detection.wiki

Microsoft-Windows-RTWorkQueue-Threading

EventTitleChannelSampleRule
4435WorkQueue Execute: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4436WorkQueue Execute: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4437WorkQueue Queue: WorkQueuePtr=WorkQueuePointer Start threads=QueueDepth …RTWorkQueueTheadingNN
4438WorkQueue Queue: WorkQueuePtr=WorkQueuePointer End threads=QueueDepth …RTWorkQueueTheadingNN
4439WorkQueue Thread: Start workqueue_ptr=WorkQueuePointer WorkQueueID=WordQueueID …RTWorkQueueTheadingNN
4440WorkQueue Thread: End workqueue_ptr=WorkQueuePointer WorkQueueID=WordQueueID …RTWorkQueueTheadingNN
4454MMCSS Registration Enter Queue=Queue ThreadID=ThreadID Handle=Handle Error=Error …RTWorkQueueTheadingNN
4455MMCSS Registration Enter Queue=Queue ThreadID=ThreadID Handle=Handle Error=Error …RTWorkQueueTheadingNN
4472WorkQueue Queue: WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID …RTWorkQueueTheadingYN
4473WorkQueue Queue: WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID.RTWorkQueueTheadingNN
4474WorkQueue Execute Callback: Start workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4475WorkQueue Execute Callback: End workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4476WorkQueue MMCSS: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4477WorkQueue MMCSS: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4478WorkQueue UpdateDeadlines: Start workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4479WorkQueue UpdateDeadlines: End workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4480WorkQueue AddDeadline: Start workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4481WorkQueue AddDeadline: End workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4482WorkQueue AddImmediateDeadline: Start workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4483WorkQueue AddImmediateDeadline: End workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4484WorkQueue DeadlineYield: Start workQueueID=WorkQueueID Delay=Yield.RTWorkQueueTheadingNN
4485WorkQueue DeadlineYield: End workQueueID=WorkQueueID Delay=Yield.RTWorkQueueTheadingNN
4486WorkQueue DeadlineQueue: WorkQueuePtr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4487WorkQueue LongRunning: Start workQueueID=WorkQueueID.RTWorkQueueTheadingNN
4488WorkQueue LongRunning: End workQueueID=WorkQueueID.RTWorkQueueTheadingNN
4489WorkQueue: StartTimer QueuePtr=WorkQueuePointer QueueID=WorkQueueID …RTWorkQueueTheadingNN
4490WorkQueue: ExecuteTimer QueuePtr=WorkQueuePointer QueueID=WorkQueueID …RTWorkQueueTheadingNN
4491SubscribePPMChangeWNF queryStatus=queryStatus subscribeStatus=subscribeStatus …RTWorkQueueTheadingNN
4492PPMChangeWnfCallback ChangeStamp=ChangeStamp CurChangeStamp=CurChangeStamp …RTWorkQueueTheadingNN
4493UpdateSelectWorkQueuesCpuGroupMask Enter ProcessorGroup=ProcessorGroup …RTWorkQueueTheadingNN
4494UpdateSelectWorkQueuesCpuGroupMask Leave ProcessorGroup=ProcessorGroup …RTWorkQueueTheadingNN
4495SubscribeCpuGroupMaskChangeWNF queryStatus=queryStatus …RTWorkQueueTheadingYN
4496UpdateWorkqueueCpuGroupMask workQueue=dwWorkQueue Class=Class …RTWorkQueueTheadingNN
4497CpuGroupMaskChangeWnfCallback ChangeStamp=ChangeStamp …RTWorkQueueTheadingNN
4498SetThreadCpuGroupMask pWorkQueue=pWorkQueue Class=Class Priority=Priority …RTWorkQueueTheadingNN
4499WorkQueue Start Notification WorkQueuePtr=WorkQueuePointer …RTWorkQueueTheadingNN
4500WorkQueue End Notification WorkQueuePtr=WorkQueuePointer …RTWorkQueueTheadingNN
4501WorkQueue Debounce: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4502WorkQueue Debounce: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4503WorkQueue Buffering: Start workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4504WorkQueue Buffering: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4505Platform AllocIndex start: Platform=Platform WorkQueueID=WorkQueueID …RTWorkQueueTheadingNN
4506Platform AllocIndex stop: Platform=Platform WorkQueueID=WorkQueueID Index=Index.RTWorkQueueTheadingNN
4507Platform Init start: Platform=Platform.RTWorkQueueTheadingYN
4508Platform Init stop: Platform=Platform.RTWorkQueueTheadingNN
4509Platform Shutdown start: Platform=Platform.RTWorkQueueTheadingNN
4510Platform Shutdown stop: Platform=Platform.RTWorkQueueTheadingNN
4511Platform Shutdown timeout: Platform=Platform.RTWorkQueueTheadingNN
4512Platform Shutdown_WorkQueue start: Platform=Platform workqueue=WorkQueue …RTWorkQueueTheadingNN
4513Platform Shutdown_WorkQueue stop: Platform=Platform workqueue=WorkQueue …RTWorkQueueTheadingNN
4514WorkQueue RunLimit: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4515WorkQueue RunLimit: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4516WorkQueue RunLimit: Exceeded workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4517TaskGroup: Start TaskGroup=TaskGroup.RTWorkQueueTheadingNN
4518TaskGroup: End TaskGroup=TaskGroup.RTWorkQueueTheadingNN
4519TaskGroup RefCount TaskGroup=TaskGroup RefCount=RefCount.RTWorkQueueTheadingNN
4520TaskGroup ObjectCount ObjectCount=ObjectCount.RTWorkQueueTheadingNN
4521TaskGroup Reinit TaskGroup=TaskGroup TaskID=TaskID.RTWorkQueueTheadingNN
4522Platform Init shutdown in progress: Platform=Platform.RTWorkQueueTheadingNN
4523Platform Shutdown aborted: Platform=Platform.RTWorkQueueTheadingNN
4524WorkQueue GetMMCSSFailure: workqueue_ptr=WorkQueuePointer …RTWorkQueueTheadingNN
4525WorkQueue MMCSS: RegCount workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID …RTWorkQueueTheadingNN
4526WorkQueue DeadlineYield: Start workQueueID=WorkQueueID Delay=TaskID.RTWorkQueueTheadingNN
4527WorkQueue DeadlineYield: End workQueueID=WorkQueueID Delay=TaskID.RTWorkQueueTheadingNN

