Microsoft-Windows-Search-Core

365 events across 1 channel

Event	Title	Channel	Sample
1	CrawlStart	Diagnostic	N
2	CrawlStop	Diagnostic	N
3	IncCrawlStart	Diagnostic	N
4	IncCrawlStop	Diagnostic	N
5	BackOff_MemStart	Diagnostic	N
6	BackOff_MemStop	Diagnostic	N
7	BackOff_BatStart	Diagnostic	N
8	BackOff_BatStop	Diagnostic	N
9	BackOff_ActStart	Diagnostic	N
10	BackOff_ActStop	Diagnostic	N
11	BackOff_IORStart	Diagnostic	N
12	BackOff_IORStop	Diagnostic	N
13	BackOff_NtfStart	Diagnostic	N
14	BackOff_NtfStop	Diagnostic	N
15	BackOff_CPUStart	Diagnostic	N
16	BackOff_CPUStop	Diagnostic	N
17	Index_FileStart	Diagnostic	N
18	Index_FileStop_V1	Diagnostic	N
19	USN_Notify	Diagnostic	Y
21	USN_Notify_Filtered	Diagnostic	N
22	Catalog_MonitorStart	Diagnostic	N
23	Catalog_MonitorStop	Diagnostic	N
24	Index_MergeStart	Diagnostic	N
25	Index_MergeStop	Diagnostic	N
26	Index_CommitStart	Diagnostic	N
27	Index_CommitStop	Diagnostic	N
28	MapiEmailItemStart	Diagnostic	N
29	MapiEmailItemStop	Diagnostic	N
30	CSCDocumentStart	Diagnostic	N
31	CSCDocumentStop	Diagnostic	N
32	RetrieveValueStart	Diagnostic	N
33	RetrieveValueStop	Diagnostic	N
34	MapiOpenMessageStart	Diagnostic	N
35	MapiOpenMessageStop	Diagnostic	N
36	MapiGetAttachmentFromMessageStart	Diagnostic	N
37	MapiGetAttachmentFromMessageStop	Diagnostic	N
38	MapiEnumerateAttachmentsStart	Diagnostic	N
39	MapiEnumerateAttachmentsStop	Diagnostic	N
40	MapiGetMapiFpsPropValsStop	Diagnostic	N
41	MapiGetMapiFpsPropValsStop41	Diagnostic	N
42	IndexItemInit	Diagnostic	N
43	IndexItemSetStatus	Diagnostic	N
44	OnDataChange	Diagnostic	N
46	IndexItemDataComplete	Diagnostic	N
47	HighPriorityItemBoost	Diagnostic	N
48	HighPriorityThreadBoost	Diagnostic	N
49	HighPriorityMergeBoost	Diagnostic	N
50	ClientQueryStart_V1	Diagnostic	N
51	ClientQueryStop_V1	Diagnostic	N
52	IndexItemEnd	Diagnostic	N
53	MergeItemStart	Diagnostic	N
54	MergeThreadStart_V1	Diagnostic	N
55	MergeThreadStop_V1	Diagnostic	N
56	IndexItemPushToFile	Diagnostic	N
57	ClientGetNextRows	Diagnostic	N
58	FilterOplockBreak	Diagnostic	N
59	BackoffThreadWaitStart	Diagnostic	N
60	BackoffThreadWaitStop	Diagnostic	N
61	BackoffReason	Diagnostic	N
62	FilterOplockFail	Diagnostic	N
63	ServiceStatusUpdate	Diagnostic	N
64	SearchIndexerStart	Diagnostic	N
65	SearchIndexerStop	Diagnostic	N
66	SearchProtocolHostStart	Diagnostic	N
67	SearchProtocolHostStop	Diagnostic	N
68	SearchFilterHostStart	Diagnostic	N
69	SearchFilterHostStop	Diagnostic	N
70	StatusChange_PostToStatusThread	Diagnostic	N
71	StatusChange_ProcessInStatusThread	Diagnostic	N
72	StatusThreadStart	Diagnostic	N
73	StatusThreadStop	Diagnostic	N
74	StatusChange_AppendToGathererQueue	Diagnostic	N
75	StatusChange_AppendCrawlToGathererQueue	Diagnostic	N
76	StatusChange_RemoveFromGathererQueue	Diagnostic	N
77	Gatherer_AdviseStatus	Diagnostic	N
78	Gatherer_RequestStatusChange	Diagnostic	N
79	GatherProject_AdviseStatusChange_V1	Diagnostic	N
80	GatherProject_AdviseRequestStatus	Diagnostic	N
81	GatherProject_PrepareStatusChange	Diagnostic	N
82	AliasTable_InitSDIDCache	Diagnostic	N
83	WID_SDID_Cache_Initialize	Diagnostic	N
84	WID_SDID_Cache_Write	Diagnostic	N
85	WID_SDID_Cache_SwitchToFull	Diagnostic	N
86	Backoff_MemoryCheck	Diagnostic	N
87	Backoff_BatteryPolicyCheck	Diagnostic	N
88	Backoff_BatteryCheck	Diagnostic	N
89	Backoff_LowDiskCheck	Diagnostic	N
90	Backoff_UserActivityCheck	Diagnostic	N
91	Backoff_HighCPUCheck	Diagnostic	N
92	Backoff_HighIOCheck	Diagnostic	N
93	Backoff_HighNotificationsCheck	Diagnostic	N
94	Backoff_PendingNotificationsCheck	Diagnostic	N
95	Backoff_AllowNewItemsCheck	Diagnostic	N
96	Backoff_State	Diagnostic	N
97	ProtocolHostObjConstructor	Diagnostic	N
98	ProtocolHostObjInit	Diagnostic	N
99	ProtocolHostTerminating	Diagnostic	N
100	ProtocolHostStarted	Diagnostic	N
101	ProtocolHostStopped	Diagnostic	N
102	ProtocolHostKilled	Diagnostic	N
103	ProtocolHostStoppedAlready	Diagnostic	N
104	ProtocolHostTerminatingInDestructor	Diagnostic	N
105	ProtocolHostKilledInDestructor	Diagnostic	N
106	ProtocolHostStoppedInDestructor	Diagnostic	N
107	ProtocolHostObjDestructor	Diagnostic	N
108	ProtocolHostNameConflict_FailedToKill	Diagnostic	N
109	ProtocolHostNameConflict_Killed	Diagnostic	N
110	ProtocolHostNameConflict_Killing	Diagnostic	N
111	FilterHostStarting	Diagnostic	N
112	FilterHostStarted	Diagnostic	N
113	FilterHostStopping	Diagnostic	N
114	FilterHostHung	Diagnostic	N
115	FilterHostStopped	Diagnostic	N
116	Startup_CSearchService_Init	Diagnostic	N
117	Startup_CDcomService_Init	Diagnostic	N
118	Startup_CDcomService_ServiceStart	Diagnostic	N
119	Startup_CDcomService_ServiceMain	Diagnostic	N
120	Startup_RecoverIfNecessary	Diagnostic	N
121	Startup_RecoverDataFiles	Diagnostic	N
122	Startup_RecoverDataFiles_RemoveDir	Diagnostic	N
123	Startup_MoveDataFiles	Diagnostic	N
124	Startup_MoveDataFiles_CopyDir	Diagnostic	N
125	Startup_MoveDataFiles_RemoveDir	Diagnostic	N
126	Startup_ReplaceDirectoryPrefixInValue	Diagnostic	N
127	Startup_SysPrepInProgress	Diagnostic	N
128	Startup_GuiSetupInProgress	Diagnostic	N
129	Startup_CDcomService_IsIdleServiceMode	Diagnostic	N
130	Startup_CSearchService_Init2	Diagnostic	N
131	Startup_SetupWorkingDirectory	Diagnostic	N
132	Startup_SetupWorkingDirectory_RemovePath	Diagnostic	N
133	Startup_CheckAndCleanup	Diagnostic	N
134	Startup_CSearchServiceObj_Initialize	Diagnostic	N
135	Startup_CGatherModule_Init	Diagnostic	N
136	Startup_CGatheringService_InitStart	Diagnostic	N
137	Startup_CGatheringService_InitStop	Diagnostic	N
138	Startup_InitialIndexSetup	Diagnostic	N
139	Setup_DeletePreviousUsersSettingsKey	Diagnostic	N
140	Setup_SetCompletedSuccessfully	Diagnostic	N
141	Setup_Phase	Diagnostic	N
142	Setup_CatalogSetupSucceeded	Diagnostic	N
143	Setup_CatalogSetupFailed	Diagnostic	N
144	Setup_CleanupStarted	Diagnostic	N
145	Setup_CleanupRemoveDir	Diagnostic	N
146	Setup_CleanupSucceeded	Diagnostic	N
147	Setup_CleanupFailed	Diagnostic	N
148	Crawl_InitializeNew	Diagnostic	N
149	Crawl_Initialize	Diagnostic	N
150	Crawl_Initialize_Load	Diagnostic	N
151	Crawl_AddStartPage	Diagnostic	N
152	Crawl_RemoveStartPage	Diagnostic	N
153	Crawl_IsDone	Diagnostic	N
154	Transactions_IterateHistoryStart	Diagnostic	N
155	Transactions_IterateHistoryStop	Diagnostic	N
156	Transactions_IterateHistory_Modify	Diagnostic	N
157	Transactions_IterateHistory_Delete	Diagnostic	N
158	Transactions_UpdateFailuresStart	Diagnostic	N
159	Transactions_UpdateFailuresStop	Diagnostic	N
160	GatherLog_Transaction	Diagnostic	N
161	GatherLog_Crawl	Diagnostic	N
162	Gatherer_OnDataChangeStart	Diagnostic	N
163	Gatherer_OnDataChangeStop	Diagnostic	N
164	Gatherer_OnDataChange	Diagnostic	N
165	Gatherer_OnDataChange_Failed	Diagnostic	N
166	OnDataChange_Failed	Diagnostic	N
169	RobotThread_BeforeGetNewTransaction	Diagnostic	N
170	RobotThread_ProcessNewTransaction	Diagnostic	N
171	RobotThread_FilterDriver_Init_Failed_V1	Diagnostic	N
172	RobotThread_IsHistoryIterator_V1	Diagnostic	N
173	RobotThread_IsWildcardTransaction_V1	Diagnostic	N
174	RobotThread_IsIteratorByStartAddress_V1	Diagnostic	N
175	RobotThread_IsHistoryIteratorUpdateFailures_V1	Diagnostic	N
176	RobotThread_ProcessAnnotation_Failed_V1	Diagnostic	N
177	RobotThread_GetStandardProperties_Failed_V1	Diagnostic	N
178	RobotThread_TransactionNotModified_V1	Diagnostic	N
179	RobotThread_CatalogResetRequested_V1	Diagnostic	N
180	CEnumSearchRoots_Constructor	Diagnostic	N
181	CEnumSearchRoots_Destructor	Diagnostic	N
182	CEnumSearchRoots_DestructorStop	Diagnostic	N
183	CEnumSearchRoots_Reset	Diagnostic	N
184	CEnumSearchRoots_CloneStart	Diagnostic	N
185	CEnumSearchRoots_CloneStop	Diagnostic	N
186	CEnumSearchRoots_NextStart	Diagnostic	N
187	CEnumSearchRoots_NextStop	Diagnostic	N
188	CEnumSearchRoots_Next_Fetch	Diagnostic	N
189	CEnumSearchRoots_SkipStart	Diagnostic	N
190	CEnumSearchRoots_SkipStop	Diagnostic	N
191	CEnumSearchScopeRules_Constructor	Diagnostic	N
192	CEnumSearchScopeRules_DestructorStart	Diagnostic	N
193	CEnumSearchScopeRules_DestructorStop	Diagnostic	N
194	CEnumSearchScopeRules_Reset	Diagnostic	N
195	CEnumSearchScopeRules_CloneStart	Diagnostic	N
196	CEnumSearchScopeRules_CloneStop	Diagnostic	N
197	CEnumSearchScopeRules_NextStart	Diagnostic	N
198	CEnumSearchScopeRules_NextStop	Diagnostic	N
199	CEnumSearchScopeRules_Next_Fetch	Diagnostic	N
200	CEnumSearchScopeRules_SkipStart	Diagnostic	N
201	CEnumSearchScopeRules_SkipStop	Diagnostic	N
202	CSearchCrawlScopeManager_Constructor	Diagnostic	N
203	CSearchCrawlScopeManager_Destructor	Diagnostic	N
204	CSearchCrawlScopeManager_IncludedInCrawlScopeStart	Diagnostic	N
205	CSearchCrawlScopeManager_IncludedInCrawlScopeStop	Diagnostic	N
206	CSearchCrawlScopeManager_AddDefaultScopeRuleStart	Diagnostic	N
207	CSearchCrawlScopeManager_AddDefaultScopeRuleStop	Diagnostic	N
208	CSearchCrawlScopeManager_AddHierarchicalScopeStart	Diagnostic	N
209	CSearchCrawlScopeManager_AddHierarchicalScopeStop	Diagnostic	N
210	CSearchCrawlScopeManager_AddRootStart	Diagnostic	N
211	CSearchCrawlScopeManager_AddRootStop	Diagnostic	N
212	CSearchCrawlScopeManager_AddUserScopeRuleStart	Diagnostic	N
213	CSearchCrawlScopeManager_AddUserScopeRuleStop	Diagnostic	N
214	CSearchCrawlScopeManager_EnumerateRootsStart	Diagnostic	N
215	CSearchCrawlScopeManager_EnumerateRootsStop	Diagnostic	N
216	CSearchCrawlScopeManager_EnumerateScopeRulesStart	Diagnostic	N
217	CSearchCrawlScopeManager_EnumerateScopeRulesStop	Diagnostic	N
218	CSearchCrawlScopeManager_GetParentScopeVersionIdStart	Diagnostic	N
219	CSearchCrawlScopeManager_GetParentScopeVersionIdStop	Diagnostic	N
220	CSearchCrawlScopeManager_HasChildScopeRuleStart	Diagnostic	N
221	CSearchCrawlScopeManager_HasChildScopeRuleStop	Diagnostic	N
222	CSearchCrawlScopeManager_HasParentScopeRuleStart	Diagnostic	N
223	CSearchCrawlScopeManager_HasParentScopeRuleStop	Diagnostic	N
224	CSearchCrawlScopeManager_IncludedInCrawlScopeExStart	Diagnostic	N
225	CSearchCrawlScopeManager_IncludedInCrawlScopeExStop	Diagnostic	N
226	CSearchCrawlScopeManager_RemoveDefaultScopeRuleStart	Diagnostic	N
227	CSearchCrawlScopeManager_RemoveDefaultScopeRuleStop	Diagnostic	N
228	CSearchCrawlScopeManager_RemoveRootStart	Diagnostic	N
229	CSearchCrawlScopeManager_RemoveRootStop	Diagnostic	N
230	CSearchCrawlScopeManager_RemoveScopeRuleStart	Diagnostic	N
231	CSearchCrawlScopeManager_RemoveScopeRuleStop	Diagnostic	N
232	CSearchCrawlScopeManager_RevertToDefaultScopesStart	Diagnostic	N
233	CSearchCrawlScopeManager_RevertToDefaultScopesStop	Diagnostic	N
234	CSearchCrawlScopeManager_SaveAllStart	Diagnostic	N
235	CSearchCrawlScopeManager_SaveAllStop	Diagnostic	N
236	CSearchRoot_put_RootURL	Diagnostic	N
237	CSearchRoot_get_RootURL	Diagnostic	N
238	CSearchRoot_get_AuthenticationType	Diagnostic	N
239	CSearchRoot_get_EnumerationDepth	Diagnostic	N
240	CSearchRoot_get_FollowDirectories	Diagnostic	N
241	CSearchRoot_get_HostDepth	Diagnostic	N
242	CSearchRoot_get_IsHierarchical	Diagnostic	N
243	CSearchRoot_get_ProvidesNotifications	Diagnostic	N
244	CSearchRoot_get_Schedule	Diagnostic	N
245	CSearchRoot_get_UseNotificationsOnly	Diagnostic	N
246	CSearchRoot_put_AuthenticationType	Diagnostic	N
247	CSearchRoot_put_EnumerationDepth	Diagnostic	N
248	CSearchRoot_put_FollowDirectories	Diagnostic	N
249	CSearchRoot_put_HostDepth	Diagnostic	N
250	CSearchRoot_put_IsHierarchical	Diagnostic	N
251	CSearchRoot_put_ProvidesNotifications	Diagnostic	N
252	CSearchRoot_put_Schedule	Diagnostic	N
253	CSearchRoot_put_UseNotificationsOnly	Diagnostic	N
254	CSearchScopeRule_get_IsDefault	Diagnostic	N
255	CSearchScopeRule_get_IsIncluded	Diagnostic	N
256	CSearchScopeRule_get_PatternOrURL	Diagnostic	N
257	StatusChange_QueueLocked	Diagnostic	N
258	StatusChange_QueueUnlocked	Diagnostic	N
259	Gatherer_OnDataChange_Track_Url	Diagnostic	Y
260	Gatherer_DocIdTable_GetNewId	Diagnostic	N
261	Gatherer_DocIdTable_UndeleteId	Diagnostic	N
262	Gatherer_DocIdTable_DeleteId	Diagnostic	N
263	Gatherer_DocIdTable_GetMaxId	Diagnostic	N
264	Gatherer_DocIdTable_SetMaxId	Diagnostic	N
265	WID_SDID_Cache_NumberItems	Diagnostic	N
266	Gatherer_Queues_QueueLength	Diagnostic	N
267	Startup_Search_Service_DurationStart	Diagnostic	N
268	Startup_Search_Service_DurationStop	Diagnostic	N
269	Shutdown_Search_Service_DurationStart	Diagnostic	N
270	Shutdown_Search_Service_DurationStop	Diagnostic	N
271	ServerQueryRelease	Diagnostic	N
272	CreatePhysCursorStart	Diagnostic	N
273	CreatePhysCursorStop	Diagnostic	N
274	CreatePhysCursorRangeStart	Diagnostic	N
275	CreatePhysCursorRangeStop	Diagnostic	N
276	MergeStart	Diagnostic	N
277	MergeStop	Diagnostic	N
278	CreateWLCursorStart	Diagnostic	N
279	CreateWLCursorStop	Diagnostic	N
280	CreateWLCursorRangeStart	Diagnostic	N
281	CreateWLCursorRangeStop	Diagnostic	N
282	ServerQueryStart	Diagnostic	N
283	ServerQuery_Send	Diagnostic	N
284	ServerQuery_Received	Diagnostic	N
285	ClientQuery_Send	Diagnostic	N
286	ClientQuery_Received	Diagnostic	N
287	ServerQueryStop	Diagnostic	N
288	ServerQuery_Create	Diagnostic	N
289	ClientStartFetch	Diagnostic	N
290	ClientFetched	Diagnostic	N
291	ServerGetRowsStart	Diagnostic	N
292	ServerGetRowsStop	Diagnostic	N
293	RobotThread_LangAutoDetection_Start	Diagnostic	N
294	RobotThread_LangAutoDetection_Stop	Diagnostic	N
295	RobotThread_LangAutoDetection_Succeed	Diagnostic	N
296	RobotThread_LangAutoDetection_Fail	Diagnostic	N
297	Service_Status_NotifyStart	Diagnostic	N
298	Service_Status_NotifyStop	Diagnostic	N
300	ServerQuery_ForcePublishStart	Diagnostic	N
301	ServerQuery_ForcePublishStop	Diagnostic	N
302	Wordlist_PublishStart	Diagnostic	N
303	Wordlist_PublishStop	Diagnostic	N
304	Flush_Schedule	Diagnostic	N
305	CBPool_ForceFlush	Diagnostic	N
306	DocAborted_ForcePublish	Diagnostic	N
307	DocAborted_CBOverflow	Diagnostic	N
308	Wordlist_BeginResourceFailed_CBOverflow	Diagnostic	N
309	Wordlist_BeginResourceFailed_DocInError	Diagnostic	N
310	Wordlist_BeginResource_InvalidatedPreviousDoc	Diagnostic	N
311	ClientQuery_Rowset_Reuse	Diagnostic	N
312	ServerQuery_DeferredProperty	Diagnostic	N
313	ScopeManager_Init	Diagnostic	N
314	ScopeManager_Retrieved	Diagnostic	N
315	ScopeManager_SwitchToFull	Diagnostic	N
316	ScopeManager_Write	Diagnostic	N
317	Prioritization_Request	Diagnostic	N
318	Prioritization_Complete	Diagnostic	N
319	Prioritization_Statistics	Diagnostic	N
320	JET_IO_Low_Priority_Change	Diagnostic	N
321	Gather_Transaction_Failure_Code	Diagnostic	N
322	ETWLogging	Diagnostic	Y
323	ETWLoggingFailure	Diagnostic	N
324	ETWLoggingItem	Diagnostic	N
325	ETWLoggingItemFailure	Diagnostic	N
326	USN_Notify_Journal_Wrap	Diagnostic	N
327	GathererRecoverStart	Diagnostic	N
328	GathererRecoverStop	Diagnostic	N
329	ValueIndexCreationStart	Diagnostic	N
330	ValueIndexCreationStop	Diagnostic	N
331	ValueIndexSeekStart	Diagnostic	N
332	ValueIndexSeekStop	Diagnostic	N
333	ValueIndexSeekStart333	Diagnostic	N
334	ValueIndexSeekStop334	Diagnostic	N
335	FreeCursor	Diagnostic	N
336	ReuseRestriction	Diagnostic	N
337	GetQueryStatusExStart	Diagnostic	N
338	GetQueryStatusExStop	Diagnostic	N
339	CreateWordBreakerStart	Diagnostic	N
340	CreateWordBreakerStop	Diagnostic	N
341	ReleaseWordBreakerStart	Diagnostic	N
342	ReleaseWordBreakerStop	Diagnostic	N
343	CreateStemmerStart	Diagnostic	N
344	CreateStemmerStop	Diagnostic	N
345	ReleaseStemmerStart	Diagnostic	N
346	ReleaseStemmerStop	Diagnostic	N
347	CreateCatalog	Diagnostic	N
348	DeleteCatalog	Diagnostic	N
349	RobotThread_GetWordBreaker	Diagnostic	N
350	GetWordBreaker	Diagnostic	N
351	WordBreakerSelector_IncrementHistory	Diagnostic	N
352	WordBreakerSelector_SubstituteLocale	Diagnostic	N
353	WordBreakerSelector_Fallback	Diagnostic	N
354	WordBreakerHistory_Save	Diagnostic	N
355	WordBreakerHistory_Load	Diagnostic	N
356	RobotThread_LangAutoDetection_Scores	Diagnostic	N
357	FileChangeTracker_APICallStart	Diagnostic	N
358	FileChangeTracker_APICallStop	Diagnostic	N
359	FileChangeTracker_APICallStart359	Diagnostic	N
360	FileChangeTracker_APICallStop360	Diagnostic	N
361	FileChangeTracker_APICallStart361	Diagnostic	N
362	FileChangeTracker_APICallStop362	Diagnostic	N
363	FileChangeTracker_ProcessUSN	Diagnostic	Y
364	FileChangeTracker_ProcessUSN	Diagnostic	Y
365	ScopeChangeNotification_OnChanged	Diagnostic	N
366	ScopeChangeNotification_OnChanged366	Diagnostic	N
367	ScopeChangeNotification_RegisterStart	Diagnostic	N
368	ScopeChangeNotification_RegisterStop	Diagnostic	N
369	ScopeChangeNotification_UnregisterStart	Diagnostic	N
370	ScopeChangeNotification_UnregisterStop	Diagnostic	N

Event ID 1: CrawlStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl
Opcode: Start

Event ID 2: CrawlStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl
Opcode: Stop

Event ID 3: IncCrawlStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IncCrawl
Opcode: Start

Event ID 4: IncCrawlStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IncCrawl
Opcode: Stop

Event ID 5: BackOff_MemStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Mem
Opcode: Start

Event ID 6: BackOff_MemStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Mem
Opcode: Stop

Event ID 7: BackOff_BatStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Bat
Opcode: Start

Event ID 8: BackOff_BatStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Bat
Opcode: Stop

Event ID 9: BackOff_ActStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Act
Opcode: Start

Event ID 10: BackOff_ActStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Act
Opcode: Stop

Event ID 11: BackOff_IORStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_IOR
Opcode: Start

Event ID 12: BackOff_IORStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_IOR
Opcode: Stop

Event ID 13: BackOff_NtfStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Ntf
Opcode: Start

Event ID 14: BackOff_NtfStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_Ntf
Opcode: Stop

Event ID 15: BackOff_CPUStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_CPU
Opcode: Start

Event ID 16: BackOff_CPUStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackOff_CPU
Opcode: Stop

Event ID 17: Index_FileStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_File
Opcode: Start

Fields #

Name	Description
`Description` UnicodeString

Event ID 18: Index_FileStop_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_File
Opcode: Stop

Fields #

Name	Description
`UsesFilter` Boolean
`UsesPropertyHandler` Boolean

Event ID 19: USN_Notify

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: USN_Notify
Opcode: win:Info

Fields #

Name	Description
`Reason` UInt32
`Path` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 19,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": "0x0000000000200008",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Path": "file attr: 0x00002010 C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\",
    "Reason": 2147485696
  },
  "message": "USN_Notify"
}

Event ID 21: USN_Notify_Filtered

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: USN_Notify_Filtered

Fields #

Name	Description
`Reason` UInt32
`Path` UnicodeString

Event ID 22: Catalog_MonitorStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Catalog_Monitor
Opcode: Start

Event ID 23: Catalog_MonitorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Catalog_Monitor
Opcode: Stop

Event ID 24: Index_MergeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_Merge
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 25: Index_MergeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_Merge
Opcode: Stop

Event ID 26: Index_CommitStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_Commit
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 27: Index_CommitStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Index_Commit
Opcode: Stop

Event ID 28: MapiEmailItemStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiEmailItem
Opcode: Start

Event ID 29: MapiEmailItemStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiEmailItem
Opcode: Stop

Event ID 30: CSCDocumentStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSCDocument
Opcode: Start

Event ID 31: CSCDocumentStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSCDocument
Opcode: Stop

Event ID 32: RetrieveValueStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RetrieveValue
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 33: RetrieveValueStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RetrieveValue
Opcode: Stop

Event ID 34: MapiOpenMessageStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiOpenMessage
Opcode: Start

Event ID 35: MapiOpenMessageStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiOpenMessage
Opcode: Stop

Event ID 36: MapiGetAttachmentFromMessageStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiGetAttachmentFromMessage
Opcode: Start

Event ID 37: MapiGetAttachmentFromMessageStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiGetAttachmentFromMessage
Opcode: Stop

Event ID 38: MapiEnumerateAttachmentsStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiEnumerateAttachments
Opcode: Start

Event ID 39: MapiEnumerateAttachmentsStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiEnumerateAttachments
Opcode: Stop

Event ID 40: MapiGetMapiFpsPropValsStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiGetMapiFpsPropVals
Opcode: Stop

Event ID 41: MapiGetMapiFpsPropValsStop41

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MapiGetMapiFpsPropVals
Opcode: Stop

Event ID 42: IndexItemInit

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemInit

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 43: IndexItemSetStatus

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemSetStatus

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 44: OnDataChange

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: OnDataChange

Fields #

Name	Description
`Value` UInt64

Event ID 46: IndexItemDataComplete

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemDataComplete

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 47: HighPriorityItemBoost

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: HighPriorityItemBoost

Fields #

Name	Description
`Value` UInt32

Event ID 48: HighPriorityThreadBoost

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: HighPriorityThreadBoost

Fields #

Name	Description
`Value` UInt32

Event ID 49: HighPriorityMergeBoost

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: HighPriorityMergeBoost

Fields #

Name	Description
`Value` UInt32

Event ID 50: ClientQueryStart_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery
Opcode: Start

Fields #

Name	Description
`QueryText` UnicodeString

Event ID 51: ClientQueryStop_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery
Opcode: Stop

Fields #

Name	Description
`QueryText` UnicodeString
`ErrorCode` UInt32

Event ID 52: IndexItemEnd

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemEnd

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 53: MergeItemStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MergeItem
Opcode: Start

Fields #

Name	Description
`Value` UInt64

Event ID 54: MergeThreadStart_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MergeThread
Opcode: Start

Fields #

Name	Description
`Level` UInt32
`Type` UInt64

Event ID 55: MergeThreadStop_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: MergeThread
Opcode: Stop

Fields #

Name	Description
`Level` UInt32
`Type` UInt64

Event ID 56: IndexItemPushToFile

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: IndexItemPushToFile

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 57: ClientGetNextRows

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientGetNextRows

Fields #

Name	Description
`Rowset` UInt64
`Chapter` UInt64
`RowsToSkip` Int64
`RowsRequested` Int64
`RowsReturned` UInt64

Event ID 58: FilterOplockBreak

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterOplockBreak

Fields #

Name	Description
`Description` UnicodeString

Event ID 59: BackoffThreadWaitStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackoffThreadWait
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 60: BackoffThreadWaitStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackoffThreadWait
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 61: BackoffReason

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: BackoffReason

Fields #

Name	Description
`Value` UInt32

Event ID 62: FilterOplockFail

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterOplockFail

Fields #

Name	Description
`Description` UnicodeString

Event ID 63: ServiceStatusUpdate

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServiceStatusUpdate

Fields #

Name	Description
`WaitHint` UInt32
`State` UInt32
`CheckPoint` UInt32

Event ID 64: SearchIndexerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchIndexer
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 65: SearchIndexerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchIndexer
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 66: SearchProtocolHostStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchProtocolHost
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 67: SearchProtocolHostStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchProtocolHost
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 68: SearchFilterHostStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchFilterHost
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 69: SearchFilterHostStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: SearchFilterHost
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 70: StatusChange_PostToStatusThread

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_PostToStatusThread

Fields #

Name	Description
`Value` UInt32

Event ID 71: StatusChange_ProcessInStatusThread

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_ProcessInStatusThread

Fields #

Name	Description
`Value` UInt32

Event ID 72: StatusThreadStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusThread
Opcode: Start

Event ID 73: StatusThreadStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusThread
Opcode: Stop

Event ID 74: StatusChange_AppendToGathererQueue

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_AppendToGathererQueue

Fields #

Name	Description
`Value` UInt32

Event ID 75: StatusChange_AppendCrawlToGathererQueue

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_AppendCrawlToGathererQueue

Fields #

Name	Description
`Value` UInt32

Event ID 76: StatusChange_RemoveFromGathererQueue

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_RemoveFromGathererQueue

Fields #

Name	Description
`Value` UInt32

Event ID 77: Gatherer_AdviseStatus

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_AdviseStatus

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`hrReason` UInt32

Event ID 78: Gatherer_RequestStatusChange

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_RequestStatusChange

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`hrReason` UInt32

Event ID 79: GatherProject_AdviseStatusChange_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherProject_AdviseStatusChange

Fields #

Name	Description
`ProjectPtr` UInt64
`Status` UInt32	NTSTATUS reference
`hrReason` UInt32

Event ID 80: GatherProject_AdviseRequestStatus

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherProject_AdviseRequestStatus

Fields #

Name	Description
`Value` UInt32

Event ID 81: GatherProject_PrepareStatusChange

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherProject_PrepareStatusChange

Fields #

Name	Description
`Value` UInt32

Event ID 82: AliasTable_InitSDIDCache

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: AliasTable_InitSDIDCache

Event ID 83: WID_SDID_Cache_Initialize

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WID_SDID_Cache_Initialize

Fields #

Name	Description
`IsCompact` Boolean
`CacheCapacity` UInt32

Event ID 84: WID_SDID_Cache_Write

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WID_SDID_Cache_Write

Fields #

Name	Description
`MaxWID` UInt32
`SDID` UInt32
`IsCompact` Boolean
`CacheCapacity` UInt32

Event ID 85: WID_SDID_Cache_SwitchToFull

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WID_SDID_Cache_SwitchToFull

Fields #

Name	Description
`Value` UInt32

Event ID 86: Backoff_MemoryCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_MemoryCheck

Fields #

Name	Description
`MemAvail` UInt32
`MemTreshold` UInt32
`IsLow` Boolean

Event ID 87: Backoff_BatteryPolicyCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_BatteryPolicyCheck

Fields #

Name	Description
`ACLineStatus` UInt8
`BackOffOnBattery` Boolean
`IsBackOffNeeded` Boolean

Event ID 88: Backoff_BatteryCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_BatteryCheck

Fields #

Name	Description
`ACLineStatus` UInt8
`BatteryFlag` UInt8
`BatteryLifePercent` UInt8
`LowBatteryThreshold` UInt32
`IsLow` Boolean

Event ID 89: Backoff_LowDiskCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_LowDiskCheck

Fields #

Name	Description
`DiskAvail` Double
`LowDiskThreshold` UInt32
`IsLow` Boolean

Event ID 90: Backoff_UserActivityCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_UserActivityCheck

Fields #

Name	Description
`Interval` UInt32
`IsUserActive` Boolean

Event ID 91: Backoff_HighCPUCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_HighCPUCheck

Fields #

Name	Description
`Idle` Double
`MaxIdle` UInt32
`IsHigh` Boolean

Event ID 92: Backoff_HighIOCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_HighIOCheck

Fields #

Name	Description
`IORate` UInt32
`HighIOThreshold` UInt32
`IsHigh` Boolean

Event ID 93: Backoff_HighNotificationsCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_HighNotificationsCheck

Fields #

Name	Description
`NotificationRate` UInt32
`HighNotificationThreshold` UInt32
`IsHigh` Boolean

Event ID 94: Backoff_PendingNotificationsCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_PendingNotificationsCheck

Fields #

Name	Description
`PendingNotifications` UInt32
`NotificationsForceAtMost` UInt32
`NotificationsForced` Boolean

Event ID 95: Backoff_AllowNewItemsCheck

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_AllowNewItemsCheck

Fields #

Name	Description
`LastIndexNewItemReason` UInt32
`IndexNewItemReason` UInt32
`BackoffReason` UInt32

Event ID 96: Backoff_State

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Backoff_State

Fields #

Name	Description
`BackoffReason` UInt32
`IndexNewItemReason` UInt32
`AllReasons` UInt32
`FeatureDisabled` UInt32
`PowerSetting` UInt32
`BackoffRecoveryIsON` Boolean
`ProcessNotifications` Boolean
`BackOffOnPendingNotifications` Boolean
`PendingHiPriNotifications` UInt32
`BackOffOnPowerSetting` Boolean
`XPScreenSaverAndNoBattery` Boolean
`Merging` Boolean

Event ID 97: ProtocolHostObjConstructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostObjConstructor

Event ID 98: ProtocolHostObjInit

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostObjInit

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 99: ProtocolHostTerminating

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostTerminating

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 100: ProtocolHostStarted

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostStarted

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 101: ProtocolHostStopped

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostStopped

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 102: ProtocolHostKilled

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostKilled

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 103: ProtocolHostStoppedAlready

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostStoppedAlready

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 104: ProtocolHostTerminatingInDestructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostTerminatingInDestructor

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 105: ProtocolHostKilledInDestructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostKilledInDestructor

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 106: ProtocolHostStoppedInDestructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostStoppedInDestructor

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 107: ProtocolHostObjDestructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostObjDestructor

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString
`Architecture` UInt16

Event ID 108: ProtocolHostNameConflict_FailedToKill

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostNameConflict_FailedToKill

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString

Event ID 109: ProtocolHostNameConflict_Killed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostNameConflict_Killed

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString

Event ID 110: ProtocolHostNameConflict_Killing

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ProtocolHostNameConflict_Killing

Fields #

Name	Description
`ProcessID` UInt32
`SID` UnicodeString

Event ID 111: FilterHostStarting

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostStarting

Event ID 112: FilterHostStarted

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostStarted

Fields #

Name	Description
`Value` UInt32

Event ID 113: FilterHostStopping

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostStopping

Fields #

Name	Description
`Value` UInt32

Event ID 114: FilterHostHung

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostHung

Fields #

Name	Description
`Value` UInt32

Event ID 115: FilterHostStopped

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FilterHostStopped

Fields #

Name	Description
`Value` UInt32

Event ID 116: Startup_CSearchService_Init

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CSearchService_Init

Event ID 117: Startup_CDcomService_Init

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CDcomService_Init

Event ID 118: Startup_CDcomService_ServiceStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CDcomService_ServiceStart

Event ID 119: Startup_CDcomService_ServiceMain

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CDcomService_ServiceMain

Event ID 120: Startup_RecoverIfNecessary

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_RecoverIfNecessary

Event ID 121: Startup_RecoverDataFiles

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_RecoverDataFiles

Event ID 122: Startup_RecoverDataFiles_RemoveDir

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_RecoverDataFiles_RemoveDir

Fields #

Name	Description
`Path` UnicodeString

Event ID 123: Startup_MoveDataFiles

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_MoveDataFiles

Fields #

Name	Description
`OldPath` UnicodeString
`NewPath` UnicodeString

Event ID 124: Startup_MoveDataFiles_CopyDir

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_MoveDataFiles_CopyDir

Fields #

Name	Description
`OldPath` UnicodeString
`NewPath` UnicodeString

Event ID 125: Startup_MoveDataFiles_RemoveDir

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_MoveDataFiles_RemoveDir

Fields #

Name	Description
`Path` UnicodeString

Event ID 126: Startup_ReplaceDirectoryPrefixInValue

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_ReplaceDirectoryPrefixInValue

Fields #

Name	Description
`Value` UnicodeString
`OldPrefix` UnicodeString
`NewPrefix` UnicodeString

Event ID 127: Startup_SysPrepInProgress

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_SysPrepInProgress

Fields #

Name	Description
`Value` UInt32

Event ID 128: Startup_GuiSetupInProgress

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_GuiSetupInProgress

Fields #

Name	Description
`Value` UInt32

Event ID 129: Startup_CDcomService_IsIdleServiceMode

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CDcomService_IsIdleServiceMode

Fields #

Name	Description
`Value` UInt32

Event ID 130: Startup_CSearchService_Init2

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CSearchService_Init2

Fields #

Name	Description
`NoRun` Boolean
`SystemSetupOver` Boolean

Event ID 131: Startup_SetupWorkingDirectory

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_SetupWorkingDirectory

Event ID 132: Startup_SetupWorkingDirectory_RemovePath

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_SetupWorkingDirectory_RemovePath

Fields #

Name	Description
`Path` UnicodeString

Event ID 133: Startup_CheckAndCleanup

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CheckAndCleanup

Event ID 134: Startup_CSearchServiceObj_Initialize

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CSearchServiceObj_Initialize

Fields #

Name	Description
`Value` UInt32

Event ID 135: Startup_CGatherModule_Init

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CGatherModule_Init

Event ID 136: Startup_CGatheringService_InitStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CGatheringService_Init
Opcode: Start

Fields #

Name	Description
`NoRun` Boolean

Event ID 137: Startup_CGatheringService_InitStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_CGatheringService_Init
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 138: Startup_InitialIndexSetup

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_InitialIndexSetup

Event ID 139: Setup_DeletePreviousUsersSettingsKey

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_DeletePreviousUsersSettingsKey

Event ID 140: Setup_SetCompletedSuccessfully

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_SetCompletedSuccessfully

Fields #

Name	Description
`Value` UInt32

Event ID 141: Setup_Phase

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_Phase

Fields #

Name	Description
`Value` UInt32

Event ID 142: Setup_CatalogSetupSucceeded

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CatalogSetupSucceeded

Event ID 143: Setup_CatalogSetupFailed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CatalogSetupFailed

Fields #

Name	Description
`hr` UInt32
`Message` UnicodeString

Event ID 144: Setup_CleanupStarted

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CleanupStarted

Event ID 145: Setup_CleanupRemoveDir

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CleanupRemoveDir

Fields #

Name	Description
`Path` UnicodeString

Event ID 146: Setup_CleanupSucceeded

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CleanupSucceeded

Event ID 147: Setup_CleanupFailed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Setup_CleanupFailed

Fields #

Name	Description
`hr` UInt32

Event ID 148: Crawl_InitializeNew

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_InitializeNew

Fields #

Name	Description
`CrawlNo` UInt32
`CrawlType` UInt32
`FileName` UnicodeString
`IsCatalogLevel` Boolean

Event ID 149: Crawl_Initialize

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_Initialize

Fields #

Name	Description
`CrawlNo` UInt32

Event ID 150: Crawl_Initialize_Load

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_Initialize_Load

Fields #

Name	Description
`CrawlNo` UInt32
`CrawlType` UInt32
`FileName` UnicodeString
`IsCatalogLevel` Boolean

Event ID 151: Crawl_AddStartPage

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_AddStartPage

Fields #

Name	Description
`CrawlNo` UInt32
`StartPageName` UnicodeString
`StartPageRefID` UInt32

Event ID 152: Crawl_RemoveStartPage

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_RemoveStartPage

Fields #

Name	Description
`CrawlNo` UInt32
`StartPageName` UnicodeString
`StartPageRefID` UInt32
`CrawlIsInProgress` UInt32

Event ID 153: Crawl_IsDone

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Crawl_IsDone

Fields #

Name	Description
`CrawlNo` UInt32
`IsDone` Boolean

Event ID 154: Transactions_IterateHistoryStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_IterateHistory
Opcode: Start

Fields #

Name	Description
`CrawlNo` UInt32
`CrawlType` UInt32

Event ID 155: Transactions_IterateHistoryStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_IterateHistory
Opcode: Stop

Fields #

Name	Description
`CrawlNo` UInt32
`hr` UInt32

Event ID 156: Transactions_IterateHistory_Modify

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_IterateHistory_Modify

Fields #

Name	Description
`CrawlNo` UInt32
`URL` UnicodeString

Event ID 157: Transactions_IterateHistory_Delete

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_IterateHistory_Delete

Fields #

Name	Description
`CrawlNo` UInt32
`URL` UnicodeString

Event ID 158: Transactions_UpdateFailuresStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_UpdateFailures
Opcode: Start

Event ID 159: Transactions_UpdateFailuresStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Transactions_UpdateFailures
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 160: GatherLog_Transaction

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherLog_Transaction

Fields #

Name	Description
`hrCode` UInt32
`URL` UnicodeString
`TransactionType` UInt32
`StartAddressId` UInt32
`CrawlNo` UInt32
`DocId` UInt32
`hrTransactionError` UInt32
`Description` UnicodeString

Event ID 161: GatherLog_Crawl

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GatherLog_Crawl

Fields #

Name	Description
`hrCode` UInt32
`URL` UnicodeString
`TransactionType` UInt32
`StartAddressId` UInt32
`CrawlNo` UInt32
`DocId` UInt32
`hrTransactionError` UInt32
`Description` UnicodeString

Event ID 162: Gatherer_OnDataChangeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_OnDataChange
Opcode: Start

Fields #

Name	Description
`Resource` UInt64
`ChangeAdvice` UInt32

Event ID 163: Gatherer_OnDataChangeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_OnDataChange
Opcode: Stop

Fields #

Name	Description
`Resource` UInt64
`hr` UInt32

Event ID 164: Gatherer_OnDataChange

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_OnDataChange

Fields #

Name	Description
`Resource` UInt64
`TransactionURL` UnicodeString
`TransactionType` UInt32

Event ID 165: Gatherer_OnDataChange_Failed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_OnDataChange_Failed

Event ID 166: OnDataChange_Failed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: OnDataChange_Failed

Event ID 169: RobotThread_BeforeGetNewTransaction

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_BeforeGetNewTransaction

Event ID 170: RobotThread_ProcessNewTransaction

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_ProcessNewTransaction

Fields #

Name	Description
`ITrans` UInt64
`ResID` UInt32
`Status` UInt32	NTSTATUS reference
`Type` UInt32
`Flags` UInt32
`InternalFlags` UInt32
`CrawlNumber` UInt32
`CrawlType` UInt32
`Extra1` UInt32
`Extra2` UInt32
`Extra3` UInt32
`Path` UnicodeString

Event ID 171: RobotThread_FilterDriver_Init_Failed_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_FilterDriver_Init_Failed

Fields #

Name	Description
`ITrans` UInt64

Event ID 172: RobotThread_IsHistoryIterator_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_IsHistoryIterator

Fields #

Name	Description
`ITrans` UInt64

Event ID 173: RobotThread_IsWildcardTransaction_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_IsWildcardTransaction

Fields #

Name	Description
`ITrans` UInt64

Event ID 174: RobotThread_IsIteratorByStartAddress_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_IsIteratorByStartAddress

Fields #

Name	Description
`ITrans` UInt64

Event ID 175: RobotThread_IsHistoryIteratorUpdateFailures_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_IsHistoryIteratorUpdateFailures

Fields #

Name	Description
`ITrans` UInt64

Event ID 176: RobotThread_ProcessAnnotation_Failed_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_ProcessAnnotation_Failed

Fields #

Name	Description
`ITrans` UInt64
`hr` UInt32

Event ID 177: RobotThread_GetStandardProperties_Failed_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_GetStandardProperties_Failed

Fields #

Name	Description
`ITrans` UInt64
`hr` UInt32

Event ID 178: RobotThread_TransactionNotModified_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_TransactionNotModified

Fields #

Name	Description
`ITrans` UInt64

Event ID 179: RobotThread_CatalogResetRequested_V1

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_CatalogResetRequested

Fields #

Name	Description
`ITrans` UInt64

Event ID 180: CEnumSearchRoots_Constructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Constructor

Event ID 181: CEnumSearchRoots_Destructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Destructor

Event ID 182: CEnumSearchRoots_DestructorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Destructor
Opcode: Stop

Event ID 183: CEnumSearchRoots_Reset

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Reset

Event ID 184: CEnumSearchRoots_CloneStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Clone
Opcode: Start

Event ID 185: CEnumSearchRoots_CloneStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Clone
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 186: CEnumSearchRoots_NextStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Next
Opcode: Start

Fields #

Name	Description
`ElementCount` UInt32

Event ID 187: CEnumSearchRoots_NextStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Next
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`ElementCount` UInt32

Event ID 188: CEnumSearchRoots_Next_Fetch

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Next_Fetch

Fields #

Name	Description
`SearchRootURL` UnicodeString

Event ID 189: CEnumSearchRoots_SkipStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Skip
Opcode: Start

Event ID 190: CEnumSearchRoots_SkipStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchRoots_Skip
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 191: CEnumSearchScopeRules_Constructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Constructor

Event ID 192: CEnumSearchScopeRules_DestructorStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Destructor
Opcode: Start

Event ID 193: CEnumSearchScopeRules_DestructorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Destructor
Opcode: Stop

Event ID 194: CEnumSearchScopeRules_Reset

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Reset

Event ID 195: CEnumSearchScopeRules_CloneStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Clone
Opcode: Start

Event ID 196: CEnumSearchScopeRules_CloneStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Clone
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 197: CEnumSearchScopeRules_NextStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Next
Opcode: Start

Event ID 198: CEnumSearchScopeRules_NextStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Next
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 199: CEnumSearchScopeRules_Next_Fetch

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Next_Fetch

Fields #

Name	Description
`ScopeRuleURL` UnicodeString

Event ID 200: CEnumSearchScopeRules_SkipStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Skip
Opcode: Start

Event ID 201: CEnumSearchScopeRules_SkipStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CEnumSearchScopeRules_Skip
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 202: CSearchCrawlScopeManager_Constructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_Constructor

Event ID 203: CSearchCrawlScopeManager_Destructor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_Destructor

Event ID 204: CSearchCrawlScopeManager_IncludedInCrawlScopeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_IncludedInCrawlScope
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 205: CSearchCrawlScopeManager_IncludedInCrawlScopeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_IncludedInCrawlScope
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`IsIncluded` Boolean

Event ID 206: CSearchCrawlScopeManager_AddDefaultScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddDefaultScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString
`IsInclude` Boolean
`FollowFlags` UInt32

Event ID 207: CSearchCrawlScopeManager_AddDefaultScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddDefaultScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 208: CSearchCrawlScopeManager_AddHierarchicalScopeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddHierarchicalScope
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString
`IsInclude` Boolean
`IsDefault` Boolean
`OverrideChildren` Boolean

Event ID 209: CSearchCrawlScopeManager_AddHierarchicalScopeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddHierarchicalScope
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 210: CSearchCrawlScopeManager_AddRootStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddRoot
Opcode: Start

Fields #

Name	Description
`SearchRootURL` UnicodeString

Event ID 211: CSearchCrawlScopeManager_AddRootStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddRoot
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 212: CSearchCrawlScopeManager_AddUserScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddUserScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString
`IsInclude` Boolean
`OverrideChildren` Boolean
`FollowFlags` UInt32

Event ID 213: CSearchCrawlScopeManager_AddUserScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_AddUserScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 214: CSearchCrawlScopeManager_EnumerateRootsStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_EnumerateRoots
Opcode: Start

Event ID 215: CSearchCrawlScopeManager_EnumerateRootsStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_EnumerateRoots
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 216: CSearchCrawlScopeManager_EnumerateScopeRulesStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_EnumerateScopeRules
Opcode: Start

Event ID 217: CSearchCrawlScopeManager_EnumerateScopeRulesStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_EnumerateScopeRules
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 218: CSearchCrawlScopeManager_GetParentScopeVersionIdStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_GetParentScopeVersionId
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 219: CSearchCrawlScopeManager_GetParentScopeVersionIdStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_GetParentScopeVersionId
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`ScopeId` UInt32

Event ID 220: CSearchCrawlScopeManager_HasChildScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_HasChildScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 221: CSearchCrawlScopeManager_HasChildScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_HasChildScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`HasChildRule` Boolean

Event ID 222: CSearchCrawlScopeManager_HasParentScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_HasParentScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 223: CSearchCrawlScopeManager_HasParentScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_HasParentScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`HasParentRule` Boolean

Event ID 224: CSearchCrawlScopeManager_IncludedInCrawlScopeExStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_IncludedInCrawlScopeEx
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 225: CSearchCrawlScopeManager_IncludedInCrawlScopeExStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_IncludedInCrawlScopeEx
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`IsIncluded` Boolean
`Reason` UInt32

Event ID 226: CSearchCrawlScopeManager_RemoveDefaultScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveDefaultScopeRule
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 227: CSearchCrawlScopeManager_RemoveDefaultScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveDefaultScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 228: CSearchCrawlScopeManager_RemoveRootStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveRoot
Opcode: Start

Fields #

Name	Description
`SearchRootURL` UnicodeString

Event ID 229: CSearchCrawlScopeManager_RemoveRootStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveRoot
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 230: CSearchCrawlScopeManager_RemoveScopeRuleStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveScopeRule
Opcode: Start

Fields #

Name	Description
`ScopeRuleURL` UnicodeString

Event ID 231: CSearchCrawlScopeManager_RemoveScopeRuleStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RemoveScopeRule
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 232: CSearchCrawlScopeManager_RevertToDefaultScopesStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RevertToDefaultScopes
Opcode: Start

Event ID 233: CSearchCrawlScopeManager_RevertToDefaultScopesStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_RevertToDefaultScopes
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 234: CSearchCrawlScopeManager_SaveAllStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_SaveAll
Opcode: Start

Event ID 235: CSearchCrawlScopeManager_SaveAllStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchCrawlScopeManager_SaveAll
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 236: CSearchRoot_put_RootURL

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_RootURL

Fields #

Name	Description
`SearchRootURL` UnicodeString

Event ID 237: CSearchRoot_get_RootURL

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_RootURL

Fields #

Name	Description
`hr` UInt32
`SearchRootURL` UnicodeString

Event ID 238: CSearchRoot_get_AuthenticationType

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_AuthenticationType

Fields #

Name	Description
`hr` UInt32
`Value` UInt32

Event ID 239: CSearchRoot_get_EnumerationDepth

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_EnumerationDepth

Fields #

Name	Description
`hr` UInt32
`Value` UInt32

Event ID 240: CSearchRoot_get_FollowDirectories

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_FollowDirectories

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 241: CSearchRoot_get_HostDepth

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_HostDepth

Fields #

Name	Description
`hr` UInt32
`Value` UInt32

Event ID 242: CSearchRoot_get_IsHierarchical

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_IsHierarchical

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 243: CSearchRoot_get_ProvidesNotifications

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_ProvidesNotifications

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 244: CSearchRoot_get_Schedule

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_Schedule

Fields #

Name	Description
`hr` UInt32
`Value` UnicodeString

Event ID 245: CSearchRoot_get_UseNotificationsOnly

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_get_UseNotificationsOnly

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 246: CSearchRoot_put_AuthenticationType

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_AuthenticationType

Fields #

Name	Description
`Value` UInt32

Event ID 247: CSearchRoot_put_EnumerationDepth

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_EnumerationDepth

Fields #

Name	Description
`Value` UInt32

Event ID 248: CSearchRoot_put_FollowDirectories

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_FollowDirectories

Fields #

Name	Description
`Value` Boolean

Event ID 249: CSearchRoot_put_HostDepth

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_HostDepth

Fields #

Name	Description
`Value` UInt32

Event ID 250: CSearchRoot_put_IsHierarchical

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_IsHierarchical

Fields #

Name	Description
`Value` Boolean

Event ID 251: CSearchRoot_put_ProvidesNotifications

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_ProvidesNotifications

Fields #

Name	Description
`Value` Boolean

Event ID 252: CSearchRoot_put_Schedule

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_Schedule

Fields #

Name	Description
`Description` UnicodeString

Event ID 253: CSearchRoot_put_UseNotificationsOnly

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchRoot_put_UseNotificationsOnly

Fields #

Name	Description
`Value` Boolean

Event ID 254: CSearchScopeRule_get_IsDefault

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchScopeRule_get_IsDefault

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 255: CSearchScopeRule_get_IsIncluded

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchScopeRule_get_IsIncluded

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 256: CSearchScopeRule_get_PatternOrURL

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CSearchScopeRule_get_PatternOrURL

Fields #

Name	Description
`hr` UInt32
`Value` UnicodeString

Event ID 257: StatusChange_QueueLocked

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_QueueLocked

Fields #

Name	Description
`Value` UInt32

Event ID 258: StatusChange_QueueUnlocked

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: StatusChange_QueueUnlocked

Event ID 259: Gatherer_OnDataChange_Track_Url

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: Gatherer_OnDataChange_Track_Url
Opcode: win:Info

Fields #

Name	Description
`Resource` UInt64
`TransactionURL` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 259,
    "version": 0,
    "level": 4,
    "task": 209,
    "opcode": 0,
    "keywords": "0x0000000000000408",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Resource": 0,
    "TransactionURL": "file:C:/ProgramData/Microsoft/Windows/WER/Temp/"
  },
  "message": "Gatherer_OnDataChange_Track_Url"
}

Event ID 260: Gatherer_DocIdTable_GetNewId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_GetNewId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 261: Gatherer_DocIdTable_UndeleteId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_UndeleteId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 262: Gatherer_DocIdTable_DeleteId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_DeleteId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 263: Gatherer_DocIdTable_GetMaxId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_GetMaxId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 264: Gatherer_DocIdTable_SetMaxId

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_DocIdTable_SetMaxId

Fields #

Name	Description
`WorkId` UInt32
`hr` UInt32

Event ID 265: WID_SDID_Cache_NumberItems

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WID_SDID_Cache_NumberItems

Fields #

Name	Description
`NumWID` UInt32

Event ID 266: Gatherer_Queues_QueueLength

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gatherer_Queues_QueueLength

Fields #

Name	Description
`GathererCodeLocation` UInt32
`TransactionsInFile` UInt32
`TransactionsInMemory` UInt32
`TransactionQueueLength` UInt32
`TransactionsInFileNotifications` UInt32
`TransactionsInMemoryNotifications` UInt32
`TransactionQueueLengthNotifications` UInt32
`TransactionsHighLimit` UInt32
`TransactionsLowLimitPerCrawl` UInt32
`TransactionsHighLimitPerCrawl` UInt32
`TransactionsInIncrementalQueue` UInt32
`TransactionsInNotificationQueue` UInt32
`TansactionsInNotificationHighPriorityQueue` UInt32

Event ID 267: Startup_Search_Service_DurationStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_Search_Service_Duration
Opcode: Start

Event ID 268: Startup_Search_Service_DurationStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Startup_Search_Service_Duration
Opcode: Stop

Event ID 269: Shutdown_Search_Service_DurationStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Shutdown_Search_Service_Duration
Opcode: Start

Event ID 270: Shutdown_Search_Service_DurationStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Shutdown_Search_Service_Duration
Opcode: Stop

Event ID 271: ServerQueryRelease

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQueryRelease

Fields #

Name	Description
`Qid` UInt32

Event ID 272: CreatePhysCursorStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreatePhysCursor
Opcode: Start

Fields #

Name	Description
`ObjectWid` UInt32
`KeyPid` UInt32
`GroupPids` UnicodeString
`KeyStr` UnicodeString

Event ID 273: CreatePhysCursorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreatePhysCursor
Opcode: Stop

Fields #

Name	Description
`ObjectWid` UInt32

Event ID 274: CreatePhysCursorRangeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreatePhysCursorRange
Opcode: Start

Fields #

Name	Description
`ObjectWid` UInt32
`KeyStartPid` UInt32
`GroupPids` UnicodeString
`KeyEndStr` UnicodeString

Event ID 275: CreatePhysCursorRangeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreatePhysCursorRange
Opcode: Stop

Fields #

Name	Description
`ObjectWid` UInt32
`StackCount` UInt32

Event ID 276: MergeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Merge
Opcode: Start

Fields #

Name	Description
`ObjectWid` UInt32
`UseQueryPerfOpt` Boolean
`Restarted` Boolean
`IndexIds` UnicodeString
`TotalSizeInPages` UInt32
`MaxWid` UInt32

Event ID 277: MergeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Merge
Opcode: Stop

Fields #

Name	Description
`ObjectWid` UInt32

Event ID 278: CreateWLCursorStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWLCursor
Opcode: Start

Fields #

Name	Description
`WordListId` UInt64
`KeyTargetPid` UInt32
`KeyTargetStr` UnicodeString

Event ID 279: CreateWLCursorStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWLCursor
Opcode: Stop

Fields #

Name	Description
`WordListId` UInt64

Event ID 280: CreateWLCursorRangeStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWLCursorRange
Opcode: Start

Fields #

Name	Description
`WordListId` UInt64
`KeyStartPid` UInt32
`GroupPids` UnicodeString
`KeyEndStr` UnicodeString

Event ID 281: CreateWLCursorRangeStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWLCursorRange
Opcode: Stop

Fields #

Name	Description
`WordListId` UInt64
`StackCount` UInt32

Event ID 282: ServerQueryStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery
Opcode: Start

Fields #

Name	Description
`Qid` UInt32

Event ID 283: ServerQuery_Send

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_Send

Fields #

Name	Description
`Qid` UInt32
`BytesSent` UInt32
`MessageId` Int32

Event ID 284: ServerQuery_Received

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_Received

Fields #

Name	Description
`Qid` UInt32
`BytesReceived` UInt32
`MessageId` Int32

Event ID 285: ClientQuery_Send

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery_Send

Fields #

Name	Description
`BytesSent` UInt32
`MessageId` Int32

Event ID 286: ClientQuery_Received

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery_Received

Fields #

Name	Description
`BytesReceived` UInt32
`MessageId` Int32

Event ID 287: ServerQueryStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery
Opcode: Stop

Fields #

Name	Description
`Qid` UInt32

Event ID 288: ServerQuery_Create

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_Create

Fields #

Name	Description
`Qid` UInt32

Event ID 289: ClientStartFetch

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientStartFetch

Fields #

Name	Description
`Rowset` UInt64
`Chapter` UInt64
`RowsRequested` Int64
`RowSeekMethod` Int32
`RowsToSkip` Int64
`RowOffset` Int32
`Bookmark` UInt32
`Bookmarks` UnicodeString
`Numerator` UInt32
`Denominator` UInt32

Event ID 290: ClientFetched

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientFetched

Fields #

Name	Description
`Rowset` UInt64
`RowsReturned` Int64
`ErrorCode` UInt32

Event ID 291: ServerGetRowsStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerGetRows
Opcode: Start

Fields #

Name	Description
`Qid` UInt32
`WidStart` UInt32
`Chapter` UInt32
`Depth` UInt32
`RowOffset` Int64
`RequestedRows` UInt32

Event ID 292: ServerGetRowsStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerGetRows
Opcode: Stop

Fields #

Name	Description
`Qid` UInt32
`RowsTransferred` UInt32
`ErrorCode` UInt32

Event ID 293: RobotThread_LangAutoDetection_Start

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Start
Opcode: Start

Fields #

Name	Description
`fmtid` GUID
`pid` UInt32
`TextPrefix` UnicodeString
`TextLength` UInt32

Event ID 294: RobotThread_LangAutoDetection_Stop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Stop
Opcode: Stop

Fields #

Name	Description
`LocaleID` UInt32

Event ID 295: RobotThread_LangAutoDetection_Succeed

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Succeed

Fields #

Name	Description
`LocaleName` UnicodeString

Event ID 296: RobotThread_LangAutoDetection_Fail

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Fail

Fields #

Name	Description
`hr` UInt32

Event ID 297: Service_Status_NotifyStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Service_Status_Notify
Opcode: Start

Fields #

Name	Description
`Value` UInt32

Event ID 298: Service_Status_NotifyStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Service_Status_Notify
Opcode: Stop

Fields #

Name	Description
`Value` UInt32

Event ID 300: ServerQuery_ForcePublishStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_ForcePublish
Opcode: Start

Fields #

Name	Description
`Qid` UInt32

Event ID 301: ServerQuery_ForcePublishStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_ForcePublish
Opcode: Stop

Fields #

Name	Description
`Qid` UInt32

Event ID 302: Wordlist_PublishStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_Publish
Opcode: Start

Fields #

Name	Description
`CBID` UInt64
`DocCount` UInt32
`BytesAvailable` UInt64

Event ID 303: Wordlist_PublishStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_Publish
Opcode: Stop

Fields #

Name	Description
`CBID` UInt64

Event ID 304: Flush_Schedule

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Flush_Schedule

Fields #

Name	Description
`Scheduled` Boolean
`Reason` UInt32

Event ID 305: CBPool_ForceFlush

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CBPool_ForceFlush

Fields #

Name	Description
`AvailableCBCount` UInt32
`DirtyCBCount` UInt32
`InUseCBCount` UInt32
`PublishedCBCount` UInt32

Event ID 306: DocAborted_ForcePublish

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: DocAborted_ForcePublish

Fields #

Name	Description
`DocID` UInt32

Event ID 307: DocAborted_CBOverflow

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: DocAborted_CBOverflow

Fields #

Name	Description
`DocID` UInt32

Event ID 308: Wordlist_BeginResourceFailed_CBOverflow

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_BeginResourceFailed_CBOverflow

Fields #

Name	Description
`DocID` UInt32
`BytesAvailable` UInt32

Event ID 309: Wordlist_BeginResourceFailed_DocInError

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_BeginResourceFailed_DocInError

Fields #

Name	Description
`DocID` UInt32

Event ID 310: Wordlist_BeginResource_InvalidatedPreviousDoc

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Wordlist_BeginResource_InvalidatedPreviousDoc

Fields #

Name	Description
`DocID` UInt32
`CBID` UInt64

Event ID 311: ClientQuery_Rowset_Reuse

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ClientQuery_Rowset_Reuse

Fields #

Name	Description
`Value` UInt32

Event ID 312: ServerQuery_DeferredProperty

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ServerQuery_DeferredProperty

Fields #

Name	Description
`DocID` UInt32
`PropID` UInt32

Event ID 313: ScopeManager_Init

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeManager_Init

Fields #

Name	Description
`IsCompact` Boolean
`CacheCapacity` UInt32

Event ID 314: ScopeManager_Retrieved

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeManager_Retrieved

Fields #

Name	Description
`NumWID` UInt32

Event ID 315: ScopeManager_SwitchToFull

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeManager_SwitchToFull

Fields #

Name	Description
`Value` UInt32

Event ID 316: ScopeManager_Write

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeManager_Write

Fields #

Name	Description
`MaxWID` UInt32
`Scope` UInt32
`IsCompact` Boolean
`CacheCapacity` UInt32

Event ID 317: Prioritization_Request

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Prioritization_Request

Fields #

Name	Description
`RequestID` UInt64
`Priority` UInt32
`Indexed` UInt32
`OutstandingAdds` UInt32
`OutstandingModifies` UInt32

Event ID 318: Prioritization_Complete

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Prioritization_Complete

Fields #

Name	Description
`RequestID` UInt64
`Priority` UInt32
`Indexed` UInt32
`OutstandingAdds` UInt32
`OutstandingModifies` UInt32

Event ID 319: Prioritization_Statistics

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Prioritization_Statistics

Fields #

Name	Description
`RequestID` UInt64
`Priority` UInt32
`Indexed` UInt32
`OutstandingAdds` UInt32
`OutstandingModifies` UInt32

Event ID 320: JET_IO_Low_Priority_Change

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: JET_IO_Low_Priority_Change

Fields #

Name	Description
`hr` UInt32
`Value` Boolean

Event ID 321: Gather_Transaction_Failure_Code

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: Gather_Transaction_Failure_Code

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`URL` UnicodeString
`DocID` UInt32
`hr` UInt32
`Passes` UInt32

Event ID 322: ETWLogging

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ETWLogging
Opcode: win:Info

Fields #

Name	Description
`Info` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 322,
    "version": 0,
    "level": 4,
    "task": 258,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Info": "ProcessDataChange_Internal for {, flags: 0, flags_e 0"
  },
  "message": "ETWLogging"
}

Event ID 323: ETWLoggingFailure

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ETWLoggingFailure

Fields #

Name	Description
`Hr` UInt32
`Info` UnicodeString

Event ID 324: ETWLoggingItem

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ETWLoggingItem

Fields #

Name	Description
`DocID` UInt32
`URL` UnicodeString
`Info` UnicodeString

Event ID 325: ETWLoggingItemFailure

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ETWLoggingItemFailure

Fields #

Name	Description
`Hr` UInt32
`DocID` UInt32
`URL` UnicodeString
`Info` UnicodeString

Event ID 326: USN_Notify_Journal_Wrap

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: USN_Notify_Journal_Wrap

Fields #

Name	Description
`Volume` UnicodeString
`DesiredPosition` Int64
`CurrentPosition` Int64
`hr` UInt32

Event ID 327: GathererRecoverStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GathererRecover
Opcode: Start

Event ID 328: GathererRecoverStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GathererRecover
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 329: ValueIndexCreationStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexCreation
Opcode: Start

Fields #

Name	Description
`Locale` UInt32
`IdxName` AnsiString
`IsShadow` Boolean
`ColumnType` UInt64

Event ID 330: ValueIndexCreationStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexCreation
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32
`IdxName` AnsiString
`IsShadow` Boolean
`ErrorCode` UInt32

Event ID 331: ValueIndexSeekStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexSeek
Opcode: Start

Fields #

Name	Description
`SeekType` UnicodeString
`ColumnType` UInt32

Event ID 332: ValueIndexSeekStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexSeek
Opcode: Stop

Fields #

Name	Description
`SeekType` UnicodeString
`Result` UInt32

Event ID 333: ValueIndexSeekStart333

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexSeek
Opcode: Start

Fields #

Name	Description
`HasStartVariant` Boolean
`HasEndVariant` Boolean
`ExcludeStartVariant` Boolean
`ExcludeEndVariant` Boolean

Event ID 334: ValueIndexSeekStop334

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ValueIndexSeek
Opcode: Stop

Fields #

Name	Description
`RangeSet` UInt32

Event ID 335: FreeCursor

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FreeCursor

Fields #

Name	Description
`Qid` UInt32
`Cursor` UInt32

Event ID 336: ReuseRestriction

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReuseRestriction

Fields #

Name	Description
`WhereID` UInt32

Event ID 337: GetQueryStatusExStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GetQueryStatusEx
Opcode: Start

Fields #

Name	Description
`Qid` UInt32

Event ID 338: GetQueryStatusExStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GetQueryStatusEx
Opcode: Stop

Fields #

Name	Description
`Qid` UInt32

Event ID 339: CreateWordBreakerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWordBreaker
Opcode: Start

Fields #

Name	Description
`Locale` UInt32

Event ID 340: CreateWordBreakerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateWordBreaker
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32

Event ID 341: ReleaseWordBreakerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReleaseWordBreaker
Opcode: Start

Fields #

Name	Description
`Locale` UInt32

Event ID 342: ReleaseWordBreakerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReleaseWordBreaker
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32

Event ID 343: CreateStemmerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateStemmer
Opcode: Start

Fields #

Name	Description
`Locale` UInt32

Event ID 344: CreateStemmerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateStemmer
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32

Event ID 345: ReleaseStemmerStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReleaseStemmer
Opcode: Start

Fields #

Name	Description
`Locale` UInt32

Event ID 346: ReleaseStemmerStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ReleaseStemmer
Opcode: Stop

Fields #

Name	Description
`Locale` UInt32

Event ID 347: CreateCatalog

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: CreateCatalog

Fields #

Name	Description
`hr` UInt32
`Message` UnicodeString

Event ID 348: DeleteCatalog

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: DeleteCatalog

Fields #

Name	Description
`hr` UInt32
`Message` UnicodeString

Event ID 349: RobotThread_GetWordBreaker

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_GetWordBreaker

Fields #

Name	Description
`fmtid` GUID
`pid` UInt32
`LocaleID` UInt32
`LocaleSource` UInt32

Event ID 350: GetWordBreaker

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: GetWordBreaker

Fields #

Name	Description
`Locale` UInt32

Event ID 351: WordBreakerSelector_IncrementHistory

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerSelector_IncrementHistory

Fields #

Name	Description
`LocaleID` UInt32
`IncrementCallID` UInt32

Event ID 352: WordBreakerSelector_SubstituteLocale

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerSelector_SubstituteLocale

Fields #

Name	Description
`LocaleOriginal` UInt32
`LocaleSubstitute` UInt32

Event ID 353: WordBreakerSelector_Fallback

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerSelector_Fallback

Fields #

Name	Description
`LocaleID` UInt32

Event ID 354: WordBreakerHistory_Save

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerHistory_Save

Fields #

Name	Description
`Data` AnsiString

Event ID 355: WordBreakerHistory_Load

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: WordBreakerHistory_Load

Fields #

Name	Description
`Data` AnsiString

Event ID 356: RobotThread_LangAutoDetection_Scores

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: RobotThread_LangAutoDetection_Scores

Fields #

Name	Description
`TextLength` UInt32
`TopLCID` UInt32
`TopScore` UInt32
`SecondLCID` UInt32
`SecondScore` UInt32

Event ID 357: FileChangeTracker_APICallStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Start

Event ID 358: FileChangeTracker_APICallStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 359: FileChangeTracker_APICallStart359

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Start

Event ID 360: FileChangeTracker_APICallStop360

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 361: FileChangeTracker_APICallStart361

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Start

Event ID 362: FileChangeTracker_APICallStop362

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: FileChangeTracker_APICall
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 363: FileChangeTracker_ProcessUSN

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Level: Informational
Task: FileChangeTracker_ProcessUSN
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 363,
    "version": 0,
    "level": 4,
    "task": 284,
    "opcode": 1,
    "keywords": "0x0000000000000410",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "FileChangeTracker_ProcessUSN"
}

Event ID 364: FileChangeTracker_ProcessUSN

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Level: Informational
Task: FileChangeTracker_ProcessUSN
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search-Core",
    "guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
    "event_source_name": "",
    "event_id": 364,
    "version": 0,
    "level": 4,
    "task": 284,
    "opcode": 2,
    "keywords": "0x0000000000000410",
    "time_created": "2026-06-02T06:02:17.234+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6624,
      "thread_id": 6772
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "FileChangeTracker_ProcessUSN"
}

Event ID 365: ScopeChangeNotification_OnChanged

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_OnChanged

Fields #

Name	Description
`ScopeId` UInt32
`EventId` GUID
`PackageFamilyName` UnicodeString
`Path` UnicodeString
`Result` UInt32
`SuccessEvent` Boolean

Event ID 366: ScopeChangeNotification_OnChanged366

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_OnChanged

Fields #

Name	Description
`ScopeId` UInt32

Event ID 367: ScopeChangeNotification_RegisterStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_Register
Opcode: Start

Fields #

Name	Description
`UserSid` UnicodeString
`PackageFamilyName` UnicodeString
`EventId` GUID
`Count` UInt32
`Paths` UnicodeString

Event ID 368: ScopeChangeNotification_RegisterStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_Register
Opcode: Stop

Event ID 369: ScopeChangeNotification_UnregisterStart

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_Unregister
Opcode: Start

Fields #

Name	Description
`UserSid` UnicodeString
`PackageFamilyName` UnicodeString
`EventId` GUID

Event ID 370: ScopeChangeNotification_UnregisterStop

Provider: Microsoft-Windows-Search-Core
Channel: Diagnostic
Task: ScopeChangeNotification_Unregister
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}

Defined in SearchIndexer.exe, which carries the event manifest.

Observed on:

Win11-26200.6584, sample captured from a live trace, binary version 7.0.26100.4946, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 7.0.20348.2849, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 7.0.26100.4946, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)