}.
#Event ID 593: A10___FUNCTION__: RM at 0xA11_(PVOID)CalloutParameters->TxfFlush.TxfRmcb {A12__CalloutParameters->TxfFlush.TxfRmcb->RmId}: Unexpected exception code of 0xA13_GetExceptionCode() received.
#Description
A10___FUNCTION__: RM at 0xA11_(PVOID)CalloutParameters->TxfFlush.TxfRmcb {A12__CalloutParameters->TxfFlush.TxfRmcb->RmId}: Unexpected exception code of 0xA13_GetExceptionCode() received.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)CalloutParameters->TxfFlush.TxfRmcb Pointer | |
A12__CalloutParameters->TxfFlush.TxfRmcb->RmId GUID | |
A13_GetExceptionCode() HexInt32 |
Event ID 594: A10___FUNCTION__: TxfStartRm reports RM will be reset: RM metadata corrupt.
#Event ID 595: A10___FUNCTION__: TxfStartRm reports RM will be reset: TM could not be initialized.
#Event ID 596: A10___FUNCTION__: TxfStartRm reports RM will be reset: RM log corrupt.
#Event ID 597: A10___FUNCTION__: TxfStartRm reports RM will be reset: log version changed.
#Event ID 598: A10___FUNCTION__: TxfStartRm reports RM will be reset: dedicated log found, need multiplexed.
#Event ID 599: A10___FUNCTION__: TxfStartRm reports RM will be reset: multiplexed log found, need dedicated.
#Event ID 600: A10___FUNCTION__: TxfStartRm reports RM will be reset: CLFS log metadata corrupt.
#Event ID 601: A10___FUNCTION__: TxfStartRm reports RM will be reset: 0xA11_FailureStatus.
#Event ID 602: A10___FUNCTION__: RM did not start and WILL NOT be reset, status code is 0xA11_FailureStatus!
#Event ID 603: A10___FUNCTION__: Could not initialize IrpContext: 0xA11_Status.
#Event ID 604: TxfInitializeVolume: Denying access due to Txf start is not allowed (possible racing with dismount or volume shutdown).
#Description
TxfInitializeVolume: Denying access due to Txf start is not allowed (possible racing with dismount or volume shutdown). Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, FxfVcb flags: 0x!08x!.
Message #
Event ID 605: A10___FUNCTION__: IOCTL_VOLUME_GET_GPT_ATTRIBUTES returned 0xA11_TempStatus for default RM on VCB at 0xA12_(PVOID)Vcb.
#Event ID 606: A10___FUNCTION__: Exception code 0xA11_GetExceptionCode(), Status 0xA12_Status for default RM on VCB at 0xA13_(PVOID)Vcb.
#Event ID 607: A10___FUNCTION__: Couldn't reset default RM on VCB at 0xA11_(PVOID)Vcb after A12_TXF_MAX_RESET_ATTEMPTS_ON_MOUNT tries: 0xA13_OldStatus.
#Event ID 608: A10___FUNCTION__: Exception 0xA11_GetExceptionCode() raised from TxfConvertRmStartFailureStatusCode for default RM on VCB at 0xA12_(PVOID)Vcb.
#Event ID 609: A10___FUNCTION__: A11_(NT_SUCCESS( Status ) ? 'Succeeded' : 'FAILED') auto-restart of RM at 0xA12_(PVOID)TxfRmcb ({A13__TxfRmcb->RmId}): 0xA14_Status.
#Description
A10___FUNCTION__: A11_(NT_SUCCESS( Status ) ? 'Succeeded' : 'FAILED') auto-restart of RM at 0xA12_(PVOID)TxfRmcb ({A13__TxfRmcb->RmId}): 0xA14_Status.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(NT_SUCCESS( Status ) ? 'Succeeded' : 'FAILED') AnsiString | |
A12_(PVOID)TxfRmcb Pointer | |
A13__TxfRmcb->RmId GUID | |
A14_Status HexInt32 |
Event ID 610: A10___FUNCTION__: Attempting auto-restart of RM at 0xA11_(PVOID)TxfRmcb ({A12__TxfRmcb->RmId}).
#Event ID 611: A10___FUNCTION__: Volume too small to start RM at 0xA11_(PVOID)TxfRmcb ({A12__TxfRmcb->RmId}).
#Event ID 612: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: invalid flags in $Tops.
