detection.wiki

Microsoft-Windows-StorDiag

EventTitleChannelSampleRule
1ClassPnP IO request completeOperationalYN
2ClassPnP Enqueue Idle IO requestOperationalYN
3ClassPnP Boost Idle IO requestOperationalYN
4CopyOffload request servicing time taken by lower driver stack(s).AnalyticNN
5Dispatching a CopyOffload read request.DiagnoseNN
6Dispatching a CopyOffload write request.DiagnoseNN
7Completing a CopyOffload IO (read/write) request.DiagnoseNN
8Device returned sense data.DiagnoseNN
201Request servicing time taken by lower driver stack(s).AnalyticYN
202Dispatching a read request.DiagnoseYN
203Dispatching a write request.DiagnoseYN
204Dispatching a read request.DiagnoseYN
205Dispatching a write request.DiagnoseYN
206Dispatching a read request.DiagnoseNN
207Dispatching a write request.DiagnoseNN
208Completing an IO (read/write) request.DiagnoseYN
209Retrying an IO (read/write) request.DiagnoseYN
210Flush request.DiagnoseNN
211Flush request.DiagnoseNN
212Dispatching an IOCTL.DiagnoseNN
213Dispatching a WMI request.DiagnoseNN
214Completing a non-read/write request.DiagnoseYN
215Dispatching a power request.DiagnoseNN
216Completing a power request.DiagnoseNN
217Dispatching a PnP request.DiagnoseNN
218Completing a PnP request.DiagnoseNN
219Completing a PnP enumeration request.DiagnoseNN
220Performing a queue-related operation.DiagnoseYN
221Dispatching a PassThrough request.DiagnoseNN
222Upperlevel Trim request servicing time.AnalyticYN
223Downlevel Unmap SRB request servicing time taken by lower driver stack(s)AnalyticYN
224Report Zone LatencyDiagnoseNN
225Reset Write Pointer LatencyDiagnoseNN
226Completing a failed IOCTL request.DiagnoseNN
500Completing a failed upper level read request.OperationalYN
501Completing a failed upper level write request.OperationalNN
502Completing a failed upper level paging read request.OperationalYN
503Completing a failed upper level paging write request.OperationalNN
504Completing a failed IOCTL request.OperationalNN
505Completing a failed Read SCSI SRB requestOperationalYN
506Completing a failed Write SCSI SRB requestOperationalNN
507Completing a failed non-ReadWrite SCSI SRB requestOperationalYN
508Completing a failed Non-SCSI SRB requestOperationalNN
509Completing a failed PNP request.OperationalNN
510Completing a failed Power request.OperationalNN
511Completing a failed WMI requestOperationalNN
512Get Storage Firmware InformationOperationalNN
513Download Storage FirmwareOperationalNN
514Activate New Storage FirmwareOperationalNN
515Query Device TelemetryOperationalNN
516Failed to process zone command asynchronouslyOperationalNN
517Read capacity failed with SMR deviceOperationalNN
518Zone count mismatchOperationalNN
519Retrieve zone information failedOperationalNN
520Query Command Duration Limit support and its Mode PageOperationalNN
521Query Command Duration Limit Mode Page failedOperationalNN
522Set Command Duration Limit Mode Page failedOperationalNN
523Read capacity failedOperationalNN

Event ID 1: ClassPnP IO request complete

#
Channel
Operational
Also via
realtime ETW trace
Level
Informational
Task
ClassPnPIOrequestcomplete
Opcode
ClassPnP_IO_End

Fields #

NameDescription
RequestProcessTime UInt64
OriginalIrp Pointer
Irp Pointer
MajorFunction UInt8
RequestType UInt8
SrbStatus UInt8
DeviceNumber UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 1,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 11,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:31:09.868+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceNumber": 0,
    "Irp": "0xFFFF878DBD7D6A20",
    "MajorFunction": 4,
    "OriginalIrp": "0xFFFF878DBBCE3010",
    "RequestProcessTime": 524,
    "RequestType": 0,
    "SrbStatus": 1
  },
  "message": "TaskClassPnPIOEnd"
}

Event ID 2: ClassPnP Enqueue Idle IO request

#
Channel
Operational
Level
Informational
Task
ClassPnPEnqueueIdleIOrequest
Opcode
ClassPnP_Enqueue_IdleIO

Fields #

NameDescription
Irp Pointer
CurrentIOCount UInt32
ActiveIOCount UInt32
DeviceNumber UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-StorDiag/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9228,
      "thread_id": 3844
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-StorDiag",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:57:02.225Z",
    "version": 0
  },
  "event_data": {
    "ActiveIOCount": 0,
    "CurrentIOCount": 1,
    "DeviceNumber": 0,
    "Irp": "0xFFFFC807C4A89320"
  },
  "message": ""
}

Event ID 3: ClassPnP Boost Idle IO request

#
Channel
Operational
Level
Informational
Task
ClassPnPBoostIdleIOrequest
Opcode
ClassPnP_Boost_IdleIO

Fields #

NameDescription
Irp Pointer
Thread Pointer
CurrentIOCount UInt32
ActiveIOCount UInt32
DeviceNumber UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-StorDiag/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 8056
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 13,
    "provider": "Microsoft-Windows-StorDiag",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:16:06.357Z",
    "version": 0
  },
  "event_data": {
    "ActiveIOCount": 0,
    "CurrentIOCount": 1,
    "DeviceNumber": 0,
    "Irp": "0xFFFFC807C4BA7AD0",
    "Thread": "0xFFFFC807C851E380"
  },
  "message": ""
}

Event ID 4: CopyOffload request servicing time taken by lower driver stack(s).

#
Channel
Analytic
Task
Class

Fields #

NameDescription
DeviceNumber UInt32
RequestDurationin100ns UInt64
Irp Pointer
Command UInt8
ServiceAction UInt8
SrbStatus UInt8
OriginalIrp Pointer

Event ID 5: Dispatching a CopyOffload read request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
IsWrite Boolean
FirstStartingLBA HexInt64
LengthOfTransferinbytes UInt64

Event ID 6: Dispatching a CopyOffload write request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
IsWrite Boolean
FirstStartingLBA HexInt64
LengthOfTransferinbytes UInt64

Event ID 7: Completing a CopyOffload IO (read/write) request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
TransferredLength UInt64
Flags HexInt32
NTStatus HexInt32NTSTATUS reference

Event ID 8: Device returned sense data.

#
Channel
Diagnose
Task
Class

Fields #

NameDescription
DeviceNumber UInt32
SenseKey UInt8
AddSense UInt8
AddSenseQ UInt8
CurrentRetryCount UInt32

Event ID 201: Request servicing time taken by lower driver stack(s).

#
Channel
Analytic
Also via
realtime ETW trace
Level
Informational
Task
Class
Opcode
win:Info

Fields #

NameDescription
DeviceNumber UInt32
RequestDurationin100ns UInt64
Irp Pointer
Command UInt8
SrbStatus UInt8
OriginalIrp Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 201,
    "version": 1,
    "level": 4,
    "task": 200,
    "opcode": 0,
    "keywords": "0x1000000000100000",
    "time_created": "2026-06-02T05:31:09.868+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{04300006-000D-0000-D0FA-62C48D87FFFF}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Command": 42,
    "DeviceNumber": 0,
    "Irp": "0xFFFF878DBD7D6A20",
    "OriginalIrp": "0xFFFF878DBBCE3010",
    "RequestDuration (in 100ns)": 5216,
    "SrbStatus": 1
  },
  "message": "Class"
}

Example keys not documented in the fields table: RequestDuration (in 100ns)

Event ID 202: Dispatching a read request.

#
Channel
Diagnose
Level
Informational
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Command UInt8
LengthOfTransferinbytes UInt64
LBA HexInt64
OriginalIrp Pointer
NvCachePriority UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Storage-ClassPnP/Diagnose",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 202,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 4864
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 100,
    "provider": "Microsoft-Windows-StorDiag",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:15:33.264Z",
    "version": 0
  },
  "event_data": {
    "Command": 40,
    "DeviceNumber": 0,
    "Irp": "0xFFFFC807BFB31B90",
    "LBA": "E0C1FB1A00000000",
    "LengthOfTransfer (in bytes)": 512,
    "NvCachePriority": 255,
    "OriginalIrp": "0xFFFFC807C759F560"
  },
  "message": ""
}

Example keys not documented in the fields table: LengthOfTransfer (in bytes)

Event ID 203: Dispatching a write request.

