Microsoft-Windows-Search

Event	Title	Channel	Sample	Rule
1003	The Windows Search Service started.	Application	Y	N
1003	The Windows Search Service started	Operational	Y	N
1004	The Windows Search service is creating the new search index {Reason: Full Index …	Application	Y	N
1004	The Windows Search service is creating the new search index {Reason: Reason}	Operational	Y	N
1005	The Windows Search Service has successfully created the new search index.	Application	Y	N
1005	The Windows Search Service has successfully created the new search index	Operational	Y	N
1006	The Windows Search Service has failed to create the new search index	Operational	N	N
1007	The Windows Search Service was unable to allocate memory	Operational	N	N
1008	The Windows Search Service is starting up and attempting to remove the old …	Application	Y	N
1008	The Windows Search Service is starting up and attempting to remove the old …	Operational	Y	N
1009	An exception occurred in	Operational	N	N
1010	The Windows Search Service has successfully removed the old search index.	Application	Y	N
1010	The Windows Search Service has successfully removed the old search index	Operational	Y	N
1011	The Windows Search Service has failed to remove the old search index	Operational	N	N
1013	Windows Search Service stopped normally.	Application	Y	N
1013	Windows Search Service stopped normally	Operational	Y	N
1014	The Windows Search Service has failed to create one or more path rules	Operational	N	N
1015	Event ID EventID for the Windows Search Service has been suppressed RepeatCount …	Operational	Y	N
1016	The Windows Search Service failed to move Index files from OldIndexPath to …	Operational	N	N
1017	The Windows Search Service successfully moved index files from OldIndexPath to	Operational	N	N
1018	While rolling back the index, the Windows Search Service encountered the …	Operational	N	N
1019	Windows Search Service failed to process the list of included and excluded …	Operational	N	N
1044	An error occurred in configuration file <FileName>	Operational	N	N
1053	The system exception Code occurred, and will be handled	Operational	N	N
3003	A configuration error occurred	Operational	N	N
3006	Performance monitoring cannot be initialized for the gatherer service, because …	Operational	N	N
3007	Performance monitoring cannot be initialized for the gatherer object, because …	Operational	N	N
3008	The entry <Entry> cannot be inserted into the history	Operational	N	N
3009	The transaction object cannot be created	Operational	N	N
3010	The transaction cannot be appended to the queue	Operational	N	N
3011	The transaction cannot be updated in the queue	Operational	N	N
3013	The entry <Entry> in the hash map cannot be updated	Operational	N	N
3014	An exception occurred	Operational	N	N
3015	The transaction file cannot be read	Operational	N	N
3020	Internal gatherer error ErrorCode occurred	Operational	N	N
3023	The update cannot be started because all of the content sources were excluded by …	Operational	N	N
3024	The update cannot be started because the content sources cannot be accessed	Operational	N	N
3025	Critical error ErrorCode occurred, and the index was shut down	Operational	N	N
3026	Advise Status Change failed	Operational	N	N
3027	The URL <URL> cannot be crawled	Operational	N	N
3028	The gatherer object cannot be initialized	Operational	N	N
3029	The plug-in in <Plugin> cannot be initialized	Operational	N	N
3030	The gatherer service cannot be initialized	Operational	N	N
3031	A document ID cannot be allocated	Operational	N	N
3032	A document ID cannot be freed	Operational	N	N
3033	A new queue file cannot be created	Operational	N	N
3034	The registry version does not match with the expected <ExpectedVersion>, or the …	Operational	N	N
3036	Crawl could not be completed on content source <URL>	Operational	N	N
3037	Crawl could not be started on content source <URL>	Operational	N	N
3038	The gatherer is unable to read the registry	Operational	N	N
3039	A request to start the update has been ignored because the update is already in …	Operational	N	N
3040	The status change request RequestedStatusMessage cannot be processed	Operational	N	N
3041	The index is being reset	Operational	N	N
3042	The index was paused	Operational	N	N
3044	The gatherer index resumed	Operational	N	N
3045	The automatic description length was adjusted from OldLength to	Operational	N	N
3046	The update for the index cannot be started because the specified content sources …	Operational	N	N
3048	No documents were accessed because no e-mail address is specified in the content …	Operational	N	N
3050	Unvisited items cannot be deleted from the history after a full update	Operational	N	N
3052	The crawl was requested to be stopped	Operational	N	N
3053	The previous update was reset, or was otherwise interrupted	Operational	N	N
3054	The update has been delayed because a disk is full	Operational	N	N
3055	The gatherer property mapping file cannot be opened	Operational	N	N
3056	The automatic description encoding tag value is invalid	Operational	N	N
3057	The plug-in manager <PluginManager> cannot be initialized	Operational	N	N
3058	The application cannot be initialized	Operational	N	N
3059	The update cannot be initialized	Operational	N	N
3060	An update cannot begin because the content source <URL> is in use by another …	Operational	N	N
3061	The gatherer log cannot be created	Operational	N	N
3062	The word breaker for language <Locale> cannot be loaded	Operational	N	N
3072	The gatherer is recovering after an improper shutdown	Operational	N	N
3073	The gatherer detected pages in the history during recovery that cannot be read, …	Operational	N	N
3078	The Windows Search service stopped the Protocol Host process because it was …	Operational	N	N
3079	Notifications for the volume VolumeName are not active	Operational	N	N
3083	The protocol handler ProtocolHandler cannot be loaded	Operational	N	N
3084	Failed to load protocol handler	Operational	N	N
3085	The application network access account is invalid	Operational	N	N
3086	The system locale has changed	Operational	N	N
3087	The gatherer files cannot be flushed, and this action cannot be completed	Operational	N	N
3088	The checkpoint record cannot be updated, and this action cannot be completed	Operational	N	N
3089	The gatherer files cannot be saved, and this action cannot be completed	Operational	N	N
3090	The gatherer files from the previous checkpoint cannot be restored, and this …	Operational	N	N
3091	The checkpoint record cannot be read, and this action cannot be completed	Operational	N	N
3092	The project cannot be initialized, because the checkpoint record cannot be read	Operational	N	N
3093	The project cannot be initialized, because one of the checkpoint files is …	Operational	N	N
3095	The group Domain\Account contains Users members	Operational	N	N
3096	The local groups cache was flushed, because	Operational	N	N
3097	The gatherer did not connect to the SQLServer instance	Operational	N	N
3099	Unable to terminate notifications normally	Operational	N	N
3100	Unable to initialize the filter host process	Operational	N	N
3101	The filter host process could not be terminated	Operational	N	N
4103	ExtraInfoA master merge has completed for catalog	Operational	N	N
4104	ExtraInfoA master merge has been paused for catalog CatalogName due to error	Operational	N	N
4105	ExtraInfoA master merge cannot be started for catalog CatalogName due to error	Operational	N	N
4106	ExtraInfoA master merge cannot be re-started for catalog CatalogName due to …	Operational	N	N
4121	ExtraInfoA master merge has restarted for catalog	Application, Operational	Y	N
4138	An index corruption was detected in component Component in catalog	Operational	N	N
4163	ExtraInfoA master merge has been paused for catalog CatalogName due to low disk …	Operational	N	N
4164	ExtraInfoCatalog:	Operational	N	N
4165	ExtraInfoCatalog:	Operational	N	N
4166	ExtraInfoCatalog:	Operational	N	N
4167	ExtraInfoCatalog:	Operational	N	N
4168	ExtraInfo Unable to create the query engine's first request item due to error	Operational	N	N
4169	Error ID Phase happened in Windows Search recovery stage, please restart the …	Operational	N	N
7001	The schema file <SrcFile> cannot be copied to <DstFile>	Operational	N	N
7010	The index cannot be initialized	Operational	Y	N
7011	Directory location <Directory> is invalid	Operational	N	N
7013	The update was paused because the disk <Directory> is full	Operational	N	N
7040	The search service has detected corrupted data files in the index …	Operational	Y	N
7042	The Windows Search Service is being stopped because there is a problem with the …	Operational	Y	N
7043	The index cannot be loaded	Operational	N	N
7064	Performance monitoring cannot be initialized because the counters are not loaded …	Operational	N	N
7066	Configuration directory Directory is missing, and disaster recovery must be …	Operational	N	N
7068	The registry cannot be read, possibly because the registry keys for this index …	Operational	N	N
7070	The Windows Search Service added catalog	Operational	N	N
7071	The Windows Search Service removed index	Operational	N	N
9000	The Windows Search Service cannot open the Jet property store	Operational	N	N
9001	The Windows Search Service cannot create a Jet property store	Operational	N	N
9002	The Windows Search Service cannot load the property store information	Operational	N	N
9003	The Windows Search Service cannot initialize multi-instancing in Jet	Operational	N	N
10013	The noise files cannot be renamed	Operational	N	N
10014	The noise file "OldNoiseFile"" cannot be renamed to ""NewNoiseFile""	Operational	N	N
10020	Performance Counters could not be loaded for Driver for instance InstanceName …	Operational	N	N
10021	Could not get performance counter registry info for Driver for instance …	Operational	N	N
10022	Performance counters will not be loaded because the named objects (shared memory …	Operational	N	N
10023	The protocol host process ProtocolHostProcessID did not respond and is being …	Operational	N	N
10024	The filter host process FilterHostProcessID did not respond and is being …	Application	Y	N
10024	The filter host process FilterHostProcessID did not respond and is being …	Operational	Y	N
10025	The search service has failed to create database instance for the index …	Operational	N	N
10026	The search service has failed to configure maximum number of database instance	Operational	N	N
10027	The search service has failed to create or load catalog for an user with SID …	Operational	N	N
10028	The search service has failed to unload catalog for an user with SID {SID}	Operational	N	N
1073742827	The Windows Search Service started.	Operational	Y	N
1073742828	The Windows Search service is creating the new search index {Reason: Reason}.	Operational	Y	N
