Microsoft-Windows-StorageReplica-Cluster

60 events across 3 channels

Event	Title	Channel	Sample
500	Event ID 500	Operational	N
500	Storage Replica service is not installed.	System	N
501	Event ID 501	Operational	N
501	Storage Replica resource failed to open Service Control Manager to register for …	System	N
502	Event ID 502	Operational	N
502	Storage Replica resource failed to register for service status change …	System	N
503	Event ID 503	Operational	N
503	Storage Replica service is not running.	System	N
504	Event ID 504	Operational	N
504	Storage Replica cluster resource failed to read configuration from the metadata …	System	N
505	Event ID 505	Operational	N
505	Storage Replica cluster resource is unable to detect disk resources connected to …	Admin	N
506	Event ID 506	Operational	N
506	Storage Replica cluster resource failed to persist the replication status of …	System	N
507	Event ID 507	Operational	N
507	Storage Replica cluster resource failed to update possible owners.	System	N
508	Event ID 508	Operational	N
508	Storage Replica cluster resource could not find any replication group that can …	System	N
509	Event ID 509	Operational	N
509	Storage Replica cluster resource received a replication status change …	Admin	N
510	Event ID 510	Operational	N
510	Storage Replica cluster resource received a member status change notification …	Admin	N
511	Event ID 511	Operational	N
511	Storage Replica source cluster resource is not online.	Admin	N
512	Event ID 512	Operational	N
512	Storage Replica cluster resource is unable to detect disk resources connected to …	System	N
513	Event ID 513	Operational	N
513	Storage Replica cluster resource has detected that the replication group is in …	System	N
514	Event ID 514	Operational	N
514	Storage Replica cluster resource has successfully updated possible owners based …	Admin	N
515	Event ID 515	Operational	N
515	Source Storage Replica cluster resource has succesfully completed recovery and …	Admin	N
516	Event ID 516	Operational	N
516	Storage Replica cluster resource failed to update possible owners.	System	N
517	Event ID 517	Operational	N
517	Storage Replica cluster resource failed to update cluster disk unique identifier …	System	N
518	Event ID 518	Operational	N
518	Storage Replica cluster resource cannot be brought online as there is a source …	System	N
519	Event ID 519	Operational	N
519	Storage Replica cluster resource failed to come online.	System	N
520	Event ID 520	Operational	N
520	Storage Replica cluster resource is online.	Admin	N
521	Event ID 521	Operational	N
521	Storage Replica service has entered running state.	Admin	N
522	Event ID 522	Operational	N
522	Storage Replica cluster resource has detected incorrect resource dependency.	System	N
523	Event ID 523	Operational	N
523	Storage Replica cluster resource has detected invalid resource group …	System	N
524	Event ID 524	Operational	N
524	Storage Replica cluster resource failed to bring destination resource offline.	System	N
525	Event ID 525	Operational	N
525	Storage Replica cluster resource failed to bring destination resource online.	System	N
526	Event ID 526	Operational	N
526	Destination replication group is now disabled for automatic failover.	Admin	N
527	Event ID 527	Operational	N
527	Destination replication group is now enabled for automatic failover.	Admin	N
528	Event ID 528	Operational	N
528	The Network interface is not constrained.	Admin	N
529	Event ID 529	Operational	N
529	Storage Replica cluster resource failed to grant permission for replication to a …	Admin	N

Event ID 500

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica service is not installed.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 500: Storage Replica service is not installed.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica service is not installed.

Message #

Storage Replica service is not installed.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 501

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica resource failed to open Service Control Manager to register for status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 501: Storage Replica resource failed to open Service Control Manager to register for status change notifications.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica resource failed to open Service Control Manager to register for status change notifications.

Message #

Storage Replica resource failed to open Service Control Manager to register for status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 502

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica resource failed to register for service status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 502: Storage Replica resource failed to register for service status change notifications.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica resource failed to register for service status change notifications.

Message #

Storage Replica resource failed to register for service status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 503

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica service is not running.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 503: Storage Replica service is not running.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica service is not running.

Message #

Storage Replica service is not running.

Guidance: The Storage Replica resource can be brought online only when the service is in the running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 504

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to read configuration from the metadata store.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 504: Storage Replica cluster resource failed to read configuration from the metadata store.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to read configuration from the metadata store.

Message #

Storage Replica cluster resource failed to read configuration from the metadata store.

Resource: %1
Status:%5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 505

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource is unable to detect disk resources connected to this node for the source replication group.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 505: Storage Replica cluster resource is unable to detect disk resources connected to this node for the source replication group.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource is unable to detect disk resources connected to this node for the source replication group.

Message #

Storage Replica cluster resource is unable to detect disk resources connected to this node for the source replication group.

Resource: %1

Guidance: An attempt will now be made to choose a synchronous replication group that can take up the source role.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 506

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to persist the replication status of partner replication groups.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 506: Storage Replica cluster resource failed to persist the replication status of partner replication groups.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to persist the replication status of partner replication groups.

Message #

Storage Replica cluster resource failed to persist the replication status of partner replication groups.

Resource: %1
PartnerReplicationGroupId: %5
ReplicationGroupInSync: %6
Status: %7

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 507

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to update possible owners.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 507: Storage Replica cluster resource failed to update possible owners.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to update possible owners.

Message #

Storage Replica cluster resource failed to update possible owners.

Resource: %1
Status:%6
Possible owners: %5

Guidance: This can cause unexpected failover behavior. Resources should have the above possible owners.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 508

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource could not find any replication group that can assume the source role on this cluster node.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 508: Storage Replica cluster resource could not find any replication group that can assume the source role on this cluster node.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource could not find any replication group that can assume the source role on this cluster node.

Message #

Storage Replica cluster resource could not find any replication group that can assume the source role on this cluster node.

Resource: %1

Guidance: Either the replication groups were not in the required synchronous state or some of the cluster disks were not connected to this node. Try moving the resource to a node where the disks are attached.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 509

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource received a replication status change notification for one or more replication groups.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReplicationStatus` UInt32
`PossibleOwnersUpdated` Boolean
`ReplicationStateUpdated` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 509: Storage Replica cluster resource received a replication status change notification for one or more replication groups.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource received a replication status change notification for one or more replication groups.

Message #

Storage Replica cluster resource received a replication status change notification for one or more replication groups.

Resource: %1
Replication status: %5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReplicationStatus` UInt32
`PossibleOwnersUpdated` Boolean
`ReplicationStateUpdated` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 510

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource received a member status change notification for replication group.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReplicaState` UInt32
`PossibleOwnersUpdated` Boolean
`ReplicationStateUpdated` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 510: Storage Replica cluster resource received a member status change notification for replication group.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource received a member status change notification for replication group.

Message #

Storage Replica cluster resource received a member status change notification for replication group.

Resource: %1
Replica state: %5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReplicaState` UInt32
`PossibleOwnersUpdated` Boolean
`ReplicationStateUpdated` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 511

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica source cluster resource is not online.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 511: Storage Replica source cluster resource is not online.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica source cluster resource is not online.

Message #

Storage Replica source cluster resource is not online.

Resource: %1

Guidance: The destination replication groups will periodically attempt to connect to source replication group.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 512

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource is unable to detect disk resources connected to this node for this destination replication group.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 512: Storage Replica cluster resource is unable to detect disk resources connected to this node for this destination replication group.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource is unable to detect disk resources connected to this node for this destination replication group.

Message #

Storage Replica cluster resource is unable to detect disk resources connected to this node for this destination replication group.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 513

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource has detected that the replication group is in suspended state and therefore cannot come online on any node.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 513: Storage Replica cluster resource has detected that the replication group is in suspended state and therefore cannot come online on any node.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource has detected that the replication group is in suspended state and therefore cannot come online on any node.

Message #

Storage Replica cluster resource has detected that the replication group is in suspended state and therefore cannot come online on any node.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 514

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource has successfully updated possible owners based on storage and service availability.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 514: Storage Replica cluster resource has successfully updated possible owners based on storage and service availability.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource has successfully updated possible owners based on storage and service availability.

Message #

Storage Replica cluster resource has successfully updated possible owners based on storage and service availability.

Resource: %1
Possible owners: %5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 515

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Source Storage Replica cluster resource has succesfully completed recovery and has entered ready state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReadConfigurationTimeInMilliSeconds` UInt32
`DeterminePrimaryTimeInMilliSeconds` UInt32
`OfflineSecondaryTimeInMilliSeconds` UInt32
`UpdateDiskConfigTimeInMilliSeconds` UInt32
`OnlineSecondaryTimeInMilliSeconds` UInt32
`CreateDriverConfigTimeInMilliSeconds` UInt32
`ResourceOnlineTimeInMilliSeconds` UInt32
`ReplicaReadyTimeInMilliSeconds` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 515: Source Storage Replica cluster resource has succesfully completed recovery and has entered ready state.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Source Storage Replica cluster resource has succesfully completed recovery and has entered ready state.

Message #

Source Storage Replica cluster resource has succesfully completed recovery and has entered ready state.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`ReadConfigurationTimeInMilliSeconds` UInt32
`DeterminePrimaryTimeInMilliSeconds` UInt32
`OfflineSecondaryTimeInMilliSeconds` UInt32
`UpdateDiskConfigTimeInMilliSeconds` UInt32
`OnlineSecondaryTimeInMilliSeconds` UInt32
`CreateDriverConfigTimeInMilliSeconds` UInt32
`ResourceOnlineTimeInMilliSeconds` UInt32
`ReplicaReadyTimeInMilliSeconds` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 516

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to update possible owners.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 516: Storage Replica cluster resource failed to update possible owners.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to update possible owners.

Message #

Storage Replica cluster resource failed to update possible owners.