#
Channel
Diagnose
Also via
realtime ETW trace
Level
Informational
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Command UInt8
LengthOfTransferinbytes UInt64
LBA HexInt64
OriginalIrp Pointer
NvCachePriority UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 203,
    "version": 2,
    "level": 4,
    "task": 200,
    "opcode": 100,
    "keywords": "0x4000000000400000",
    "time_created": "2026-06-02T05:31:09.868+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{04300006-000D-0000-D0FA-62C48D87FFFF}"
    },
    "execution": {
      "process_id": 12112,
      "thread_id": 7804
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Command": 42,
    "DeviceNumber": 0,
    "Irp": "0xFFFF878DBD7D6A20",
    "LBA": "78C4800800000000",
    "LengthOfTransfer (in bytes)": 4096,
    "NvCachePriority": 255,
    "OriginalIrp": "0xFFFF878DBBCE3010"
  },
  "message": "Class"
}

Example keys not documented in the fields table: LengthOfTransfer (in bytes)

Event ID 204: Dispatching a read request.

#
Channel
Diagnose
Also via
realtime ETW trace
Level
Informational
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Command UInt8
LengthOfTransferinbytes UInt64
LBA HexInt64
OriginalIrp Pointer
NvCachePriority UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 204,
    "version": 2,
    "level": 4,
    "task": 200,
    "opcode": 100,
    "keywords": "0x4000000000A00000",
    "time_created": "2026-06-02T05:31:10.248+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{04300006-000B-0000-403D-4FB68D87FFFF}"
    },
    "execution": {
      "process_id": 2140,
      "thread_id": 16816
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Command": 40,
    "DeviceNumber": 0,
    "Irp": "0xFFFF878DBD7D6A20",
    "LBA": "2800330900000000",
    "LengthOfTransfer (in bytes)": 4096,
    "NvCachePriority": 255,
    "OriginalIrp": "0xFFFF878DBC990A20"
  },
  "message": "Class"
}

Example keys not documented in the fields table: LengthOfTransfer (in bytes)

Event ID 205: Dispatching a write request.

#
Channel
Diagnose
Also via
realtime ETW trace
Level
Informational
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Command UInt8
LengthOfTransferinbytes UInt64
LBA HexInt64
OriginalIrp Pointer
NvCachePriority UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 205,
    "version": 2,
    "level": 4,
    "task": 200,
    "opcode": 100,
    "keywords": "0x4000000001400000",
    "time_created": "2026-06-02T05:31:09.868+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{04300006-000D-0000-D0FA-62C48D87FFFF}"
    },
    "execution": {
      "process_id": 12112,
      "thread_id": 7804
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Command": 42,
    "DeviceNumber": 0,
    "Irp": "0xFFFF878DBD7D6A20",
    "LBA": "88C95D0000000000",
    "LengthOfTransfer (in bytes)": 16384,
    "NvCachePriority": 255,
    "OriginalIrp": "0xFFFF878DC3EECB60"
  },
  "message": "Class"
}

Example keys not documented in the fields table: LengthOfTransfer (in bytes)

Event ID 206: Dispatching a read request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Command UInt8
LengthOfTransferinbytes UInt64
LBA HexInt64
OriginalIrp Pointer
NvCachePriority UInt8

Event ID 207: Dispatching a write request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Command UInt8
LengthOfTransferinbytes UInt64
LBA HexInt64
OriginalIrp Pointer
NvCachePriority UInt8

Event ID 208: Completing an IO (read/write) request.

#
Channel
Diagnose
Also via
realtime ETW trace
Level
Informational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
NTStatus HexInt32NTSTATUS reference
SrbStatus UInt8
ScsiStatus UInt8
SenseKey UInt8
AddSense UInt8
AddSenseQ UInt8
OriginalIrp Pointer
NumberOfTimesRetried UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 208,
    "version": 2,
    "level": 4,
    "task": 200,
    "opcode": 101,
    "keywords": "0x4000000007E00000",
    "time_created": "2026-06-02T05:31:09.868+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{04300006-000D-0000-D0FA-62C48D87FFFF}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AddSense": 0,
    "AddSenseQ": 0,
    "DeviceNumber": 0,
    "Irp": "0xFFFF878DBD7D6A20",
    "NTStatus": "00000000",
    "NumberOfTimesRetried": 0,
    "OriginalIrp": "0xFFFF878DBBCE3010",
    "ScsiStatus": 0,
    "SenseKey": 0,
    "SrbStatus": 1
  },
  "message": "Class"
}

Event ID 209: Retrying an IO (read/write) request.