#Event ID 613: TxfStartRm: Denying access due to Txf start is not allowed (possible racing with dismount or volume shutdown).
#Description
TxfStartRm: Denying access due to Txf start is not allowed (possible racing with dismount or volume shutdown). Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, FxfVcb flags: 0x!08x!.
Message #
Event ID 614: A10___FUNCTION__: Raising to reset RM at 0xA11_(PVOID)TxfRmcb ({A12__TxfRmcb->RmId}): Explicit reset requested.
#Event ID 615: TxfStartRm: Denying access due to Txf start is not allowed (possible racing with dismount or volume shutdown).
#Description
TxfStartRm: Denying access due to Txf start is not allowed (possible racing with dismount or volume shutdown). Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, FxfVcb flags: 0x!08x!.
Message #
Event ID 616: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: no TXF_DATA in root.
#Event ID 617: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Different nesting levels of 0xA13_LogNestingLevel and 0xA14_DiskNestingLevel.
#Description
A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Different nesting levels of 0xA13_LogNestingLevel and 0xA14_DiskNestingLevel.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_LogNestingLevel HexInt32 | |
A14_DiskNestingLevel HexInt32 |
Event ID 618: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: restart area already exists.
#Event ID 619: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: restart area already exists.
#Event ID 620: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: RmID in restart area does not match {A13__ClfsRestartArea->RmId}.
#Event ID 621: A10___FUNCTION__: Got A11_Status from ClfsGetLogFileInformation for RM at 0xA12_(PVOID)TxfRmcb {A13__TxfRmcb->RmId}.
#Event ID 622: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Restart LSN is before beginning of log.
#Event ID 623: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: MinRollforwardEndLsn is beyond end of log.
#Event ID 624: A10___FUNCTION__: TxF RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} started successfully.
#Event ID 625: A10___FUNCTION__: TxF RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} failed to start with Status 0xA13_Status A14_AbnormalTermination() ? '(abnormal termination)' : ''.
#Description
A10___FUNCTION__: TxF RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} failed to start with Status 0xA13_Status A14_AbnormalTermination() ? '(abnormal termination)' : ''.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_Status HexInt32 | |
A14_AbnormalTermination() ? '(abnormal termination)' : '' AnsiString |
Event ID 626: A10___FUNCTION__: Shutting down A11_(TxfIsDefaultRm( TxfRmcb ) ? 'default' : 'secondary') RM at 0xA12_(PVOID)TxfRmcb {A13__TxfRmcb->RmId}.
#Description
A10___FUNCTION__: Shutting down A11_(TxfIsDefaultRm( TxfRmcb ) ? 'default' : 'secondary') RM at 0xA12_(PVOID)TxfRmcb {A13__TxfRmcb->RmId}. Shutdown is A14_(ForceDirtyShutdown ? 'DIRTY!' : 'CLEAN.').
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(TxfIsDefaultRm( TxfRmcb ) ? 'default' : 'secondary') AnsiString | |
A12_(PVOID)TxfRmcb Pointer | |
A13__TxfRmcb->RmId GUID | |
A14_(ForceDirtyShutdown ? 'DIRTY!' : 'CLEAN.') AnsiString |
Event ID 627: A10___FUNCTION__: Setting RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} up for auto-restart.
#Event ID 628: TxfFlushAndInvalidateExistingStructures: File has open user handles.
#Description
TxfFlushAndInvalidateExistingStructures: File has open user handles. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: 0x!I64x!, CleanupCount: !d!.
Message #
Event ID 629: (A10_FILEID_FROM_SOURCE( FileNLine ):A11_LINENUM_FROM_SOURCE( FileNLine )) - TXF_HARD_ERROR on RM at 0xA12_TxfRmcb ({A13__TxfRmcb->RmId}): A14_Status).
#Description
(A10_FILEID_FROM_SOURCE( FileNLine ):A11_LINENUM_FROM_SOURCE( FileNLine )) - TXF_HARD_ERROR on RM at 0xA12_TxfRmcb ({A13__TxfRmcb->RmId}): A14_Status).
Message #
Fields #
| Name | Description |
|---|---|
A10_FILEID_FROM_SOURCE( FileNLine ) UInt32 | |
A11_LINENUM_FROM_SOURCE( FileNLine ) Int32 | |
A12_TxfRmcb Pointer | |
A13__TxfRmcb->RmId GUID | |
A14_Status HexInt32 |
Event ID 630: A10___FUNCTION__: Renamed RM at 0xA11_(PVOID)TxfRmcb from {A12__OldGuid} to {A13__TxfRmcb->RmId}.
