detection.wiki

Microsoft-Windows-StorageManagement-WSP-Spaces

EventTitleChannelSampleRule
2000The Windows Storage Provider could not start the remote storage subsystem.OperationalNN
2001The Windows Storage Provider has lost its connection to the cluster.OperationalNN
2002The Windows Storage Provider has established a connection to the cluster.OperationalNN
2003An error occurred during method execution.OperationalNN
2004An error was posted by the Windows Storage Provider during the course of an …OperationalNN
2005An error occurred during storage job execution.OperationalYN
2006An error occurred during a get instance operation.OperationalNN
2007An error occurred during object enumeration.OperationalNN
2008An error occurred during method execution.OperationalNN
2009An error occurred while trying to perform a diagnostic operation.OperationalNN
2010The Windows Storage Spaces and Disk provider was loaded.OperationalYN
2011Cluster state initialization succeeded.OperationalNN
2012Cluster state initialization failed.OperationalNN
2013Cluster node arrived.OperationalNN
2014Cluster node Node was deleted.OperationalNN
2015Cluster node Node came online.OperationalNN
2016Cluster node Node went offline.OperationalNN
2017It took longer than usual for this target node to respond to the following …OperationalNN
2018It took longer than usual for this initiator node to complete the following …OperationalNN
2019One or more nodes did not respond to the cluster broadcast.OperationalNN
2020An unmapped error was encountered.OperationalNN
2021It is taking longer than usual for this target node to respond to the following …OperationalNN
2022It is taking longer than usual for this initiator node to complete the following …OperationalNN
2023Successfully initialized the Storage Management Provider.OperationalYN
2024Failed to initialize the Storage Management Provider.OperationalNN
2025Successfully cleaned up the Storage Management Provider.OperationalYN
2026Failed to clean up the Storage Management Provider.OperationalNN
2027Successfully initialized Extended Storage Spaces API.OperationalYN
2028Failed to initialize Extended Storage Spaces API.OperationalNN
2029Successfully cleaned up Extended Storage Spaces API.OperationalYN
2030Failed to clean up Extended Storage Spaces API.OperationalNN
2031Successfully Converted PhysicalDisk to Space.OperationalNN
2032Failed to Convert PhysicalDisk to Space.OperationalNN
2033It is taking longer than usual to execute the following function.OperationalNN
2034It took longer than usual to complete the following function.OperationalNN
2036Failed to query ReFSDedupSvc.OperationalNN

Event ID 2000: The Windows Storage Provider could not start the remote storage subsystem.

#
Channel
Operational

Message #

The Windows Storage Provider could not start the remote storage subsystem.             
Storage Subsystem ID: %1             
Storage Subsystem URI: %2             
Username: %3             
Error Code: %4             
Error String: %5             

Ensure that the remote storage subsystem is online and connected to the network.             
Check if the user attempting to connect to the subsystem has the necessary permissions.

Fields #

NameDescription
SubsystemID UnicodeString
SubsystemURI UnicodeString
Username UnicodeString
ErrorCode UInt32
ErrorString UnicodeString

Event ID 2001: The Windows Storage Provider has lost its connection to the cluster.

#
Channel
Operational

Message #

The Windows Storage Provider has lost its connection to the cluster.             
Error Code: %1

Fields #

NameDescription
ErrorCode HexInt32

Event ID 2002: The Windows Storage Provider has established a connection to the cluster.

#
Channel
Operational

Event ID 2003: An error occurred during method execution.

#
Channel
Operational

Message #

An error occurred during method execution.             
Class: %1             
Method: %2             
ObjectId: %3             
Error Code: %4

Fields #

NameDescription
ClassName UnicodeString
MethodName UnicodeString
ObjectId UnicodeString
ErrorCode UInt32
ExtendedStatusMsgId UnicodeString

Event ID 2004: An error was posted by the Windows Storage Provider during the course of an operation.

#
Channel
Operational

Message #

An error was posted by the Windows Storage Provider during the course of an operation.             
Message: %1

Fields #

NameDescription
Message UnicodeString

Event ID 2005: An error occurred during storage job execution.

#
Channel
Operational
Level
Error

Message #

An error occurred during storage job execution.             
Job Name: %1             
Error Code: %2

Fields #

NameDescription
JobName UnicodeString
ErrorCode UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Spaces",
    "guid": "88C09888-118D-48FC-8863-E1C6D39CA4DF",
    "event_source_name": "",
    "event_id": 2005,
    "version": 1,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-22T19:03:51.693844+00:00",
    "event_record_id": 1313,
    "correlation": {
      "ActivityID": "4B7AB6F7-5217-403F-811D-8FB9A373C39A"
    },
    "execution": {
      "process_id": 17392,
      "thread_id": 1928
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "JobName": "Optimize Volume",
    "ErrorCode": 43030
  },
  "message": ""
}

Event ID 2006: An error occurred during a get instance operation.

#
Channel
Operational

Message #

An error occurred during a get instance operation.             
Class: %1             
ObjectId: %2             
Error Code: %3

Fields #

NameDescription
ClassName UnicodeString
ObjectId UnicodeString
ErrorCode UInt32

Event ID 2007: An error occurred during object enumeration.

#
Channel
Operational

Message #

An error occurred during object enumeration.             
Class: %1             
Error Code: %2

Fields #

NameDescription
ClassName UnicodeString
ErrorCode UInt32

Event ID 2008: An error occurred during method execution.

#
Channel
Operational

Message #

An error occurred during method execution.             
Class: %1             
Method: %2             
ObjectId: %3             
MI_Result: %4

Fields #

NameDescription
ClassName UnicodeString
MethodName UnicodeString
ObjectId UnicodeString
ErrorCode UInt32
ExtendedStatusMsgId UnicodeString

Event ID 2009: An error occurred while trying to perform a diagnostic operation.

#
Channel
Operational

Message #

An error occurred while trying to perform a diagnostic operation.             
Computer name: %1             
Error Code: %2             
Secondary Error: %3

Fields #

NameDescription
ComputerName UnicodeString
ErrorCode UInt32
SecondaryErrorCode UInt32

Event ID 2010: The Windows Storage Spaces and Disk provider was loaded.

#
Channel
Operational
Level
Informational

Message #

The Windows Storage Spaces and Disk provider was loaded.             
Load time (milliseconds): %1             
Miresult: %2

Fields #

NameDescription
LoadTime_msecs UInt32
MI_Result UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Spaces",
    "guid": "{88C09888-118D-48FC-8863-E1C6D39CA4DF}",
    "event_source_name": "",
    "event_id": 2010,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T04:29:32.6090423+00:00",
    "event_record_id": 32,
    "correlation": {
      "ActivityID": "{F06DF7AC-EF89-0001-142D-6EF089EFDC01}"
    },
    "execution": {
      "process_id": 7924,
      "thread_id": 7408
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "LoadTime_msecs": "15",
    "MI_Result": "0"
  },
  "message": "The Windows Storage Spaces and Disk provider was loaded.             \r\nLoad time (milliseconds): 15             \r\nMiresult: 0"
}

Event ID 2011: Cluster state initialization succeeded.

#
Channel
Operational

Message #

Cluster state initialization succeeded.             
Cluster name: %1

Fields #

NameDescription
ClusterName UnicodeString

Event ID 2012: Cluster state initialization failed.

#
Channel
Operational

Message #

Cluster state initialization failed.             
Cluster Name: %1             
Initialization Phase: %2             
HRESULT: %3

Fields #

NameDescription
ClusterName UnicodeString
InitializationPhase UInt32
HRESULT HexInt32

Event ID 2013: Cluster node arrived.

#
Channel
Operational

Message #

Cluster node arrived.             
Node: %1             
Node State: %2

Fields #

NameDescription
Node UnicodeString
NodeState UInt32

Event ID 2014: Cluster node Node was deleted.

#
Channel
Operational

Message #

Cluster node %1 was deleted.

Fields #

NameDescription
Node UnicodeString

Event ID 2015: Cluster node Node came online.

#
Channel
Operational

Message #

Cluster node %1 came online.

Fields #

NameDescription
Node UnicodeString

Event ID 2016: Cluster node Node went offline.

#
Channel
Operational

Message #

Cluster node %1 went offline.

Fields #

NameDescription
Node UnicodeString

Event ID 2017: It took longer than usual for this target node to respond to the following control code.

#
Channel
Operational

Message #

It took longer than usual for this target node to respond to the following control code.             
Control Code: %1 (%2)             
Response time (milliseconds): %3

Fields #

NameDescription
ControlCode UInt32
ControlCodeName UnicodeString
Runtime_msecs UInt64

Event ID 2018: It took longer than usual for this initiator node to complete the following control code.