Event ID 4435: WorkQueue Execute: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID AsyncResult=AsyncResult.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Execute
Opcode
Start

Message #

WorkQueue Execute: Start workqueue_ptr=%1 workQueueID=%2 AsyncResult=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
AsyncResult Pointer
LongRunning Boolean

Event ID 4436: WorkQueue Execute: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID AsyncResult=AsyncResult.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Execute
Opcode
Stop

Message #

WorkQueue Execute: End workqueue_ptr=%1 workQueueID=%2 AsyncResult=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
AsyncResult Pointer
LongRunning Boolean

Event ID 4437: WorkQueue Queue: WorkQueuePtr=WorkQueuePointer Start threads=QueueDepth AsyncResult=AsyncResult.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Queue
Opcode
Start

Message #

WorkQueue Queue: WorkQueuePtr=%1 Start threads=%2 AsyncResult=%3

Fields #

NameDescription
WorkQueuePointer Pointer
QueueDepth Int32
AsyncResult Pointer

Event ID 4438: WorkQueue Queue: WorkQueuePtr=WorkQueuePointer End threads=QueueDepth AsyncResult=AsyncResult.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Queue
Opcode
Stop

Message #

WorkQueue Queue: WorkQueuePtr=%1 End threads=%2 AsyncResult=%3

Fields #

NameDescription
WorkQueuePointer Pointer
QueueDepth Int32
AsyncResult Pointer

Event ID 4439: WorkQueue Thread: Start workqueue_ptr=WorkQueuePointer WorkQueueID=WordQueueID ThreadCount=ThreadCount.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Thread
Opcode
Start

Message #

WorkQueue Thread: Start workqueue_ptr=%1 WorkQueueID=%2 ThreadCount=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WordQueueID UInt32
ThreadCount UInt32
ThreadID UInt32

Event ID 4440: WorkQueue Thread: End workqueue_ptr=WorkQueuePointer WorkQueueID=WordQueueID ThreadCount=ThreadCount.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Thread
Opcode
Stop

Message #

WorkQueue Thread: End workqueue_ptr=%1 WorkQueueID=%2 ThreadCount=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WordQueueID UInt32
ThreadCount UInt32
ThreadID UInt32

Event ID 4454: MMCSS Registration Enter Queue=Queue ThreadID=ThreadID Handle=Handle Error=Error Class=Class Pri=Priority TaskID=TaskID.