#Event ID 631: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}, rolling back Tx at 0xA13_(PVOID)TxfTrans {A14__TxfTrans->KtmUow}, Status was 0xA15_Status.
#Description
A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}, rolling back Tx at 0xA13_(PVOID)TxfTrans {A14__TxfTrans->KtmUow}, Status was 0xA15_Status.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_(PVOID)TxfTrans Pointer | |
A14__TxfTrans->KtmUow GUID | |
A15_Status HexInt32 |
Event ID 632: A10___FUNCTION__: Renamed RM at 0xA11_(PVOID)TxfRmcb from {A12__OldGuid} to {A13__TxfRmcb->RmId}.
#Event ID 633: TxfFsctlStartRm: Denying access due starting default RM is not allowed.
#Description
TxfFsctlStartRm: Denying access due starting default RM is not allowed. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, RmRootFcb: !p!.
Message #
Event ID 634: TxfFsctlWriteBackupInformation: Denying access due RM is active.
#Description
TxfFsctlWriteBackupInformation: Denying access due RM is active. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, BackupInfo flags: 0x!08x!.
Message #
Event ID 635: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Found too high of a TxF ID in log.
#Event ID 636: A10___FUNCTION__: Error Setting Delete Disposition: 0xA11_Status FileObject: 0xA12_(PVOID)FileObject.
#Event ID 637: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Got a RECOVER notification for a transaction that isn't in-doubt.
#Event ID 638: TxfSetupTransactionContextFromCcb: Modifying operation is now allowed with a non-TxF modify handle.
#Message #
Event ID 640: TxfSetupTransactionContextFromCcb: Denying access of modifying operation on a read-only handle.
#Message #
Event ID 641: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} raising 0xA13_ExceptionCode to KTM!
#Event ID 642: A10___FUNCTION__: Commit (0xA11_TransactionNotification) ofA12_(TransactionAlreadyPrepared ? ' **PREPARED** ' : ' ')tx {A13__TxfTrans->KtmUow} on RM at 0xA14_(PVOID)TxfRmcb {A15__TxfRmcb->RmId} fai...
#Description
A10___FUNCTION__: Commit (0xA11_TransactionNotification) ofA12_(TransactionAlreadyPrepared ? ' **PREPARED** ' : ' ')tx {A13__TxfTrans->KtmUow} on RM at 0xA14_(PVOID)TxfRmcb {A15__TxfRmcb->RmId} failed with 0xA16_Status.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_TransactionNotification HexInt32 | |
A12_(TransactionAlreadyPrepared ? ' **PREPARED** ' : ' ') AnsiString | |
A13__TxfTrans->KtmUow GUID | |
A14_(PVOID)TxfRmcb Pointer | |
A15__TxfRmcb->RmId GUID | |
A16_Status HexInt32 |
Event ID 643: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} aborting transaction at 0xA13_TxfTrans {A14__TxfTrans->KtmUow} (notify commit).
#Description
A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} aborting transaction at 0xA13_TxfTrans {A14__TxfTrans->KtmUow} (notify commit).
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTrans->KtmUow GUID |
Event ID 644: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} aborting transaction at 0xA13_TxfTrans {A14__TxfTrans->KtmUow} (notify rollback).
#Description
A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} aborting transaction at 0xA13_TxfTrans {A14__TxfTrans->KtmUow} (notify rollback).
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_TxfTrans Pointer | |
A14__TxfTrans->KtmUow GUID |
Event ID 645: A10___FUNCTION__: Error doing IRP_MJ_FLUSH_BUFFERS on RM at 0xA11_(PVOID)Trans->TxfRmcb {A12__Trans->TxfRmcb->RmId}: 0xA13_FlushStatus.
#Event ID 646: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} trying to abort transaction at 0xA13_Trans {A14__Trans->KtmUow}.
#Event ID 647: A10___FUNCTION__: Aborting call stack: 0xA11_CallStack[0] 0xA12_CallStack[1] 0xA13_CallStack[2] 0xA14_CallStack[3] 0xA15_CallStack[4].
#Description
A10___FUNCTION__: Aborting call stack: 0xA11_CallStack[0] 0xA12_CallStack[1] 0xA13_CallStack[2] 0xA14_CallStack[3] 0xA15_CallStack[4].
