Microsoft-Windows-PersistentMemory-PmemDisk

31 events across 4 channels

Event	Title	Channel	Sample
1	Reported memory resource.	Analytic	N
2	Memory operation duration, in hundreds of nanoseconds.	Analytic	N
3	Request servicing time taken by lower driver stack(s).	Analytic	N
101	Dispatching a read request.	Diagnostic	N
102	Dispatching a write request.	Diagnostic	N
103	Dispatching a read request.	Diagnostic	N
104	Dispatching a write request.	Diagnostic	N
105	Completing an IO (read/write) request.	Diagnostic	N
106	Dispatching an IOCTL.	Diagnostic	N
107	Completing a non-read/write request.	Diagnostic	N
108	Dispatching a PnP request.	Diagnostic	N
109	Completing a PnP request.	Diagnostic	N
202	Persistent memory disk Reason failed to start.	Operational	N
203	Persistent memory disk PersistentMemoryDiskGuid started successfully.	Operational	N
204	One of the NVDIMMs that make up persistent memory disk PersistentMemoryDiskGuid …	Operational	N
205	During a previous boot session, one of the NVDIMMs that make up persistent …	Operational	N
206	NVDIMM PhysicalNvdimmGuid notified persistent memory disk …	Operational	N
207	One of the NVDIMMs that make up the persistent memory disk …	Operational	N
209	The computer didn't assign any memory resources to persistent memory disk …	Operational	N
210	Some physical memory locations on persistent memory disk …	Operational	N
211	The problem with the persistent memory disk PersistentMemoryDiskGuid was …	Operational	N
212	One of the NVDIMMs that make up the persistent memory disk …	Operational	N
213	The physical devices that make up persistent memory disk …	Operational	N
214	The persistent memory disk PersistentMemoryDiskGuid is inaccessible because at …	Operational	N
215	The driver for persistent memory disk PersistentMemoryDiskGuid encountered an …	Operational	N
216	The driver couldn't configure the dump stack on persistent memory disk …	Operational	N
217	The persistent memory disk PersistentMemoryDiskGuid changed its powerfail …	Operational	N
300	Persistent memory disk PersistentMemoryDiskGuid is now in read-only mode.	System	N
301	Persistent memory disk PersistentMemoryDiskGuid is no longer in read-only mode.	System	N
302	Windows does not support this configuration: two or more NVDIMMs on this system …	System	N
900	Persistent memory disk PersistentMemoryDiskGuid logged: Message.	Diagnostic	N

Event ID 1: Reported memory resource.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Analytic
Opcode: Info

Description

Reported memory resource.

Message #

Reported memory resource.

Fields #

Name	Description
`StartAddress` UInt64
`Size` UInt64

Event ID 2: Memory operation duration, in hundreds of nanoseconds.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Analytic
Opcode: Info

Description

Memory operation duration, in hundreds of nanoseconds.

Message #

Memory operation duration, in hundreds of nanoseconds.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`RequestDuration` UInt64
`Irp` Pointer
`IsWrite` Boolean
`NtStatus` UInt32

Event ID 3: Request servicing time taken by lower driver stack(s).

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Analytic
Opcode: Info

Description

Request servicing time taken by lower driver stack(s).

Message #

Request servicing time taken by lower driver stack(s).

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`RequestDuration` UInt64
`Irp` Pointer
`IsWrite` Boolean
`NtStatus` UInt32

Event ID 101: Dispatching a read request.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Dispatching a read request.

Message #

Dispatching a read request.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`IRPMJ` UInt8
`LengthOfTransfer` UInt64
`LBA` HexInt64

Event ID 102: Dispatching a write request.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Dispatching a write request.

Message #

Dispatching a write request.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`IRPMJ` UInt8
`LengthOfTransfer` UInt64
`LBA` HexInt64

Event ID 103: Dispatching a read request.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Dispatching a read request.

Message #

Dispatching a read request.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`IRPMJ` UInt8
`LengthOfTransfer` UInt64
`LBA` HexInt64

Event ID 104: Dispatching a write request.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Dispatching a write request.

Message #

Dispatching a write request.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`IRPMJ` UInt8
`LengthOfTransfer` UInt64
`LBA` HexInt64

Event ID 105: Completing an IO (read/write) request.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Completing an IO (read/write) request.

