Microsoft-Windows-StorageReplica-Service

70 events across 3 channels

Event	Title	Channel	Sample
12000	Event ID 12000	Operational	N
12000	Computer account to security identifier (SID) conversion failed.	Admin	N
12001	Event ID 12001	Operational	N
12001	Created a new replication group.	Admin	N
12002	Event ID 12002	Operational	N
12002	Removed an existing replication group.	Admin	N
12003	Event ID 12003	Operational	N
12003	Created a new replication partnership.	Admin	N
12004	Event ID 12004	Operational	N
12004	Deleted an existing replication partnership.	Admin	N
12005	Event ID 12005	Operational	N
12005	Added a new partition into a replication group.	Admin	N
12006	Event ID 12006	Operational	N
12006	Removed an existing partition from a replication group.	Admin	N
12007	Event ID 12007	Operational	N
12007	Made this replication group the source of replication.	Admin	N
12008	Event ID 12008	Operational	N
12008	Made this replication group the destination of replication.	Admin	N
12009	Event ID 12009	Operational	N
12009	Suspended replication of an existing replication group.	Admin	N
12010	Event ID 12010	Operational	N
12010	Resumed replication of an existing replication group.	Admin	N
12011	Event ID 12011	Operational	N
12011	Removed an invalid partition record.	Admin	N
12012	Event ID 12012	Operational	N
12012	Failed to remove an invalid partition record.	Admin	N
12013	Event ID 12013	Operational	N
12013	Successfully removed an orphan Storage Replica cluster resource.	Admin	N
12014	Event ID 12014	Operational	N
12014	Failed to remove an orphan Storage Replica cluster resource.	Admin	N
12015	Event ID 12015	Operational	N
12015	Storage Replica service failed to connect to failover cluster.	Admin	N
12016	Event ID 12016	Operational	N
12016	Storage Replica service found a leftover non-cluster replication group …	Admin	N
12017	Event ID 12017	Operational	N
12017	Storage Replica CIM provider API is invoked: Parameters.	Operational	N
12018	Event ID 12018	Operational	N
12018	Succeed granting Storage Replica delegation on computer MachineName.	Admin	N
12019	Event ID 12019	Operational	N
12019	Failed granting Storage Replica delegation on computer MachineName.	Admin	N
12020	Event ID 12020	Operational	N
12020	Succeed revoking Storage Replica delegation on computer MachineName.	Admin	N
12021	Event ID 12021	Operational	N
12021	Failed revoking Storage Replica delegation on computer MachineName.	Admin	N
12022	Event ID 12022	Operational	N
12022	Succeed reverting granting Storage Replica delegation on computer MachineName.	Admin	N
12023	Event ID 12023	Operational	N
12023	Failed reverting granting Storage Replica delegation on computer MachineName.	Admin	N
12024	Event ID 12024	Operational	N
12024	Succeed reverting revoking Storage Replica delegation on computer MachineName.	Admin	N
12025	Event ID 12025	Operational	N
12025	Failed reverting revoking Storage Replica delegation on computer MachineName.	Admin	N
12026	Event ID 12026	Operational	N
12026	Unable to update log size to LogSizeInBytes bytes as requested.	Operational	N
13000	Event ID 13000	Operational	N
13000	Remote procedure call from Storage Replica Driver to Storage Replica user mode …	Admin	N
14000	Event ID 14000	Operational	N
14000	Storage Replica Volume Shadow Copy Service Writer OnIdentify failed.	Admin	N
14001	Event ID 14001	Operational	N
14001	Storage Replica Volume Shadow Copy Service Writer post-restore process failed.	Admin	N
14002	Event ID 14002	Operational	N
14002	Storage Replica reset the log after a restore of a Volume Shadow Copy Service …	Admin	N
14003	Event ID 14003	Operational	N
14003	Storage Replica was unable to reset the log after a restore of a Volume Shadow …	Admin	N
14004	Event ID 14004	Operational	N
14004	Storage Replica service added a partner ACL to the share.	Admin	N
14005	Event ID 14005	Operational	N
14005	Storage Replica service did not add a partner ACL to the share.	Admin	N
14006	Event ID 14006	Operational	N
14006	Storage Replica service received a retry response from cluster api while …	Operational	N

Event ID 12000

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational

Description

Computer account to security identifier (SID) conversion failed.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`MachineName` UnicodeString
`Win32Error` UInt32

Event ID 12000: Computer account to security identifier (SID) conversion failed.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin

Description

Computer account to security identifier (SID) conversion failed.

Message #

Computer account to security identifier (SID) conversion failed.

ReplicationGroup: %1
ComputerAccount: %2
Error: %3

Guidance: This may cause connectivity issues when a computer tries to connect to its replication group partners. For security purposes, replication endpoints are secured so that only administrator-defined partners can connect. This is done through an Access Control List (ACL) consisting of replication partner computer accounts that is applied on the replication endpoint. Once the SID lookup issue is resolved, restart the Storage Replica service (for standalone replication group deployments) or restart the cluster resource group consisting of replicated disks (for clustered replication deployments).

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`MachineName` UnicodeString
`Win32Error` UInt32

Event ID 12001

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Created a new replication group.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12001: Created a new replication group.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Created a new replication group.

Message #

Created a new replication group.

ReplicationGroupName: %1
ComputerName: %2
ReplicationGroupId: %3

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12002

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Removed an existing replication group.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12002: Removed an existing replication group.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Removed an existing replication group.

Message #

Removed an existing replication group.

ReplicationGroupName: %1
ComputerName: %2
ReplicationGroupId: %3

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12003

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Created a new replication partnership.

Fields #

Name	Description
`SourceReplicationGroupName` UnicodeString
`SourceComputerName` UnicodeString
`DestinationReplicationGroupName` UnicodeString
`DestinationComputerName` UnicodeString

Event ID 12003: Created a new replication partnership.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Created a new replication partnership.

Message #

Created a new replication partnership.

SourceReplicationGroupName: %1
SourceComputerName: %2
DestinationReplicationGroupName: %3
DestinationComputerName: %4

Fields #

Name	Description
`SourceReplicationGroupName` UnicodeString
`SourceComputerName` UnicodeString
`DestinationReplicationGroupName` UnicodeString
`DestinationComputerName` UnicodeString

Event ID 12004

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Deleted an existing replication partnership.

Fields #

Name	Description
`SourceReplicationGroupName` UnicodeString
`SourceComputerName` UnicodeString
`DestinationReplicationGroupName` UnicodeString
`DestinationComputerName` UnicodeString

Event ID 12004: Deleted an existing replication partnership.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Deleted an existing replication partnership.

Message #

Deleted an existing replication partnership.

SourceReplicationGroupName: %1
SourceComputerName: %2
DestinationReplicationGroupName: %3
DestinationComputerName: %4

Fields #

Name	Description
`SourceReplicationGroupName` UnicodeString
`SourceComputerName` UnicodeString
`DestinationReplicationGroupName` UnicodeString
`DestinationComputerName` UnicodeString

Event ID 12005

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Added a new partition into a replication group.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`PartitionId` GUID

Event ID 12005: Added a new partition into a replication group.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Added a new partition into a replication group.

Message #

Added a new partition into a replication group.

ReplicationGroupName: %1
ComputerName: %2
PartitionId: %3

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`PartitionId` GUID

Event ID 12006

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Removed an existing partition from a replication group.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`PartitionId` GUID

Event ID 12006: Removed an existing partition from a replication group.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Removed an existing partition from a replication group.

Message #

Removed an existing partition from a replication group.

ReplicationGroupName: %1
ComputerName: %2
PartitionId: %3

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`PartitionId` GUID

Event ID 12007

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Made this replication group the source of replication.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12007: Made this replication group the source of replication.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Made this replication group the source of replication.

Message #

Made this replication group the source of replication.

ReplicationGroupName: %1
ComputerName: %2
ReplicationGroupId: %3

Guidance: This event is triggered when an administrator performs a role switch, which reverses the replication direction. Changing direction may lead to data loss on the previous source if using asynchronous replication. Always perform a backup before taking any remedial actions.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12008

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Made this replication group the destination of replication.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12008: Made this replication group the destination of replication.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Made this replication group the destination of replication.

Message #

Made this replication group the destination of replication.

ReplicationGroupName: %1
ComputerName: %2
ReplicationGroupId: %3

Guidance: This event is triggered when the replication direction is modified. This can be a result of the initial configuration of a partnership or an administrative action such as a role switch or modification of the partnership to which this replication group belongs. Changes to an existing replication direction may lead to data loss on the previous source if using asynchronous replication. Always perform a backup before taking any remedial actions.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12009

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Suspended replication of an existing replication group.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12009: Suspended replication of an existing replication group.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Suspended replication of an existing replication group.

Message #

Suspended replication of an existing replication group.

ReplicationGroupName: %1
ComputerName: %2
PartitionId: %3

Guidance: This event is triggered when an administrator pauses replication, which temporarily stops data synchronization. You can resume replication using the Sync-SRGroup cmdlet.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12010

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Resumed replication of an existing replication group.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12010: Resumed replication of an existing replication group.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Resumed replication of an existing replication group.

Message #

Resumed replication of an existing replication group.

ReplicationGroupName: %1
ComputerName: %2
PartitionId: %3

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ComputerName` UnicodeString
`ReplicationGroupId` GUID

Event ID 12011

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Removed an invalid partition record.

Fields #

Name	Description
`DiskId` GUID
`PartitionId` GUID
`Win32Error` UInt32

Event ID 12011: Removed an invalid partition record.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Removed an invalid partition record.

Message #

Removed an invalid partition record.

DiskId: %1
PartitionId: %2
Status: %3

Guidance: The partition should now be available for regular operations.

Fields #

Name	Description
`DiskId` GUID
`PartitionId` GUID
`Win32Error` UInt32

Event ID 12012

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Failed to remove an invalid partition record.

Fields #

Name	Description
`DiskId` GUID
`PartitionId` GUID
`Win32Error` UInt32

Event ID 12012: Failed to remove an invalid partition record.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Failed to remove an invalid partition record.

Message #

Failed to remove an invalid partition record.

DiskId: %1
PartitionId: %2
Status: %3

Fields #

Name	Description
`DiskId` GUID
`PartitionId` GUID
`Win32Error` UInt32

Event ID 12013

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Successfully removed an orphan Storage Replica cluster resource.

Fields #

Name	Description
`ResourceName` UnicodeString
`Win32Error` UInt32

Event ID 12013: Successfully removed an orphan Storage Replica cluster resource.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Successfully removed an orphan Storage Replica cluster resource.

Message #

Successfully removed an orphan Storage Replica cluster resource.

Resource Name: %1
Status: %2

Fields #

Name	Description
`ResourceName` UnicodeString
`Win32Error` UInt32

Event ID 12014

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Failed to remove an orphan Storage Replica cluster resource.

Fields #

Name	Description
`ResourceName` UnicodeString
`Win32Error` UInt32

Event ID 12014: Failed to remove an orphan Storage Replica cluster resource.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Failed to remove an orphan Storage Replica cluster resource.

Message #

Failed to remove an orphan Storage Replica cluster resource.

Resource Name: %1
Status: %2

Fields #

Name	Description
`ResourceName` UnicodeString
`Win32Error` UInt32

Event ID 12015

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational

Description

Storage Replica service failed to connect to failover cluster.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PartnerReplicationGroupName` UnicodeString
`PartnerReplicationGroupId` GUID
`ClusterName` UnicodeString
`Win32Error` UInt32

Event ID 12015: Storage Replica service failed to connect to failover cluster.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin

Description

Storage Replica service failed to connect to failover cluster.

Message #

Storage Replica service failed to connect to failover cluster.

ReplicationGroup: %3
ClusterName: %5
Error: %6

Guidance: This will prevent replication. Verify that the cluster name is available. Once the network name is available, restart the secondary replication group.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`ReplicationGroupId` GUID
`PartnerReplicationGroupName` UnicodeString
`PartnerReplicationGroupId` GUID
`ClusterName` UnicodeString
`Win32Error` UInt32

Event ID 12016

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational

Description

Storage Replica service found a leftover non-cluster replication group configuration.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString

Event ID 12016: Storage Replica service found a leftover non-cluster replication group configuration.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin

Description

Storage Replica service found a leftover non-cluster replication group configuration.

Message #

Storage Replica service found a leftover non-cluster replication group configuration.

ReplicationGroup: %1

Guidance: This will prevent replication for that replication group. Make sure to cleanup non-cluster replication groups on the computer before joining cluster.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString

Event ID 12017

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Storage Replica CIM provider API is invoked.

Fields #

Name	Description
`Parameters` UnicodeString

Event ID 12017: Storage Replica CIM provider API is invoked: Parameters.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Storage Replica CIM provider API is invoked: Parameters.

Message #

Storage Replica CIM provider API is invoked: %1

Fields #

Name	Description
`Parameters` UnicodeString

Event ID 12018

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Succeed granting Storage Replica delegation on computer.

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12018: Succeed granting Storage Replica delegation on computer MachineName.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Succeed granting Storage Replica delegation on computer MachineName.

Message #

Succeed granting Storage Replica delegation on computer %1
for user %2
Status: %3

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12019

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Failed granting Storage Replica delegation on computer.

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12019: Failed granting Storage Replica delegation on computer MachineName.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Failed granting Storage Replica delegation on computer MachineName.

Message #

Failed granting Storage Replica delegation on computer %1
 for user %2
Status: %3

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12020

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Succeed revoking Storage Replica delegation on computer.

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12020: Succeed revoking Storage Replica delegation on computer MachineName.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Succeed revoking Storage Replica delegation on computer MachineName.

Message #

Succeed revoking Storage Replica delegation on computer %1
 from user %2
Status: %3

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12021

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Failed revoking Storage Replica delegation on computer.

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12021: Failed revoking Storage Replica delegation on computer MachineName.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Failed revoking Storage Replica delegation on computer MachineName.

Message #

Failed revoking Storage Replica delegation on computer %1
 from user %2
Status: %3

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12022

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Succeed reverting granting Storage Replica delegation on computer.

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12022: Succeed reverting granting Storage Replica delegation on computer MachineName.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Succeed reverting granting Storage Replica delegation on computer MachineName.

Message #

Succeed reverting granting Storage Replica delegation on computer %1
 for user %2
Status: %3

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12023

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Failed reverting granting Storage Replica delegation on computer.

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12023: Failed reverting granting Storage Replica delegation on computer MachineName.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Failed reverting granting Storage Replica delegation on computer MachineName.

Message #

Failed reverting granting Storage Replica delegation on computer %1
 for user %2
Status: %3

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12024

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Succeed reverting revoking Storage Replica delegation on computer.

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12024: Succeed reverting revoking Storage Replica delegation on computer MachineName.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Succeed reverting revoking Storage Replica delegation on computer MachineName.

Message #

Succeed reverting revoking Storage Replica delegation on computer %1
 from user %2
Status: %3

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12025

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Failed reverting revoking Storage Replica delegation on computer.

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12025: Failed reverting revoking Storage Replica delegation on computer MachineName.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrCim

Description

Failed reverting revoking Storage Replica delegation on computer MachineName.

Message #

Failed reverting revoking Storage Replica delegation on computer %1
 from user %2
Status: %3

Fields #

Name	Description
`MachineName` UnicodeString
`Username` UnicodeString
`Win32Error` UInt32

Event ID 12026

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Unable to update log size to bytes as requested. Instead, the log size will be updated to bytes.

Fields #

Name	Description
`LogSizeInBytes` UInt64
`NewLogSizeInBytes` UInt64
`ReplicationGroupName` UnicodeString

Event ID 12026: Unable to update log size to LogSizeInBytes bytes as requested.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrCim

Description

Unable to update log size to LogSizeInBytes bytes as requested. Instead, the log size will be updated to NewLogSizeInBytes bytes.

Message #

Unable to update log size to %1 bytes as requested. Instead, the log size will be updated to %2 bytes.

ReplicationGroupName: %3

Fields #

Name	Description
`LogSizeInBytes` UInt64
`NewLogSizeInBytes` UInt64
`ReplicationGroupName` UnicodeString

Event ID 13000

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational

Description

Remote procedure call from Storage Replica Driver to Storage Replica user mode service completed with error.

Fields #

Name	Description
`Win32Error` UInt32

Event ID 13000: Remote procedure call from Storage Replica Driver to Storage Replica user mode service completed with error.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin

Description

Remote procedure call from Storage Replica Driver to Storage Replica user mode service completed with error.

Message #

Remote procedure call from Storage Replica Driver to Storage Replica user mode service completed with error.

Error: %1

Fields #

Name	Description
`Win32Error` UInt32

Event ID 14000

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrVssWriter

Description

Storage Replica Volume Shadow Copy Service Writer OnIdentify failed.

Fields #

Name	Description
`VolumePath` UnicodeString
`PartitionId` GUID
`Win32Error` UInt32

Event ID 14000: Storage Replica Volume Shadow Copy Service Writer OnIdentify failed.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrVssWriter

Description

Storage Replica Volume Shadow Copy Service Writer OnIdentify failed.

Message #

Storage Replica Volume Shadow Copy Service Writer OnIdentify failed. 

Error (HRESULT): %3

Guidance: Storage Replica will not be notified of backup or restore operations. If any files were successfully restored onto a replicated volume, you must remove the replication partnership and recreate it. The seeded option is recommended when recreating replication in this case, in order to save initial synchronization time

Fields #

Name	Description
`VolumePath` UnicodeString
`PartitionId` GUID
`Win32Error` UInt32

Event ID 14001

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrVssWriter

Description

Storage Replica Volume Shadow Copy Service Writer post-restore process failed.

Fields #

Name	Description
`VolumePath` UnicodeString
`PartitionId` GUID
`Win32Error` UInt32

Event ID 14001: Storage Replica Volume Shadow Copy Service Writer post-restore process failed.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrVssWriter

Description

Storage Replica Volume Shadow Copy Service Writer post-restore process failed.

Message #

Storage Replica Volume Shadow Copy Service Writer post-restore process failed. 

Error (HRESULT): %3 

Guidance: If any files were successfully restored onto a replicated volume, you must remove the replication partnership and recreate it. The seeded option is recommended when recreating replication in this case, in order to save initial synchronization time

Fields #

Name	Description
`VolumePath` UnicodeString
`PartitionId` GUID
`Win32Error` UInt32

Event ID 14002

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrVssWriter

Description

Storage Replica reset the log after a restore of a Volume Shadow Copy Service backup.

Fields #

Name	Description
`VolumePath` UnicodeString
`PartitionId` GUID
`Win32Error` UInt32

Event ID 14002: Storage Replica reset the log after a restore of a Volume Shadow Copy Service backup.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrVssWriter

Description

Storage Replica reset the log after a restore of a Volume Shadow Copy Service backup.

Message #

Storage Replica reset the log after a restore of a Volume Shadow Copy Service backup. 

Volume name: %1
PartitionId: %2
Error (HRESULT): %3

Guidance: Storage Replica will perform initial synchronization of this volume.

Fields #

Name	Description
`VolumePath` UnicodeString
`PartitionId` GUID
`Win32Error` UInt32

Event ID 14003

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational
Task: SrVssWriter

Description

Storage Replica was unable to reset the log after a restore of a Volume Shadow Copy Service backup.

Fields #

Name	Description
`VolumePath` UnicodeString
`PartitionId` GUID
`Win32Error` UInt32

Event ID 14003: Storage Replica was unable to reset the log after a restore of a Volume Shadow Copy Service backup.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin
Task: SrVssWriter

Description

Storage Replica was unable to reset the log after a restore of a Volume Shadow Copy Service backup.

Message #

Storage Replica was unable to reset the log after a restore of a Volume Shadow Copy Service backup. 

Volume name: %1
PartitionId: %2
Error (HRESULT): %3

Guidance: You must remove the replication partnership and recreate it. The seeded option is recommended when recreating replication in this case, in order to save initial synchronization time

Fields #

Name	Description
`VolumePath` UnicodeString
`PartitionId` GUID
`Win32Error` UInt32

Event ID 14004

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational

Description

Storage Replica service added a partner ACL to the share.

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`Win32Error` UInt32

Event ID 14004: Storage Replica service added a partner ACL to the share.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin

Description

Storage Replica service added a partner ACL to the share.

Message #

Storage Replica service added a partner ACL to the share. 

Replication group name: %1
Result (HRESULT): %2

Fields #

Name	Description
`ReplicationGroupName` UnicodeString
`Win32Error` UInt32

Event ID 14005

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational

Description

Storage Replica service did not add a partner ACL to the share.

Fields #

Name	Description
`Win32Error` UInt32

Event ID 14005: Storage Replica service did not add a partner ACL to the share.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Admin

Description

Storage Replica service did not add a partner ACL to the share.

Message #

Storage Replica service did not add a partner ACL to the share. 

Result (HRESULT): %1

Guidance: Failure to ACL the share indicates a problem with SID lookups against an Active Directory domain controller. This can be caused by problems with network communication, firewall, DNS lookup, or other environmental dependencies. After resolving this issue, restart the Storage Replica service.

Fields #

Name	Description
`Win32Error` UInt32

Event ID 14006

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational

Description

Storage Replica service received a retry response from cluster api while handling a resource online/offline event.

Event ID 14006: Storage Replica service received a retry response from cluster api while handling a resource online/offline event.

Provider: Microsoft-Windows-StorageReplica-Service
Channel: Operational

Description

Storage Replica service received a retry response from cluster api while handling a resource online/offline event.

Message #

Storage Replica service received a retry response from cluster api while handling a resource online/offline event.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID ce171fd7-a5ba-4d95-926b-6dc4d89e8171

Defined in wvrsvc.exe, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02

Downloads

Microsoft-Windows-StorageReplica-Service registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)