Microsoft-Windows-QoS-qWAVE
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | QOSSetFlow Failure | Debug | N | N |
| 2 | QOSSetFlow Success | Debug | N | N |
| 3 | QOSQueryFlow Failure | Debug | N | N |
| 4 | QOSNotifyFlow Failure | Debug | N | N |
| 5 | QosAddSocketToFlow Failure | Debug | N | N |
| 6 | QOSEnumerateFlows Failure | Debug | N | N |
| 7 | QOSStartTrackingClient Failure | Debug | N | N |
| 8 | QOSStopTrackingClient Failure | Debug | N | N |
| 9 | Network Congestion Begin | Debug | N | N |
| 10 | Network Congestion End | Debug | N | N |
| 11 | Available Bandwidth Detected | Debug | N | N |
| 12 | QOSCreateHandle | Debug | N | N |
| 13 | Diagonstics | Debug | N | N |
| 14 | QDLHStartDiagnosingPath | Debug | N | N |
| 15 | Packet Pair Result | Debug | N | N |
| 16 | Probe Quiescent | Debug | N | N |
| 17 | QosAddSocketToFlow Success | Debug | N | N |
| 18 | Legacy Mode Active | Debug | N | N |
| 19 | Legacy Mode Inactive | Debug | N | N |
| 20 | Burst Control | Debug | N | N |
| 21 | AC Cache Initialized | Debug | N | N |
| 22 | AC Cache DeInitialized | Debug | N | N |
Event ID 1: QOSSetFlow Failure
#Fields #
| Name | Description |
|---|---|
FlowId UInt32 | |
SetFlowType UInt32 | |
BufferLen UInt32 | |
Buffer Binary | |
Flags UInt32 | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 2: QOSSetFlow Success
#Fields #
| Name | Description |
|---|---|
FlowId UInt32 | |
SetFlowType UInt32 | |
BufferLen UInt32 | |
Buffer Binary | |
Flags UInt32 | |
LLTDSupported Boolean |
Event ID 3: QOSQueryFlow Failure
#Fields #
| Name | Description |
|---|---|
FlowId UInt32 | |
QueryFlowType UInt32 | |
BufferLen UInt32 | |
Buffer Binary | |
Flags UInt32 | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 4: QOSNotifyFlow Failure
#Fields #
| Name | Description |
|---|---|
FlowId UInt32 | |
NotifyFlowType UInt32 | |
BufferLen UInt32 | |
Buffer Binary | |
Flags UInt32 | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 5: QosAddSocketToFlow Failure
#Fields #
| Name | Description |
|---|---|
AddressLen UInt32 | |
Address Binary | |
TrafficType UInt32 | |
Flags UInt32 | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 6: QOSEnumerateFlows Failure
#Fields #
| Name | Description |
|---|---|
BufferLen UInt32 | |
Buffer Binary | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 7: QOSStartTrackingClient Failure
#Fields #
| Name | Description |
|---|---|
AddressLen UInt32 | |
Address Binary | |
Flags UInt32 | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 8: QOSStopTrackingClient Failure
#Fields #
| Name | Description |
|---|---|
AddressLen UInt32 | |
Address Binary | |
Flags UInt32 | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 9: Network Congestion Begin
#Fields #
| Name | Description |
|---|---|
SourceAddressLen UInt32 | |
SourceAddress Binary | |
DestAddressLen UInt32 | |
DestAddress Binary | |
BottleneckBandwidth Double | |
Is8021pSupported Boolean |
Event ID 10: Network Congestion End
#Fields #
| Name | Description |
|---|---|
SourceAddressLen UInt32 | |
SourceAddress Binary | |
DestAddressLen UInt32 | |
DestAddress Binary | |
BottleneckBandwidth Double | |
AvailableBandwidth Double | |
Is8021pSupported Boolean |
Event ID 11: Available Bandwidth Detected
#Fields #
| Name | Description |
|---|---|
SourceAddressLen UInt32 | |
SourceAddress Binary | |
DestAddressLen UInt32 | |
DestAddress Binary | |
BottleneckBandwidth Double | |
AvailableBandwidth Double | |
Is8021pSupported Boolean |
Event ID 12: QOSCreateHandle
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
ThreadID UInt32 | |
QoSHandle Pointer | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 13: Diagonstics
#Fields #
| Name | Description |
|---|---|
LocalCollectionError UInt32 | |
RemoteCollectionError UInt32 | |
CrossTrafficCollectionError UInt32 | |
PathAnalysisResult UInt32 | |
RemoteAnalysisResult UInt32 | |
LocalAnalysisResult UInt32 |
Event ID 14: QDLHStartDiagnosingPath
#Fields #
| Name | Description |
|---|---|
AddressLen UInt32 | |
Address Binary | |
Flags UInt32 | |
FailureActivity UInt32 | |
FailureErrorCodeType UInt32 | |
FailureErrorCode UInt32 |
Event ID 15: Packet Pair Result
#Fields #
| Name | Description |
|---|---|
AddressLength UInt32 | |
SourceAddress Binary | |
DestinationAddress Binary | |
BottleneckBandwidth Double | |
AvailableBandwidth Double |
Event ID 16: Probe Quiescent
#Fields #
| Name | Description |
|---|---|
AddressLength UInt32 | |
SourceAddress Binary | |
DestinationAddress Binary | |
Quiescent Boolean |
Event ID 17: QosAddSocketToFlow Success
#Fields #
| Name | Description |
|---|---|
AddressLen UInt32 | |
Address Binary | |
TrafficType UInt32 | |
Flags UInt32 | |
Offlink Boolean |
Event ID 18: Legacy Mode Active
#Fields #
| Name | Description |
|---|---|
AddressLength UInt32 | |
NonLLTDEnabledMachine Binary |
Event ID 19: Legacy Mode Inactive
#Fields #
| Name | Description |
|---|---|
AddressLength UInt32 | |
LLTDEnabledMachine Binary |
Event ID 20: Burst Control
#Fields #
| Name | Description |
|---|---|
CurrentTime UInt32 | |
SystemTime UInt32 | |
RequestedBandwidth Double | |
NumBursts UInt32 | |
BurstSize UInt32 |
Event ID 21: AC Cache Initialized
#Event ID 22: AC Cache DeInitialized
#Provenance
ETW provider GUID 6ba132c4-da49-415b-a7f4-31870dc9fe25
Defined in qwave.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB