Microsoft-Windows-Search-Core
Event ID 1: CrawlStart
#Event ID 2: CrawlStop
#Event ID 3: IncCrawlStart
#Event ID 4: IncCrawlStop
#Event ID 5: BackOff_MemStart
#Event ID 6: BackOff_MemStop
#Event ID 7: BackOff_BatStart
#Event ID 8: BackOff_BatStop
#Event ID 9: BackOff_ActStart
#Event ID 10: BackOff_ActStop
#Event ID 11: BackOff_IORStart
#Event ID 12: BackOff_IORStop
#Event ID 13: BackOff_NtfStart
#Event ID 14: BackOff_NtfStop
#Event ID 15: BackOff_CPUStart
#Event ID 16: BackOff_CPUStop
#Event ID 17: Index_FileStart
#Fields #
| Name | Description |
|---|---|
Description UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 17,
"version": 0,
"level": 4,
"task": 9,
"opcode": 1,
"keywords": "0x8000000000004009",
"time_created": "2026-07-19T03:44:19.854545100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5844,
"thread_id": 13216
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Description": "C:\\Users\\Public\\catalog-sample.txt"
},
"message": ""
}
Event ID 18: Index_FileStop_V1
#Fields #
| Name | Description |
|---|---|
UsesFilter Boolean | |
UsesPropertyHandler Boolean |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 18,
"version": 1,
"level": 4,
"task": 9,
"opcode": 2,
"keywords": "0x8000000000004009",
"time_created": "2026-07-19T03:44:20.236166800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5844,
"thread_id": 13216
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"UsesFilter": "true",
"UsesPropertyHandler": "true"
},
"message": ""
}
Event ID 19: USN_Notify
#Fields #
| Name | Description |
|---|---|
Reason UInt32 | |
Path UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
"event_source_name": "",
"event_id": 19,
"version": 0,
"level": 4,
"task": 10,
"opcode": 0,
"keywords": "0x0000000000200008",
"time_created": "2026-06-02T06:02:17.234+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 6624,
"thread_id": 6772
},
"channel": "ETW Trace",
"computer": "DESKTOP-FF3N5XK",
"security": {
"user_id": ""
}
},
"event_data": {
"Path": "file attr: 0x00002010 C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\",
"Reason": 2147485696
},
"message": "USN_Notify"
}
Event ID 22: Catalog_MonitorStart
#Event ID 23: Catalog_MonitorStop
#Event ID 25: Index_MergeStop
#Event ID 27: Index_CommitStop
#Event ID 28: MapiEmailItemStart
#Event ID 29: MapiEmailItemStop
#Event ID 30: CSCDocumentStart
#Event ID 31: CSCDocumentStop
#Event ID 33: RetrieveValueStop
#Event ID 34: MapiOpenMessageStart
#Event ID 35: MapiOpenMessageStop
#Event ID 36: MapiGetAttachmentFromMessageStart
#Event ID 37: MapiGetAttachmentFromMessageStop
#Event ID 38: MapiEnumerateAttachmentsStart
#Event ID 39: MapiEnumerateAttachmentsStop
#Event ID 40: MapiGetMapiFpsPropValsStop
#Event ID 41: MapiGetMapiFpsPropValsStop41
#Event ID 42: IndexItemInit
#Fields #
| Name | Description |
|---|---|
ITrans UInt64 | |
ResID UInt32 | |
Status UInt32 | NTSTATUS reference |
Type UInt32 | |
Flags UInt32 | |
InternalFlags UInt32 | |
CrawlNumber UInt32 | |
CrawlType UInt32 | |
Extra1 UInt32 | |
Extra2 UInt32 | |
Extra3 UInt32 | |
Path UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 42,
"version": 0,
"level": 4,
"task": 22,
"opcode": 0,
"keywords": "0x8000000000000408",
"time_created": "2026-07-19T03:44:19.753566400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ITrans": "0x19A61AF9A50",
"ResID": "0xFFFFFFFF",
"Status": "0x8",
"Type": "0x0",
"Flags": "0x21008064",
"InternalFlags": "0x0",
"CrawlNumber": "0xFFFFFFFF",
"CrawlType": "0x0",
"Extra1": "0x24",
"Extra2": "0x2",
"Extra3": "0x0",
"Path": "file:C:/Users/Public/catalog-sample.txt"
},
"message": ""
}
Event ID 43: IndexItemSetStatus
#Fields #
| Name | Description |
|---|---|
ITrans UInt64 | |
ResID UInt32 | |
Status UInt32 | NTSTATUS reference |
Type UInt32 | |
Flags UInt32 | |
InternalFlags UInt32 | |
CrawlNumber UInt32 | |
CrawlType UInt32 | |
Extra1 UInt32 | |
Extra2 UInt32 | |
Extra3 UInt32 | |
Path UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 43,
"version": 0,
"level": 4,
"task": 23,
"opcode": 0,
"keywords": "0x8000000000000408",
"time_created": "2026-07-19T03:44:19.753616400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ITrans": "0x19A61AF9A50",
"ResID": "0x23B5",
"Status": "0x0",
"Type": "0x0",
"Flags": "0x21008064",
"InternalFlags": "0x0",
"CrawlNumber": "0xFFFFFFFF",
"CrawlType": "0x0",
"Extra1": "0x0",
"Extra2": "0x47544852",
"Extra3": "0x0",
"Path": "file:C:/Users/Public/catalog-sample.txt"
},
"message": ""
}
Event ID 46: IndexItemDataComplete
#Fields #
| Name | Description |
|---|---|
ITrans UInt64 | |
ResID UInt32 | |
Status UInt32 | NTSTATUS reference |
Type UInt32 | |
Flags UInt32 | |
InternalFlags UInt32 | |
CrawlNumber UInt32 | |
CrawlType UInt32 | |
Extra1 UInt32 | |
Extra2 UInt32 | |
Extra3 UInt32 | |
Path UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 46,
"version": 0,
"level": 4,
"task": 25,
"opcode": 0,
"keywords": "0x8000000000000408",
"time_created": "2026-07-19T03:44:20.240363100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ITrans": "0x19A61AF9A50",
"ResID": "0x23B5",
"Status": "0x4",
"Type": "0x0",
"Flags": "0x21008065",
"InternalFlags": "0x9005",
"CrawlNumber": "0xFFFFFFFF",
"CrawlType": "0x0",
"Extra1": "0x0",
"Extra2": "0x0",
"Extra3": "0x0",
"Path": "file:C:/Users/Public/catalog-sample.txt"
},
"message": ""
}
Event ID 51: ClientQueryStop_V1
#Fields #
| Name | Description |
|---|---|
QueryText UnicodeString | |
ErrorCode UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 51,
"version": 1,
"level": 4,
"task": 29,
"opcode": 2,
"keywords": "0x8000000000000021",
"time_created": "2026-07-19T04:22:48.768103800+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "BF440000-0BF1-0007-FA2B-4DBFF10BDD01"
},
"execution": {
"process_id": 11384,
"thread_id": 1932
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"QueryText": "SELECT TOP 50 System.ItemName, System.Size FROM SystemIndex WHERE CONTAINS('catalog')",
"ErrorCode": "0x0"
},
"message": ""
}
Event ID 52: IndexItemEnd
#Fields #
| Name | Description |
|---|---|
ITrans UInt64 | |
ResID UInt32 | |
Status UInt32 | NTSTATUS reference |
Type UInt32 | |
Flags UInt32 | |
InternalFlags UInt32 | |
CrawlNumber UInt32 | |
CrawlType UInt32 | |
Extra1 UInt32 | |
Extra2 UInt32 | |
Extra3 UInt32 | |
Path UnicodeString |
Event ID 56: IndexItemPushToFile
#Fields #
| Name | Description |
|---|---|
ITrans UInt64 | |
ResID UInt32 | |
Status UInt32 | NTSTATUS reference |
Type UInt32 | |
Flags UInt32 | |
InternalFlags UInt32 | |
CrawlNumber UInt32 | |
CrawlType UInt32 | |
Extra1 UInt32 | |
Extra2 UInt32 | |
Extra3 UInt32 | |
Path UnicodeString |
Event ID 57: ClientGetNextRows
#Fields #
| Name | Description |
|---|---|
Rowset UInt64 | |
Chapter UInt64 | |
RowsToSkip Int64 | |
RowsRequested Int64 | |
RowsReturned UInt64 |
Event ID 59: BackoffThreadWaitStart
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 59,
"version": 0,
"level": 4,
"task": 36,
"opcode": 1,
"keywords": "0x8000000000400001",
"time_created": "2026-07-19T03:44:19.833776100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5844,
"thread_id": 13216
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Value": "60000"
},
"message": ""
}
Event ID 60: BackoffThreadWaitStop
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 60,
"version": 0,
"level": 4,
"task": 36,
"opcode": 2,
"keywords": "0x8000000000400001",
"time_created": "2026-07-19T03:44:19.833816400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5844,
"thread_id": 13216
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Value": "0"
},
"message": ""
}
Event ID 63: ServiceStatusUpdate
#Fields #
| Name | Description |
|---|---|
WaitHint UInt32 | |
State UInt32 | |
CheckPoint UInt32 |
Event ID 66: SearchProtocolHostStart
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 66,
"version": 0,
"level": 4,
"task": 41,
"opcode": 1,
"keywords": "0x8000000000004000",
"time_created": "2026-07-19T03:44:19.819389800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5844,
"thread_id": 1768
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Value": "5844"
},
"message": ""
}
Event ID 67: SearchProtocolHostStop
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 67,
"version": 0,
"level": 4,
"task": 41,
"opcode": 2,
"keywords": "0x8000000000004000",
"time_created": "2026-07-19T03:44:24.379610000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 11384,
"thread_id": 9468
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Value": "11384"
},
"message": ""
}
Event ID 68: SearchFilterHostStart
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 68,
"version": 0,
"level": 4,
"task": 42,
"opcode": 1,
"keywords": "0x8000000000008000",
"time_created": "2026-07-19T03:44:19.914567500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 9632,
"thread_id": 14064
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Value": "9632"
},
"message": ""
}
Event ID 72: StatusThreadStart
#Event ID 73: StatusThreadStop
#Event ID 77: Gatherer_AdviseStatus
#Fields #
| Name | Description |
|---|---|
Status UInt32 | NTSTATUS reference |
hrReason UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 77,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 13000,
"thread_id": 12280
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Search-Core",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:12:44.066Z",
"version": 0
},
"event_data": {
"Status": 20,
"hrReason": 0
},
"message": ""
}
Event ID 78: Gatherer_RequestStatusChange
#Fields #
| Name | Description |
|---|---|
Status UInt32 | NTSTATUS reference |
hrReason UInt32 |
Event ID 79: GatherProject_AdviseStatusChange_V1
#Fields #
| Name | Description |
|---|---|
ProjectPtr UInt64 | |
Status UInt32 | NTSTATUS reference |
hrReason UInt32 |
Event ID 82: AliasTable_InitSDIDCache
#Event ID 84: WID_SDID_Cache_Write
#Fields #
| Name | Description |
|---|---|
MaxWID UInt32 | |
SDID UInt32 | |
IsCompact Boolean | |
CacheCapacity UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 84,
"version": 0,
"level": 4,
"task": 57,
"opcode": 0,
"keywords": "0x8000000000000408",
"time_created": "2026-07-19T03:44:20.239565600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"MaxWID": "9141",
"SDID": "507",
"IsCompact": "true",
"CacheCapacity": "222208"
},
"message": ""
}
Event ID 86: Backoff_MemoryCheck
#Fields #
| Name | Description |
|---|---|
MemAvail UInt32 | |
MemTreshold UInt32 | |
IsLow Boolean |
Event ID 87: Backoff_BatteryPolicyCheck
#Fields #
| Name | Description |
|---|---|
ACLineStatus UInt8 | |
BackOffOnBattery Boolean | |
IsBackOffNeeded Boolean |
Event ID 88: Backoff_BatteryCheck
#Fields #
| Name | Description |
|---|---|
ACLineStatus UInt8 | |
BatteryFlag UInt8 | |
BatteryLifePercent UInt8 | |
LowBatteryThreshold UInt32 | |
IsLow Boolean |
Event ID 89: Backoff_LowDiskCheck
#Fields #
| Name | Description |
|---|---|
DiskAvail Double | |
LowDiskThreshold UInt32 | |
IsLow Boolean |
Event ID 92: Backoff_HighIOCheck