Message #

Completing an IO (read/write) request.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`NTStatus` HexInt32	NTSTATUS reference

Event ID 106: Dispatching an IOCTL.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Dispatching an IOCTL.

Message #

Dispatching an IOCTL.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`MajorFunction` HexInt32
`MinorFunction` HexInt32
`Parameter` HexInt32

Event ID 107: Completing a non-read/write request.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Completing a non-read/write request.

Message #

Completing a non-read/write request.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`Status` HexInt32	NTSTATUS reference

Event ID 108: Dispatching a PnP request.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Dispatching a PnP request.

Message #

Dispatching a PnP request.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`MinorFunction` HexInt32
`Type` HexInt32
`DeviceObject` Pointer

Event ID 109: Completing a PnP request.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Completing a PnP request.

Message #

Completing a PnP request.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DeviceNumber` UInt32
`Irp` Pointer
`Status` HexInt32	NTSTATUS reference

Event ID 202: Persistent memory disk Reason failed to start.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

Persistent memory disk Reason failed to start.

Message #

Persistent memory disk %1 failed to start.                    
Reason: %7                    
NTSTATUS code: %8

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString
`Reason` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 203: Persistent memory disk PersistentMemoryDiskGuid started successfully.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

Persistent memory disk PersistentMemoryDiskGuid started successfully.

Message #

Persistent memory disk %1 started successfully.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 204: One of the NVDIMMs that make up persistent memory disk PersistentMemoryDiskGuid encountered an error while transferring your data to or from persistent media.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

One of the NVDIMMs that make up persistent memory disk PersistentMemoryDiskGuid encountered an error while transferring your data to or from persistent media (see the Details tab for more information). Some of your data may have been lost. If this is a data disk, it is now in read-only mode as a precaution. If you want to keep using it, run the Reset-PhysicalDisk command to make it writeable again. If this is the system disk, it will remain writeable but will appear as Unhealthy until you run the Reset-PhysicalDisk command in PowerShell. Look at the events logged by the physical NVDIMM driver for more details.

Message #

One of the NVDIMMs that make up persistent memory disk %1 encountered an error while transferring your data to or from persistent media (see the Details tab for more information). Some of your data may have been lost. If this is a data disk, it is now in read-only mode as a precaution. If you want to keep using it, run the Reset-PhysicalDisk command to make it writeable again. If this is the system disk, it will remain writeable but will appear as Unhealthy until you run the Reset-PhysicalDisk command in PowerShell.                    
                    
Look at the events logged by the physical NVDIMM driver for more details.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 205: During a previous boot session, one of the NVDIMMs that make up persistent memory disk PersistentMemoryDiskGuid encountered an error while transferring your data to or f...

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

During a previous boot session, one of the NVDIMMs that make up persistent memory disk PersistentMemoryDiskGuid encountered an error while transferring your data to or from persistent media. Some of your data may have been lost then. If this is a data disk, it is now in read-only mode as a precaution. If you want to keep using it, run the Reset-PhysicalDisk command to make it writeable again. If this is the system disk, it will remain writeable but will appear as Unhealthy until you run the Reset-PhysicalDisk command in PowerShell. Look at the events logged by the physical NVDIMM driver for more details.

Message #

During a previous boot session, one of the NVDIMMs that make up persistent memory disk %1 encountered an error while transferring your data to or from persistent media. Some of your data may have been lost then. If this is a data disk, it is now in read-only mode as a precaution. If you want to keep using it, run the Reset-PhysicalDisk command to make it writeable again. If this is the system disk, it will remain writeable but will appear as Unhealthy until you run the Reset-PhysicalDisk command in PowerShell.                    
                    
Look at the events logged by the physical NVDIMM driver for more details.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 206: NVDIMM PhysicalNvdimmGuid notified persistent memory disk PersistentMemoryDiskGuid of a change in its health state.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

NVDIMM PhysicalNvdimmGuid notified persistent memory disk PersistentMemoryDiskGuid of a change in its health state. The NVDIMM now has the following health status: NvdimmHealthStatus.