#
Channel
Operational

Message #

It took longer than usual for this initiator node to complete the following control code.             
Control Code: %1 (%2)             
Complete time (milliseconds): %3

Fields #

NameDescription
ControlCode UInt32
ControlCodeName UnicodeString
Runtime_msecs UInt64

Event ID 2019: One or more nodes did not respond to the cluster broadcast.

#
Channel
Operational

Message #

One or more nodes did not respond to the cluster broadcast.             
Control Code: %1 (%2)             
Nodes: %3             
Unresponsive Nodes: %4

Fields #

NameDescription
ControlCode UInt32
ControlCodeName UnicodeString
Nodes UnicodeString
UnresponsiveNodes UnicodeString

Event ID 2020: An unmapped error was encountered.

#
Channel
Operational

Message #

An unmapped error was encountered.             
Function: %1             
HResult: %2             
MI_Result: %3

Fields #

NameDescription
Function AnsiString
HResult Int32
MI_Result UInt32

Event ID 2021: It is taking longer than usual for this target node to respond to the following control code.

#
Channel
Operational

Message #

It is taking longer than usual for this target node to respond to the following control code.             
Control Code: %1 (%2)

Fields #

NameDescription
ControlCode UInt32
ControlCodeName UnicodeString

Event ID 2022: It is taking longer than usual for this initiator node to complete the following control code.

#
Channel
Operational

Message #

It is taking longer than usual for this initiator node to complete the following control code.             
Control Code: %1 (%2)

Fields #

NameDescription
ControlCode UInt32
ControlCodeName UnicodeString

Event ID 2023: Successfully initialized the Storage Management Provider.

#
Channel
Operational
Level
Informational

Message #

Successfully initialized the Storage Management Provider.             
Function: %1             
Duration (milliseconds): %2

Fields #

NameDescription
Function AnsiString
Runtime_msecs UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Spaces",
    "guid": "88C09888-118D-48FC-8863-E1C6D39CA4DF",
    "event_source_name": "",
    "event_id": 2023,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:49:38.030091+00:00",
    "event_record_id": 3,
    "correlation": {
      "ActivityID": "49DBD9FB-0795-0000-18F0-DB499507DA01"
    },
    "execution": {
      "process_id": 6420,
      "thread_id": 5412
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Function": "CSpProvider::Initialize",
    "Runtime_msecs": 49
  },
  "message": ""
}

References #

Event ID 2024: Failed to initialize the Storage Management Provider.

#
Channel
Operational

Message #

Failed to initialize the Storage Management Provider.             
Function: %1             
Callee: %2             
MI_Result: %3

Fields #

NameDescription
Function AnsiString
Callee AnsiString
MI_Result UInt32

Event ID 2025: Successfully cleaned up the Storage Management Provider.

#
Channel
Operational
Level
Informational

Message #

Successfully cleaned up the Storage Management Provider.             
Function: %1             
Duration (milliseconds): %2

Fields #

NameDescription
Function AnsiString
Runtime_msecs UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Spaces",
    "guid": "88C09888-118D-48FC-8863-E1C6D39CA4DF",
    "event_source_name": "",
    "event_id": 2025,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-09T18:55:49.426575+00:00",
    "event_record_id": 24,
    "correlation": {
      "ActivityID": "9FF1A52F-4A79-4A0B-A8C0-D2AEAF7E912A"
    },
    "execution": {
      "process_id": 2188,
      "thread_id": 9228
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Function": "CSpProvider::Cleanup",
    "Runtime_msecs": 0
  },
  "message": ""
}

Event ID 2026: Failed to clean up the Storage Management Provider.

#
Channel
Operational

Message #

Failed to clean up the Storage Management Provider.             
Function: %1             
Callee: %2             
MI_Result: %3

Fields #

NameDescription
Function AnsiString
Callee AnsiString
MI_Result UInt32

Event ID 2027: Successfully initialized Extended Storage Spaces API.

#
Channel
Operational
Level
Informational

Message #

Successfully initialized Extended Storage Spaces API.             
Function: %1             
Duration (milliseconds): %2

Fields #

NameDescription
Function AnsiString
Runtime_msecs UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Spaces",
    "guid": "88C09888-118D-48FC-8863-E1C6D39CA4DF",
    "event_source_name": "",
    "event_id": 2027,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:49:38.028676+00:00",
    "event_record_id": 2,
    "correlation": {
      "ActivityID": "49DBD9FB-0795-0000-18F0-DB499507DA01"
    },
    "execution": {
      "process_id": 6420,
      "thread_id": 5412
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Function": "SuInitializeEx",
    "Runtime_msecs": 5
  },
  "message": ""
}

References #

Event ID 2028: Failed to initialize Extended Storage Spaces API.

#
Channel
Operational

Message #

Failed to initialize Extended Storage Spaces API.             
Function: %1             
Callee: %2             
Error: %3

Fields #

NameDescription
Function AnsiString
Callee AnsiString
Error UInt32

Event ID 2029: Successfully cleaned up Extended Storage Spaces API.

#
Channel
Operational
Level
Informational

Message #

Successfully cleaned up Extended Storage Spaces API.             
Function: %1             
Duration (milliseconds): %2

Fields #

NameDescription
Function AnsiString
Runtime_msecs UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Spaces",
    "guid": "88C09888-118D-48FC-8863-E1C6D39CA4DF",
    "event_source_name": "",
    "event_id": 2029,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-09T18:55:49.425955+00:00",
    "event_record_id": 23,
    "correlation": {
      "ActivityID": "9FF1A52F-4A79-4A0B-A8C0-D2AEAF7E912A"
    },
    "execution": {
      "process_id": 2188,
      "thread_id": 9228
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Function": "SuCleanupEx",
    "Runtime_msecs": 0
  },
  "message": ""
}

Event ID 2030: Failed to clean up Extended Storage Spaces API.

#
Channel
Operational

Message #

Failed to clean up Extended Storage Spaces API.             
Function: %1             
Callee: %2             
Error: %3

Fields #

NameDescription
Function AnsiString
Callee AnsiString
Error UInt32

Event ID 2031: Successfully Converted PhysicalDisk to Space.

#
Channel
Operational

Message #

Successfully Converted PhysicalDisk to Space.             
Function: %1             
Duration (milliseconds): %2             
DriveId: %3             
PoolName: %4             
PoolVersion: %5             
PoolMetadataLength: %6             
PoolMinimumAllocationSize: %7             
SpaceName: %8             
SpaceProvisioningType: %9             
SpaceAllocationSize: %10             
SpaceResiliencyType: %11             
MinimumFreeSizeRequired: %12

Fields #

NameDescription
Function AnsiString
Runtime_msecs UInt64
DriveId GUID
PoolName UnicodeString
PoolVersion UInt16
PoolMetadataLength UInt32
PoolMinimumAllocationSize UInt64
SpaceName UnicodeString
SpaceProvisioningType UInt16
SpaceAllocationSize UInt64
SpaceResiliencyType UInt16
MinimumFreeSizeRequired UInt64

Event ID 2032: Failed to Convert PhysicalDisk to Space.

#
Channel
Operational

Message #

Failed to Convert PhysicalDisk to Space.             
Function: %1             
Callee: %2             
Error: %3             
DriveId: %4             
PoolName: %5             
PoolVersion: %6             
PoolMetadataLength: %7             
PoolMinimumAllocationSize: %8             
SpaceName: %9             
SpaceProvisioningType: %10             
SpaceAllocationSize: %11             
SpaceResiliencyType: %12             
MinimumFreeSizeRequired: %13

Fields #

NameDescription
Function AnsiString
Callee AnsiString
Error UInt32
DriveId GUID
PoolName UnicodeString
PoolVersion UInt16
PoolMetadataLength UInt32
PoolMinimumAllocationSize UInt64
SpaceName UnicodeString
SpaceProvisioningType UInt16
SpaceAllocationSize UInt64
SpaceResiliencyType UInt16
MinimumFreeSizeRequired UInt64

Event ID 2033: It is taking longer than usual to execute the following function.

#
Channel
Operational

Message #

It is taking longer than usual to execute the following function.             
Function: %1

Fields #

NameDescription
Function AnsiString

Event ID 2034: It took longer than usual to complete the following function.

#
Channel
Operational

Message #

It took longer than usual to complete the following function.             
Function: %1             
Response time (milliseconds): %2

Fields #

NameDescription
Function AnsiString
Runtime_msecs UInt64

Event ID 2036: Failed to query ReFSDedupSvc.

#
Channel
Operational

Message #

Failed to query ReFSDedupSvc.             
Function: %1             
Stage: %2             
ErrorMessage: %3             
VolumeName: %4             
HRESULT: %5

Fields #

NameDescription
Function AnsiString
Stage AnsiString
ErrorMessage UnicodeString
VolumeName UnicodeString
HRESULT HexInt32

Provenance

ETW provider GUID 88c09888-118d-48fc-8863-e1c6d39ca4df

Defined in mispace.dll, which carries the event manifest.