#
Channel
RTWorkQueueTheading
Task
MMCSSRegistration
Opcode
Start

Message #

MMCSS Registration Enter Queue=%1 ThreadID=%2 Handle=%3 Error=%4 Class=%5 Pri=%6 TaskID=%7

Fields #

NameDescription
Queue Pointer
ThreadID UInt32
Handle Pointer
Error UInt32
Class UnicodeString
Priority Int32
TaskID UInt32

Event ID 4455: MMCSS Registration Enter Queue=Queue ThreadID=ThreadID Handle=Handle Error=Error Class=Class Pri=Priority TaskID=TaskID.

#
Channel
RTWorkQueueTheading
Task
MMCSSRegistration
Opcode
Stop

Message #

MMCSS Registration Enter Queue=%1 ThreadID=%2 Handle=%3 Error=%4 Class=%5 Pri=%6 TaskID=%7

Fields #

NameDescription
Queue Pointer
ThreadID UInt32
Handle Pointer
Error UInt32
Class UnicodeString
Priority Int32
TaskID UInt32

Event ID 4472: WorkQueue Queue: WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID QOS_Supported=Flags.

#
Channel
RTWorkQueueTheading
Level
Verbose
Task
WorkQueue:Queue_Create
Opcode
Start

Message #

WorkQueue Queue: WorkQueuePtr=%1 WorkQueueID=%2 QOS_Supported=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID Int32
Flags UInt32
QoSSupported UInt32

Example Event #

{
  "system": {
    "channel": "RTWorkQueueTheading",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4472,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 13220,
      "thread_id": 7260
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-RTWorkQueue-Threading",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:05:45.338Z",
    "version": 0
  },
  "event_data": {
    "Flags": 0,
    "WorkQueueID": 5,
    "WorkQueuePointer": "0x2AF64F256B0"
  },
  "message": ""
}

Event ID 4473: WorkQueue Queue: WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Queue_Create
Opcode
Stop

Message #

WorkQueue Queue: WorkQueuePtr=%1 WorkQueueID=%2

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID Int32
Flags UInt32
QoSSupported UInt32

Event ID 4474: WorkQueue Execute Callback: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID BaseWorkQueueID=BaseWorkQueueID ThreadID=ThreadID AsyncResult=AsyncResult AsyncResultPtr=AsyncResultVTable L...

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Executecallback
Opcode
Start

Description

WorkQueue Execute Callback: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID BaseWorkQueueID=BaseWorkQueueID ThreadID=ThreadID AsyncResult=AsyncResult AsyncResultPtr=AsyncResultVTable LongRunning=LongRunning.

Message #

WorkQueue Execute Callback: Start workqueue_ptr=%1 workQueueID=%2 BaseWorkQueueID=%3 ThreadID=%4 AsyncResult=%5 AsyncResultPtr=%6 LongRunning=%7

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
BaseWorkQueueID UInt32
ThreadID UInt32
AsyncResult Pointer
AsyncResultVTable Pointer
LongRunning Boolean

Event ID 4475: WorkQueue Execute Callback: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID BaseWorkQueueID=BaseWorkQueueID ThreadID=ThreadID AsyncResult=AsyncResult AsyncResultPtr=AsyncResultVTable Lon...

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Executecallback
Opcode
Stop

Description

WorkQueue Execute Callback: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID BaseWorkQueueID=BaseWorkQueueID ThreadID=ThreadID AsyncResult=AsyncResult AsyncResultPtr=AsyncResultVTable LongRunning=LongRunning.

Message #

WorkQueue Execute Callback: End workqueue_ptr=%1 workQueueID=%2 BaseWorkQueueID=%3 ThreadID=%4 AsyncResult=%5 AsyncResultPtr=%6 LongRunning=%7

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
BaseWorkQueueID UInt32
ThreadID UInt32
AsyncResult Pointer
AsyncResultVTable Pointer
LongRunning Boolean

Event ID 4476: WorkQueue MMCSS: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Class=Class Pri=Priority TaskId=TaskID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:MMCSSTransition
Opcode
Start

Message #

WorkQueue MMCSS: Start workqueue_ptr=%1 workQueueID=%2 Class=%3 Pri=%4 TaskId=%5

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
Class UnicodeString
Priority Int32
TaskID UInt32

Event ID 4477: WorkQueue MMCSS: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Class=Class Pri=Priority TaskId=TaskID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:MMCSSTransition
Opcode
Stop

Message #

WorkQueue MMCSS: End workqueue_ptr=%1 workQueueID=%2 Class=%3 Pri=%4 TaskId=%5

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
Class UnicodeString
Priority Int32
TaskID UInt32

Event ID 4478: WorkQueue UpdateDeadlines: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskId=TaskID Previous=PreviousDeadline Next=NextDeadline Delay=lDelay_ms.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:UpdateDeadlines
Opcode
Start

Message #

WorkQueue UpdateDeadlines: Start workqueue_ptr=%1 workQueueID=%2 TaskId=%3 Previous=%4 Next=%5 Delay=%6

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskID UInt32
PreviousDeadline Int64
NextDeadline Int64
lDelay_ms Int32
lPreDelay_ms Int32
NextDeadline_RelToNow_us Int64

Event ID 4479: WorkQueue UpdateDeadlines: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskId=TaskID Previous=PreviousDeadline Next=NextDeadline Delay=lDelay_ms.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:UpdateDeadlines
Opcode
Stop

Message #

WorkQueue UpdateDeadlines: End workqueue_ptr=%1 workQueueID=%2 TaskId=%3 Previous=%4 Next=%5 Delay=%6

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskID UInt32
PreviousDeadline Int64
NextDeadline Int64
lDelay_ms Int32
lPreDelay_ms Int32

Event ID 4480: WorkQueue AddDeadline: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:AddDeadline
Opcode
Start

Message #

WorkQueue AddDeadline: Start workqueue_ptr=%1 workQueueID=%2 Item=%3 global=%4 delta=%5

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
ItemPointer Pointer
ItemID UInt32
GlobalDeadline Int64
DeltaAhead_usec Int64

Event ID 4481: WorkQueue AddDeadline: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:AddDeadline
Opcode
Stop

Message #

WorkQueue AddDeadline: End workqueue_ptr=%1 workQueueID=%2 Item=%3 global=%4 delta=%5

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
ItemPointer Pointer
ItemID UInt32
GlobalDeadline Int64
DeltaAhead_usec Int64

Event ID 4482: WorkQueue AddImmediateDeadline: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:AddImmediateDeadline
Opcode
Start

Message #

WorkQueue AddImmediateDeadline: Start workqueue_ptr=%1 workQueueID=%2 Item=%3 global=%4 delta=%5

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
ItemPointer Pointer
ItemID UInt32
GlobalDeadline Int64
DeltaAhead_usec Int64

Event ID 4483: WorkQueue AddImmediateDeadline: End workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID Item=ItemPointer global=GlobalDeadline delta=DeltaAhead_usec.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:AddImmediateDeadline
Opcode
Stop

Message #

WorkQueue AddImmediateDeadline: End workqueue_ptr=%1 workQueueID=%2 Item=%3 global=%4 delta=%5

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
ItemPointer Pointer
ItemID UInt32
GlobalDeadline Int64
DeltaAhead_usec Int64

Event ID 4484: WorkQueue DeadlineYield: Start workQueueID=WorkQueueID Delay=Yield.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:DeadlineYield
Opcode
Start

Message #

WorkQueue DeadlineYield: Start workQueueID=%1 Delay=%2

Fields #

NameDescription
WorkQueueID UInt32
Yield UInt32

Event ID 4485: WorkQueue DeadlineYield: End workQueueID=WorkQueueID Delay=Yield.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:DeadlineYield
Opcode
Stop

Message #

WorkQueue DeadlineYield: End workQueueID=%1 Delay=%2

Fields #

NameDescription
WorkQueueID UInt32
Yield UInt32

Event ID 4486: WorkQueue DeadlineQueue: WorkQueuePtr=WorkQueuePointer workQueueID=WorkQueueID count=TotalCount immediateCount=ImmediateCount nextDeadline=NextDeadline nextItem=ItemPointer.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:UpdateDeadlineQueue