Message #

NVDIMM %5 notified persistent memory disk %1 of a change in its health state. The NVDIMM now has the following health status: %7.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`PhysicalNvdimmGuid` GUID
`NfitHandle` UInt32
`NvdimmHealthStatus` UInt32

Event ID 207: One of the NVDIMMs that make up the persistent memory disk PersistentMemoryDiskGuid encountered a serious problem and the disk is now in read-only mode.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

One of the NVDIMMs that make up the persistent memory disk PersistentMemoryDiskGuid encountered a serious problem and the disk is now in read-only mode. Data that was saved to this disk may be lost when the computer shuts down or restarts. Consider backing up your data to another disk. Use the Get-PhysicalDisk command to get more information about the disk's health status. Look at the events logged by the physical NVDIMM driver for more details.

Message #

One of the NVDIMMs that make up the persistent memory disk %1 encountered a serious problem and the disk is now in read-only mode. Data that was saved to this disk may be lost when the computer shuts down or restarts. Consider backing up your data to another disk.                    
                    
Use the Get-PhysicalDisk command to get more information about the disk's health status.                    
Look at the events logged by the physical NVDIMM driver for more details.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 209: The computer didn't assign any memory resources to persistent memory disk PersistentMemoryDiskGuid.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

The computer didn't assign any memory resources to persistent memory disk PersistentMemoryDiskGuid. You won't be able to access the data on the device, but you can still query its health status by using the Get-PhysicalDisk command.

Message #

The computer didn't assign any memory resources to persistent memory disk %1. You won't be able to access the data on the device, but you can still query its health status by using the Get-PhysicalDisk command.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 210: Some physical memory locations on persistent memory disk PersistentMemoryDiskGuid are corrupt.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

Some physical memory locations on persistent memory disk PersistentMemoryDiskGuid are corrupt. In order to protect your computer, Windows will not access those locations and you may see failures trying to read or write to your data. Contact your hardware vendor to learn what recovery steps are available.

Message #

Some physical memory locations on persistent memory disk %1 are corrupt. In order to protect your computer, Windows will not access those locations and you may see failures trying to read or write to your data. Contact your hardware vendor to learn what recovery steps are available.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString
`OldBadMemoryRangesCount` UInt32
`NewBadMemoryRangesCount` UInt32

Event ID 211: The problem with the persistent memory disk PersistentMemoryDiskGuid was resolved and it is now back in read-write mode.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

The problem with the persistent memory disk PersistentMemoryDiskGuid was resolved and it is now back in read-write mode.

Message #

The problem with the persistent memory disk %1 was resolved and it is now back in read-write mode.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 212: One of the NVDIMMs that make up the persistent memory disk PersistentMemoryDiskGuid is in a degraded health state and may soon encounter serious problems.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

One of the NVDIMMs that make up the persistent memory disk PersistentMemoryDiskGuid is in a degraded health state and may soon encounter serious problems. Consider backing up your data to another disk.

Message #

One of the NVDIMMs that make up the persistent memory disk %1 is in a degraded health state and may soon encounter serious problems. Consider backing up your data to another disk.                    
                    
Look at the events logged by the physical NVDIMM driver for more details.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 213: The physical devices that make up persistent memory disk PersistentMemoryDiskGuid have an atomicity setting that is incompatible with the data on the disk.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

The physical devices that make up persistent memory disk PersistentMemoryDiskGuid have an atomicity setting that is incompatible with the data on the disk. Windows didn't start the disk to prevent data loss.

Message #

The physical devices that make up persistent memory disk %1 have an atomicity setting that is incompatible with the data on the disk. Windows didn't start the disk to prevent data loss.             
             
This type of problem can happen when you update your computer's firmware, or when you upgrade from a version of Windows that doesn't look at atomicity settings to one that does.             
             
To recover the disk, follow these steps:             
1. Open the registry editor (regedit) and navigate to 'Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\ACPI0012\<instance ID>\Device Parameters'. There will only be one instance ID key.             
2. Create a registry key named 'ScmBus'. Inside it, create a new DWORD value named 'IgnoreLabels' and set it to 1.             
3. Restart your computer.             
4. When Windows starts again, your persistent memory disks will be accessible. Back up **all the data** on **all of them** to a different disk. NOTE: these recovery steps will clear all persistent memory disks, even the ones that aren't affected by this problem, so it's important to back up all your data.             
5. Open the registry editor, navigate to the 'IgnoreLabels' value you created and set it to 0.             
6. Restart your computer.             
7. The persistent memory disk will be inaccessible again. To use it, you will have to reinitialize all physical persistent memory devices on the system. Open an elevated PowerShell window and run 'Get-PmemPhysicalDevice | Initialize-PmemPhysicalDevice'.             
8. The last step is to recreate the persistent memory disks. You can do that in the elevated PowerShell window by running 'Get-PmemUnusedRegion | New-PmemDisk'. Look at the help content for 'New-PmemDisk' to learn how to specify the disks' atomicity modes.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 214: The persistent memory disk PersistentMemoryDiskGuid is inaccessible because at least one of its NVDIMMs are locked.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

The persistent memory disk PersistentMemoryDiskGuid is inaccessible because at least one of its NVDIMMs are locked. Contact your hardware vendor for instructions on how to unlock the NVDIMMs.

