Microsoft-Windows-SettingSync-OneDrive

Event	Title	Channel	Sample	Rule
1000	Event ID 1000	Operational	N	N
1001	Event ID 1001	Operational	N	N
1002	Event ID 1002	Operational	N	N
1003	Cannot find restore folder for collection {CollectionId}.	Operational	N	N
1004	Reupload Needed request for {CollectionId}.	Operational	N	N
1005	Shared settings in the collection {CollectionId} didnt sync.	Operational	N	N
1006	Cloud sync provider encountered an unexpected null setting unit in collection …	Operational	N	N
1007	Cloud provider failed to update setting unit {SettingUnitId} in collection …	Operational	N	N
1008	MSA ticket request failed for current user.	Operational	N	N
1012	The sync server returned error {Value}.	Operational	N	N
1013	Settings view failed to parse.	Operational	N	N
1014	UserTile view failed to parse.	Operational	N	N
1015	Failed to parse response from Live Storage Quota API.	Operational	N	N
1016	Activation of PDC failed.	Operational	N	N
1017	Policy document failed to parse.	Operational	N	N
1018	Policy document failed to download.	Operational	N	N
1019	Policy document failed to save.	Operational	N	N
1020	Notification WNS channel {ChannelName} creation failed (Result: {HRESULT}).	Operational	N	N
1021	Notification WLS channel {ChannelName} creation failed (Result: {HRESULT}).	Operational	N	N
3000	Event ID 3000	Debug	N	N
3001	Event ID 3001	Debug	N	N
3002	Event ID 3002	Debug	N	N
3003	Setting unit {SettingUnitId} failed to upload with WriteStatus ({WriteStatus}).	Debug	N	N
3004	A garbage collection occurred in cloud storage.	Debug	N	N
3005	Device was still interested in garbge collected collection {CollectionId}.	Debug	N	N
3006	Collection {CollectionId} was removed completely from the device due to a …	Debug	N	N
3008	Collection {CollectionId} failed to back up (Result: {HRESULT}).	Debug	N	N
3009	Property {PropStoreName} of the setting unit {SettingUnitId} was not applied as …	Debug	N	N
3010	The {ProviderName} provider cleaned up tombstones for {CollectionId} (HRESULT: …	Debug	N	N
3011	Setting unit {SettingUnitId} in collection {CollectionId} was backed up via BITS …	Debug	N	N
3012	Cloud provider updated setting unit {SettingUnitId} in collection {CollectionId} …	Debug	N	N
3013	A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was …	Debug	N	N
3014	A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was …	Debug	N	N
3015	Ramp State Update: {Name} upgraded from {OldValue} to {NewValue}.	Debug	N	N
3017	BITS Upload session failed for setting unit {SettingUnitId} for collection …	Debug	N	N
3018	Register Notification Response: {Response}.	Debug	N	N
3020	Storage request: {Verb} to {Url} completed with status code {StatusCode}.	Debug	N	N
3021	Uploading Batch to service with transaction Id: {TransactionId}.	Debug	N	N
3022	Collection Metadata Destroy Failure.	Debug	N	N
3023	PDCActivation was used by process {Message} instead of SettingSyncHost.	Debug	N	N
3024	Collection {CollectionId} was blocked from uploading to cloud storage.	Debug	N	N
3025	Collection {CollectionId} was blocked from downloading to Windows.	Debug	N	N
3026	Storage subscription operation (create/update) failed for {CollectionId} …	Debug	N	N
3027	Storage subscription operation (delete) failed for {CollectionId} (HRESULT: …	Debug	N	N
3029	The collection ({CollectionId}) is being throttled due to excessive syncing.	Debug	N	N
9000	Event ID 9000	Analytic	N	N
9001	Event ID 9001	Analytic	N	N
9002	Event ID 9002	Analytic	N	N

Event ID 1000

Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1001

Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1002

Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1003: Cannot find restore folder for collection {CollectionId}.

Channel: Operational

Description

Cannot find restore folder for collection {CollectionId}. Looks like it was stolen by another device and then deleted.

