Microsoft-Windows-Storage-Tiering

11 events across 2 channels

Event	Title	Channel	Sample
1	Volume {VolumeGuid} (ID {VolumeIdHash}) is measuring I/O heat.	Tiering Heat Measurement Channel	N
2	READ - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} …	Tiering Heat Measurement Channel	N
3	WRITE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} …	Tiering Heat Measurement Channel	N
4	DELETE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper}.	Tiering Heat Measurement Channel	N
5	TIERMOVE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: …	Tiering Heat Measurement Channel	N
11	The Storage Tiers Management service started monitoring a volume on a tiered …	Admin	N
12	The Storage Tiers Management service encountered an error with the database of …	Admin	N
13	The Storage Tiers Management service is monitoring a volume on a tiered storage …	Admin	N
21	The Storage Tiers Management service completed optimization of the tiered …	Admin	N
22	Storage Tier Optimization Report for volume VolumeName.	Admin	N
31	The Storage Tiers Management service reached the limit of in-memory records of …	Admin	N

Event ID 1: Volume {VolumeGuid} (ID {VolumeIdHash}) is measuring I/O heat.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Tiering Heat Measurement Channel

Description

Volume {VolumeGuid} (ID {VolumeIdHash}) is measuring I/O heat.

Message #

Volume {VolumeGuid} (ID {VolumeIdHash}) is measuring I/O heat.

Fields #

Name	Description
`VolumeGuid`
`VolumeIdHash`

Event ID 2: READ - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length}.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Tiering Heat Measurement Channel

Description

READ - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length}.

Message #

READ - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length}

Fields #

Name	Description
`VolumeIdHash`
`FileIDLower`
`FileIDUpper`
`Offset`
`Length`

Event ID 3: WRITE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length}.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Tiering Heat Measurement Channel

Description

WRITE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length}.

Message #

WRITE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length}

Fields #

Name	Description
`VolumeIdHash`
`FileIDLower`
`FileIDUpper`
`Offset`
`Length`

Event ID 4: DELETE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper}.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Tiering Heat Measurement Channel

Description

DELETE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper}.

Message #

DELETE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper}

Fields #

Name	Description
`VolumeIdHash`
`FileIDLower`
`FileIDUpper`

Event ID 5: TIERMOVE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length} Source: {Source} Destination: {Destination}.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Tiering Heat Measurement Channel

Description

TIERMOVE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length} Source: {Source} Destination: {Destination}.

Message #

TIERMOVE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length} Source: {Source} Destination: {Destination}

Fields #

Name	Description
`VolumeIdHash`
`FileIDLower`
`FileIDUpper`
`Offset`
`Length`
`Source`
`Destination`

Event ID 11: The Storage Tiers Management service started monitoring a volume on a tiered storage space.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Admin
Opcode: Info

Description

The Storage Tiers Management service started monitoring a volume on a tiered storage space. No action is required. Volume name: VolumeName.

Message #

The Storage Tiers Management service started monitoring a volume on a tiered storage space. No action is required.  Volume name: %2.

Fields #

Name	Description
`VolumeNameLength` UInt16
`VolumeName` UnicodeString

Event ID 12: The Storage Tiers Management service encountered an error with the database of manually assigned files and re-created the database.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Admin
Opcode: Info

Description

The Storage Tiers Management service encountered an error with the database of manually assigned files and re-created the database. Confirm that files that were manually assigned to a particular storage tier are still assigned to the correct tier, as appropriate. Volume name: VolumeName.

Message #

The Storage Tiers Management service encountered an error with the database of manually assigned files and re-created the database. Confirm that files that were manually assigned to a particular storage tier are still assigned to the correct tier, as appropriate. Volume name: %2.

Fields #

Name	Description
`VolumeNameLength` UInt16
`VolumeName` UnicodeString

Event ID 13: The Storage Tiers Management service is monitoring a volume on a tiered storage space.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Admin
Opcode: Info

Description

The Storage Tiers Management service is monitoring a volume on a tiered storage space. No action is required.

Message #

The Storage Tiers Management service is monitoring a volume on a tiered storage space. No action is required.

           Local volume name: %2
           CSV name: %4

Fields #

Name	Description
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`CsvNameLength` UInt16
`CsvName` UnicodeString

Event ID 21: The Storage Tiers Management service completed optimization of the tiered storage space.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Admin
Opcode: Info

Description

The Storage Tiers Management service completed optimization of the tiered storage space. No action is required. Volume name: VolumeName Result: HResult. Processing time (in minutes): ProcessTimeInMinutes Optimization time (in minutes): DefragTimeInMinutes Number of clusters requested to move to Performance tier: AskedToMoveToFlash; to Capacity tier: AskedToMoveToDisk Actual number of clusters moved to Performance tier: MovedToFlash; to Capacity tier: MovedToDisk

Message #

The Storage Tiers Management service completed optimization of the tiered storage space. No action is required. Volume name: %2 Result: %7.  Processing time (in minutes): %8 Optimization time (in minutes): %9  Number of clusters requested to move to Performance tier: %3; to Capacity tier: %4  Actual number of clusters moved to Performance tier: %5; to Capacity tier: %6

Fields #

Name	Description
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`AskedToMoveToFlash` UInt64
`AskedToMoveToDisk` UInt64
`MovedToFlash` UInt64
`MovedToDisk` UInt64
`HResult` Int32
`ProcessTimeInMinutes` Int32
`DefragTimeInMinutes` Int32

Event ID 22: Storage Tier Optimization Report for volume VolumeName.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Admin
Opcode: Info

Description

Storage Tier Optimization Report for volume VolumeName.

Message #

Storage Tier Optimization Report for volume %2

	% I/Os serviced from Perf tier		Performance tier size required
%3
Current size of the Performance tier: %4
Percent of total I/Os serviced from the Performance tier: %5% 

Size of files pinned to the Performance tier: %6
Percent of total I/Os: %7% 

Size of files pinned to the Capacity tier: %8
Percent of total I/Os: %9%

Fields #

Name	Description
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Report` UnicodeString
`FasterTierSize` UnicodeString
`TotalIOPercentFromPerfTier` UInt16
`SizeOfPerfTierPinnedFiles` UnicodeString
`PercentOfPerfTierPinnedFilesIO` UInt16
`SizeOfCapacityTierPinnedFiles` UnicodeString
`PercentOfCapacityTierPinnedFilesIO` UInt16

Event ID 31: The Storage Tiers Management service reached the limit of in-memory records of reads and writes to a tiered storage space.

Provider: Microsoft-Windows-Storage-Tiering
Channel: Admin
Opcode: Info

Description

The Storage Tiers Management service reached the limit of in-memory records of reads and writes to a tiered storage space. Additional read and write activity will not be recorded or considered during optimization of storage tiers on this storage space for the rest of the hour. Consider increasing the MaxInMemoryTreeSize registry value. Memory entries limit: NumberEntries Volume name: VolumeName

Message #

The Storage Tiers Management service reached the limit of in-memory records of reads and writes to a tiered storage space. Additional read and write activity will not be recorded or considered during optimization of storage tiers on this storage space for the rest of the hour.  Consider increasing the MaxInMemoryTreeSize registry value. Memory entries limit: %3 Volume name: %2

Fields #

Name	Description
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`NumberEntries` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 4a104570-ec6d-4560-a40f-858fa955e84f

Defined in TieringEngineService.exe, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-Storage-Tiering

Event ID 1: Volume {VolumeGuid} (ID {VolumeIdHash}) is measuring I/O heat.

Description

Message #

Fields #

Event ID 2: READ - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length}.

Description

Message #

Fields #

Event ID 3: WRITE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length}.

Description

Message #

Fields #

Event ID 4: DELETE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper}.

Description

Message #

Fields #

Event ID 5: TIERMOVE - Volume: {VolumeIdHash} File: {FileIDLower}{FileIDUpper} Offset: {Offset} Length {Length} Source: {Source} Destination: {Destination}.

Description

Message #

Fields #

Event ID 11: The Storage Tiers Management service started monitoring a volume on a tiered storage space.

Description

Message #

Fields #

Event ID 12: The Storage Tiers Management service encountered an error with the database of manually assigned files and re-created the database.

Description

Message #

Fields #

Event ID 13: The Storage Tiers Management service is monitoring a volume on a tiered storage space.

Description

Message #

Fields #

Event ID 21: The Storage Tiers Management service completed optimization of the tiered storage space.

Description

Message #

Fields #

Event ID 22: Storage Tier Optimization Report for volume VolumeName.

Description

Message #

Fields #

Event ID 31: The Storage Tiers Management service reached the limit of in-memory records of reads and writes to a tiered storage space.

Description

Message #

Fields #

Provenance

Downloads