#
Channel
Diagnose
Level
Informational
Task
Class
Opcode
Retryhandling.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
CurrentRetryCount UInt32
NTStatus HexInt32NTSTATUS reference
SrbStatus UInt8
ScsiStatus UInt8
SenseKey UInt8
AddSense UInt8
AddSenseQ UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Storage-ClassPnP/Diagnose",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 209,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 104,
    "provider": "Microsoft-Windows-StorDiag",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:16:08.906Z",
    "version": 0
  },
  "event_data": {
    "AddSense": 0,
    "AddSenseQ": 0,
    "CurrentRetryCount": 0,
    "DeviceNumber": 0,
    "Irp": "0xFFFFC807C473FBC0",
    "NTStatus": "00000000",
    "ScsiStatus": 0,
    "SenseKey": 0,
    "SrbStatus": 0
  },
  "message": ""
}

Event ID 210: Flush request.

#
Channel
Diagnose
Task
Class

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Bus UInt8
Target UInt8
LUN UInt8

Event ID 211: Flush request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
NTStatus HexInt32NTSTATUS reference
SrbStatus UInt8
ScsiStatus UInt8
SenseKey UInt8
AddSense UInt8
AddSenseQ UInt8
OriginalIrp Pointer

Event ID 212: Dispatching an IOCTL.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
MajorFunction HexInt32
MinorFunction HexInt32
Parameter HexInt32

Event ID 213: Dispatching a WMI request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
MajorFunction HexInt32
MinorFunction HexInt32
Parameter HexInt32

Event ID 214: Completing a non-read/write request.

#
Channel
Diagnose
Also via
realtime ETW trace
Level
Informational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Status HexInt32NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 214,
    "version": 1,
    "level": 4,
    "task": 200,
    "opcode": 101,
    "keywords": "0x40000000C0000000",
    "time_created": "2026-06-02T06:03:26.286+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 2520
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceNumber": 0,
    "Irp": "0xFFFFBD09F10D2010",
    "Status": "00000000"
  },
  "message": "Class"
}

Event ID 215: Dispatching a power request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
MinorFunction HexInt32
Type UInt8
OldState HexInt32
NewState HexInt32
Action HexInt32
PowerStateContext HexInt32

Event ID 216: Completing a power request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Status HexInt32NTSTATUS reference

Event ID 217: Dispatching a PnP request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
MinorFunction HexInt32
Type HexInt32
DeviceObject Pointer

Event ID 218: Completing a PnP request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
Status HexInt32NTSTATUS reference

Event ID 219: Completing a PnP enumeration request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
NumberOfChildren UInt32
Status HexInt32NTSTATUS reference

Event ID 220: Performing a queue-related operation.

#
Channel
Diagnose
Level
Informational
Task
Class
Opcode
Queue_relatedoperation.

Fields #

NameDescription
DeviceNumber UInt32
QueueTag HexInt32
Operation UInt8
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
Status HexInt32NTSTATUS reference

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Storage-ClassPnP/Diagnose",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 220,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9228,
      "thread_id": 3844
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 106,
    "provider": "Microsoft-Windows-StorDiag",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:57:02.224Z",
    "version": 0
  },
  "event_data": {
    "DeviceNumber": 0,
    "Operation": 3,
    "QueueTag": "01000000",
    "Status": "00000000"
  },
  "message": ""
}

Event ID 221: Dispatching a PassThrough request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceNumber UInt32
Irp Pointer
MajorFunction HexInt32
MinorFunction HexInt32
Parameter HexInt32

Event ID 222: Upperlevel Trim request servicing time.

#
Channel
Analytic
Also via
realtime ETW trace
Level
Informational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
RequestDurationin100ns UInt64
UpperLevelIrp Pointer
IrpStatus HexInt32
DsmFlags UInt32
DataSetRangesCount UInt32
DataSetRanges UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 222,
    "version": 1,
    "level": 4,
    "task": 200,
    "opcode": 101,
    "keywords": "0x1000400000000000",
    "time_created": "2026-06-02T06:03:26.286+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 2520
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DataSetRanges": "00C0230E060000000040000000000000",
    "DataSetRangesCount": 1,
    "DeviceGUID": "{5A7D9CED-A852-A1AC-E3DA-7B3E59928B2A}",
    "DeviceNumber": 0,
    "DsmFlags": 2147483648,
    "IrpStatus": "00000000",
    "RequestDuration (in 100ns)": 10333,
    "Upper Level Irp": "0xFFFFBD09F10D2010"
  },
  "message": "Class"
}