Message #

Cannot find restore folder for collection {CollectionId}. Looks like it was stolen by another device and then deleted.

Fields #

Name	Description
`CollectionId`

Event ID 1004: Reupload Needed request for {CollectionId}.

Channel: Operational

Description

Reupload Needed request for {CollectionId}. (Result: {HRESULT}).

Message #

Reupload Needed request for {CollectionId}. (Result: {HRESULT})

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 1005: Shared settings in the collection {CollectionId} didnt sync.

Channel: Operational

Message #

Shared settings in the collection {CollectionId} didnt sync. The updates were blocked by the server because theyre too big or have changed too frequently. The settings will sync again when the limits have been reset.

Fields #

Name	Description
`CollectionId`

Event ID 1006: Cloud sync provider encountered an unexpected null setting unit in collection {CollectionId} (saveAction: {Value}; Result: {HRESULT}).

Channel: Operational

Fields #

Name	Description
`CollectionId`
`Value`
`HRESULT`

Event ID 1007: Cloud provider failed to update setting unit {SettingUnitId} in collection {CollectionId} (Operation: {Operation}; Result: {HRESULT}).

Channel: Operational

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`HRESULT`

Event ID 1008: MSA ticket request failed for current user.

Channel: Operational

Description

MSA ticket request failed for current user. (Result: {HRESULT}).

Message #

MSA ticket request failed for current user. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1012: The sync server returned error {Value}.

Channel: Operational

Description

The sync server returned error {Value}. Shared settings might be out of sync.

Message #

The sync server returned error {Value}. Shared settings might be out of sync.

Fields #

Name	Description
`Value`

Event ID 1013: Settings view failed to parse.

Channel: Operational

Description

Settings view failed to parse. (Result: {HRESULT}).

Message #

Settings view failed to parse. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1014: UserTile view failed to parse.

Channel: Operational

Description

UserTile view failed to parse. (Result: {HRESULT}).

Message #

UserTile view failed to parse. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1015: Failed to parse response from Live Storage Quota API.

Channel: Operational

Description

Failed to parse response from Live Storage Quota API. (Result: {HRESULT}).

Message #

Failed to parse response from Live Storage Quota API. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1016: Activation of PDC failed.

Channel: Operational

Description

Activation of PDC failed. (Result: {HRESULT}).

Message #

Activation of PDC failed. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1017: Policy document failed to parse.

Channel: Operational

Description

Policy document failed to parse. (Result: {HRESULT}).

Message #

Policy document failed to parse. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1018: Policy document failed to download.

Channel: Operational

Description

Policy document failed to download. (Result: {HRESULT}).

Message #

Policy document failed to download. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1019: Policy document failed to save.

Channel: Operational

Description

Policy document failed to save. (Result: {HRESULT}).

Message #

Policy document failed to save. (Result: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 1020: Notification WNS channel {ChannelName} creation failed (Result: {HRESULT}).

Channel: Operational

Fields #

Name	Description
`ChannelName`
`HRESULT`

Event ID 1021: Notification WLS channel {ChannelName} creation failed (Result: {HRESULT}).

Channel: Operational

Fields #

Name	Description
`ChannelName`
`HRESULT`

Event ID 3000

Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 3001

Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 3002

Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 3003: Setting unit {SettingUnitId} failed to upload with WriteStatus ({WriteStatus}).

Channel: Debug

Fields #

Name	Description
`SettingUnitId`
`WriteStatus`

Event ID 3004: A garbage collection occurred in cloud storage.

Channel: Debug

Description

A garbage collection occurred in cloud storage. {Value} collection(s) on this device were removed.

Message #

A garbage collection occurred in cloud storage. {Value} collection(s) on this device were removed.

Fields #

Name	Description
`Value`

Event ID 3005: Device was still interested in garbge collected collection {CollectionId}.

Channel: Debug

Fields #

Name	Description
`CollectionId`

Event ID 3006: Collection {CollectionId} was removed completely from the device due to a garbage collection in cloud storage.

Channel: Debug

Fields #

Name	Description
`CollectionId`

Event ID 3008: Collection {CollectionId} failed to back up (Result: {HRESULT}).

Channel: Debug

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 3009: Property {PropStoreName} of the setting unit {SettingUnitId} was not applied as more recent settings were detected locally.

Channel: Debug

Fields #

Name	Description
`PropStoreName`
`SettingUnitId`

Event ID 3010: The {ProviderName} provider cleaned up tombstones for {CollectionId} (HRESULT: {HRESULT}).

Channel: Debug

Fields #

Name	Description
`ProviderName`
`CollectionId`
`HRESULT`

Event ID 3011: Setting unit {SettingUnitId} in collection {CollectionId} was backed up via BITS (Result: {HRESULT}).

Channel: Debug

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`HRESULT`

Event ID 3012: Cloud provider updated setting unit {SettingUnitId} in collection {CollectionId} (Operation: {Operation}).

Channel: Debug

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 3013: A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage.

Channel: Debug

Description

A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage. Attempting repair.

Message #

A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage. Attempting repair.

Fields #

Name	Description
`SettingUnitId`
`CollectionId`

Event ID 3014: A missing blob for setting unit {SettingUnitId} in collection {CollectionId} was detected in cloud storage; but this client cannot repair it.

Channel: Debug

Fields #

Name	Description
`SettingUnitId`
`CollectionId`

Event ID 3015: Ramp State Update: {Name} upgraded from {OldValue} to {NewValue}.

Channel: Debug

Fields #

Name	Description
`Name`
`OldValue`
`NewValue`

Event ID 3017: BITS Upload session failed for setting unit {SettingUnitId} for collection {CollectionId} (HRESULT: {Operation}).

Channel: Debug

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 3018: Register Notification Response: {Response}.

Channel: Debug

Fields #

Name	Description
`Response`

Event ID 3020: Storage request: {Verb} to {Url} completed with status code {StatusCode}.

Channel: Debug

Fields #

Name	Description
`Verb`
`Url`
`StatusCode`	NTSTATUS reference

Event ID 3021: Uploading Batch to service with transaction Id: {TransactionId}.

Channel: Debug

Fields #

Name	Description
`TransactionId`

Event ID 3022: Collection Metadata Destroy Failure.

Channel: Debug

Description

Collection Metadata Destroy Failure. Collection Id: {Message}. HRESULT: {HRESULT}.

Message #

Collection Metadata Destroy Failure. Collection Id: {Message}. HRESULT: {HRESULT}.

Fields #

Name	Description
`Message`
`HRESULT`

Event ID 3023: PDCActivation was used by process {Message} instead of SettingSyncHost.

Channel: Debug

Fields #

Name	Description
`Message`

Event ID 3024: Collection {CollectionId} was blocked from uploading to cloud storage.

Channel: Debug

Description

Collection {CollectionId} was blocked from uploading to cloud storage. (Reason: {Reason}).

Message #

Collection {CollectionId} was blocked from uploading to cloud storage. (Reason: {Reason})

Fields #

Name	Description
`CollectionId`
`Reason`

Event ID 3025: Collection {CollectionId} was blocked from downloading to Windows.

Channel: Debug

Description

Collection {CollectionId} was blocked from downloading to Windows. (Reason: {Reason}).

Message #

Collection {CollectionId} was blocked from downloading to Windows. (Reason: {Reason})

Fields #

Name	Description
`CollectionId`
`Reason`

Event ID 3026: Storage subscription operation (create/update) failed for {CollectionId} (HRESULT: {HRESULT}).

Channel: Debug

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 3027: Storage subscription operation (delete) failed for {CollectionId} (HRESULT: {HRESULT}).

Channel: Debug

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 3029: The collection ({CollectionId}) is being throttled due to excessive syncing.

Channel: Debug

Fields #

Name	Description
`CollectionId`

Event ID 9000

Channel: Analytic

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 9001

Channel: Analytic

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 9002

Channel: Analytic

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`