1073742829	The Windows Search Service has successfully created the new search index.	Operational	Y	N
1073742834	The Windows Search Service has successfully removed the old search index.	Operational	Y	N
1073742837	Windows Search Service stopped normally.	Operational	Y	N
1073742841	The Windows Search Service successfully moved index files from OldIndexPath to …	Operational	N	N
1073744865	The index is being reset.	Operational	N	N
1073744868	The gatherer index resumed.	Operational	N	N
1073744876	The crawl was requested to be stopped.	Operational	N	N
1073744884	An update cannot begin because the content source <.	Operational	N	N
1073744919	The group Domain\Account contains Users members.	Operational	N	N
1073744920	The local groups cache was flushed, because Reason.	Operational	N	N
1073745927	ExtraInfoA master merge has completed for catalog CatalogName.	Operational	N	N
1073745928	ExtraInfoA master merge has been paused for catalog CatalogName due to error …	Operational	N	N
1073745945	ExtraInfoA master merge has restarted for catalog CatalogName.	Operational	N	N
1073745962	An index corruption was detected in component Component in catalog CatalogName.	Operational	N	N
1073745987	ExtraInfoA master merge has been paused for catalog CatalogName due to low disk …	Operational	N	N
1073745988	1CatalogCatalog: ExtraInfo.	Operational	N	N
1073745989	1CatalogCatalog: ExtraInfo.	Operational	N	N
1073745990	1CatalogCatalog: ExtraInfo.	Operational	N	N
1073745991	1CatalogCatalog: ExtraInfo.	Operational	N	N
1073748866	The Windows Search Service is being stopped because there is a problem with the …	Operational	N	N
2147484656	The Windows Search Service is starting up and attempting to remove the old …	Operational	Y	N
2147484662	The Windows Search Service has failed to create one or more path rules.	Operational	N	N
2147484663	Event ID EventID for the Windows Search Service has been suppressed RepeatCount …	Operational	N	N
2147484666	While rolling back the index, the Windows Search Service encountered the …	Operational	N	N
2147484692	An error occurred in configuration file <FileName>.	Operational	N	N
2147484701	The system exception Code occurred, and will be handled.	Operational	N	N
2147486671	The update cannot be started because all of the content sources were excluded by …	Operational	N	N
2147486672	The update cannot be started because the content sources cannot be accessed.	Operational	N	N
2147486684	Crawl could not be completed on content source <URL>.	Operational	N	N
2147486685	Crawl could not be started on content source <URL>.	Operational	N	N
2147486686	The gatherer is unable to read the registry RegPath.	Operational	N	N
2147486687	A request to start the update has been ignored because the update is already in …	Operational	N	N
2147486690	The index was paused.	Operational	N	N
2147486693	The automatic description length was adjusted from OldLength to NewLength.	Operational	N	N
2147486694	The update for the index cannot be started because the specified content sources …	Operational	N	N
2147486701	The previous update was reset, or was otherwise interrupted.	Operational	N	N
2147486702	The update has been delayed because a disk is full.	Operational	N	N
2147486703	The gatherer property mapping file cannot be opened.	Operational	N	N
2147486704	The automatic description encoding tag value is invalid.	Operational	N	N
2147486709	The gatherer log cannot be created.	Operational	N	N
2147486710	The word breaker for language <Locale> cannot be loaded.	Operational	N	N
2147486720	The gatherer is recovering after an improper shutdown.	Operational	N	N
2147486721	The gatherer detected pages in the history during recovery that cannot be read, …	Operational	N	N
2147486726	The Windows Search service stopped the Protocol Host process because it was …	Operational	N	N
2147486734	The system locale has changed.	Operational	N	N
2147487816	ExtraInfo Unable to create the query engine's first request item due to error …	Operational	N	N
2147487817	Error ID Phase happened in Windows Search recovery stage, please restart the …	Operational	N	N
2147492651	The Windows Search Service cannot initialize multi-instancing in Jet.	Operational	N	N
2147493661	The noise files cannot be renamed.	Operational	N	N
2147493662	The noise file "OldNoiseFile"" cannot be renamed to ""NewNoiseFile"".	Operational	N	N
2147493668	Performance Counters could not be loaded for Driver for instance InstanceName …	Operational	N	N
2147493669	Could not get performance counter registry info for Driver for instance …	Operational	N	N
2147493670	Performance counters will not be loaded because the named objects (shared memory …	Operational	N	N
2147493671	The protocol host process ProtocolHostProcessID did not respond and is being …	Operational	N	N
2147493672	The filter host process FilterHostProcessID did not respond and is being …	Operational	Y	N
2147493673	The search service has failed to create database instance for the index …	Operational	N	N
2147493674	The search service has failed to configure maximum number of database instance.	Operational	N	N
2147493675	The search service has failed to create or load catalog for an user with SID {.	Operational	N	N
2147493676	The search service has failed to unload catalog for an user with SID {SID}.	Operational	N	N
3221226478	The Windows Search Service has failed to create the new search index.	Operational	N	N
3221226479	The Windows Search Service was unable to allocate memory.	Operational	N	N
3221226481	An exception occurred in Address.	Operational	N	N
3221226483	The Windows Search Service has failed to remove the old search index.	Operational	N	N
3221226488	The Windows Search Service failed to move Index files from OldIndexPath to …	Operational	N	N
3221226491	Windows Search Service failed to process the list of included and excluded …	Operational	N	N
3221228475	A configuration error occurred.	Operational	N	N
3221228478	Performance monitoring cannot be initialized for the gatherer service, because …	Operational	N	N
3221228479	Performance monitoring cannot be initialized for the gatherer object, because …	Operational	N	N
3221228480	The entry <Entry> cannot be inserted into the history.	Operational	N	N
3221228481	The transaction object cannot be created.	Operational	N	N
3221228482	The transaction cannot be appended to the queue.	Operational	N	N
3221228483	The transaction cannot be updated in the queue.	Operational	N	N
3221228485	The entry <Entry> in the hash map cannot be updated.	Operational	N	N
3221228486	An exception occurred.	Operational	N	N
3221228487	The transaction file cannot be read.	Operational	N	N
3221228492	Internal gatherer error ErrorCode occurred.	Operational	N	N
3221228497	Critical error ErrorCode occurred, and the index was shut down.	Operational	N	N
3221228498	Advise Status Change failed.	Operational	N	N
3221228499	The URL <URL> cannot be crawled.	Operational	N	N
3221228500	The gatherer object cannot be initialized.	Operational	N	N
3221228501	The plug-in in <Plugin> cannot be initialized.	Operational	N	N
3221228502	The gatherer service cannot be initialized.	Operational	N	N
3221228503	A document ID cannot be allocated.	Operational	N	N
3221228504	A document ID cannot be freed.	Operational	N	N
3221228505	A new queue file cannot be created.	Operational	N	N
3221228506	The registry version does not match with the expected <.	Operational	N	N
3221228512	The status change request RequestedStatusMessage cannot be processed.	Operational	N	N
3221228520	No documents were accessed because no e-mail address is specified in the content …	Operational	N	N
3221228522	Unvisited items cannot be deleted from the history after a full update.	Operational	N	N
3221228529	The plug-in manager <PluginManager> cannot be initialized.	Operational	N	N
3221228530	The application cannot be initialized.	Operational	N	N
3221228531	The update cannot be initialized.	Operational	N	N
3221228551	Notifications for the volume VolumeName are not active.	Operational	N	N
3221228555	The protocol handler ProtocolHandler cannot be loaded.	Operational	N	N
3221228556	Failed to load protocol handler ProtocolHandler.	Operational	N	N
3221228557	The application network access account is invalid.	Operational	N	N
3221228559	The gatherer files cannot be flushed, and this action cannot be completed.	Operational	N	N
3221228560	The checkpoint record cannot be updated, and this action cannot be completed.	Operational	N	N
3221228561	The gatherer files cannot be saved, and this action cannot be completed.	Operational	N	N
3221228562	The gatherer files from the previous checkpoint cannot be restored, and this …	Operational	N	N
3221228563	The checkpoint record cannot be read, and this action cannot be completed.	Operational	N	N
3221228564	The project cannot be initialized, because the checkpoint record cannot be read.	Operational	N	N
3221228565	The project cannot be initialized, because one of the checkpoint files is …	Operational	N	N
3221228569	The gatherer did not connect to the SQLServer instance.	Operational	N	N
3221228571	Unable to terminate notifications normally.	Operational	N	N
3221228572	Unable to initialize the filter host process.	Operational	N	N
3221228573	The filter host process could not be terminated.	Operational	N	N
3221229577	ExtraInfoA master merge cannot be started for catalog CatalogName due to error …	Operational	N	N
3221229578	ExtraInfoA master merge cannot be re-started for catalog CatalogName due to …	Operational	N	N
3221232473	The schema file <SrcFile> cannot be copied to <DstFile>.	Operational	N	N
3221232482	The index cannot be initialized.	Operational	N	N
3221232483	Directory location <Directory> is invalid.	Operational	N	N
3221232485	The update was paused because the disk <Directory> is full.	Operational	N	N
3221232512	The search service has detected corrupted data files in the index …	Operational	N	N
3221232515	The index cannot be loaded.	Operational	N	N
3221232536	Performance monitoring cannot be initialized because the counters are not loaded …	Operational	N	N
3221232538	Configuration directory Directory is missing, and disaster recovery must be …	Operational	N	N
3221232540	The registry cannot be read, possibly because the registry keys for this index …	Operational	N	N
3221232542	The Windows Search Service added catalog ExtraInfo.	Operational	N	N
3221232543	The Windows Search Service removed index ExtraInfo.	Operational	N	N
3221234472	The Windows Search Service cannot open the Jet property store.	Operational	N	N
3221234473	The Windows Search Service cannot create a Jet property store.	Operational	N	N
3221234474	The Windows Search Service cannot load the property store information.	Operational	N	N

Event ID 1003: The Windows Search Service started.

Channel: Application
Level: Informational

Fields #

Name	Description
`ExtraInfo`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "Windows Search Service",
    "event_id": 1003,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-06T06:25:51.885710+00:00",
    "event_record_id": 1450,
    "correlation": {},
    "execution": {
      "process_id": 5004,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": {
      "Name": "ExtraInfo",
      "Value": "\n"
    }
  },
  "message": "The Windows Search Service started.ExtraInfo"
}

Example keys not documented in the fields table: Data

Event ID 1003: The Windows Search Service started

Channel: Operational
Level: 4

Fields #

Name	Description
`ExtraInfo` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 1003,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-29T16:38:25.7177321+00:00",
    "event_record_id": 4745,
    "correlation": {},
    "execution": {
      "process_id": 7088,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "telemetry-W11-a.cell-a.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": ""
  },
  "message": "The Windows Search Service started.\n"
}

Event ID 1004: The Windows Search service is creating the new search index {Reason: Full Index Reset}.

Channel: Application
Level: Informational

Fields #

Name	Description
`ExtraInfo`
`Reason`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "Windows Search Service",
    "event_id": 1004,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-06T06:25:51.187482+00:00",
    "event_record_id": 1447,
    "correlation": {},
    "execution": {
      "process_id": 5004,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "\n",
    "Reason": "Full Index Reset"
  },
  "message": "The Windows Search service is creating the new search index {Reason: Full Index Reset}. \n"
}

Event ID 1004: The Windows Search service is creating the new search index {Reason: Reason}

Channel: Operational
Level: 4

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Reason` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 1004,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-18T00:27:20.5494469+00:00",
    "event_record_id": 16,
    "correlation": {},
    "execution": {
      "process_id": 928,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "",
    "Reason": "Full Index Reset"
  },
  "message": "The Windows Search service is creating the new search index {Reason: Full Index Reset}. \n"
}

Event ID 1005: The Windows Search Service has successfully created the new search index.

Channel: Application
Level: Informational

Fields #

Name	Description
`ExtraInfo`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "Windows Search Service",
    "event_id": 1005,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-06T06:25:51.828936+00:00",
    "event_record_id": 1449,
    "correlation": {},
    "execution": {
      "process_id": 5004,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": {
      "Name": "ExtraInfo",
      "Value": "\n"
    }
  },
  "message": "The Windows Search Service has successfully created the new search index. ExtraInfo"
}

Example keys not documented in the fields table: Data

Event ID 1005: The Windows Search Service has successfully created the new search index

Channel: Operational
Level: 4

Fields #

Name	Description
`ExtraInfo` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 1005,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-18T00:27:20.6255220+00:00",
    "event_record_id": 17,
    "correlation": {},
    "execution": {
      "process_id": 928,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": ""
  },
  "message": "The Windows Search Service has successfully created the new search index. \n"
}

Event ID 1006: The Windows Search Service has failed to create the new search index

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Phase` UnicodeString
`HR` UnicodeString
`DiagnosticsInfo` UnicodeString

Event ID 1007: The Windows Search Service was unable to allocate memory

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 1008: The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}.

Channel: Application
Level: Warning

Fields #

Name	Description
`ExtraInfo`
`Reason`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "Windows Search Service",
    "event_id": 1008,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-06T06:25:47.791114+00:00",
    "event_record_id": 1444,
    "correlation": {},
    "execution": {
      "process_id": 5004,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "\n",
    "Reason": "Full Index Reset"
  },
  "message": "The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}. \n"
}

Event ID 1008: The Windows Search Service is starting up and attempting to remove the old search index {Reason: Reason}

Channel: Operational
Level: 3

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Reason` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 1008,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-18T00:27:19.5207507+00:00",
    "event_record_id": 14,
    "correlation": {},
    "execution": {
      "process_id": 928,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "",
    "Reason": "Full Index Reset"
  },
  "message": "The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}. \n"
}

Event ID 1009: An exception occurred in

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Address` UnicodeString

Event ID 1010: The Windows Search Service has successfully removed the old search index.

Channel: Application
Level: Informational

Fields #

Name	Description
`ExtraInfo`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "Windows Search Service",
    "event_id": 1010,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-06T06:25:47.798155+00:00",
    "event_record_id": 1445,
    "correlation": {},
    "execution": {
      "process_id": 5004,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": {
      "Name": "ExtraInfo",
      "Value": "\n"
    }
  },
  "message": "The Windows Search Service has successfully removed the old search index. ExtraInfo"
}

Example keys not documented in the fields table: Data

Event ID 1010: The Windows Search Service has successfully removed the old search index

Channel: Operational
Level: 4

Fields #

Name	Description
`ExtraInfo` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 1010,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-18T00:27:19.5234771+00:00",
    "event_record_id": 15,
    "correlation": {},
    "execution": {
      "process_id": 928,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": ""
  },
  "message": "The Windows Search Service has successfully removed the old search index. \n"
}

Event ID 1011: The Windows Search Service has failed to remove the old search index

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Phase` UnicodeString
`HR` UnicodeString

Event ID 1013: Windows Search Service stopped normally.

Channel: Application
Level: Informational

Fields #

Name	Description
`ExtraInfo`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "Windows Search Service",
    "event_id": 1013,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-10-25T22:56:14.357450+00:00",
    "event_record_id": 1432,
    "correlation": {},
    "execution": {
      "process_id": 7916,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDevEval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": {
      "Name": "ExtraInfo",
      "Value": "\n"
    }
  },
  "message": "Windows Search Service stopped normally.ExtraInfo"
}

Example keys not documented in the fields table: Data

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1013: Windows Search Service stopped normally

Channel: Operational
Level: 4

Fields #

Name	Description
`ExtraInfo` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 1013,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "time_created": "2026-05-27T21:12:09.8066660+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Application"
  },
  "event_data": {
    "ExtraInfo": ""
  }
}

Event ID 1014: The Windows Search Service has failed to create one or more path rules

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`DebugInfo` UnicodeString

Event ID 1015: Event ID EventID for the Windows Search Service has been suppressed RepeatCount time(s) since

Channel: Operational
Level: 3

Fields #

Name	Description
`ExtraInfo` UnicodeString
`EventID` UnicodeString
`RepeatCount` UnicodeString
`ReferenceTime` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 1015,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T14:07:06.2189579+00:00",
    "event_record_id": 267219,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "",
    "EventID": "1013",
    "RepeatCount": "121",
    "ReferenceTime": "1:07:03 PM"
  },
  "message": "Event ID 1013 for the Windows Search Service has been suppressed 121 time(s) since 1:07:03 PM. This event is used to suppress Windows Search Service events that have occurred frequently within a short period of time.  See Event ID 1013 for further details on this event."
}

Event ID 1016: The Windows Search Service failed to move Index files from OldIndexPath to NewIndexPath with the following error: <Phase,ErrorCode>

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldIndexPath` UnicodeString
`NewIndexPath` UnicodeString
`Phase` UnicodeString
`ErrorCode` UnicodeString

Event ID 1017: The Windows Search Service successfully moved index files from OldIndexPath to

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldIndexPath` UnicodeString
`NewIndexPath` UnicodeString

Event ID 1018: While rolling back the index, the Windows Search Service encountered the following error: <Phase,ErrorCode>

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldIndexPath` UnicodeString
`NewIndexPath` UnicodeString
`Phase` UnicodeString
`ErrorCode` UnicodeString

Event ID 1019: Windows Search Service failed to process the list of included and excluded locations with the error <Phase, ErrorCode, "Path">

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Phase` UnicodeString
`ErrorCode` UnicodeString
`Path` UnicodeString

Event ID 1044: An error occurred in configuration file <FileName>

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`FileName` UnicodeString

Event ID 1053: The system exception Code occurred, and will be handled

Channel: Operational

Fields #

Name	Description
`Code` UnicodeString
`StackTrace` UnicodeString

Event ID 3003: A configuration error occurred

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3006: Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3007: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3008: The entry <Entry> cannot be inserted into the history

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Entry` UnicodeString

Event ID 3009: The transaction object cannot be created

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3010: The transaction cannot be appended to the queue

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`FilePath` UnicodeString

Event ID 3011: The transaction cannot be updated in the queue

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`FilePath` UnicodeString

Event ID 3013: The entry <Entry> in the hash map cannot be updated

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Entry` UnicodeString

Event ID 3014: An exception occurred

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ID` UnicodeString

Event ID 3015: The transaction file cannot be read

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3020: Internal gatherer error ErrorCode occurred

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ErrorCode` UnicodeString

Event ID 3023: The update cannot be started because all of the content sources were excluded by site path rules, or removed from the index configuration

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3024: The update cannot be started because the content sources cannot be accessed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3025: Critical error ErrorCode occurred, and the index was shut down

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ErrorCode` UnicodeString

Event ID 3026: Advise Status Change failed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3027: The URL <URL> cannot be crawled

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`URL` UnicodeString

Event ID 3028: The gatherer object cannot be initialized

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3029: The plug-in in <Plugin> cannot be initialized

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Plugin` UnicodeString

Event ID 3030: The gatherer service cannot be initialized

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3031: A document ID cannot be allocated

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3032: A document ID cannot be freed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3033: A new queue file cannot be created

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3034: The registry version does not match with the expected <ExpectedVersion>, or the registry cannot be accessed because the service account does not have the correct permissions

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ExpectedVersion` UnicodeString

Event ID 3036: Crawl could not be completed on content source <URL>

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`URL` UnicodeString

Event ID 3037: Crawl could not be started on content source <URL>

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`URL` UnicodeString

Event ID 3038: The gatherer is unable to read the registry

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`RegPath` UnicodeString

Event ID 3039: A request to start the update has been ignored because the update is already in progress or is scheduled on one or more content sources

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3040: The status change request RequestedStatusMessage cannot be processed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`RequestedStatusMessage` UnicodeString

Event ID 3041: The index is being reset

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3042: The index was paused

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3044: The gatherer index resumed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3045: The automatic description length was adjusted from OldLength to

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldLength` UnicodeString
`NewLength` UnicodeString

Event ID 3046: The update for the index cannot be started because the specified content sources were not configured for updates

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3048: No documents were accessed because no e-mail address is specified in the content index server properties

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3050: Unvisited items cannot be deleted from the history after a full update

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3052: The crawl was requested to be stopped

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3053: The previous update was reset, or was otherwise interrupted

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3054: The update has been delayed because a disk is full

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3055: The gatherer property mapping file cannot be opened

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3056: The automatic description encoding tag value is invalid

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3057: The plug-in manager <PluginManager> cannot be initialized

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`PluginManager` UnicodeString

Event ID 3058: The application cannot be initialized

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3059: The update cannot be initialized

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3060: An update cannot begin because the content source <URL> is in use by another update already in progress

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`URL` UnicodeString

Event ID 3061: The gatherer log cannot be created

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3062: The word breaker for language <Locale> cannot be loaded

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Locale` UnicodeString

Event ID 3072: The gatherer is recovering after an improper shutdown

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3073: The gatherer detected pages in the history during recovery that cannot be read, and repaired them

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3078: The Windows Search service stopped the Protocol Host process because it was consuming too many resources

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3079: Notifications for the volume VolumeName are not active

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`VolumeName` UnicodeString

Event ID 3083: The protocol handler ProtocolHandler cannot be loaded

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ProtocolHandler` UnicodeString
`ErrorMessage` UnicodeString

Event ID 3084: Failed to load protocol handler

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ProtocolHandler` UnicodeString
`ErrorMessage` UnicodeString

Event ID 3085: The application network access account is invalid

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3086: The system locale has changed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3087: The gatherer files cannot be flushed, and this action cannot be completed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3088: The checkpoint record cannot be updated, and this action cannot be completed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3089: The gatherer files cannot be saved, and this action cannot be completed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3090: The gatherer files from the previous checkpoint cannot be restored, and this action cannot be completed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3091: The checkpoint record cannot be read, and this action cannot be completed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3092: The project cannot be initialized, because the checkpoint record cannot be read

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3093: The project cannot be initialized, because one of the checkpoint files is missing

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3095: The group Domain\Account contains Users members

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Domain` UnicodeString
`Account` UnicodeString
`Users` UnicodeString
`MaxUsers` UnicodeString

Event ID 3096: The local groups cache was flushed, because

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Reason` UnicodeString

Event ID 3097: The gatherer did not connect to the SQLServer instance

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3099: Unable to terminate notifications normally

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3100: Unable to initialize the filter host process

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3101: The filter host process could not be terminated

Channel: Operational

Event ID 4103: ExtraInfoA master merge has completed for catalog

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString

Event ID 4104: ExtraInfoA master merge has been paused for catalog CatalogName due to error

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`ErrorMessage` UnicodeString

Event ID 4105: ExtraInfoA master merge cannot be started for catalog CatalogName due to error

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`ErrorMessage` UnicodeString

Event ID 4106: ExtraInfoA master merge cannot be re-started for catalog CatalogName due to error

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`ErrorMessage` UnicodeString

Event ID 4121: ExtraInfoA master merge has restarted for catalog

Channel: Application, Operational
Level: Informational

Fields #

Name	Description
`ExtraInfo`
`CatalogName`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "Windows Search Service",
    "event_id": 4121,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2014-11-26T23:22:14.000000Z",
    "event_record_id": 1157,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "\n",
    "CatalogName": "SystemIndex"
  }
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4138: An index corruption was detected in component Component in catalog

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Component` UnicodeString
`CatalogName` UnicodeString

Event ID 4163: ExtraInfoA master merge has been paused for catalog CatalogName due to low disk space

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString

Event ID 4164: ExtraInfoCatalog:

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString

Event ID 4165: ExtraInfoCatalog:

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`IndexesPerMergeLevel` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 4166: ExtraInfoCatalog:

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`ExpectedDocCount` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 4167: ExtraInfoCatalog:

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`MasterMergeReason` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 4168: ExtraInfo Unable to create the query engine's first request item due to error

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ErrorMessage` UnicodeString
`__binLength` UInt32
`binary` Binary

Event ID 4169: Error ID Phase happened in Windows Search recovery stage, please restart the service

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Phase` UnicodeString

Event ID 7001: The schema file <SrcFile> cannot be copied to <DstFile>

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`SrcFile` UnicodeString
`DstFile` UnicodeString

Event ID 7010: The index cannot be initialized

Channel: Operational
Level: 2

Fields #

Name	Description
`ExtraInfo` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 7010,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T14:07:09.1120688+00:00",
    "event_record_id": 267229,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "\n\nDetails:\n\t0x%08x (0x80040d06 - The specified object cannot be found. Specify the name of an existing object.  (HRESULT : 0x80040d06))\n"
  },
  "message": "The index cannot be initialized.\n\nDetails:\n\t0x%08x (0x80040d06 - The specified object cannot be found. Specify the name of an existing object.  (HRESULT : 0x80040d06))\n"
}

Event ID 7011: Directory location <Directory> is invalid

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Directory` UnicodeString

Event ID 7013: The update was paused because the disk <Directory> is full

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Directory` UnicodeString

Event ID 7040: The search service has detected corrupted data files in the index {id=CorruptionId}

Channel: Operational
Level: 2

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CorruptionId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 7040,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T14:07:06.4539724+00:00",
    "event_record_id": 267224,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "\n\nDetails:\n\t 0x8e5e01f5 (0x8e5e01f5)\n",
    "CorruptionId": "4810 - onecoreuap\\base\\appmodel\\search\\tquery\\fteutil\\jetutil.cpp (272)"
  },
  "message": "The search service has detected corrupted data files in the index {id=4810 - onecoreuap\\base\\appmodel\\search\\tquery\\fteutil\\jetutil.cpp (272)}. The service will attempt to automatically correct this problem by rebuilding the index.\n\nDetails:\n\t 0x8e5e01f5 (0x8e5e01f5)\n"
}

Event ID 7042: The Windows Search Service is being stopped because there is a problem with the indexer:

Channel: Operational
Level: 2

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Reason` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "",
    "event_id": 7042,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T14:07:06.9226730+00:00",
    "event_record_id": 267227,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "\n\nDetails:\n\tThe content index catalog is corrupt.   0xc0041801 (0xc0041801)\n",
    "Reason": "The catalog is corrupt"
  },
  "message": "The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.\n\nDetails:\n\tThe content index catalog is corrupt.   0xc0041801 (0xc0041801)\n"
}

Event ID 7043: The index cannot be loaded

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 7064: Performance monitoring cannot be initialized because the counters are not loaded or the shared memory object cannot be opened

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 7066: Configuration directory Directory is missing, and disaster recovery must be performed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Directory` UnicodeString

Event ID 7068: The registry cannot be read, possibly because the registry keys for this index are missing

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 7070: The Windows Search Service added catalog

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 7071: The Windows Search Service removed index

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 9000: The Windows Search Service cannot open the Jet property store

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 9001: The Windows Search Service cannot create a Jet property store

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 9002: The Windows Search Service cannot load the property store information

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 9003: The Windows Search Service cannot initialize multi-instancing in Jet

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 10013: The noise files cannot be renamed

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 10014: The noise file "OldNoiseFile"" cannot be renamed to ""NewNoiseFile""

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldNoiseFile` UnicodeString
`NewNoiseFile` UnicodeString

Event ID 10020: Performance Counters could not be loaded for Driver for instance InstanceName InstanceNum due to the following error:

Channel: Operational

Fields #

Name	Description
`Driver` UnicodeString
`InstanceName` UnicodeString
`InstanceNum` UnicodeString
`ErrorMessage` UnicodeString

Event ID 10021: Could not get performance counter registry info for Driver for instance InstanceName InstanceNum due to the following error:

Channel: Operational

Fields #

Name	Description
`Driver` UnicodeString
`InstanceName` UnicodeString
`InstanceNum` UnicodeString
`ErrorMessage` UnicodeString

Event ID 10022: Performance counters will not be loaded because the named objects (shared memory or events) are in use for Driver for instance InstanceName

Channel: Operational

Fields #

Name	Description
`Driver` UnicodeString
`InstanceName` UnicodeString
`InstanceNum` UnicodeString

Event ID 10023: The protocol host process ProtocolHostProcessID did not respond and is being forcibly terminated {filter host process FilterHostProcessID}

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ProtocolHostProcessID` UnicodeString
`FilterHostProcessID` UnicodeString

Event ID 10024: The filter host process FilterHostProcessID did not respond and is being forcibly terminated

Channel: Application
Level: Warning

Fields #

Name	Description
`ExtraInfo`
`FilterHostProcessID`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "guid": "{CA4E628D-8567-4896-AB6B-835B221F373F}",
    "event_source_name": "Windows Search Service",
    "event_id": 10024,
    "version": 0,
    "level": 3,
    "task": 3,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2014-11-25T22:48:11.000000Z",
    "event_record_id": 1044,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ExtraInfo": "\n",
    "FilterHostProcessID": "4008"
  }
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 10024: The filter host process FilterHostProcessID did not respond and is being forcibly terminated

Channel: Operational
Level: 3

Fields #

Name	Description
`ExtraInfo` UnicodeString
`FilterHostProcessID` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 10024,
    "level": 3,
    "task": 3,
    "opcode": 0,
    "time_created": "2026-05-27T20:09:27.3577890+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Application"
  },
  "event_data": {
    "FilterHostProcessID": "7144",
    "ExtraInfo": ""
  }
}

Event ID 10025: The search service has failed to create database instance for the index {ExtraInfo} due to maximum number of instance reached

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 10026: The search service has failed to configure maximum number of database instance

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 10027: The search service has failed to create or load catalog for an user with SID {SID}

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`SID` UnicodeString

Event ID 10028: The search service has failed to unload catalog for an user with SID {SID}

Channel: Operational

Fields #

Name	Description
`ExtraInfo` UnicodeString
`SID` UnicodeString

Event ID 1073742827: The Windows Search Service started.

Channel: Operational
Level: 4

Description

The Windows Search Service started.ExtraInfo.

Message #

The Windows Search Service started.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString	The Windows Search Service started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 1003,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "time_created": "2026-05-27T21:12:13.3924551+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Application"
  },
  "event_data": {
    "ExtraInfo": ""
  }
}

Event ID 1073742828: The Windows Search service is creating the new search index {Reason: Reason}.

Channel: Operational
Level: 4

Description

The Windows Search service is creating the new search index {Reason: Reason}. ExtraInfo.

Message #

The Windows Search service is creating the new search index {Reason: %2}. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Reason` UnicodeString	The Windows Search service is creating the new search index {Reason

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 1004,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "time_created": "2026-04-18T00:27:20.5494469+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Application"
  },
  "event_data": {
    "Reason": "Full Index Reset",
    "ExtraInfo": ""
  }
}

Event ID 1073742829: The Windows Search Service has successfully created the new search index.

Channel: Operational
Level: 4

Description

The Windows Search Service has successfully created the new search index. ExtraInfo.

Message #

The Windows Search Service has successfully created the new search index. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString	The Windows Search Service has successfully created the new search index.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 1005,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "time_created": "2026-04-18T00:27:20.6255220+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Application"
  },
  "event_data": {
    "ExtraInfo": ""
  }
}

Event ID 1073742834: The Windows Search Service has successfully removed the old search index.

Channel: Operational
Level: 4

Description

The Windows Search Service has successfully removed the old search index. ExtraInfo.

Message #

The Windows Search Service has successfully removed the old search index. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 1010,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "time_created": "2026-04-18T00:27:19.5234771+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Application"
  },
  "event_data": {
    "ExtraInfo": ""
  }
}

Event ID 1073742837: Windows Search Service stopped normally.

Channel: Operational
Level: 4

Description

Windows Search Service stopped normally.ExtraInfo.

Message #

Windows Search Service stopped normally.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 1013,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "time_created": "2026-05-27T21:12:09.8066660+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Application"
  },
  "event_data": {
    "ExtraInfo": ""
  }
}

Event ID 1073742841: The Windows Search Service successfully moved index files from OldIndexPath to NewIndexPath.

Channel: Operational

Description

The Windows Search Service successfully moved index files from OldIndexPath to NewIndexPath. ExtraInfo.

Message #

The Windows Search Service successfully moved index files from %2 to %3. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldIndexPath` UnicodeString
`NewIndexPath` UnicodeString

Event ID 1073744865: The index is being reset.

Channel: Operational

Description

The index is being reset.ExtraInfo.

Message #

The index is being reset.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 1073744868: The gatherer index resumed.

Channel: Operational

Description

The gatherer index resumed.ExtraInfo.

Message #

The gatherer index resumed.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 1073744876: The crawl was requested to be stopped.

Channel: Operational

Description

The crawl was requested to be stopped.ExtraInfo.

Message #

The crawl was requested to be stopped.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 1073744884: An update cannot begin because the content source <.

Channel: Operational

Description

An update cannot begin because the content source <URL> is in use by another update already in progress. The update will start as soon as all its content sources are released by updates already in progress.ExtraInfo

Message #

An update cannot begin because the content source <%2> is in use by another update already in progress. The update will start as soon as all its content sources are released by updates already in progress.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`URL` UnicodeString

Event ID 1073744919: The group Domain\Account contains Users members.

Channel: Operational

Description

The group Domain\Account contains Users members. Groups over MaxUsers members are not expanded. ExtraInfo.

Message #

The group %2\%3 contains %4 members. Groups over %5 members are not expanded. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Domain` UnicodeString
`Account` UnicodeString
`Users` UnicodeString
`MaxUsers` UnicodeString

Event ID 1073744920: The local groups cache was flushed, because Reason.

Channel: Operational

Description

The local groups cache was flushed, because Reason. ExtraInfo.

Message #

The local groups cache was flushed, because %2. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Reason` UnicodeString

Event ID 1073745927: ExtraInfoA master merge has completed for catalog CatalogName.

Channel: Operational

Message #

%1A master merge has completed for catalog %2.

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString

Event ID 1073745928: ExtraInfoA master merge has been paused for catalog CatalogName due to error ErrorMessage.

Channel: Operational

Description

ExtraInfoA master merge has been paused for catalog CatalogName due to error ErrorMessage. It will be rescheduled later.

Message #

%1A master merge has been paused for catalog %2 due to error %3. It will be rescheduled later.

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`ErrorMessage` UnicodeString

Event ID 1073745945: ExtraInfoA master merge has restarted for catalog CatalogName.

Channel: Operational

Message #

%1A master merge has restarted for catalog %2.

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString

Event ID 1073745962: An index corruption was detected in component Component in catalog CatalogName.

Channel: Operational

Description

An index corruption was detected in component Component in catalog CatalogName.ExtraInfo.

Message #

An index corruption was detected in component %2 in catalog %3.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Component` UnicodeString
`CatalogName` UnicodeString

Event ID 1073745987: ExtraInfoA master merge has been paused for catalog CatalogName due to low disk space.

Channel: Operational

Description

ExtraInfoA master merge has been paused for catalog CatalogName due to low disk space. The merge will be rescheduled later. Please free some disk space for indexing to continue.

Message #

%1A master merge has been paused for catalog %2 due to low disk space. The merge will be rescheduled later.  Please free some disk space for indexing to continue.

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString

Event ID 1073745988: 1CatalogCatalog: ExtraInfo.

Channel: Operational

Description

1CatalogCatalog: ExtraInfo. A master merge was started due to an external request.

Message #

%1Catalog: %2. A master merge was started due to an external request.

Fields #

Name	Description
`1Catalog`
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString

Event ID 1073745989: 1CatalogCatalog: ExtraInfo.

Channel: Operational

Description

1CatalogCatalog: ExtraInfo. A master merge was started because the catalog reached the maximum number of indexes on the last level (CatalogName).

Message #

%1Catalog: %2. A master merge was started because the catalog reached the maximum number of indexes on the last level (%3).

Fields #

Name	Description
`1Catalog`
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`IndexesPerMergeLevel` UnicodeString
`binary` Binary

Event ID 1073745990: 1CatalogCatalog: ExtraInfo.

Channel: Operational

Description

1CatalogCatalog: ExtraInfo. A master merge was started because the expected number of documents in the catalog (CatalogName) were indexed.

Message #

%1Catalog: %2. A master merge was started because the expected number of documents in the catalog (%3) were indexed.

Fields #

Name	Description
`1Catalog`
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`ExpectedDocCount` UnicodeString
`binary` Binary

Event ID 1073745991: 1CatalogCatalog: ExtraInfo.

Channel: Operational

Description

1CatalogCatalog: ExtraInfo. The master merge was started because of internal reason number CatalogName.

Message #

%1Catalog: %2. The master merge was started because of internal reason number %3.

Fields #

Name	Description
`1Catalog`
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`MasterMergeReason` UnicodeString
`binary` Binary

Event ID 1073748866: The Windows Search Service is being stopped because there is a problem with the indexer: Reason.

Channel: Operational

Description

The Windows Search Service is being stopped because there is a problem with the indexer: Reason.ExtraInfo.

Message #

The Windows Search Service is being stopped because there is a problem with the indexer: %2.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Reason` UnicodeString

Event ID 2147484656: The Windows Search Service is starting up and attempting to remove the old search index {Reason: Reason}.

Channel: Operational
Level: 3

Description

The Windows Search Service is starting up and attempting to remove the old search index {Reason: Reason}. ExtraInfo.

Message #

The Windows Search Service is starting up and attempting to remove the old search index {Reason: %2}. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Reason` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 1008,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "time_created": "2026-04-18T00:27:19.5207507+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Application"
  },
  "event_data": {
    "Reason": "Full Index Reset",
    "ExtraInfo": ""
  }
}

Event ID 2147484662: The Windows Search Service has failed to create one or more path rules.

Channel: Operational

Description

The Windows Search Service has failed to create one or more path rules. The service will continue creating the SystemIndex search index. Debug information: <DebugInfo>. ExtraInfo.

Message #

The Windows Search Service has failed to create one or more path rules.  The service will continue creating the SystemIndex search index.  Debug information: <%2>. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`DebugInfo` UnicodeString

Event ID 2147484663: Event ID EventID for the Windows Search Service has been suppressed RepeatCount time(s) since ReferenceTime.

Channel: Operational

Description

Event ID EventID for the Windows Search Service has been suppressed RepeatCount time(s) since ReferenceTime. This event is used to suppress Windows Search Service events that have occurred frequently within a short period of time. See Event ID EventID for further details on this event.ExtraInfo

Message #

Event ID %2 for the Windows Search Service has been suppressed %3 time(s) since %4. This event is used to suppress Windows Search Service events that have occurred frequently within a short period of time.  See Event ID %2 for further details on this event.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`EventID` UnicodeString
`RepeatCount` UnicodeString
`ReferenceTime` UnicodeString

Event ID 2147484666: While rolling back the index, the Windows Search Service encountered the following error: <Phase,ErrorCode>.

Channel: Operational

Description

While rolling back the index, the Windows Search Service encountered the following error: <Phase,ErrorCode>. Index files were not moved from OldIndexPath to NewIndexPath. ExtraInfo.

Message #

While rolling back the index, the Windows Search Service encountered the following error: <%4,%5>. Index files were not moved from %2 to %3. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldIndexPath` UnicodeString
`NewIndexPath` UnicodeString
`Phase` UnicodeString
`ErrorCode` UnicodeString

Event ID 2147484692: An error occurred in configuration file <FileName>.

Channel: Operational

Description

An error occurred in configuration file <FileName>.ExtraInfo.

Message #

An error occurred in configuration file <%2>.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`FileName` UnicodeString

Event ID 2147484701: The system exception Code occurred, and will be handled.

Channel: Operational

Description

The system exception Code occurred, and will be handled. If this causes problems, contact Microsoft Product Support Services and include the stack trace in the event. StackTrace.

Message #

The system exception %1 occurred, and will be handled.  If this causes problems, contact Microsoft Product Support Services and include the stack trace in the event. %2.

Fields #

Name	Description
`Code` UnicodeString
`StackTrace` UnicodeString

Event ID 2147486671: The update cannot be started because all of the content sources were excluded by site path rules, or removed from the index configuration.

Channel: Operational

Description

The update cannot be started because all of the content sources were excluded by site path rules, or removed from the index configuration.ExtraInfo.

Message #

The update cannot be started because all of the content sources were excluded by site path rules, or removed from the index configuration.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486672: The update cannot be started because the content sources cannot be accessed.

Channel: Operational

Description

The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.ExtraInfo.

Message #

The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486684: Crawl could not be completed on content source <URL>.

Channel: Operational

Description

Crawl could not be completed on content source <URL>.ExtraInfo.

Message #

Crawl could not be completed on content source <%2>.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`URL` UnicodeString

Event ID 2147486685: Crawl could not be started on content source <URL>.

Channel: Operational

Description

Crawl could not be started on content source <URL>.ExtraInfo.

Message #

Crawl could not be started on content source <%2>.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`URL` UnicodeString

Event ID 2147486686: The gatherer is unable to read the registry RegPath.

Channel: Operational

Description

The gatherer is unable to read the registry RegPath.ExtraInfo.

Message #

The gatherer is unable to read the registry %2.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`RegPath` UnicodeString

Event ID 2147486687: A request to start the update has been ignored because the update is already in progress or is scheduled on one or more content sources.

Channel: Operational

Description

A request to start the update has been ignored because the update is already in progress or is scheduled on one or more content sources.ExtraInfo.

Message #

A request to start the update has been ignored because the update is already in progress or is scheduled on one or more content sources.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486690: The index was paused.

Channel: Operational

Description

The index was paused.ExtraInfo.

Message #

The index was paused.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486693: The automatic description length was adjusted from OldLength to NewLength.

Channel: Operational

Description

The automatic description length was adjusted from OldLength to NewLength.ExtraInfo.

Message #

The automatic description length was adjusted from %2 to %3.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldLength` UnicodeString
`NewLength` UnicodeString

Event ID 2147486694: The update for the index cannot be started because the specified content sources were not configured for updates.

Channel: Operational

Description

The update for the index cannot be started because the specified content sources were not configured for updates. Add at least one content source.ExtraInfo.

Message #

The update for the index cannot be started because the specified content sources were not configured for updates. Add at least one content source.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486701: The previous update was reset, or was otherwise interrupted.

Channel: Operational

Description

The previous update was reset, or was otherwise interrupted. A full update of all content sources will be automatically started. ExtraInfo.

Message #

The previous update was reset, or was otherwise interrupted. A full update of all content sources will be automatically started. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486702: The update has been delayed because a disk is full.

Channel: Operational

Description

The update has been delayed because a disk is full. Check the system default temp location and the drive on which search catalog is created. The system default temp location is used for creation of temporary files during crawling. If it is full, crawling pauses. If the system default temp location is full, change the location to a disk with more free space and restart the computer. Changes to the system temp location do not take effect for system services until the computer is restarted.ExtraInfo

Message #

The update has been delayed because a disk is full. Check the system default temp location and the drive on which search catalog is created. The system default temp location is used for creation of temporary files during crawling. If it is full, crawling pauses. If the system default temp location is full, change the location to a disk with more free space and restart the computer. Changes to the system temp location do not take effect for system services until the computer is restarted.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486703: The gatherer property mapping file cannot be opened.

Channel: Operational

Description

The gatherer property mapping file cannot be opened. The default values are being used. You may have to copy the property mapping file from the setup CD, or reinstall the application.ExtraInfo.

Message #

The gatherer property mapping file cannot be opened. The default values are being used. You may have to copy the property mapping file from the setup CD, or reinstall the application.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486704: The automatic description encoding tag value is invalid.

Channel: Operational

Description

The automatic description encoding tag value is invalid. The gatherer is setting this value to "yes"". Fix the gthrprm.txt file.ExtraInfo.

Message #

The automatic description encoding tag value is invalid. The gatherer is setting this value to "yes"". Fix the gthrprm.txt file.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486709: The gatherer log cannot be created.

Channel: Operational

Description

The gatherer log cannot be created.ExtraInfo.

Message #

The gatherer log cannot be created.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486710: The word breaker for language <Locale> cannot be loaded.

Channel: Operational

Description

The word breaker for language <Locale> cannot be loaded.ExtraInfo.

Message #

The word breaker for language <%2> cannot be loaded.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Locale` UnicodeString

Event ID 2147486720: The gatherer is recovering after an improper shutdown.

Channel: Operational

Description

The gatherer is recovering after an improper shutdown. This will delay availability of gathering functions, and may result in some noncritical data loss.ExtraInfo.

Message #

The gatherer is recovering after an improper shutdown.  This will delay availability of gathering functions, and may result in some noncritical data loss.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486721: The gatherer detected pages in the history during recovery that cannot be read, and repaired them.

Channel: Operational

Description

The gatherer detected pages in the history during recovery that cannot be read, and repaired them. However, statistical data for some URLs may have been lost. This can be caused by restarting a computer without first shutting down Windows, or by disk failure.ExtraInfo

Message #

The gatherer detected pages in the history during recovery that cannot be read, and repaired them.  However, statistical data for some URLs may have been lost.  This can be caused by restarting a computer without first shutting down Windows, or by disk failure.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486726: The Windows Search service stopped the Protocol Host process because it was consuming too many resources.

Channel: Operational

Description

The Windows Search service stopped the Protocol Host process because it was consuming too many resources. A new Protocol Host process will be started. No user action is required.ExtraInfo.

Message #

The Windows Search service stopped the Protocol Host process because it was consuming too many resources.  A new Protocol Host process will be started.  No user action is required.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147486734: The system locale has changed.

Channel: Operational

Description

The system locale has changed. Existing data will be deleted and the index must be recreated.ExtraInfo.

Message #

The system locale has changed. Existing data will be deleted and the index must be recreated.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147487816: ExtraInfo Unable to create the query engine's first request item due to error ErrorMessage.

Channel: Operational

Description

ExtraInfo Unable to create the query engine's first request item due to error ErrorMessage. It's possible that the MSFTESQL service account is invalid or the password has expired.

Message #

%1 Unable to create the query engine's first request item due to error %2. It's possible that the MSFTESQL service account is invalid or the password has expired.

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ErrorMessage` UnicodeString
`binary` Binary

Event ID 2147487817: Error ID Phase happened in Windows Search recovery stage, please restart the service.

Channel: Operational

Description

Error ID Phase happened in Windows Search recovery stage, please restart the service. If this error persists, please recreate the index.ExtraInfo.

Message #

Error ID %2 happened in Windows Search recovery stage, please restart the service. If this error persists, please recreate the index.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Phase` UnicodeString

Event ID 2147492651: The Windows Search Service cannot initialize multi-instancing in Jet.

Channel: Operational

Description

The Windows Search Service cannot initialize multi-instancing in Jet. If the application is used in a cluster environment, all applications using Jet will fail in the same group.ExtraInfo.

Message #

The Windows Search Service cannot initialize multi-instancing in Jet. If the application is used in a cluster environment, all applications using Jet will fail in the same group.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147493661: The noise files cannot be renamed.

Channel: Operational

Description

The noise files cannot be renamed.ExtraInfo.

Message #

The noise files cannot be renamed.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147493662: The noise file "OldNoiseFile"" cannot be renamed to ""NewNoiseFile"".

Channel: Operational

Description

The noise file "OldNoiseFile"" cannot be renamed to ""NewNoiseFile"".ExtraInfo.

Message #

The noise file "%2"" cannot be renamed to ""%3"".%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldNoiseFile` UnicodeString
`NewNoiseFile` UnicodeString

Event ID 2147493668: Performance Counters could not be loaded for Driver for instance InstanceName InstanceNum due to the following error: ErrorMessage.

Channel: Operational

Message #

Performance Counters could not be loaded for %1 for instance %2 %3 due to the following error: %4.

Fields #

Name	Description
`Driver` UnicodeString
`InstanceName` UnicodeString
`InstanceNum` UnicodeString
`ErrorMessage` UnicodeString

Event ID 2147493669: Could not get performance counter registry info for Driver for instance InstanceName InstanceNum due to the following error: ErrorMessage.

Channel: Operational

Message #

Could not get performance counter registry info for %1 for instance %2 %3 due to the following error: %4.

Fields #

Name	Description
`Driver` UnicodeString
`InstanceName` UnicodeString
`InstanceNum` UnicodeString
`ErrorMessage` UnicodeString

Event ID 2147493670: Performance counters will not be loaded because the named objects (shared memory or events) are in use for Driver for instance InstanceName InstanceNum.

Channel: Operational

Message #

Performance counters will not be loaded because the named objects (shared memory or events) are in use for %1 for instance %2 %3.

Fields #

Name	Description
`Driver` UnicodeString
`InstanceName` UnicodeString
`InstanceNum` UnicodeString

Event ID 2147493671: The protocol host process ProtocolHostProcessID did not respond and is being forcibly terminated {filter host process FilterHostProcessID}.

Channel: Operational

Description

The protocol host process ProtocolHostProcessID did not respond and is being forcibly terminated {filter host process FilterHostProcessID}. ExtraInfo.

Message #

The protocol host process %2 did not respond and is being forcibly terminated {filter host process %3}. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ProtocolHostProcessID` UnicodeString
`FilterHostProcessID` UnicodeString

Event ID 2147493672: The filter host process FilterHostProcessID did not respond and is being forcibly terminated.

Channel: Operational
Level: 3

Description

The filter host process FilterHostProcessID did not respond and is being forcibly terminated. ExtraInfo.

Message #

The filter host process %2 did not respond and is being forcibly terminated. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`FilterHostProcessID` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Search",
    "event_id": 10024,
    "level": 3,
    "task": 3,
    "opcode": 0,
    "time_created": "2026-05-27T20:09:27.3577890+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Application"
  },
  "event_data": {
    "FilterHostProcessID": "7144",
    "ExtraInfo": ""
  }
}

Event ID 2147493673: The search service has failed to create database instance for the index {ExtraInfo} due to maximum number of instance reached.

Channel: Operational

Description

The search service has failed to create database instance for the index {ExtraInfo} due to maximum number of instance reached. Please re-configure maximum value and restart the service.

Message #

The search service has failed to create database instance for the index {%1} due to maximum number of instance reached. Please re-configure maximum value and restart the service.

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147493674: The search service has failed to configure maximum number of database instance.

Channel: Operational

Description

The search service has failed to configure maximum number of database instance. {ExtraInfo}. Please re-configure maximum value and restart the service.

Message #

The search service has failed to configure maximum number of database instance. {%1}. Please re-configure maximum value and restart the service.

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 2147493675: The search service has failed to create or load catalog for an user with SID {.

Channel: Operational

Description

The search service has failed to create or load catalog for an user with SID {SID}. Please inspect a profile directory for the user is accessible. You should re-start the search service after fixing any issue found from the profile directory. ExtraInfo

Message #

The search service has failed to create or load catalog for an user with SID {%2}. Please inspect a profile directory for the user is accessible. You should re-start the search service after fixing any issue found from the profile directory. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`SID` UnicodeString

Event ID 2147493676: The search service has failed to unload catalog for an user with SID {SID}.

Channel: Operational

Description

The search service has failed to unload catalog for an user with SID {SID}. ExtraInfo.

Message #

The search service has failed to unload catalog for an user with SID {%2}. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`SID` UnicodeString

Event ID 3221226478: The Windows Search Service has failed to create the new search index.

Channel: Operational

Description

The Windows Search Service has failed to create the new search index. Internal error <Phase, HR, DiagnosticsInfo>. ExtraInfo.

Message #

The Windows Search Service has failed to create the new search index. Internal error <%2, %3, %4>. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Phase` UnicodeString
`HR` UnicodeString
`DiagnosticsInfo` UnicodeString

Event ID 3221226479: The Windows Search Service was unable to allocate memory.

Channel: Operational

Description

The Windows Search Service was unable to allocate memory.ExtraInfo.

Message #

The Windows Search Service was unable to allocate memory.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221226481: An exception occurred in Address.

Channel: Operational

Description

An exception occurred in Address. Check other related Event Log messages.ExtraInfo.

Message #

An exception occurred in %2. Check other related Event Log messages.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Address` UnicodeString

Event ID 3221226483: The Windows Search Service has failed to remove the old search index.

Channel: Operational

Description

The Windows Search Service has failed to remove the old search index. Internal error <Phase,HR>. ExtraInfo.

Message #

The Windows Search Service has failed to remove the old search index. Internal error <%2,%3>. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Phase` UnicodeString
`HR` UnicodeString

Event ID 3221226488: The Windows Search Service failed to move Index files from OldIndexPath to NewIndexPath with the following error: <Phase,ErrorCode>.

Channel: Operational

Description

The Windows Search Service failed to move Index files from OldIndexPath to NewIndexPath with the following error: <Phase,ErrorCode>. This might be because the target directory is not empty, or because the SYSTEM account doesn't have write access to the target directory. ExtraInfo

Message #

The Windows Search Service failed to move Index files from %2 to %3 with the following error: <%4,%5>. This might be because the target directory is not empty, or because the SYSTEM account doesn't have write access to the target directory. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`OldIndexPath` UnicodeString
`NewIndexPath` UnicodeString
`Phase` UnicodeString
`ErrorCode` UnicodeString

Event ID 3221226491: Windows Search Service failed to process the list of included and excluded locations with the error <Phase, ErrorCode, "Path">.

Channel: Operational

Description

Windows Search Service failed to process the list of included and excluded locations with the error <Phase, ErrorCode, "Path">. ExtraInfo.

Message #

Windows Search Service failed to process the list of included and excluded locations with the error <%2, %3, "%4">. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Phase` UnicodeString
`ErrorCode` UnicodeString
`Path` UnicodeString

Event ID 3221228475: A configuration error occurred.

Channel: Operational

Description

A configuration error occurred.ExtraInfo.

Message #

A configuration error occurred.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228478: Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be op...

Channel: Operational

Description

Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.ExtraInfo

Message #

Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228479: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be ope...

Channel: Operational

Description

Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.ExtraInfo

Message #

Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228480: The entry <Entry> cannot be inserted into the history.

Channel: Operational

Description

The entry <Entry> cannot be inserted into the history.ExtraInfo.

Message #

The entry <%2> cannot be inserted into the history.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Entry` UnicodeString

Event ID 3221228481: The transaction object cannot be created.

Channel: Operational

Description

The transaction object cannot be created.ExtraInfo.

Message #

The transaction object cannot be created.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228482: The transaction cannot be appended to the queue.

Channel: Operational

Description

The transaction cannot be appended to the queue. File: FilePath.ExtraInfo.

Message #

The transaction cannot be appended to the queue. File: %2.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`FilePath` UnicodeString

Event ID 3221228483: The transaction cannot be updated in the queue.

Channel: Operational

Description

The transaction cannot be updated in the queue. File: FilePath.ExtraInfo.

Message #

The transaction cannot be updated in the queue. File: %2.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`FilePath` UnicodeString

Event ID 3221228485: The entry <Entry> in the hash map cannot be updated.

Channel: Operational

Description

The entry <Entry> in the hash map cannot be updated.ExtraInfo.

Message #

The entry <%2> in the hash map cannot be updated.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Entry` UnicodeString

Event ID 3221228486: An exception occurred.

Channel: Operational

Description

An exception occurred. ID: ID. This is an internal error. Reproduce the error with the debugger attached and enable exceptions, then contact product support. One of the components loaded in your system is bad. You may be able to avoid the problem by recreating the index.ExtraInfo

Message #

An exception occurred. ID: %2. This is an internal error. Reproduce the error with the debugger attached and enable exceptions, then contact product support. One of the components loaded in your system is bad. You may be able to avoid the problem by recreating the index.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ID` UnicodeString

Event ID 3221228487: The transaction file cannot be read.

Channel: Operational

Description

The transaction file cannot be read.ExtraInfo.

Message #

The transaction file cannot be read.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228492: Internal gatherer error ErrorCode occurred.

Channel: Operational

Description

Internal gatherer error ErrorCode occurred. Please contact Microsoft Product Support Services.ExtraInfo.

Message #

Internal gatherer error %2 occurred. Please contact Microsoft Product Support Services.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ErrorCode` UnicodeString

Event ID 3221228497: Critical error ErrorCode occurred, and the index was shut down.

Channel: Operational

Description

Critical error ErrorCode occurred, and the index was shut down. The system is probably low on resources. Free up resources and restart the service.ExtraInfo.

Message #

Critical error %2 occurred, and the index was shut down. The system is probably low on resources. Free up resources and restart the service.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ErrorCode` UnicodeString

Event ID 3221228498: Advise Status Change failed.

Channel: Operational

Description

Advise Status Change failed. The system is probably low on resources. Free up resources and restart the service.ExtraInfo.

Message #

Advise Status Change failed. The system is probably low on resources. Free up resources and restart the service.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228499: The URL <URL> cannot be crawled.

Channel: Operational

Description

The URL <URL> cannot be crawled.ExtraInfo.

Message #

The URL <%2> cannot be crawled.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`URL` UnicodeString

Event ID 3221228500: The gatherer object cannot be initialized.

Channel: Operational

Description

The gatherer object cannot be initialized.ExtraInfo.

Message #

The gatherer object cannot be initialized.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228501: The plug-in in <Plugin> cannot be initialized.

Channel: Operational

Description

The plug-in in <Plugin> cannot be initialized.ExtraInfo.

Message #

The plug-in in <%2> cannot be initialized.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Plugin` UnicodeString

Event ID 3221228502: The gatherer service cannot be initialized.

Channel: Operational

Description

The gatherer service cannot be initialized.ExtraInfo.

Message #

The gatherer service cannot be initialized.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228503: A document ID cannot be allocated.

Channel: Operational

Description

A document ID cannot be allocated.ExtraInfo.

Message #

A document ID cannot be allocated.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228504: A document ID cannot be freed.

Channel: Operational

Description

A document ID cannot be freed.ExtraInfo.

Message #

A document ID cannot be freed.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228505: A new queue file cannot be created.

Channel: Operational

Description

A new queue file cannot be created.ExtraInfo.

Message #

A new queue file cannot be created.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228506: The registry version does not match with the expected <.

Channel: Operational

Description

The registry version does not match with the expected <ExpectedVersion>, or the registry cannot be accessed because the service account does not have the correct permissions. Uninstall the previous version before installing the new one.ExtraInfo

Message #

The registry version does not match with the expected <%2>, or the registry cannot be accessed because the service account does not have the correct permissions.  Uninstall the previous version before installing the new one.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ExpectedVersion` UnicodeString

Event ID 3221228512: The status change request RequestedStatusMessage cannot be processed.

Channel: Operational

Description

The status change request RequestedStatusMessage cannot be processed.ExtraInfo.

Message #

The status change request %2 cannot be processed.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`RequestedStatusMessage` UnicodeString

Event ID 3221228520: No documents were accessed because no e-mail address is specified in the content index server properties.

Channel: Operational

Description

No documents were accessed because no e-mail address is specified in the content index server properties. Specify the e-mail address in the service configuration.ExtraInfo.

Message #

No documents were accessed because no e-mail address is specified in the content index server properties. Specify the e-mail address in the service configuration.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228522: Unvisited items cannot be deleted from the history after a full update.

Channel: Operational

Description

Unvisited items cannot be deleted from the history after a full update.ExtraInfo.

Message #

Unvisited items cannot be deleted from the history after a full update.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228529: The plug-in manager <PluginManager> cannot be initialized.

Channel: Operational

Description

The plug-in manager <PluginManager> cannot be initialized.ExtraInfo.

Message #

The plug-in manager <%2> cannot be initialized.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`PluginManager` UnicodeString

Event ID 3221228530: The application cannot be initialized.

Channel: Operational

Description

The application cannot be initialized.ExtraInfo.

Message #

The application cannot be initialized.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228531: The update cannot be initialized.

Channel: Operational

Description

The update cannot be initialized.ExtraInfo.

Message #

The update cannot be initialized.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228551: Notifications for the volume VolumeName are not active.

Channel: Operational

Description

Notifications for the volume VolumeName are not active. ExtraInfo.

Message #

Notifications for the volume %2 are not active. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`VolumeName` UnicodeString

Event ID 3221228555: The protocol handler ProtocolHandler cannot be loaded.

Channel: Operational

Description

The protocol handler ProtocolHandler cannot be loaded. Error description: ErrorMessage. ExtraInfo.

Message #

The protocol handler %2 cannot be loaded. Error description: %3. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ProtocolHandler` UnicodeString
`ErrorMessage` UnicodeString

Event ID 3221228556: Failed to load protocol handler ProtocolHandler.

Channel: Operational

Description

Failed to load protocol handler ProtocolHandler. Error description: ErrorMessage. ExtraInfo.

Message #

Failed to load protocol handler %2. Error description: %3. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`ProtocolHandler` UnicodeString
`ErrorMessage` UnicodeString

Event ID 3221228557: The application network access account is invalid.

Channel: Operational

Description

The application network access account is invalid. Update the account with a valid username and password. ExtraInfo.

Message #

The application network access account is invalid.  Update the account with a valid username and password. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228559: The gatherer files cannot be flushed, and this action cannot be completed.

Channel: Operational

Description

The gatherer files cannot be flushed, and this action cannot be completed. The gatherer will attempt to flush files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. ExtraInfo

Message #

The gatherer files cannot be flushed, and this action cannot be completed. The gatherer will attempt to flush files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228560: The checkpoint record cannot be updated, and this action cannot be completed.

Channel: Operational

Description

The checkpoint record cannot be updated, and this action cannot be completed. The gatherer will attempt to update the checkpoint record again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. ExtraInfo

Message #

The checkpoint record cannot be updated, and this action cannot be completed. The gatherer will attempt to update the checkpoint record again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228561: The gatherer files cannot be saved, and this action cannot be completed.

Channel: Operational

Description

The gatherer files cannot be saved, and this action cannot be completed. The gatherer will attempt to save the files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. ExtraInfo

Message #

The gatherer files cannot be saved, and this action cannot be completed. The gatherer will attempt to save the files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228562: The gatherer files from the previous checkpoint cannot be restored, and this action cannot be completed.

Channel: Operational

Description

The gatherer files from the previous checkpoint cannot be restored, and this action cannot be completed. The gatherer will attempt to restore the files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. ExtraInfo

Message #

The gatherer files from the previous checkpoint cannot be restored, and this action cannot be completed. The gatherer will attempt to restore the files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228563: The checkpoint record cannot be read, and this action cannot be completed.

Channel: Operational

Description

The checkpoint record cannot be read, and this action cannot be completed. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. ExtraInfo.

Message #

The checkpoint record cannot be read, and this action cannot be completed.  If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228564: The project cannot be initialized, because the checkpoint record cannot be read.

Channel: Operational

Description

The project cannot be initialized, because the checkpoint record cannot be read. The data structures on the disk will be reset. Verify that your hardware is working properly. ExtraInfo.

Message #

The project cannot be initialized, because the checkpoint record cannot be read. The data structures on the disk will be reset.  Verify that your hardware is working properly. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228565: The project cannot be initialized, because one of the checkpoint files is missing.

Channel: Operational

Description

The project cannot be initialized, because one of the checkpoint files is missing. The data structures on the disk will be reset. Check to see if someone is manually deleting files, and verify that your hardware is working properly. ExtraInfo

Message #

The project cannot be initialized, because one of the checkpoint files is missing. The data structures on the disk will be reset.  Check to see if someone is manually deleting files, and verify that your hardware is working properly. %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228569: The gatherer did not connect to the SQLServer instance.

Channel: Operational

Description

The gatherer did not connect to the SQLServer instance.ExtraInfo.

Message #

The gatherer did not connect to the SQLServer instance.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228571: Unable to terminate notifications normally.

Channel: Operational

Description

Unable to terminate notifications normally. Restart the service or contact Product Support.ExtraInfo.

Message #

Unable to terminate notifications normally.  Restart the service or contact Product Support.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228572: Unable to initialize the filter host process.

Channel: Operational

Description

Unable to initialize the filter host process. Terminating.ExtraInfo.

Message #

Unable to initialize the filter host process. Terminating.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221228573: The filter host process could not be terminated.

Channel: Operational

Event ID 3221229577: ExtraInfoA master merge cannot be started for catalog CatalogName due to error ErrorMessage.

Channel: Operational

Message #

%1A master merge cannot be started for catalog %2 due to error %3.

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`ErrorMessage` UnicodeString

Event ID 3221229578: ExtraInfoA master merge cannot be re-started for catalog CatalogName due to error ErrorMessage.

Channel: Operational

Message #

%1A master merge cannot be re-started for catalog %2 due to error %3.

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CatalogName` UnicodeString
`ErrorMessage` UnicodeString

Event ID 3221232473: The schema file <SrcFile> cannot be copied to <DstFile>.

Channel: Operational

Description

The schema file <SrcFile> cannot be copied to <DstFile>.ExtraInfo.

Message #

The schema file <%2> cannot be copied to <%3>.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`SrcFile` UnicodeString
`DstFile` UnicodeString

Event ID 3221232482: The index cannot be initialized.

Channel: Operational

Description

The index cannot be initialized.ExtraInfo.

Message #

The index cannot be initialized.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221232483: Directory location <Directory> is invalid.

Channel: Operational

Description

Directory location <Directory> is invalid. The application configuration cannot be read. Reinstall the application.ExtraInfo.

Message #

Directory location <%2> is invalid. The application configuration cannot be read.  Reinstall the application.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Directory` UnicodeString

Event ID 3221232485: The update was paused because the disk <Directory> is full.

Channel: Operational

Description

The update was paused because the disk <Directory> is full. Free up disk space to continue crawling the index.ExtraInfo.

Message #

The update was paused because the disk <%2> is full. Free up disk space to continue crawling the index.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Directory` UnicodeString

Event ID 3221232512: The search service has detected corrupted data files in the index {id=CorruptionId}.

Channel: Operational

Description

The search service has detected corrupted data files in the index {id=CorruptionId}. The service will attempt to automatically correct this problem by rebuilding the index.ExtraInfo.

Message #

The search service has detected corrupted data files in the index {id=%2}. The service will attempt to automatically correct this problem by rebuilding the index.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`CorruptionId` UnicodeString

Event ID 3221232515: The index cannot be loaded.

Channel: Operational

Description

The index cannot be loaded.ExtraInfo.

Message #

The index cannot be loaded.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221232536: Performance monitoring cannot be initialized because the counters are not loaded or the shared memory object cannot be opened.

Channel: Operational

Description

Performance monitoring cannot be initialized because the counters are not loaded or the shared memory object cannot be opened. Stop and restart the search service. If this error continues, reinstall the application.ExtraInfo

Message #

Performance monitoring cannot be initialized because the counters are not loaded or the shared memory object cannot be opened. Stop and restart the search service.  If this error continues, reinstall the application.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221232538: Configuration directory Directory is missing, and disaster recovery must be performed.

Channel: Operational

Description

Configuration directory Directory is missing, and disaster recovery must be performed. If there are existing indexes, they must be restored from the last backup. If there is no backup of index data, then delete the catalogs and recreate them.ExtraInfo

Message #

Configuration directory %2 is missing, and disaster recovery must be performed. If there are existing indexes, they must be restored from the last backup. If there is no backup of index data, then delete the catalogs and recreate them.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString
`Directory` UnicodeString

Event ID 3221232540: The registry cannot be read, possibly because the registry keys for this index are missing.

Channel: Operational

Description

The registry cannot be read, possibly because the registry keys for this index are missing. You may have to delete and recreate the index ExtraInfo.

Message #

The registry cannot be read, possibly because the registry keys for this index are missing. You may have to delete and recreate the index %1.

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221232542: The Windows Search Service added catalog ExtraInfo.

Channel: Operational

Message #

The Windows Search Service added catalog %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221232543: The Windows Search Service removed index ExtraInfo.

Channel: Operational

Message #

The Windows Search Service removed index %1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221234472: The Windows Search Service cannot open the Jet property store.

Channel: Operational

Description

The Windows Search Service cannot open the Jet property store.ExtraInfo.

Message #

The Windows Search Service cannot open the Jet property store.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221234473: The Windows Search Service cannot create a Jet property store.

Channel: Operational

Description

The Windows Search Service cannot create a Jet property store.ExtraInfo.

Message #

The Windows Search Service cannot create a Jet property store.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Event ID 3221234474: The Windows Search Service cannot load the property store information.

Channel: Operational

Description

The Windows Search Service cannot load the property store information.ExtraInfo.

Message #

The Windows Search Service cannot load the property store information.%1

Fields #

Name	Description
`ExtraInfo` UnicodeString

Provenance

ETW provider GUID ca4e628d-8567-4896-ab6b-835b221f373f

Defined in tquery.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 7.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 7.0.26100.4946, captured 2026-06-02 — Manifest XML pack, 2.0 MB