Example keys not documented in the fields table: RequestDuration (in 100ns), Upper Level Irp

Event ID 223: Downlevel Unmap SRB request servicing time taken by lower driver stack(s)

#
Channel
Analytic
Also via
realtime ETW trace
Level
Informational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
RequestDurationin100ns UInt64
OriginalIrp Pointer
SrbStatus UInt8
SrbFlags HexInt32
MaxAllowedLbaCount UInt64
MaxAllowedBlockDescriptorCount UInt64
LbaSizeinBytes UInt32
Srb_BlockDescriptorCount UInt32
Srb_BlockDescriptors Float

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 223,
    "version": 1,
    "level": 4,
    "task": 200,
    "opcode": 101,
    "keywords": "0x1000400000000000",
    "time_created": "2026-06-02T06:03:26.286+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 2520
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceGUID": "{5A7D9CED-A852-A1AC-E3DA-7B3E59928B2A}",
    "DeviceNumber": 0,
    "LbaSize (in Bytes)": 512,
    "MaxAllowedBlockDescriptorCount": 1,
    "MaxAllowedLbaCount": 4194303,
    "Original Irp": "0xFFFFBD09F10D2010",
    "RequestDuration (in 100ns)": 8119,
    "SrbFlags": "00800000",
    "SrbStatus": 1,
    "Srb_BlockDescriptorCount": 1,
    "Srb_BlockDescriptors": "00000000030711E00000002000000000"
  },
  "message": "Class"
}

Example keys not documented in the fields table: LbaSize (in Bytes), Original Irp, RequestDuration (in 100ns)

Event ID 224: Report Zone Latency

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
RequestDurationin100ns UInt64
UpperLevelIrp Pointer
IrpStatus HexInt32
IsPartial Boolean
StartingOffset UInt64
BufferSize UInt32

Event ID 225: Reset Write Pointer Latency

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceNumber UInt32
RequestDurationin100ns UInt64
UpperLevelIrp Pointer
IrpStatus HexInt32
ResetAll Boolean
StartingOffset UInt64

Event ID 226: Completing a failed IOCTL request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
IoctlControlCode HexInt32

Event ID 500: Completing a failed upper level read request.

#
Channel
Operational
Level
Error
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
LBA HexInt64
TransferByteCount UInt64
NvCachePriority UInt8
PagingPriority UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 500,
    "version": 1,
    "level": 2,
    "task": 200,
    "opcode": 101,
    "keywords": 576460752305520640,
    "time_created": "2026-03-20T19:05:01.3457184+00:00",
    "event_record_id": 57,
    "correlation": {},
    "execution": {
      "process_id": 3800,
      "thread_id": 8480
    },
    "channel": "Microsoft-Windows-Storage-ClassPnP/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceGUID": "{e8422238-88a7-116d-3f2e-b657cf884f03}",
    "DeviceNumber": "1",
    "Vendor": "Msft    ",
    "Model": "Virtual Disk    ",
    "FirmwareVersion": "1.0 ",
    "SerialNumber": "NULL",
    "IrpStatus": "0xc000000e",
    "LBA": "0x40800",
    "TransferByteCount": "512",
    "NvCachePriority": "255",
    "PagingPriority": "2"
  },
  "message": "Completing a failed upper level read request."
}

Event ID 501: Completing a failed upper level write request.

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
LBA HexInt64
TransferByteCount UInt64
NvCachePriority UInt8
PagingPriority UInt32

Event ID 502: Completing a failed upper level paging read request.

#
Channel
Operational
Level
Error
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
LBA HexInt64
TransferByteCount UInt64
NvCachePriority UInt8
PagingPriority UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "F5D05B38-80A6-4653-825D-C414E4AB3C68",
    "event_source_name": "",
    "event_id": 502,
    "version": 1,
    "level": 2,
    "task": 200,
    "opcode": 101,
    "keywords": 576460752313909248,
    "time_created": "2026-03-13T20:08:10.726401+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 3952,
      "thread_id": 5384
    },
    "channel": "Microsoft-Windows-Storage-ClassPnP/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceGUID": "96B63F5A-0716-1FE9-02F0-284D47E6F444",
    "DeviceNumber": 1,
    "Vendor": "Msft    ",
    "Model": "Virtual Disk    ",
    "FirmwareVersion": "1.0 ",
    "SerialNumber": "NULL",
    "IrpStatus": "0xc000000e",
    "LBA": "0x40800",
    "TransferByteCount": 4096,
    "NvCachePriority": 255,
    "PagingPriority": 1
  },
  "message": ""
}

Event ID 503: Completing a failed upper level paging write request.