Resource: %1
Status:%6
Possible owners list: %5

Guidance: This can cause unexpected failover behavior. Resource should have the above entries in the possible owners list but does not.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PossibleOwners` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 517

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to update cluster disk unique identifier property. The source resource cannot come online unless this property can be updated successfully.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 517: Storage Replica cluster resource failed to update cluster disk unique identifier property.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to update cluster disk unique identifier property. The source resource cannot come online unless this property can be updated successfully.

Message #

Storage Replica cluster resource failed to update cluster disk unique identifier property. The source resource cannot come online unless this property can be updated successfully.

Resource: %1
Status:%5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 518

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource cannot be brought online as there is a source resource that represents the same replication group as this resource.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 518: Storage Replica cluster resource cannot be brought online as there is a source resource that represents the same replication group as this resource.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource cannot be brought online as there is a source resource that represents the same replication group as this resource.

Message #

Storage Replica cluster resource cannot be brought online as there is a source resource that represents the same replication group as this resource.

Resource: %1
Status:%5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 519

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to come online.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 519: Storage Replica cluster resource failed to come online.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to come online.

Message #

Storage Replica cluster resource failed to come online.

Resource: %1
Status:%5

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 520

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource is online.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 520: Storage Replica cluster resource is online.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource is online.

Message #

Storage Replica cluster resource is online.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 521

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica service has entered running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 521: Storage Replica service has entered running state.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica service has entered running state.

Message #

Storage Replica service has entered running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID

Event ID 522

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource has detected incorrect resource dependency.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PDRResourceName` UnicodeString
`DependentResourceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 522: Storage Replica cluster resource has detected incorrect resource dependency.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource has detected incorrect resource dependency.

Message #

Storage Replica cluster resource has detected incorrect resource dependency.

Resource 1: %5
Resource 2: %6

Guidance: The above cluster resource 1 must depend on resource 2, but does not.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PDRResourceName` UnicodeString
`DependentResourceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 523

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource has detected invalid resource group configuration.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PDRResourceName` UnicodeString
`PDRResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 523: Storage Replica cluster resource has detected invalid resource group configuration.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource has detected invalid resource group configuration.

Message #

Storage Replica cluster resource has detected invalid resource group configuration.

Resource: %5
Cluster group: %6

Guidance: The above cluster resource must belong to the above resource group, but does not.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PDRResourceName` UnicodeString
`PDRResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 524

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to bring destination resource offline.

Fields #

Name	Description
`SecondaryResource` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 524: Storage Replica cluster resource failed to bring destination resource offline.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to bring destination resource offline.

Message #

Storage Replica cluster resource failed to bring destination resource offline.

Resource: %1
Status:%2

Fields #

Name	Description
`SecondaryResource` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 525

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to bring destination resource online.

Fields #

Name	Description
`SecondaryResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 525: Storage Replica cluster resource failed to bring destination resource online.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: System

Description

Storage Replica cluster resource failed to bring destination resource online.

Message #

Storage Replica cluster resource failed to bring destination resource online.

Resource group: %1
Status:%2

Fields #

Name	Description
`SecondaryResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 526

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Destination replication group is now disabled for automatic failover.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 526: Destination replication group is now disabled for automatic failover.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Destination replication group is now disabled for automatic failover.

Message #

Destination replication group is now disabled for automatic failover.

Resource: %1

Guidance: When the destination replication group achieves synchronous replication state, it will be enabled for automatic failover.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 527

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Destination replication group is now enabled for automatic failover.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 527: Destination replication group is now enabled for automatic failover.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Destination replication group is now enabled for automatic failover.

Message #

Destination replication group is now enabled for automatic failover.

Resource: %1

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`SyncReplicationGroupId` GUID
`InSync` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 528

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

The Network interface is not constrained.

Fields #

Name	Description
`ResourceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 528: The Network interface is not constrained.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

The Network interface is not constrained.

Message #

The Network interface is not constrained. 

%Interface: %1
Status:%2

Guidance: An attempt was made to add the network interface to network constraint as it was part of the constrained network. Please make sure the specified network interface is Online in cluster.

Fields #

Name	Description
`ResourceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 529

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Operational

Description

Storage Replica cluster resource failed to grant permission for replication to a partner cluster.

Fields #

Name	Description
`ResourceName` UnicodeString
`ClusterName` UnicodeString
`PairedClusterName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 529: Storage Replica cluster resource failed to grant permission for replication to a partner cluster.

Provider: Microsoft-Windows-StorageReplica-Cluster
Channel: Admin

Description

Storage Replica cluster resource failed to grant permission for replication to a partner cluster.

Message #

Storage Replica cluster resource failed to grant permission for replication to a partner cluster. 

Resource: %1
PairedCluster:%3
Status:%4

Guidance: An attempt was made to pair a cluster account to this cluster's access control list. To resolve, run the following command:

 Grant-SrAccess.

Fields #

Name	Description
`ResourceName` UnicodeString
`ClusterName` UnicodeString
`PairedClusterName` UnicodeString
`Status` UInt32	NTSTATUS reference

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 35a2925c-30a3-43eb-b737-03e9659955e2

Defined in wvrres.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02

Downloads

Microsoft-Windows-StorageReplica-Cluster registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)