#Fields #
| Name | Description |
|---|---|
IORate UInt32 | |
HighIOThreshold UInt32 | |
IsHigh Boolean |
Event ID 93: Backoff_HighNotificationsCheck
#Fields #
| Name | Description |
|---|---|
NotificationRate UInt32 | |
HighNotificationThreshold UInt32 | |
IsHigh Boolean |
Event ID 94: Backoff_PendingNotificationsCheck
#Fields #
| Name | Description |
|---|---|
PendingNotifications UInt32 | |
NotificationsForceAtMost UInt32 | |
NotificationsForced Boolean |
Event ID 95: Backoff_AllowNewItemsCheck
#Fields #
| Name | Description |
|---|---|
LastIndexNewItemReason UInt32 | |
IndexNewItemReason UInt32 | |
BackoffReason UInt32 |
Event ID 96: Backoff_State
#Fields #
| Name | Description |
|---|---|
BackoffReason UInt32 | |
IndexNewItemReason UInt32 | |
AllReasons UInt32 | |
FeatureDisabled UInt32 | |
PowerSetting UInt32 | |
BackoffRecoveryIsON Boolean | |
ProcessNotifications Boolean | |
BackOffOnPendingNotifications Boolean | |
PendingHiPriNotifications UInt32 | |
BackOffOnPowerSetting Boolean | |
XPScreenSaverAndNoBattery Boolean | |
Merging Boolean |
Event ID 97: ProtocolHostObjConstructor
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 97,
"version": 0,
"level": 4,
"task": 190,
"opcode": 0,
"keywords": "0x8000000000000200",
"time_created": "2026-07-19T03:44:19.753887800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 98: ProtocolHostObjInit
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString | |
Architecture UInt16 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 98,
"version": 0,
"level": 4,
"task": 191,
"opcode": 0,
"keywords": "0x8000000000000200",
"time_created": "2026-07-19T03:44:19.753924200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ProcessID": "0",
"SID": "",
"Architecture": "34404"
},
"message": ""
}
Event ID 99: ProtocolHostTerminating
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString | |
Architecture UInt16 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 99,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 13000,
"thread_id": 12280
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Search-Core",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 05:24:42.373Z",
"version": 0
},
"event_data": {
"Architecture": 34404,
"ProcessID": 13076,
"SID": ""
},
"message": ""
}
Event ID 100: ProtocolHostStarted
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString | |
Architecture UInt16 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 100,
"version": 0,
"level": 4,
"task": 192,
"opcode": 0,
"keywords": "0x8000000000000200",
"time_created": "2026-07-19T03:44:19.769032700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ProcessID": "5844",
"SID": "",
"Architecture": "34404"
},
"message": ""
}
Event ID 103: ProtocolHostStoppedAlready
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString | |
Architecture UInt16 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 103,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 13000,
"thread_id": 12280
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Search-Core",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 05:24:42.374Z",
"version": 0
},
"event_data": {
"Architecture": 34404,
"ProcessID": 13076,
"SID": ""
},
"message": ""
}
Event ID 104: ProtocolHostTerminatingInDestructor
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString | |
Architecture UInt16 |
Event ID 105: ProtocolHostKilledInDestructor
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString | |
Architecture UInt16 |
Event ID 106: ProtocolHostStoppedInDestructor
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString | |
Architecture UInt16 |
Event ID 107: ProtocolHostObjDestructor
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString | |
Architecture UInt16 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 107,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 13000,
"thread_id": 12280
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Search-Core",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 05:24:42.374Z",
"version": 0
},
"event_data": {
"Architecture": 34404,
"ProcessID": 13076,
"SID": ""
},
"message": ""
}
Event ID 108: ProtocolHostNameConflict_FailedToKill
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString |
Event ID 109: ProtocolHostNameConflict_Killed
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString |
Event ID 110: ProtocolHostNameConflict_Killing
#Fields #
| Name | Description |
|---|---|
ProcessID UInt32 | |
SID UnicodeString |
Event ID 111: FilterHostStarting
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 111,
"version": 0,
"level": 4,
"task": 202,
"opcode": 0,
"keywords": "0x8000000000000200",
"time_created": "2026-07-19T03:44:19.854671900+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "C036E91C-E183-4F5C-9B71-339BE05FC40E"
},
"execution": {
"process_id": 4232,
"thread_id": 12692
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 112: FilterHostStarted
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 112,
"version": 0,
"level": 4,
"task": 203,
"opcode": 0,
"keywords": "0x8000000000000200",
"time_created": "2026-07-19T03:44:19.867164000+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "C036E91C-E183-4F5C-9B71-339BE05FC40E"
},
"execution": {
"process_id": 4232,
"thread_id": 12692
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Value": "9632"
},
"message": ""
}
Event ID 116: Startup_CSearchService_Init
#Event ID 117: Startup_CDcomService_Init