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_CallStack[0] Pointer | |
A12_CallStack[1] Pointer | |
A13_CallStack[2] Pointer | |
A14_CallStack[3] Pointer | |
A15_CallStack[4] Pointer |
Event ID 648: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} aborting transaction at 0xA13_Trans {A14__Trans->KtmUow}.
#Event ID 649: A10___FUNCTION__: 0xA11_Status initializing IrpContext for tx at A12_(PVOID)Trans {A13__Trans->KtmUow}, RM at A14_(PVOID)TxfRmcb {A15__TxfRmcb->RmId}.
#Description
A10___FUNCTION__: 0xA11_Status initializing IrpContext for tx at A12_(PVOID)Trans {A13__Trans->KtmUow}, RM at A14_(PVOID)TxfRmcb {A15__TxfRmcb->RmId}.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_(PVOID)Trans Pointer | |
A13__Trans->KtmUow GUID | |
A14_(PVOID)TxfRmcb Pointer | |
A15__TxfRmcb->RmId GUID |
Event ID 650: A10___FUNCTION__: 0xA11_Status writing log record for RM at 0xA12_(PVOID)TxfRmcb {A13__TxfRmcb->RmId}, Tx at 0xA14_(PVOID)Trans {A15__Trans->KtmUow}.
#Description
A10___FUNCTION__: 0xA11_Status writing log record for RM at 0xA12_(PVOID)TxfRmcb {A13__TxfRmcb->RmId}, Tx at 0xA14_(PVOID)Trans {A15__Trans->KtmUow}.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_Status HexInt32 | |
A12_(PVOID)TxfRmcb Pointer | |
A13__TxfRmcb->RmId GUID | |
A14_(PVOID)Trans Pointer | |
A15__Trans->KtmUow GUID |
Event ID 651: A10___FUNCTION__: About to force aborts on RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 652: A10___FUNCTION__: BaseLsn is greater than TargetLsn on RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 653: A10___FUNCTION__: No transactions remain on RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 654: A10___FUNCTION__: Transaction's first undo LSN greater than TargetLsn on RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 655: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} surprise-aborting transaction at 0xA13_OldestTrans {A14__OldestTrans->KtmUow}.
#Description
A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} surprise-aborting transaction at 0xA13_OldestTrans {A14__OldestTrans->KtmUow}.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_OldestTrans Pointer | |
A14__OldestTrans->KtmUow GUID |
Event ID 656: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} got 0xA13_Status from TxfTryAbortTransaction on Tx 0xA14_OldestTrans {A15__OldestTrans->KtmUow}.
#Description
A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId} got 0xA13_Status from TxfTryAbortTransaction on Tx 0xA14_OldestTrans {A15__OldestTrans->KtmUow}.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_Status HexInt32 | |
A14_OldestTrans Pointer | |
A15__OldestTrans->KtmUow GUID |
Event ID 657: A10___FUNCTION__: Inactive RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 658: A10___FUNCTION__: Log is pinned on RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 659: A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}, rolling back KTM Tx at 0xA13_(PVOID)TransToDereference {A14__TransToDereference->KtmUow}, Status was 0xA15_Status.
#Description
A10___FUNCTION__: RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}, rolling back KTM Tx at 0xA13_(PVOID)TransToDereference {A14__TransToDereference->KtmUow}, Status was 0xA15_Status.
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_(PVOID)TransToDereference Pointer | |
A14__TransToDereference->KtmUow GUID | |
A15_Status HexInt32 |
Event ID 660: A10___FUNCTION__: Log pinned trying to advance RestartLsn on RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 661: A10___FUNCTION__: Log pinned by doomed transaction on RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 662: A10___FUNCTION__: Reporting 0xA11_PinnedStatus to CLFS from RM at 0xA12_(PVOID)TxfRmcb {A13__TxfRmcb->RmId}: 0xA14_Status.
#Event ID 663: A10___FUNCTION__: Done forcing aborts on RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}.
#Event ID 664: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: $Txf directory is missing in pre-existing RM.
#Event ID 665: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Found $Txf without DUP_INDEX_IS_DOLLAR_TXF_DIRECTORY.
#Event ID 666: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Found non-empty $Txf but there is no log.
#Event ID 667: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Couldn't find $INDEX_ROOT on $Txf.
#Event ID 668: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Couldn't find TXF_DATA_ATTR on $Txf.
#Event ID 669: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Found TXF_DATA_ATTR for normal file on $Txf.
#Event ID 670: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Expected a secondary RM here.
#Event ID 671: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: $Tops is missing but $Txf is non-empty.
#Event ID 672: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: $Tops is missing but there is already a log.
#Event ID 673: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: $Tops is A13_(IsEncrypted( _TopsFcb->Info ) ? 'encrypted' : 'compressed').
#Description
A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: $Tops is A13_(IsEncrypted( _TopsFcb->Info ) ? 'encrypted' : 'compressed').
Message #
Fields #
| Name | Description |
|---|---|
A10___FUNCTION__ AnsiString | |
A11_(PVOID)TxfRmcb Pointer | |
A12__TxfRmcb->RmId GUID | |
A13_(IsEncrypted( _TopsFcb->Info ) ? 'encrypted' : 'compressed') AnsiString |
Event ID 674: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Missing $STANDARD_INFORMATION.
#Event ID 675: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Couldn't find file attributes.
#Event ID 676: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: $Tops is corrupt.
#Event ID 677: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Could not find unnamed data stream.
#Event ID 678: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: $Tops metadata is the wrong version or records wrong size.
#Event ID 679: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: $Tops metadata is the wrong size.
#Event ID 680: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Non-NULL RM ID found in $Tops and there is no log.
#Event ID 681: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Epoch in $Tops metadata doesn't match RM.
#Event ID 682: A10___FUNCTION__: Corrupt RM at 0xA11_(PVOID)TxfRmcb {A12__TxfRmcb->RmId}: Couldn't find $T stream.
#Event ID 684: TrimUsnJournal (A10_Vcb, A11_IrpContext): Decided to trim usn journal.
#Description
TrimUsnJournal (!p!, !p!): Decided to trim usn journal. FirstValidUsn !I64x!, new FirstValidUsn !I64x!, FS !I64x!, AS !I64x!, MaxSize !I64x!, DeltaSize !I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_Vcb->FirstValidUsn HexInt64 | |
A13_FirstValidUsn HexInt64 | |
A14_TrackUsnJournalFileSize HexInt64 | |
A15_TrackUsnJournalAllocationSize HexInt64 | |
A16_TrackUsnJournalMaxSize HexInt64 | |
A17_TrackUsnJournalDeltaAllocation HexInt64 |
Event ID 685: TrimUsnJournal (A10_Vcb, A11_IrpContext): About to delete allocation till A12_FirstValidUsn - 1!
#Description
TrimUsnJournal (A10_Vcb, A11_IrpContext): About to delete allocation till A12_FirstValidUsn - 1!I64x!, SavedReserve A13_SavedReserved!I64x!, RequiredReserve A14_RequiredReserved!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_FirstValidUsn - 1 HexInt64 | |
A13_SavedReserved HexInt64 | |
A14_RequiredReserved HexInt64 |
Event ID 686: TrimUsnJournal (A10_Vcb, A11_IrpContext): Before trimming journal AS A12_UsnJournal->Header.AllocationSize.QuadPart!
#Description
TrimUsnJournal (A10_Vcb, A11_IrpContext): Before trimming journal AS A12_UsnJournal->Header.AllocationSize.QuadPart!I64x!, FS A13_UsnJournal->Header.FileSize.QuadPart!I64x!, VDL A14_UsnJournal->Header.ValidDataLength.QuadPart!I64x!, TA A15_UsnJournal->TotalAllocated!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_UsnJournal->Header.AllocationSize.QuadPart HexInt64 | |
A13_UsnJournal->Header.FileSize.QuadPart HexInt64 | |
A14_UsnJournal->Header.ValidDataLength.QuadPart HexInt64 | |
A15_UsnJournal->TotalAllocated HexInt64 |
Event ID 687: TrimUsnJournal (A10_Vcb, A11_IrpContext): After trimming journal AS A12_UsnJournal->Header.AllocationSize.QuadPart!