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
LBA HexInt64
TransferByteCount UInt64
NvCachePriority UInt8
PagingPriority UInt32

Event ID 504: Completing a failed IOCTL request.

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
IoctlControlCode HexInt32

Event ID 505: Completing a failed Read SCSI SRB request

#
Channel
Operational
Level
Error
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
DownLevelIrpStatus HexInt32
SrbStatus UInt8
ScsiStatus UInt8
SenseKey UInt8
AdditionalSenseCode UInt8
AdditionalSenseCodeQualifier UInt8
CdbByteCount UInt32
CdbBytes Binary
NumberOfRetriesDone UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "F5D05B38-80A6-4653-825D-C414E4AB3C68",
    "event_source_name": "",
    "event_id": 505,
    "version": 1,
    "level": 2,
    "task": 200,
    "opcode": 101,
    "keywords": 576460752347463680,
    "time_created": "2026-03-13T20:08:10.726385+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "03A00006-0001-0000-6096-45970B92FFFF"
    },
    "execution": {
      "process_id": 3952,
      "thread_id": 5384
    },
    "channel": "Microsoft-Windows-Storage-ClassPnP/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DeviceGUID": "96B63F5A-0716-1FE9-02F0-284D47E6F444",
    "DeviceNumber": 1,
    "Vendor": "Msft    ",
    "Model": "Virtual Disk    ",
    "FirmwareVersion": "1.0 ",
    "SerialNumber": "NULL",
    "DownLevelIrpStatus": "0xc000000e",
    "SrbStatus": 8,
    "ScsiStatus": 2,
    "SenseKey": 0,
    "AdditionalSenseCode": 0,
    "AdditionalSenseCodeQualifier": 0,
    "CdbByteCount": 16,
    "CdbBytes": "88000000000000040800000000080000",
    "NumberOfRetriesDone": 0
  },
  "message": ""
}

Event ID 506: Completing a failed Write SCSI SRB request

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
DownLevelIrpStatus HexInt32
SrbStatus UInt8
ScsiStatus UInt8
SenseKey UInt8
AdditionalSenseCode UInt8
AdditionalSenseCodeQualifier UInt8
CdbByteCount UInt32
CdbBytes Binary
NumberOfRetriesDone UInt8

Event ID 507: Completing a failed non-ReadWrite SCSI SRB request

#
Channel
Operational
Level
Error
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
DownLevelIrpStatus HexInt32
SrbStatus UInt8
ScsiStatus UInt8
SenseKey UInt8
AdditionalSenseCode UInt8
AdditionalSenseCodeQualifier UInt8
CdbByteCount UInt32
CdbBytes Binary
NumberOfRetriesDone UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorDiag",
    "guid": "{F5D05B38-80A6-4653-825D-C414E4AB3C68}",
    "event_source_name": "",
    "event_id": 507,
    "version": 1,
    "level": 2,
    "task": 200,
    "opcode": 101,
    "keywords": 576460752437641216,
    "time_created": "2026-05-29T16:32:51.0502111+00:00",
    "event_record_id": 102,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000001}"
    },
    "execution": {
      "process_id": 812,
      "thread_id": 816
    },
    "channel": "Microsoft-Windows-Storage-ClassPnP/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceGUID": "{5a7d9ced-a852-a1ac-e3da-7b3e59928b2a}",
    "DeviceNumber": "0",
    "Vendor": "Red Hat ",
    "Model": "VirtIO",
    "FirmwareVersion": "0001",
    "SerialNumber": "",
    "DownLevelIrpStatus": "0xc0000185",
    "SrbStatus": "6",
    "ScsiStatus": "0",
    "SenseKey": "0",
    "AdditionalSenseCode": "0",
    "AdditionalSenseCodeQualifier": "0",
    "CdbByteCount": "6",
    "CdbBytes": "151000001800",
    "NumberOfRetriesDone": "0"
  },
  "message": "Completing a failed non-ReadWrite SCSI SRB request"
}

Event ID 508: Completing a failed Non-SCSI SRB request

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
DownLevelIrpStatus HexInt32
SrbStatus UInt8
SrbFunction HexInt32
SrbFlags HexInt32
NumberOfRetriesDone UInt8

Event ID 509: Completing a failed PNP request.