Message #

The persistent memory disk %1 is inaccessible because at least one of its NVDIMMs are locked. Contact your hardware vendor for instructions on how to unlock the NVDIMMs.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`InterleaveSetSize` UInt32
`InterleaveSet` AnsiString

Event ID 215: The driver for persistent memory disk PersistentMemoryDiskGuid encountered an internal error.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

The driver for persistent memory disk PersistentMemoryDiskGuid encountered an internal error. The information in the Details tab might help Microsoft or your platform vendor to diagnose the problem.

Message #

The driver for persistent memory disk %1 encountered an internal error. The information in the Details tab might help Microsoft or your platform vendor to diagnose the problem.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`Message` AnsiString

Event ID 216: The driver couldn't configure the dump stack on persistent memory disk PersistentMemoryDiskGuid, which may cause hibernation or memory dump generation to fail.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

The driver couldn't configure the dump stack on persistent memory disk PersistentMemoryDiskGuid, which may cause hibernation or memory dump generation to fail.

Message #

The driver couldn't configure the dump stack on persistent memory disk %1, which may cause hibernation or memory dump generation to fail.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString
`NtStatus` UInt32

Event ID 217: The persistent memory disk PersistentMemoryDiskGuid changed its powerfail persistence mode to DurabilityMode.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Operational
Opcode: Info

Description

The persistent memory disk PersistentMemoryDiskGuid changed its powerfail persistence mode to DurabilityMode. (0 is PerformanceMode, 1 is DurabilityMode).

Message #

The persistent memory disk %1 changed its powerfail persistence mode to %2. (0 is PerformanceMode, 1 is DurabilityMode)

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`DurabilityMode` UInt16

Event ID 300: Persistent memory disk PersistentMemoryDiskGuid is now in read-only mode.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: System
Opcode: Info

Description

Persistent memory disk PersistentMemoryDiskGuid is now in read-only mode. Use the Get-PhysicalDisk command to get the device’s health status. The Microsoft-Windows-PersistentMemory-PmemDisk/Operational event log may also contain more information.

Message #

Persistent memory disk %1 is now in read-only mode.  Use the Get-PhysicalDisk command to get the device?s health status.  The Microsoft-Windows-PersistentMemory-PmemDisk/Operational event log may also contain more information.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID

Event ID 301: Persistent memory disk PersistentMemoryDiskGuid is no longer in read-only mode.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: System
Opcode: Info

Description

Persistent memory disk PersistentMemoryDiskGuid is no longer in read-only mode.

Message #

Persistent memory disk %1 is no longer in read-only mode.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID

Event ID 302: Windows does not support this configuration: two or more NVDIMMs on this system are part of an interleaved set.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: System
Opcode: Info

Description

Windows does not support this configuration: two or more NVDIMMs on this system are part of an interleaved set. Back up the data on the interleaved set to a different drive and then break up the interleaved set. Consider using Storage Spaces if NVDIMM capacity needs to be aggregated.

Message #

Windows does not support this configuration: two or more NVDIMMs on this system are part of an interleaved set. Back up the data on the interleaved set to a different drive and then break up the interleaved set. Consider using Storage Spaces if NVDIMM capacity needs to be aggregated.

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID

Event ID 900: Persistent memory disk PersistentMemoryDiskGuid logged: Message.

Provider: Microsoft-Windows-PersistentMemory-PmemDisk
Channel: Diagnostic
Opcode: Info

Description

Persistent memory disk PersistentMemoryDiskGuid logged.

Message #

Persistent memory disk %1 logged:             
             
 %2

Fields #

Name	Description
`PersistentMemoryDiskGuid` GUID
`Message` AnsiString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 0fa2ee03-1feb-5057-3bb3-eb25521b8482

Defined in pmem.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)