#Description
TrimUsnJournal (A10_Vcb, A11_IrpContext): After trimming journal AS A12_UsnJournal->Header.AllocationSize.QuadPart!I64x!, FS A13_UsnJournal->Header.FileSize.QuadPart!I64x!, VDL A14_UsnJournal->Header.ValidDataLength.QuadPart!I64x!, TA A15_UsnJournal->TotalAllocated!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_UsnJournal->Header.AllocationSize.QuadPart HexInt64 | |
A13_UsnJournal->Header.FileSize.QuadPart HexInt64 | |
A14_UsnJournal->Header.ValidDataLength.QuadPart HexInt64 | |
A15_UsnJournal->TotalAllocated HexInt64 |
Event ID 688: TrimUsnJournal (A10_Vcb, A11_IrpContext): Mapping pairs validated.
#Event ID 689: TrimUsnJournal (A10_Vcb, A11_IrpContext): Checkpointed.
#Event ID 690: NtfsQueryUsnJournal: Denying access due to NULL Ccb.
#Description
NtfsQueryUsnJournal: Denying access due to NULL Ccb. Thread: !p!, TypeOfOpen: !d!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!.
Message #
Event ID 691: NtfsDeleteUsnJournal: Caller does not have manage volume access.
#Description
NtfsDeleteUsnJournal: Caller does not have manage volume access. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, Fcb: !p!, FileRef: !I64x!, Ccb FullFileName: !S!, Ccb access flags: 0x!08x!.
Message #
Event ID 694: OfsSetLength (A10_Vcb,A11_IrpContext,A12_IrpContext->OriginatingIrp,A13_PsGetCurrentThread()): Extending journal from AS A14_Scb->Header.AllocationSize.QuadPart!
#Description
OfsSetLength (A10_Vcb,A11_IrpContext,A12_IrpContext->OriginatingIrp,A13_PsGetCurrentThread()): Extending journal from AS A14_Scb->Header.AllocationSize.QuadPart!I64x!, FS A15_Scb->Header.FileSize.QuadPart!I64x!, VDL A16_Scb->Header.ValidDataLength.QuadPart!I64x!, to AS A17_NewAllocationSize!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContext->OriginatingIrp Pointer | |
A13_PsGetCurrentThread() Pointer | |
A14_Scb->Header.AllocationSize.QuadPart HexInt64 | |
A15_Scb->Header.FileSize.QuadPart HexInt64 | |
A16_Scb->Header.ValidDataLength.QuadPart HexInt64 | |
A17_NewAllocationSize HexInt64 |
Event ID 695: OfsSetLength (A10_Vcb,A11_IrpContext,A12_IrpContext->OriginatingIrp,A13_PsGetCurrentThread()): Done extending journal AS A14_Scb->Header.AllocationSize.QuadPart!
#Description
OfsSetLength (A10_Vcb,A11_IrpContext,A12_IrpContext->OriginatingIrp,A13_PsGetCurrentThread()): Done extending journal AS A14_Scb->Header.AllocationSize.QuadPart!I64x!, FS A15_Scb->Header.FileSize.QuadPart!I64x!, VDL A16_Scb->Header.ValidDataLength.QuadPart!I64x!, TA A17_Scb->TotalAllocated!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_IrpContext Pointer | |
A12_IrpContext->OriginatingIrp Pointer | |
A13_PsGetCurrentThread() Pointer | |
A14_Scb->Header.AllocationSize.QuadPart HexInt64 | |
A15_Scb->Header.FileSize.QuadPart HexInt64 | |
A16_Scb->Header.ValidDataLength.QuadPart HexInt64 | |
A17_Scb->TotalAllocated HexInt64 |
Event ID 696: OfsSetLength (A10_Vcb,A11_IrpContext,A12_IrpContext->OriginatingIrp,A13_PsGetCurrentThread()): After NtfsWriteFileSizes.
#Event ID 697: OfsSetLength (A10_Vcb,A11_IrpContext,A12_IrpContext->OriginatingIrp,A13_PsGetCurrentThread()): After NtfsSetCcFileSizesUsnBiasAware.
#Event ID 698: NtOfsPostNewLength (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Status A13_IrpContext->ExceptionStatus before calling NtfsReadUsnJournal.
#Description
NtOfsPostNewLength (A10_IrpContext,A11_IrpContext->OriginatingIrp,A12_PsGetCurrentThread()): Status A13_IrpContext->ExceptionStatus before calling NtfsReadUsnJournal.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_IrpContext->OriginatingIrp Pointer | |
A12_PsGetCurrentThread() Pointer | |
A13_IrpContext->ExceptionStatus HexInt32 |
Event ID 699: NtfsIsRegionDangling: RemainingClusterCount: 0xA10_RemainingClusterCount!
#Description
NtfsIsRegionDangling: RemainingClusterCount: 0xA10_RemainingClusterCount!I64x!, Scb: A11_Scb, Vcn: 0xA12_Vcn!I64x!, Lcn: 0xA13_Lcn!I64x!, Clusters: 0xA14_ClusterCount!I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_RemainingClusterCount HexInt64 | |
A11_Scb Pointer | |
A12_Vcn HexInt64 | |
A13_Lcn HexInt64 | |
A14_ClusterCount HexInt64 |
Event ID 700: Vcb A10_Vcb - has *no* active PFNs.
#Event ID 701: Vcb A10_Vcb - failed to query active PFNs assuming there are some.
#Event ID 702: Vcb A10_Vcb - has active PFNs.
#Event ID 703: NtfsPerformDismountOnVcb: Vcb A10_Vcb.
#Event ID 704: NtfsPerformDismountOnVcb: Vcb A10_Vcb - Found frozen deallocated clusters.
#Event ID 705: NtfsPerformDismountOnVcb: Vcb A10_Vcb - Wait for any on going trim to finish.
#Event ID 706: NtfsPerformDismountOnVcb: Vcb A10_Vcb - No more on going trim.
#Event ID 707: NtfsPerformDismountOnVcb: IC.
#Description
NtfsPerformDismountOnVcb: IC: !p!, Vcb: !p!, Label: !S!, DeviceName: !S!
Message #
Event ID 708: NtfsPostVcbIsCorrupt.
#Description
NtfsPostVcbIsCorrupt(A10_IrpContext, A11_Status, A12_FileReference, A13_Fcb, A14_Source!016I64x!): IrpContext->TopLevelIrpContext->ExceptionStatus == A15_TopLevelExceptionStatus before NtfsSetVcbDirtyFlag.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpContext Pointer | |
A11_Status HexInt32 | |
A12_FileReference Pointer | |
A13_Fcb Pointer | |
A14_Source HexInt64 | |
A15_TopLevelExceptionStatus HexInt32 |
Event ID 709: NtfsPostVcbIsCorrupt: Marking volume dirty.
#Description
NtfsPostVcbIsCorrupt: Marking volume dirty. Vcb A10_Vcb, WasDirty: A11_WasDirty, FileReference A12_NtfsFullSegmentNumber( _BugCheckFileReference )!I64x!, Source A13_Source!016I64x!
Message #
Fields #
| Name | Description |
|---|---|
A10_Vcb Pointer | |
A11_WasDirty HexInt32 | |
A12_NtfsFullSegmentNumber( _BugCheckFileReference ) HexInt64 | |
A13_Source HexInt64 |
Event ID 710: NtfsCommonSetVolumeInfo: Operation is only allowed on a VolumeOpen except for IndexOpen of \$Extend\$Quota with FileFsControlInformation.
#Message #
Event ID 711: NtfsCommonSetVolumeInfo: Operation is only allowed on a VolumeOpen except for IndexOpen of \$Extend\$Quota with FileFsControlInformation.
#Message #
Event ID 712: Succeeding log write @ 0xA10_IrpSp->Parameters.Write.ByteOffset.HighPart!
#Description
Succeeding log write @ 0xA10_IrpSp->Parameters.Write.ByteOffset.HighPart!08x!A11_IrpSp->Parameters.Write.ByteOffset.LowPart!08x! after getting 0xA12_IrpContext->TopLevelIrpContext->ExceptionStatus in top-level irpcontext.
Message #
Fields #
| Name | Description |
|---|---|
A10_IrpSp->Parameters.Write.ByteOffset.HighPart HexInt32 | |
A11_IrpSp->Parameters.Write.ByteOffset.LowPart HexInt32 | |
A12_IrpContext->TopLevelIrpContext->ExceptionStatus HexInt32 |
Event ID 713: Unexpected Paging-Write on stream accessed in Direct-Access mode, Scb=A10_Scb.
#Event ID 714: NtfsCommonWrite: Writing beyond highest writable sector on active volume is not allowed.
#Description
NtfsCommonWrite: Writing beyond highest writable sector on active volume is not allowed. Thread: !p!, Vcb: !p!, VolumeName: !S!, VolumeLabel: !S!, RequestedRange: 0x!I64x!, AllowedRange: 0x!I64x!.