Message #

WorkQueue DeadlineQueue: WorkQueuePtr=%1 workQueueID=%2 count=%3 immediateCount=%4 nextDeadline=%5 nextItem=%6

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TotalCount UInt32
ImmediateCount UInt32
NextDeadline Int64
ItemPointer Pointer
ItemID UInt32
NextDeadline_RelToNow_us Int64
NextDeadline_AddTimeRelNow_us Int64

Event ID 4487: WorkQueue LongRunning: Start workQueueID=WorkQueueID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:LongRunning
Opcode
Start

Message #

WorkQueue LongRunning: Start workQueueID=%1

Fields #

NameDescription
WorkQueueID UInt32
TaskGroupID UInt32

Event ID 4488: WorkQueue LongRunning: End workQueueID=WorkQueueID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:LongRunning
Opcode
Stop

Message #

WorkQueue LongRunning: End workQueueID=%1

Fields #

NameDescription
WorkQueueID UInt32
TaskGroupID UInt32

Event ID 4489: WorkQueue: StartTimer QueuePtr=WorkQueuePointer QueueID=WorkQueueID TimerPtr=TimerPointer Timeout=Timeout IsPeriodic=IsPeriodic.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:StartTimer

Message #

WorkQueue: StartTimer QueuePtr=%1 QueueID=%2 TimerPtr=%3 Timeout=%4 IsPeriodic=%5

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TimerPointer Pointer
Timeout Int64
IsPeriodic Boolean
Tolerance_ms UInt32

Event ID 4490: WorkQueue: ExecuteTimer QueuePtr=WorkQueuePointer QueueID=WorkQueueID TimerPtr=TimerPointer.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:ExecuteTimer

Message #

WorkQueue: ExecuteTimer QueuePtr=%1 QueueID=%2 TimerPtr=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TimerPointer Pointer
IsPeriodic Boolean

Event ID 4491: SubscribePPMChangeWNF queryStatus=queryStatus subscribeStatus=subscribeStatus changeStamp=changeStamp.

#
Channel
RTWorkQueueTheading
Task
WNF_SubscribePPMChange

Message #

SubscribePPMChangeWNF queryStatus=%1 subscribeStatus=%2 changeStamp=%3

Fields #

NameDescription
queryStatus UInt32
subscribeStatus UInt32
changeStamp UInt32

Event ID 4492: PPMChangeWnfCallback ChangeStamp=ChangeStamp CurChangeStamp=CurChangeStamp PPMMode=PPMMode QOSSupported=QOSSupported Length=Length.

#
Channel
RTWorkQueueTheading
Task
WNF_PPMChangeWnfCallback

Message #

PPMChangeWnfCallback ChangeStamp=%1 CurChangeStamp=%2 PPMMode=%3 QOSSupported=%4 Length=%5

Fields #

NameDescription
ChangeStamp UInt32
CurChangeStamp UInt32
PPMMode UInt32
QOSSupported UInt32
Length UInt32

Event ID 4493: UpdateSelectWorkQueuesCpuGroupMask Enter ProcessorGroup=ProcessorGroup ProcessorMask=ProcessorMask.

#
Channel
RTWorkQueueTheading
Task
UpdateSelectWorkQueuesCpuGroupMask
Opcode
Start

Message #

UpdateSelectWorkQueuesCpuGroupMask Enter ProcessorGroup=%1 ProcessorMask=%2

Fields #

NameDescription
ProcessorGroup UInt64
ProcessorMask UInt64

Event ID 4494: UpdateSelectWorkQueuesCpuGroupMask Leave ProcessorGroup=ProcessorGroup ProcessorMask=ProcessorMask hr=hResult.

#
Channel
RTWorkQueueTheading
Task
UpdateSelectWorkQueuesCpuGroupMask
Opcode
Stop

Message #

UpdateSelectWorkQueuesCpuGroupMask Leave ProcessorGroup=%1 ProcessorMask=%2 hr=%3

Fields #

NameDescription
ProcessorGroup UInt64
ProcessorMask UInt64
hResult UInt32

Event ID 4495: SubscribeCpuGroupMaskChangeWNF queryStatus=queryStatus subscribeStatus=subscribeStatus changeStamp=changeStamp.

#
Channel
RTWorkQueueTheading
Level
Informational
Task
WNF_SubscribeCpuGroupMaskChange

Message #

SubscribeCpuGroupMaskChangeWNF queryStatus=%1 subscribeStatus=%2 changeStamp=%3

Fields #

NameDescription
queryStatus UInt32
subscribeStatus UInt32
changeStamp UInt32

Example Event #

{
  "system": {
    "channel": "RTWorkQueueTheading",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4495,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 13220,
      "thread_id": 7260
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-RTWorkQueue-Threading",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:05:45.338Z",
    "version": 0
  },
  "event_data": {
    "changeStamp": 0,
    "queryStatus": 3221225506,
    "subscribeStatus": 0
  },
  "message": ""
}

Event ID 4496: UpdateWorkqueueCpuGroupMask workQueue=dwWorkQueue Class=Class ProcesssorGroup=ProcessorGroup ProcesssorMask=ProcessorMask.

#
Channel
RTWorkQueueTheading
Task
WNF_UpdateWorkqueueCpuGroupMask

Message #

UpdateWorkqueueCpuGroupMask workQueue=%1 Class=%2 ProcesssorGroup=%3 ProcesssorMask=%4

Fields #

NameDescription
dwWorkQueue UInt32
Class UnicodeString
ProcessorGroup UInt64
ProcessorMask UInt64

Event ID 4497: CpuGroupMaskChangeWnfCallback ChangeStamp=ChangeStamp CurChangeStamp=CurChangeStamp ProcessorGroup=ProcessorGroup ProcessorMask=ProcessorMask Length=Length.

#
Channel
RTWorkQueueTheading
Task
WNF_CpuGroupMaskChangeWnfCallback

Message #

CpuGroupMaskChangeWnfCallback ChangeStamp=%1 CurChangeStamp=%2 ProcessorGroup=%3 ProcessorMask=%4 Length=%5

Fields #

NameDescription
ChangeStamp UInt32
CurChangeStamp UInt32
ProcessorGroup UInt64
ProcessorMask UInt64
Length UInt32

Event ID 4498: SetThreadCpuGroupMask pWorkQueue=pWorkQueue Class=Class Priority=Priority ThreadId=ThreadId CurProcessorGroup=CurProcessorGroup CurProcessorMask=CurProcessorMask NewProcessorGroup=NewProcessorGroup...

#
Channel
RTWorkQueueTheading
Task
WNF_SetThreadCpuGroupMask

Description

SetThreadCpuGroupMask pWorkQueue=pWorkQueue Class=Class Priority=Priority ThreadId=ThreadId CurProcessorGroup=CurProcessorGroup CurProcessorMask=CurProcessorMask NewProcessorGroup=NewProcessorGroup NewProcessorMask=NewProcessorMask status=Status.

Message #

SetThreadCpuGroupMask pWorkQueue=%1 Class=%2 Priority=%3 ThreadId=%4 CurProcessorGroup=%5 CurProcessorMask=%6 NewProcessorGroup=%7 NewProcessorMask=%8 status=%9

Fields #

NameDescription
pWorkQueue Pointer
Class UnicodeString
Priority Int32
ThreadId Int32
CurProcessorGroup UInt64
CurProcessorMask UInt64
NewProcessorGroup UInt64
NewProcessorMask UInt64
Status Int32NTSTATUS reference

Event ID 4499: WorkQueue Start Notification WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Notification
Opcode
Start

Message #

WorkQueue Start Notification WorkQueuePtr=%1 WorkQueueID=%2

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID Int32

Event ID 4500: WorkQueue End Notification WorkQueuePtr=WorkQueuePointer WorkQueueID=WorkQueueID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Notification
Opcode
Stop

Message #

WorkQueue End Notification WorkQueuePtr=%1 WorkQueueID=%2

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID Int32

Event ID 4501: WorkQueue Debounce: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Debounce
Opcode
Start

Message #

WorkQueue Debounce: Start workqueue_ptr=%1 workQueueID=%2 TaskGroup=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskGroup UInt32

Event ID 4502: WorkQueue Debounce: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Debounce
Opcode
Stop

Message #

WorkQueue Debounce: Stop workqueue_ptr=%1 workQueueID=%2 TaskGroup=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskGroup UInt32

Event ID 4503: WorkQueue Buffering: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Buffering
Opcode
Start

Message #

WorkQueue Buffering: Start workqueue_ptr=%1 workQueueID=%2 TaskGroup=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskGroup UInt32

Event ID 4504: WorkQueue Buffering: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:Buffering
Opcode
Stop

Message #

WorkQueue Buffering: Stop workqueue_ptr=%1 workQueueID=%2 TaskGroup=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskGroup UInt32

Event ID 4505: Platform AllocIndex start: Platform=Platform WorkQueueID=WorkQueueID Index=Index.

#
Channel
RTWorkQueueTheading
Task
Platform:AllocIndex
Opcode
Start

Message #

Platform AllocIndex start: Platform=%1 WorkQueueID=%2 Index=%3

Fields #

NameDescription
Platform Pointer
WorkQueueID Int32
Index Int32

Event ID 4506: Platform AllocIndex stop: Platform=Platform WorkQueueID=WorkQueueID Index=Index.

#
Channel
RTWorkQueueTheading
Task
Platform:AllocIndex
Opcode
Stop

Message #

Platform AllocIndex stop: Platform=%1 WorkQueueID=%2 Index=%3

Fields #

NameDescription
Platform Pointer
WorkQueueID Int32
Index Int32

Event ID 4507: Platform Init start: Platform=Platform.

#
Channel
RTWorkQueueTheading
Level
Verbose
Task
Platform:Init
Opcode
Start

Message #

Platform Init start: Platform=%1

Fields #

NameDescription
Platform Pointer

Example Event #

{
  "system": {
    "channel": "RTWorkQueueTheading",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4507,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 13220,
      "thread_id": 7260
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-RTWorkQueue-Threading",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:05:45.337Z",
    "version": 0
  },
  "event_data": {
    "Platform": "0x7FFE90CA1780"
  },
  "message": ""
}

Event ID 4508: Platform Init stop: Platform=Platform.

#
Channel
RTWorkQueueTheading
Task
Platform:Init
Opcode
Stop

Message #

Platform Init stop: Platform=%1

Fields #

NameDescription
Platform Pointer

Event ID 4509: Platform Shutdown start: Platform=Platform.

#
Channel
RTWorkQueueTheading
Task
Platform:Shutdown
Opcode
Start

Message #

Platform Shutdown start: Platform=%1

Fields #

NameDescription
Platform Pointer

Event ID 4510: Platform Shutdown stop: Platform=Platform.

#
Channel
RTWorkQueueTheading
Task
Platform:Shutdown
Opcode
Stop

Message #

Platform Shutdown stop: Platform=%1

Fields #

NameDescription
Platform Pointer

Event ID 4511: Platform Shutdown timeout: Platform=Platform.

#
Channel
RTWorkQueueTheading
Task
Platform:Shutdown

Message #

Platform Shutdown timeout: Platform=%1

Fields #

NameDescription
Platform Pointer

Event ID 4512: Platform Shutdown_WorkQueue start: Platform=Platform workqueue=WorkQueue index=Index.

#
Channel
RTWorkQueueTheading
Task
Platform:Shutdown_WorkQueue
Opcode
Start

Message #

Platform Shutdown_WorkQueue start: Platform=%1 workqueue=%2 index=%3

Fields #

NameDescription
Platform Pointer
WorkQueue Int32
Index Int32

Event ID 4513: Platform Shutdown_WorkQueue stop: Platform=Platform workqueue=WorkQueue index=Index.

#
Channel
RTWorkQueueTheading
Task
Platform:Shutdown_WorkQueue
Opcode
Stop

Message #

Platform Shutdown_WorkQueue stop: Platform=%1 workqueue=%2 index=%3

Fields #

NameDescription
Platform Pointer
WorkQueue Int32
Index Int32

Event ID 4514: WorkQueue RunLimit: Start workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:RunLimit
Opcode
Start

Message #

WorkQueue RunLimit: Start workqueue_ptr=%1 workQueueID=%2 TaskGroup=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskGroup UInt32

Event ID 4515: WorkQueue RunLimit: Stop workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:RunLimit
Opcode
Stop

Message #

WorkQueue RunLimit: Stop workqueue_ptr=%1 workQueueID=%2 TaskGroup=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskGroup UInt32

Event ID 4516: WorkQueue RunLimit: Exceeded workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:RunLimit

Message #

WorkQueue RunLimit: Exceeded workqueue_ptr=%1 workQueueID=%2 TaskGroup=%3

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskGroup UInt32

Event ID 4517: TaskGroup: Start TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
TaskGroup
Opcode
Start

Message #

TaskGroup: Start TaskGroup=%1

Fields #

NameDescription
TaskGroup Pointer

Event ID 4518: TaskGroup: End TaskGroup=TaskGroup.

#
Channel
RTWorkQueueTheading
Task
TaskGroup
Opcode
Stop

Message #

TaskGroup: End TaskGroup=%1

Fields #

NameDescription
TaskGroup Pointer

Event ID 4519: TaskGroup RefCount TaskGroup=TaskGroup RefCount=RefCount.

#
Channel
RTWorkQueueTheading
Task
TaskGroup

Message #

TaskGroup RefCount TaskGroup=%1 RefCount=%2

Fields #

NameDescription
TaskGroup Pointer
RefCount UInt32

Event ID 4520: TaskGroup ObjectCount ObjectCount=ObjectCount.

#
Channel
RTWorkQueueTheading
Task
TaskGroup

Message #

TaskGroup ObjectCount ObjectCount=%1

Fields #

NameDescription
ObjectCount UInt32

Event ID 4521: TaskGroup Reinit TaskGroup=TaskGroup TaskID=TaskID.

#
Channel
RTWorkQueueTheading
Task
TaskGroup

Message #

TaskGroup Reinit TaskGroup=%1 TaskID=%2

Fields #

NameDescription
TaskGroup Pointer
TaskID UInt32

Event ID 4522: Platform Init shutdown in progress: Platform=Platform.

#
Channel
RTWorkQueueTheading
Task
Platform:Init

Message #

Platform Init shutdown in progress: Platform=%1

Fields #

NameDescription
Platform Pointer

Event ID 4523: Platform Shutdown aborted: Platform=Platform.

#
Channel
RTWorkQueueTheading
Task
Platform:Shutdown
Opcode
Stop

Message #

Platform Shutdown aborted: Platform=%1

Fields #

NameDescription
Platform Pointer

Event ID 4524: WorkQueue GetMMCSSFailure: workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID statePtr=rtStatePointer hr=hr.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:GetMMCSSFailure

Message #

WorkQueue GetMMCSSFailure: workqueue_ptr=%1 workQueueID=%2 statePtr=%3 hr=%4

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
rtStatePointer Pointer
hr HexInt32

Event ID 4525: WorkQueue MMCSS: RegCount workqueue_ptr=WorkQueuePointer workQueueID=WorkQueueID taskId=TaskID regCount=RegCount.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:MMCSSTransition

Message #

WorkQueue MMCSS: RegCount workqueue_ptr=%1 workQueueID=%2 taskId=%3 regCount=%4

Fields #

NameDescription
WorkQueuePointer Pointer
WorkQueueID UInt32
TaskID UInt32
RegCount UInt32

Event ID 4526: WorkQueue DeadlineYield: Start workQueueID=WorkQueueID Delay=TaskID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:DeadlineYield
Opcode
Start

Message #

WorkQueue DeadlineYield: Start workQueueID=%1 Delay=%2

Fields #

NameDescription
WorkQueueID UInt32
TaskID UInt32
Yield UInt32
llDelay Int32

Event ID 4527: WorkQueue DeadlineYield: End workQueueID=WorkQueueID Delay=TaskID.

#
Channel
RTWorkQueueTheading
Task
WorkQueue:DeadlineYield
Opcode
Stop

Message #

WorkQueue DeadlineYield: End workQueueID=%1 Delay=%2

Fields #

NameDescription
WorkQueueID UInt32
TaskID UInt32

Provenance

ETW provider GUID e18d0fc9-9515-4232-98e4-89e456d8551b

Defined in rtworkq.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3912, captured 2026-06-02 — Manifest XML pack, 2.0 MB