#Event ID 118: Startup_CDcomService_ServiceStart
#Event ID 119: Startup_CDcomService_ServiceMain
#Event ID 120: Startup_RecoverIfNecessary
#Event ID 121: Startup_RecoverDataFiles
#Event ID 123: Startup_MoveDataFiles
#Fields #
| Name | Description |
|---|---|
OldPath UnicodeString | |
NewPath UnicodeString |
Event ID 124: Startup_MoveDataFiles_CopyDir
#Fields #
| Name | Description |
|---|---|
OldPath UnicodeString | |
NewPath UnicodeString |
Event ID 126: Startup_ReplaceDirectoryPrefixInValue
#Fields #
| Name | Description |
|---|---|
Value UnicodeString | |
OldPrefix UnicodeString | |
NewPrefix UnicodeString |
Event ID 130: Startup_CSearchService_Init2
#Fields #
| Name | Description |
|---|---|
NoRun Boolean | |
SystemSetupOver Boolean |
Event ID 131: Startup_SetupWorkingDirectory
#Event ID 133: Startup_CheckAndCleanup
#Event ID 135: Startup_CGatherModule_Init
#Event ID 138: Startup_InitialIndexSetup
#Event ID 139: Setup_DeletePreviousUsersSettingsKey
#Event ID 142: Setup_CatalogSetupSucceeded
#Event ID 144: Setup_CleanupStarted
#Event ID 146: Setup_CleanupSucceeded
#Event ID 148: Crawl_InitializeNew
#Fields #
| Name | Description |
|---|---|
CrawlNo UInt32 | |
CrawlType UInt32 | |
FileName UnicodeString | |
IsCatalogLevel Boolean |
Event ID 150: Crawl_Initialize_Load
#Fields #
| Name | Description |
|---|---|
CrawlNo UInt32 | |
CrawlType UInt32 | |
FileName UnicodeString | |
IsCatalogLevel Boolean |
Event ID 154: Transactions_IterateHistoryStart
#Fields #
| Name | Description |
|---|---|
CrawlNo UInt32 | |
CrawlType UInt32 |
Event ID 156: Transactions_IterateHistory_Modify
#Fields #
| Name | Description |
|---|---|
CrawlNo UInt32 | |
URL UnicodeString |
Event ID 157: Transactions_IterateHistory_Delete
#Fields #
| Name | Description |
|---|---|
CrawlNo UInt32 | |
URL UnicodeString |
Event ID 158: Transactions_UpdateFailuresStart
#Event ID 160: GatherLog_Transaction
#Fields #
| Name | Description |
|---|---|
hrCode UInt32 | |
URL UnicodeString | |
TransactionType UInt32 | |
StartAddressId UInt32 | |
CrawlNo UInt32 | |
DocId UInt32 | |
hrTransactionError UInt32 | |
Description UnicodeString |
Event ID 161: GatherLog_Crawl
#Fields #
| Name | Description |
|---|---|
hrCode UInt32 | |
URL UnicodeString | |
TransactionType UInt32 | |
StartAddressId UInt32 | |
CrawlNo UInt32 | |
DocId UInt32 | |
hrTransactionError UInt32 | |
Description UnicodeString |
Event ID 164: Gatherer_OnDataChange
#Fields #
| Name | Description |
|---|---|
Resource UInt64 | |
TransactionURL UnicodeString | |
TransactionType UInt32 |
Event ID 165: Gatherer_OnDataChange_Failed
#Event ID 166: OnDataChange_Failed
#Event ID 169: RobotThread_BeforeGetNewTransaction
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 169,
"version": 0,
"level": 4,
"task": 112,
"opcode": 0,
"keywords": "0x8000000000000408",
"time_created": "2026-07-19T03:44:19.753399000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 170: RobotThread_ProcessNewTransaction
#Fields #
| Name | Description |
|---|---|
ITrans UInt64 | |
ResID UInt32 | |
Status UInt32 | NTSTATUS reference |
Type UInt32 | |
Flags UInt32 | |
InternalFlags UInt32 | |
CrawlNumber UInt32 | |
CrawlType UInt32 | |
Extra1 UInt32 | |
Extra2 UInt32 | |
Extra3 UInt32 | |
Path UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 170,
"version": 0,
"level": 4,
"task": 113,
"opcode": 0,
"keywords": "0x8000000000000408",
"time_created": "2026-07-19T03:44:19.753801700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ITrans": "0x19A61AF9A50",
"ResID": "0x23B5",
"Status": "0x4",
"Type": "0x0",
"Flags": "0x21008064",
"InternalFlags": "0x0",
"CrawlNumber": "0xFFFFFFFF",
"CrawlType": "0x0",
"Extra1": "0x0",
"Extra2": "0x0",
"Extra3": "0x0",
"Path": "file:C:/Users/Public/catalog-sample.txt"
},
"message": ""
}
Event ID 177: RobotThread_GetStandardProperties_Failed_V1
#Fields #
| Name | Description |
|---|---|
ITrans UInt64 | |
hr UInt32 |
Event ID 180: CEnumSearchRoots_Constructor
#Event ID 181: CEnumSearchRoots_Destructor
#Event ID 182: CEnumSearchRoots_DestructorStop
#Event ID 183: CEnumSearchRoots_Reset
#Event ID 184: CEnumSearchRoots_CloneStart
#Event ID 189: CEnumSearchRoots_SkipStart
#Event ID 191: CEnumSearchScopeRules_Constructor
#Event ID 192: CEnumSearchScopeRules_DestructorStart
#Event ID 193: CEnumSearchScopeRules_DestructorStop
#Event ID 194: CEnumSearchScopeRules_Reset
#Event ID 195: CEnumSearchScopeRules_CloneStart
#Event ID 197: CEnumSearchScopeRules_NextStart
#Event ID 200: CEnumSearchScopeRules_SkipStart
#Event ID 202: CSearchCrawlScopeManager_Constructor
#Event ID 203: CSearchCrawlScopeManager_Destructor
#Event ID 205: CSearchCrawlScopeManager_IncludedInCrawlScopeStop
#Fields #
| Name | Description |
|---|---|
hr UInt32 | |
IsIncluded Boolean |
Event ID 206: CSearchCrawlScopeManager_AddDefaultScopeRuleStart
#Fields #
| Name | Description |
|---|---|
URL UnicodeString | |
IsInclude Boolean | |
FollowFlags UInt32 |
Event ID 208: CSearchCrawlScopeManager_AddHierarchicalScopeStart
#Fields #
| Name | Description |
|---|---|
URL UnicodeString | |
IsInclude Boolean | |
IsDefault Boolean | |
OverrideChildren Boolean |
Event ID 210: CSearchCrawlScopeManager_AddRootStart
#Fields #
| Name | Description |
|---|---|
SearchRootURL UnicodeString |
Event ID 212: CSearchCrawlScopeManager_AddUserScopeRuleStart
#Fields #
| Name | Description |
|---|---|
URL UnicodeString | |
IsInclude Boolean | |
OverrideChildren Boolean | |
FollowFlags UInt32 |
Event ID 214: CSearchCrawlScopeManager_EnumerateRootsStart
#Event ID 216: CSearchCrawlScopeManager_EnumerateScopeRulesStart
#Event ID 218: CSearchCrawlScopeManager_GetParentScopeVersionIdStart
#Fields #
| Name | Description |
|---|---|
URL UnicodeString |
Event ID 219: CSearchCrawlScopeManager_GetParentScopeVersionIdStop
#Fields #
| Name | Description |
|---|---|
hr UInt32 | |
ScopeId UInt32 |
Event ID 220: CSearchCrawlScopeManager_HasChildScopeRuleStart
#Fields #
| Name | Description |
|---|---|
URL UnicodeString |
Event ID 221: CSearchCrawlScopeManager_HasChildScopeRuleStop
#Fields #
| Name | Description |
|---|---|
hr UInt32 | |
HasChildRule Boolean |
Event ID 222: CSearchCrawlScopeManager_HasParentScopeRuleStart
#Fields #
| Name | Description |
|---|---|
URL UnicodeString |
Event ID 223: CSearchCrawlScopeManager_HasParentScopeRuleStop
#Fields #
| Name | Description |
|---|---|
hr UInt32 | |
HasParentRule Boolean |
Event ID 224: CSearchCrawlScopeManager_IncludedInCrawlScopeExStart
#Fields #
| Name | Description |
|---|---|
URL UnicodeString |
Event ID 225: CSearchCrawlScopeManager_IncludedInCrawlScopeExStop
#Fields #
| Name | Description |
|---|---|
hr UInt32 | |
IsIncluded Boolean | |
Reason UInt32 |
Event ID 226: CSearchCrawlScopeManager_RemoveDefaultScopeRuleStart
#Fields #
| Name | Description |
|---|---|
URL UnicodeString |
Event ID 228: CSearchCrawlScopeManager_RemoveRootStart
#Fields #
| Name | Description |
|---|---|
SearchRootURL UnicodeString |
Event ID 230: CSearchCrawlScopeManager_RemoveScopeRuleStart
#Fields #
| Name | Description |
|---|---|
ScopeRuleURL UnicodeString |
Event ID 232: CSearchCrawlScopeManager_RevertToDefaultScopesStart
#Event ID 234: CSearchCrawlScopeManager_SaveAllStart
#Event ID 258: StatusChange_QueueUnlocked
#Event ID 259: Gatherer_OnDataChange_Track_Url
#Fields #
| Name | Description |
|---|---|
Resource UInt64 | |
TransactionURL UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
"event_source_name": "",
"event_id": 259,
"version": 0,
"level": 4,
"task": 209,
"opcode": 0,
"keywords": "0x0000000000000408",
"time_created": "2026-06-02T06:02:17.234+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 6624,
"thread_id": 6772
},
"channel": "ETW Trace",
"computer": "DESKTOP-FF3N5XK",
"security": {
"user_id": ""
}
},
"event_data": {
"Resource": 0,
"TransactionURL": "file:C:/ProgramData/Microsoft/Windows/WER/Temp/"
},
"message": "Gatherer_OnDataChange_Track_Url"
}
Event ID 266: Gatherer_Queues_QueueLength
#Fields #
| Name | Description |
|---|---|
GathererCodeLocation UInt32 | |
TransactionsInFile UInt32 | |
TransactionsInMemory UInt32 | |
TransactionQueueLength UInt32 | |
TransactionsInFileNotifications UInt32 | |
TransactionsInMemoryNotifications UInt32 | |
TransactionQueueLengthNotifications UInt32 | |
TransactionsHighLimit UInt32 | |
TransactionsLowLimitPerCrawl UInt32 | |
TransactionsHighLimitPerCrawl UInt32 | |
TransactionsInIncrementalQueue UInt32 | |
TransactionsInNotificationQueue UInt32 | |
TansactionsInNotificationHighPriorityQueue UInt32 |
Event ID 267: Startup_Search_Service_DurationStart
#Event ID 268: Startup_Search_Service_DurationStop
#Event ID 269: Shutdown_Search_Service_DurationStart
#Event ID 270: Shutdown_Search_Service_DurationStop
#Event ID 272: CreatePhysCursorStart
#Fields #
| Name | Description |
|---|---|
ObjectWid UInt32 | |
KeyPid UInt32 | |
GroupPids UnicodeString | |
KeyStr UnicodeString |
Event ID 274: CreatePhysCursorRangeStart
#Fields #
| Name | Description |
|---|---|
ObjectWid UInt32 | |
KeyStartPid UInt32 | |
GroupPids UnicodeString | |
KeyEndStr UnicodeString |
Event ID 276: MergeStart
#Fields #
| Name | Description |
|---|---|
ObjectWid UInt32 | |
UseQueryPerfOpt Boolean | |
Restarted Boolean | |
IndexIds UnicodeString | |
TotalSizeInPages UInt32 | |
MaxWid UInt32 |
Event ID 278: CreateWLCursorStart
#Fields #
| Name | Description |
|---|---|
WordListId UInt64 | |
KeyTargetPid UInt32 | |
KeyTargetStr UnicodeString |
Event ID 280: CreateWLCursorRangeStart
#Fields #
| Name | Description |
|---|---|
WordListId UInt64 | |
KeyStartPid UInt32 | |
GroupPids UnicodeString | |
KeyEndStr UnicodeString |
Event ID 282: ServerQueryStart
#Fields #
| Name | Description |
|---|---|
Qid UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 282,
"version": 0,
"level": 4,
"task": 226,
"opcode": 1,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.767585800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 9396
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Qid": "2837"
},
"message": ""
}
Event ID 283: ServerQuery_Send
#Fields #
| Name | Description |
|---|---|
Qid UInt32 | |
BytesSent UInt32 | |
MessageId Int32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 283,
"version": 0,
"level": 4,
"task": 227,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.766776300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 9396
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Qid": "2837",
"BytesSent": "40",
"MessageId": "200"
},
"message": ""
}
Event ID 284: ServerQuery_Received
#Fields #
| Name | Description |
|---|---|
Qid UInt32 | |
BytesReceived UInt32 | |
MessageId Int32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 284,
"version": 0,
"level": 4,
"task": 228,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.766567700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 9396
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Qid": "2837",
"BytesReceived": "1984",
"MessageId": "200"
},
"message": ""
}
Event ID 285: ClientQuery_Send
#Fields #
| Name | Description |
|---|---|
BytesSent UInt32 | |
MessageId Int32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 285,
"version": 0,
"level": 4,
"task": 229,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.766507800+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "BF440000-0BF1-0007-FA2B-4DBFF10BDD01"
},
"execution": {
"process_id": 11384,
"thread_id": 1932
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"BytesSent": "1984",
"MessageId": "200"
},
"message": ""
}
Event ID 286: ClientQuery_Received
#Fields #
| Name | Description |
|---|---|
BytesReceived UInt32 | |
MessageId Int32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 286,
"version": 0,
"level": 4,
"task": 230,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.766889900+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "BF440000-0BF1-0007-FA2B-4DBFF10BDD01"
},
"execution": {
"process_id": 11384,
"thread_id": 1932
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"BytesReceived": "40",
"MessageId": "200"
},
"message": ""
}
Event ID 287: ServerQueryStop
#Fields #
| Name | Description |
|---|---|
Qid UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 287,
"version": 0,
"level": 4,
"task": 226,
"opcode": 2,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.969005100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 9396
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Qid": "2837"
},
"message": ""
}
Event ID 288: ServerQuery_Create
#Fields #
| Name | Description |
|---|---|
Qid UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 288,
"version": 0,
"level": 4,
"task": 231,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.767148300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 9396
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Qid": "2837"
},
"message": ""
}
Event ID 289: ClientStartFetch
#Fields #
| Name | Description |
|---|---|
Rowset UInt64 | |
Chapter UInt64 | |
RowsRequested Int64 | |
RowSeekMethod Int32 | |
RowsToSkip Int64 | |
RowOffset Int32 | |
Bookmark UInt32 | |
Bookmarks UnicodeString | |
Numerator UInt32 | |
Denominator UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 289,
"version": 0,
"level": 4,
"task": 217,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.793492700+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "BF440000-0BF1-0007-FA2B-4DBFF10BDD01"
},
"execution": {
"process_id": 11384,
"thread_id": 1932
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Rowset": "0x27D46F072C0",
"Chapter": "0x0",
"RowsRequested": "1",
"RowSeekMethod": "1",
"RowsToSkip": "0",
"RowOffset": "0",
"Bookmark": "0",
"Bookmarks": "NULL",
"Numerator": "0",
"Denominator": "0"
},
"message": ""
}
Event ID 290: ClientFetched
#Fields #
| Name | Description |
|---|---|
Rowset UInt64 | |
RowsReturned Int64 | |
ErrorCode UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 290,
"version": 0,
"level": 4,
"task": 218,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.818316400+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "BF440000-0BF1-0007-FA2B-4DBFF10BDD01"
},
"execution": {
"process_id": 11384,
"thread_id": 1932
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Rowset": "0x27D46F072C0",
"RowsReturned": "1",
"ErrorCode": "0x0"
},
"message": ""
}
Event ID 291: ServerGetRowsStart
#Fields #
| Name | Description |
|---|---|
Qid UInt32 | |
WidStart UInt32 | |
Chapter UInt32 | |
Depth UInt32 | |
RowOffset Int64 | |
RequestedRows UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 291,
"version": 0,
"level": 4,
"task": 219,
"opcode": 1,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.793738600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 9396
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Qid": "2837",
"WidStart": "4294967291",
"Chapter": "0",
"Depth": "1",
"RowOffset": "1",
"RequestedRows": "1"
},
"message": ""
}
Event ID 292: ServerGetRowsStop
#Fields #
| Name | Description |
|---|---|
Qid UInt32 | |
RowsTransferred UInt32 | |
ErrorCode UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 292,
"version": 0,
"level": 4,
"task": 219,
"opcode": 2,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.818087000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 9396
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Qid": "2837",
"RowsTransferred": "1",
"ErrorCode": "0x0"
},
"message": ""
}
Event ID 293: RobotThread_LangAutoDetection_Start
#Fields #
| Name | Description |
|---|---|
fmtid GUID | |
pid UInt32 | |
TextPrefix UnicodeString | |
TextLength UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 293,
"version": 0,
"level": 4,
"task": 232,
"opcode": 1,
"keywords": "0x8000000000000410",
"time_created": "2026-07-19T03:44:20.237542100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"fmtid": "{41cf5ae0-f75a-4806-bd87-59c7d9248eb9}",
"pid": "100",
"TextPrefix": "catalog-sample.txt",
"TextLength": "28"
},
"message": ""
}
Event ID 294: RobotThread_LangAutoDetection_Stop
#Fields #
| Name | Description |
|---|---|
LocaleID UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 294,
"version": 0,
"level": 4,
"task": 233,
"opcode": 2,
"keywords": "0x8000000000000410",
"time_created": "2026-07-19T03:44:20.237672200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"LocaleID": "1033"
},
"message": ""
}
Event ID 295: RobotThread_LangAutoDetection_Succeed
#Fields #
| Name | Description |
|---|---|
LocaleName UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 295,
"version": 0,
"level": 4,
"task": 234,
"opcode": 0,
"keywords": "0x8000000000000410",
"time_created": "2026-07-19T03:44:20.237644900+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"LocaleName": "en"
},
"message": ""
}
Event ID 297: Service_Status_NotifyStart
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 297,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 13000,
"thread_id": 7140
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Search-Core",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 05:26:08.168Z",
"version": 0
},
"event_data": {
"Value": 11
},
"message": ""
}
Event ID 298: Service_Status_NotifyStop
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 298,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 13000,
"thread_id": 7140
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-Search-Core",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 05:26:08.168Z",
"version": 0
},
"event_data": {
"Value": 11
},
"message": ""
}
Event ID 308: Wordlist_BeginResourceFailed_CBOverflow
#Fields #
| Name | Description |
|---|---|
DocID UInt32 | |
BytesAvailable UInt32 |
Event ID 310: Wordlist_BeginResource_InvalidatedPreviousDoc
#Fields #
| Name | Description |
|---|---|
DocID UInt32 | |
CBID UInt64 |
Event ID 311: ClientQuery_Rowset_Reuse
#Fields #
| Name | Description |
|---|---|
Value UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 311,
"version": 0,
"level": 4,
"task": 247,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.768127900+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "BF440000-0BF1-0007-FA2B-4DBFF10BDD01"
},
"execution": {
"process_id": 11384,
"thread_id": 1932
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Value": "4294967295"
},
"message": ""
}
Event ID 316: ScopeManager_Write
#Fields #
| Name | Description |
|---|---|
MaxWID UInt32 | |
Scope UInt32 | |
IsCompact Boolean | |
CacheCapacity UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 316,
"version": 0,
"level": 4,
"task": 252,
"opcode": 0,
"keywords": "0x8000000000000408",
"time_created": "2026-07-19T03:44:19.753069600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 5356
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"MaxWID": "9141",
"Scope": "52",
"IsCompact": "true",
"CacheCapacity": "222208"
},
"message": ""
}
Event ID 317: Prioritization_Request
#Fields #
| Name | Description |
|---|---|
RequestID UInt64 | |
Priority UInt32 | |
Indexed UInt32 | |
OutstandingAdds UInt32 | |
OutstandingModifies UInt32 |
Event ID 318: Prioritization_Complete
#Fields #
| Name | Description |
|---|---|
RequestID UInt64 | |
Priority UInt32 | |
Indexed UInt32 | |
OutstandingAdds UInt32 | |
OutstandingModifies UInt32 |
Event ID 319: Prioritization_Statistics
#Fields #
| Name | Description |
|---|---|
RequestID UInt64 | |
Priority UInt32 | |
Indexed UInt32 | |
OutstandingAdds UInt32 | |
OutstandingModifies UInt32 |
Event ID 321: Gather_Transaction_Failure_Code
#Fields #
| Name | Description |
|---|---|
Status UInt32 | NTSTATUS reference |
URL UnicodeString | |
DocID UInt32 | |
hr UInt32 | |
Passes UInt32 |
Event ID 322: ETWLogging
#Fields #
| Name | Description |
|---|---|
Info UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
"event_source_name": "",
"event_id": 322,
"version": 0,
"level": 4,
"task": 258,
"opcode": 0,
"keywords": "0x0000000000000004",
"time_created": "2026-06-02T06:02:17.234+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 6624,
"thread_id": 6772
},
"channel": "ETW Trace",
"computer": "DESKTOP-FF3N5XK",
"security": {
"user_id": ""
}
},
"event_data": {
"Info": "ProcessDataChange_Internal for {, flags: 0, flags_e 0"
},
"message": "ETWLogging"
}
Event ID 324: ETWLoggingItem
#Fields #
| Name | Description |
|---|---|
DocID UInt32 | |
URL UnicodeString | |
Info UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 324,
"version": 0,
"level": 4,
"task": 260,
"opcode": 0,
"keywords": "0x8000000000000004",
"time_created": "2026-07-19T03:44:19.753237100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 5356
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"DocID": "9141",
"URL": "file:C:/[33618c3b-50a8-4a5e-8112-454277c4e992]/Users/Public/catalog-sample.txt",
"Info": "ProcessAddRequest - EXTERNAL Notification on NEW url received - added - scope:52"
},
"message": ""
}
Event ID 325: ETWLoggingItemFailure
#Fields #
| Name | Description |
|---|---|
Hr UInt32 | |
DocID UInt32 | |
URL UnicodeString | |
Info UnicodeString |
Event ID 326: USN_Notify_Journal_Wrap
#Fields #
| Name | Description |
|---|---|
Volume UnicodeString | |
DesiredPosition Int64 | |
CurrentPosition Int64 | |
hr UInt32 |
Event ID 327: GathererRecoverStart
#Event ID 329: ValueIndexCreationStart
#Fields #
| Name | Description |
|---|---|
Locale UInt32 | |
IdxName AnsiString | |
IsShadow Boolean | |
ColumnType UInt64 |
Event ID 330: ValueIndexCreationStop
#Fields #
| Name | Description |
|---|---|
Locale UInt32 | |
IdxName AnsiString | |
IsShadow Boolean | |
ErrorCode UInt32 |
Event ID 333: ValueIndexSeekStart333
#Fields #
| Name | Description |
|---|---|
HasStartVariant Boolean | |
HasEndVariant Boolean | |
ExcludeStartVariant Boolean | |
ExcludeEndVariant Boolean |
Event ID 335: FreeCursor
#Fields #
| Name | Description |
|---|---|
Qid UInt32 | |
Cursor UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 335,
"version": 0,
"level": 4,
"task": 266,
"opcode": 0,
"keywords": "0x8000000000000020",
"time_created": "2026-07-19T04:22:48.968981900+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 9396
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Qid": "2837",
"Cursor": "1"
},
"message": ""
}
Event ID 349: RobotThread_GetWordBreaker
#Fields #
| Name | Description |
|---|---|
fmtid GUID | |
pid UInt32 | |
LocaleID UInt32 | |
LocaleSource UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 349,
"version": 0,
"level": 4,
"task": 275,
"opcode": 0,
"keywords": "0x8000000000000410",
"time_created": "2026-07-19T03:44:20.236525000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"fmtid": "{b725f130-47ef-101a-a5f1-02608c9eebac}",
"pid": "4",
"LocaleID": "1033",
"LocaleSource": "12"
},
"message": ""
}
Event ID 350: GetWordBreaker
#Fields #
| Name | Description |
|---|---|
Locale UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 350,
"version": 0,
"level": 4,
"task": 276,
"opcode": 0,
"keywords": "0x8000000000000004",
"time_created": "2026-07-19T03:44:20.236541700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Locale": "1033"
},
"message": ""
}
Event ID 351: WordBreakerSelector_IncrementHistory
#Fields #
| Name | Description |
|---|---|
LocaleID UInt32 | |
IncrementCallID UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 351,
"version": 0,
"level": 4,
"task": 278,
"opcode": 0,
"keywords": "0x8000000000000410",
"time_created": "2026-07-19T03:44:20.240294400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"LocaleID": "1033",
"IncrementCallID": "7"
},
"message": ""
}
Event ID 352: WordBreakerSelector_SubstituteLocale
#Fields #
| Name | Description |
|---|---|
LocaleOriginal UInt32 | |
LocaleSubstitute UInt32 |
Event ID 353: WordBreakerSelector_Fallback
#Fields #
| Name | Description |
|---|---|
LocaleID UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 353,
"version": 0,
"level": 4,
"task": 279,
"opcode": 0,
"keywords": "0x8000000000000410",
"time_created": "2026-07-19T03:44:20.237862100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"LocaleID": "1036"
},
"message": ""
}
Event ID 356: RobotThread_LangAutoDetection_Scores
#Fields #
| Name | Description |
|---|---|
TextLength UInt32 | |
TopLCID UInt32 | |
TopScore UInt32 | |
SecondLCID UInt32 | |
SecondScore UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}",
"event_source_name": "",
"event_id": 356,
"version": 0,
"level": 4,
"task": 282,
"opcode": 0,
"keywords": "0x8000000000000410",
"time_created": "2026-07-19T03:44:20.237659700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 4232,
"thread_id": 6860
},
"channel": "Microsoft-Windows-Search-Core/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"TextLength": "28",
"TopLCID": "1033",
"TopScore": "1",
"SecondLCID": "0",
"SecondScore": "0"
},
"message": ""
}
Event ID 357: FileChangeTracker_APICallStart
#Event ID 359: FileChangeTracker_APICallStart359
#Event ID 361: FileChangeTracker_APICallStart361
#Event ID 363: FileChangeTracker_ProcessUSN
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
"event_source_name": "",
"event_id": 363,
"version": 0,
"level": 4,
"task": 284,
"opcode": 1,
"keywords": "0x0000000000000410",
"time_created": "2026-06-02T06:02:17.234+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 6624,
"thread_id": 6772
},
"channel": "ETW Trace",
"computer": "DESKTOP-FF3N5XK",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": "FileChangeTracker_ProcessUSN"
}
Event ID 364: FileChangeTracker_ProcessUSN
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Search-Core",
"guid": "{49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}",
"event_source_name": "",
"event_id": 364,
"version": 0,
"level": 4,
"task": 284,
"opcode": 2,
"keywords": "0x0000000000000410",
"time_created": "2026-06-02T06:02:17.234+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 6624,
"thread_id": 6772
},
"channel": "ETW Trace",
"computer": "DESKTOP-FF3N5XK",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": "FileChangeTracker_ProcessUSN"
}
Event ID 365: ScopeChangeNotification_OnChanged
#Fields #
| Name | Description |
|---|---|
ScopeId UInt32 | |
EventId GUID | |
PackageFamilyName UnicodeString | |
Path UnicodeString | |
Result UInt32 | |
SuccessEvent Boolean |
Event ID 367: ScopeChangeNotification_RegisterStart
#Fields #
| Name | Description |
|---|---|
UserSid UnicodeString | |
PackageFamilyName UnicodeString | |
EventId GUID | |
Count UInt32 | |
Paths UnicodeString |
Event ID 368: ScopeChangeNotification_RegisterStop
#Event ID 369: ScopeChangeNotification_UnregisterStart
#Fields #
| Name | Description |
|---|---|
UserSid UnicodeString | |
PackageFamilyName UnicodeString | |
EventId GUID |
Event ID 370: ScopeChangeNotification_UnregisterStop
#Provenance
ETW provider GUID {49C2C27C-FE2D-40BF-8C4E-C3FB518037E7}
Defined in SearchIndexer.exe, which carries the event manifest.
- Win11-26200.6584, sample captured from a live trace, binary version 7.0.26100.4946, captured 2026-06-02 — Manifest XML pack, 2.0 MB
- WS2022-20348.4893, schema read from the registered manifest, binary version 7.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 7.0.26100.4946, captured 2026-06-02 — Manifest XML pack, 2.0 MB
- JD-WIN11-22H2-1-native-20260719, sample captured from a live trace, binary version 7.0.22621.5039, captured 2026-07-19
Native ETL capture while indexing a temporary sanitized text file and requesting a catalog reindex; the file was removed after capture.