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
IrpMinorFunction UInt8
PnPType UInt32
PnPUsageInPath Boolean
CurrentPnpState UInt32
PreviousPnpState UInt32
PagingPathUsageCount UInt32
HibernationPathUsageCount UInt32
DumpPathUsageCount UInt32

Event ID 510: Completing a failed Power request.

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
IrpMinorFunction UInt8
PowerSystemContext UInt32
PowerStateType UInt32
PowerState UInt32
PowerShutdownType UInt32
CurrentPowerState UInt32
ContextPowerChangeState UInt32

Event ID 511: Completing a failed WMI request

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
IrpStatus HexInt32
IrpMinorFunction UInt8
WmiDataBlockGUID GUID
WmiProviderId Pointer

Event ID 512: Get Storage Firmware Information

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
Status HexInt32NTSTATUS reference
InputBufferLength UInt32
OutputBufferLength UInt32
DeviceNumber UInt32
PortDriverCodeSet UInt32
FirmwareGetInfoSupport UInt32
QueryFlag UInt32

Event ID 513: Download Storage Firmware

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
Status HexInt32NTSTATUS reference
InputBufferLength UInt32
DeviceNumber UInt32
PortDriverCodeSet UInt32
FirmwareGetInfoSupport UInt32
HWFirmwareSupportUpgrade UInt8
ImagePayloadAlignment UInt32
SlotCount UInt8
SlotIndex UInt32
FWImageVersion UInt32
FWSize UInt32
FWSlot UInt8
FWImageBufferSize UInt64
Flags UInt32
FWImageOffset UInt64

Event ID 514: Activate New Storage Firmware

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
Status HexInt32NTSTATUS reference
InputBufferLength UInt32
DeviceNumber UInt32
PortDriverCodeSet UInt32
FirmwareGetInfoSupport UInt32
HWFirmwareSupportUpgrade UInt8
SlotCount UInt8
SlotIndex UInt32
FWImageVersion UInt32
FWSize UInt32
FWSlot UInt8
Flags UInt32

Event ID 515: Query Device Telemetry

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
T10VendorIdLength UInt32
T10VendorId Binary
DataSet1Length UInt32
DataSet2Length UInt32
DataSet3Length UInt32
DataSet4Length UInt32
DataVersion UInt8
ReasonIdentifierLength UInt32
ReasonIdentifier Binary

Event ID 516: Failed to process zone command asynchronously

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
DsmAction UInt32

Event ID 517: Read capacity failed with SMR device

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
DefaultValueUsed Boolean
BytesPerSector UInt32
SectorShift UInt32
NTStatus HexInt32NTSTATUS reference

Event ID 518: Zone count mismatch

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
ActualZoneCount UInt32
DeviceZoneCount UInt32
ZoneGroupCount UInt32
BytesPerSector UInt32

Event ID 519: Retrieve zone information failed

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
NTStatus HexInt32NTSTATUS reference
BytesPerSector UInt32

Event ID 520: Query Command Duration Limit support and its Mode Page

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
NTStatus HexInt32NTSTATUS reference
CommandOpCode UInt8
T2CDLPage UInt8
CDLPage UInt8

Event ID 521: Query Command Duration Limit Mode Page failed

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
NTStatus HexInt32NTSTATUS reference
CDLSupported Boolean
PageSavable Boolean
T2CDLPage UInt8
CDLPage UInt8

Event ID 522: Set Command Duration Limit Mode Page failed

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
NTStatus HexInt32NTSTATUS reference
CDLSupported Boolean
PageSavable Boolean
T2CDLPage UInt8
CDLPage UInt8

Event ID 523: Read capacity failed

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Vendor AnsiString
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
DefaultValueUsed Boolean
BytesPerSector UInt32
SectorShift UInt32
NTStatus HexInt32NTSTATUS reference

Provenance

ETW provider GUID {F5D05B38-80A6-4653-825D-C414E4AB3C68}

Defined in classpnp.sys, the binary that emits these events.

  • WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.4163, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB
  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4163, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB