Microsoft-Windows-Telephony-PhoneService

137 events across 1 channel

Event	Title	Channel	Sample
1	[ERROR] originated HRESULT=.	Operational	N
2	[ERROR] propagated HRESULT=.	Operational	N
10	Event ID 10	Operational	N
102	The Phone service failed to start with error {Code}.	Operational	N
600	PH_MSG: {PhMsg} with supsvc code or SIM error: {SupSvc}.	Operational	N
601	USSD Message: {Prop_HexInt32_1} suppressed due to emergency call.	Operational	N
700	CallState Change for callId: {HCall}; from {OldState} to {NewState}.	Operational	N
702	Controller request to provider {Provider}: verb {CallVerb} id: {RequestId} hr: …	Operational	N
703	Controller request result from provider {Provider}: verb {CallVerb} id: …	Operational	N
706	Phone dialing {Prop_UnicodeString}.	Operational	N
708	Fake Call Added: {Prop_HexInt32_1}.	Operational	N
712	Controller added call history record with Oid: {Prop_HexInt32_1} hr …	Operational	N
714	Dialing rules end: modified by rule {Prop_HexInt32_1}; rule processing time …	Operational	N
717	Controller holding call {Prop_HexInt32_1} to accept call {Prop_HexInt32_2}.	Operational	N
718	Controller dropping held call {Prop_HexInt32_1} to accept call …	Operational	N
719	Controller using DropAccept for incoming; dropping call {Prop_HexInt32_1} to …	Operational	N
720	[CellularAudio] Setting audio endpoint to {AudioEndpoint}.	Operational	N
721	[CellularAudio] Notified of audio routing endpoint change to {AudioEndpoint}.	Operational	N
722	[CellularAudio] Notified of bluetooth state change to {BluetoothState}.	Operational	N
723	[CellularAudio] Enabling phone call audio to endpoint {Endpoint}; IsIncoming …	Operational	N
726	Phone service failed to initialize UDM or CallHistoryItemWriter.	Operational	N
727	Phone service failed to initialize External VVM manager.	Operational	N
728	Phone service failed to initialize POOM.	Operational	N
729	[CellularAudio] Tone Notification: {ToneType}; digits {ToneDigits}; on {OnTime}; …	Operational	N
730	Controller OnFinished called for requestId {RequestId} hr: {HResult}.	Operational	N
731	Rejected incoming call.	Operational	N
732	[CellularAudio] Enabling cellular audio: {AudioType} on executor …	Operational	N
733	[CellularAudio] Disabling cellular audio: {AudioType} on executor …	Operational	N
738	PhoneController - phone line added.	Operational	N
739	PhoneController - phone line removed.	Operational	N
740	PhoneController - line property: {property} value: {string} for line ID:{guid}.	Operational	N
741	PhoneController - line property: {property} value: {int} for line ID:{guid}.	Operational	N
742	[CellularAudio] ExecutorIndex: {Prop_HexInt32_1} already initialized for audio.	Operational	N
743	[CellularAudio] Muting cellular TX audio: {AudioType} on executor …	Operational	N
744	[CellularAudio] Muting cellular RX audio: {AudioType} on executor …	Operational	N
745	EndUpgradeOriginationCall invoked for upgrade guid {Prop_Guid}.	Operational	N
746	CancelUpgrade invoked for upgrade guid {Prop_Guid}.	Operational	N
747	[CellularAudio] Enabling cellular provider change; [executorIndex=.	Operational	N
748	[CellularAudio] Invalid cellular provider change attempted; [executorIndex=.	Operational	N
749	[CellularAudio] Handover in progress; cellular audio type change not allowed …	Operational	N
750	Phone call swap was ignored.	Operational	N
751	Calculation for time between call swaps was completed.	Operational	N
752	CallProgress - Determined sound configuration according to country code; …	Operational	N
753	Disable and enable cellular audio.	Operational	N
754	CallProgress - Using override country code for determining tone configuration; …	Operational	N
755	CallProgress - Failed to get 3GPP in call tone for type and mcc; [CountryCode=.	Operational	N
756	CallProgress - Failed to get 3GPP in call tone; [HRESULT=.	Operational	N
900	Event sound: {Prop_UnicodeString}.	Operational	N
1048	Emergency Number: received updated list {Prop_UnicodeString}.	Operational	N
1049	Emergency Number: Dial request for callid {Prop_HexInt32_1}.	Operational	N
1052	OperationWatchdog: '{OperationId}' timed out.	Operational	N
1053	OperationWatchdog: '{OperationId}' completed.	Operational	N
1054	Async API context {Prop_HexInt32_1} completed with result {Prop_HexInt32_2}.	Operational	N
1055	Phone service listener added: {Prop_HexInt32_1}.	Operational	N
1056	Phone service listener removed: {Prop_HexInt32_1}.	Operational	N
1057	Phone service listener lost notifications: {Prop_HexInt32_1}.	Operational	N
1058	Phone service listener lost notifications: {Prop_HexInt32_1}.	Operational	N
1059	Phone service listener rundown: {Prop_HexInt32_1}.	Operational	N
1060	Phone notification sent: {ChangeEvent} error: {Error}.	Operational	N
1065	Call Upgrade state for CallId: {CallId} Changed From: {OldUpgradeState} To: …	Operational	N
1066	Data Connectivity State: {Prop_HexInt32_1}.	Operational	N
1071	Connection Manager Error.	Operational	N
1072	Call Line Change for CallId: {Prop_HexInt32_1} from LineId: {Prop_Guid1} to …	Operational	N
1074	PhoneTileManager: Creating secondary Phone Tile with id: {Prop_UnicodeString}.	Operational	N
1075	PhoneTileManager: Setting the primary Phone Tile to be assigned to PhoneLineId: …	Operational	N
1076	PhoneTileManager: Deleting Phone Tile with id: {Prop_UnicodeString}.	Operational	N
1078	PhoneTile: Committed an update to the Phone Tile with tile id: {TileId}.	Operational	N
1080	PhoneTileControllerSink: The PhoneLine ({Prop_Guid}) has been removed.	Operational	N
1087	PhoneTileControllerSink: ShellReadyState changed to {Prop_BOOL}.	Operational	N
1088	SystemEventTriggerControllerSink: LineChangedTrigger fired with: LineId …	Operational	N
1089	SystemEventTriggerControllerSink: NewVoicemailMessageTrigger fired with: LineId …	Operational	N
1090	SystemEventTriggerControllerSink: CallOriginDataRequestTrigger fired with: …	Operational	N
1091	SystemEventTriggerControllerSink: CallHistoryChanged fired with: hr: …	Operational	N
1092	SystemEventTriggerControllerSink: AirplaneModeDisabledForEmergencyCall fired …	Operational	N
1093	SystemEventTriggerControllerSink: OnCallEvent called with: event: …	Operational	N
1094	SystemEventTriggerControllerSink: Attempted to advise to CallHistorySession …	Operational	N
1098	SystemEventTriggerControllerSink: LineChangedTrigger suppressed [LineId=.	Operational	N
1100	SystemEventTriggerControllerSink: OnShellReady started …	Operational	N
1101	SystemEventTriggerControllerSink: OnShellReady triggering deferred notification …	Operational	N
1102	SystemEventTriggerControllerSink: Received screen state change notification …	Operational	N
1103	SystemEventTriggerControllerSink: OnScreenStateChange started …	Operational	N
1104	SystemEventTriggerControllerSink: OnScreenStateChange triggering deferred …	Operational	N
1105	SystemEventTriggerControllerSink: LineChangedTrigger skipped [LineId=.	Operational	N
1201	InteractiveUserNotificationSink: New Incoming Call State Changed [callId=.	Operational	N
1202	InteractiveUserNotificationSink: Show Incoming Call Toast [callId=.	Operational	N
1203	Supplementary service code: {Prop_UnicodeString} was converted from erase to …	Operational	N
1204	InteractiveUserNotificationSink: Call belongs to Win32 app; skipping [callId=.	Operational	N
1501	Call data collection item added for CallId: [.	Operational	N
1502	Call data collection item removed for CallId: [.	Operational	N
1503	Call data collection item dropped an idle call for CallId: [.	Operational	N
1504	CallHistoryItemWriter: Call with id {Prop_HexInt32_1} is added.	Operational	N
1505	CallHistoryItemWriter: Call with id {Prop_HexInt32_1} is updated.	Operational	N
1506	CallAnnotationsLookupConnecting: Establishing RPC connection.	Operational	N
1507	CallAnnotationsLookup: Querying location.	Operational	N
1508	CallAnnotationsLookup: Completed location query.	Operational	N
1510	CallAnnotationsManager: Call: {CallId} LookupState: {LookupState}.	Operational	N
1512	Service Idle Callback received.	Operational	N
1513	CallRecording VALID state change from '{CurrentState}' to '{DesiredState}' on …	Operational	N
1514	CallRecording: INVALID state change from '{CurrentState}' to '{DesiredState}' on …	Operational	N
1515	CallRecording: Recorded call is now idle.	Operational	N
1516	CallRecording: Recorded call is now held.	Operational	N
1517	CallRecording: A call that is not being recorded is talking.	Operational	N
1518	CallRecording: Recorded call no longer exists.	Operational	N
1519	CallRecording: Preferred recording application changed.	Operational	N
1520	Call [callId=.	Operational	N
1521	CallRecordingOff: {callRecordingOff}; Preferred Recording app PFN: …	Operational	N
1522	CallRecordingApplication {Prop_UnicodeString} detected.	Operational	N
1600	[RcsPresence] Request Capabilities: {TelString}.	Operational	N
1601	[RcsPresence] Received query response; [responseCode=.	Operational	N
1602	[RcsPresence] Received {Count} capability tuple(s).	Operational	N
1603	[RcsPresence] Tuple {TupleIndex}; MediaType not video capable: {MediaType}.	Operational	N
1604	[RcsPresence] Tuple {TupleIndex}; ServiceIdentifier not video capable: …	Operational	N
1605	[RcsPresence] Tuple {TupleIndex} is video capable.	Operational	N
1606	[RcsPresence] RcsPresenceCache hit; [TelUri string=.	Operational	N
1607	[RcsPresence] Query suppressed due to capabilities sharing opt-in settings; …	Operational	N
1608	Checking for device support of video calling.	Operational	N
1609	Checking for device support of video calling.	Operational	N
1610	PhoneController - Updating video calling settings; [lineId=.	Operational	N
1611	CallRecording: Deferred request to disable cellular audio: {AudioType} on …	Operational	N
1612	CallRecording: Cancelled request to defer disabling of cellular audio: …	Operational	N
1613	CallRecording: An audio type change prevented deferring of audio disable.	Operational	N
1614	CallRecording: Performing deferred request to disable cellular audio: …	Operational	N
1617	[RcsPresence] Video capability sharing settings update requested …	Operational	N
1618	[RcsPresence] Cache initialized [cacheExpirationInSeconds=.	Operational	N
1619	[RcsPresence] Publishing capabilities [.	Operational	N
1621	[RcsPresence] RCS presence service status queried; [status=.	Operational	N
1623	[RcsPresence] Received publish response; [responseCode=.	Operational	N
1624	[RcsPresence] Received OnNetworkSupportVideoChanged; [updatedValue=.	Operational	N
1625	[RcsPresence] Saved last published capabilities; [updatedValue=.	Operational	N
1626	[RcsPresence] Publish capabilities requested; [reason=.	Operational	N
1627	Attempting audio routing {{Prop_AudioRoutingState}} as per settings.	Operational	N
1628	Updating callInfo with remote party hold status [callId=.	Operational	N
1629	Caller ID privacy header set to: {{value}}.	Operational	N
1630	The prefix {{Prop_UnicodeString}} was dialed which is prohibited.	Operational	N
1632	Adding call to conference [lineId=.	Operational	N
1633	Removing call from conference [lineId=.	Operational	N
1634	Updating CallInfo confererence participant property [callId=.	Operational	N

Event ID 1: [ERROR] originated HRESULT=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[ERROR] originated HRESULT={P1_HResult} [{P2_String} @ {P3_UInt32}].

Message #

[ERROR] originated HRESULT={P1_HResult} [{P2_String} @ {P3_UInt32}]

Fields #

Name	Description
`P1_HResult`
`P2_String`
`P3_UInt32`

Event ID 2: [ERROR] propagated HRESULT=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[ERROR] propagated HRESULT={P1_HResult} [{P2_String} @ {P3_UInt32}].

Message #

[ERROR] propagated HRESULT={P1_HResult} [{P2_String} @ {P3_UInt32}]

Fields #

Name	Description
`P1_HResult`
`P2_String`
`P3_UInt32`

Event ID 10

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

{Prop_UnicodeString}.

Message #

{Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 102: The Phone service failed to start with error {Code}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

The Phone service failed to start with error {Code}.

Message #

The Phone service failed to start with error {Code}

Fields #

Name	Description
`Code`

Event ID 600: PH_MSG: {PhMsg} with supsvc code or SIM error: {SupSvc}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PH_MSG: {PhMsg} with supsvc code or SIM error: {SupSvc}.

Message #

PH_MSG: {PhMsg} with supsvc code or SIM error: {SupSvc}

Fields #

Name	Description
`PhMsg`
`SupSvc`

Event ID 601: USSD Message: {Prop_HexInt32_1} suppressed due to emergency call.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

USSD Message: {Prop_HexInt32_1} suppressed due to emergency call.

Message #

USSD Message: {Prop_HexInt32_1} suppressed due to emergency call

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 700: CallState Change for callId: {HCall}; from {OldState} to {NewState}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallState Change for callId: {HCall}; from {OldState} to {NewState}.

Message #

CallState Change for callId: {HCall}; from {OldState} to {NewState}

Fields #

Name	Description
`HCall`
`OldState`
`NewState`

Event ID 702: Controller request to provider {Provider}: verb {CallVerb} id: {RequestId} hr: {HResult}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Controller request to provider {Provider}: verb {CallVerb} id: {RequestId} hr: {HResult}.

Message #

Controller request to provider {Provider}: verb {CallVerb} id: {RequestId} hr: {HResult}

Fields #

Name	Description
`Provider`
`CallVerb`
`RequestId`
`HResult`

Event ID 703: Controller request result from provider {Provider}: verb {CallVerb} id: {RequestId} hr: {HResult}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Controller request result from provider {Provider}: verb {CallVerb} id: {RequestId} hr: {HResult}.

Message #

Controller request result from provider {Provider}: verb {CallVerb} id: {RequestId} hr: {HResult}

Fields #

Name	Description
`Provider`
`CallVerb`
`RequestId`
`HResult`

Event ID 706: Phone dialing {Prop_UnicodeString}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone dialing {Prop_UnicodeString}.

Message #

Phone dialing {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 708: Fake Call Added: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Fake Call Added: {Prop_HexInt32_1}.

Message #

Fake Call Added: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 712: Controller added call history record with Oid: {Prop_HexInt32_1} hr {Prop_HexInt32_2}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Controller added call history record with Oid: {Prop_HexInt32_1} hr {Prop_HexInt32_2}.

Message #

Controller added call history record with Oid: {Prop_HexInt32_1} hr {Prop_HexInt32_2}

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_HexInt32_2`

Event ID 714: Dialing rules end: modified by rule {Prop_HexInt32_1}; rule processing time {Prop_HexInt32_2} ms.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Dialing rules end: modified by rule {Prop_HexInt32_1}; rule processing time {Prop_HexInt32_2} ms.

Message #

Dialing rules end: modified by rule {Prop_HexInt32_1}; rule processing time {Prop_HexInt32_2} ms.

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_HexInt32_2`

Event ID 717: Controller holding call {Prop_HexInt32_1} to accept call {Prop_HexInt32_2}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Controller holding call {Prop_HexInt32_1} to accept call {Prop_HexInt32_2}.

Message #

Controller holding call {Prop_HexInt32_1} to accept call {Prop_HexInt32_2}.

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_HexInt32_2`

Event ID 718: Controller dropping held call {Prop_HexInt32_1} to accept call {Prop_HexInt32_2}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Controller dropping held call {Prop_HexInt32_1} to accept call {Prop_HexInt32_2}.

Message #

Controller dropping held call {Prop_HexInt32_1} to accept call {Prop_HexInt32_2}.

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_HexInt32_2`

Event ID 719: Controller using DropAccept for incoming; dropping call {Prop_HexInt32_1} to accept {Prop_HexInt32_2}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Controller using DropAccept for incoming; dropping call {Prop_HexInt32_1} to accept {Prop_HexInt32_2}.

Message #

Controller using DropAccept for incoming; dropping call {Prop_HexInt32_1} to accept {Prop_HexInt32_2}.

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_HexInt32_2`

Event ID 720: [CellularAudio] Setting audio endpoint to {AudioEndpoint}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Setting audio endpoint to {AudioEndpoint}.

Message #

[CellularAudio] Setting audio endpoint to {AudioEndpoint}

Fields #

Name	Description
`AudioEndpoint`

Event ID 721: [CellularAudio] Notified of audio routing endpoint change to {AudioEndpoint}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Notified of audio routing endpoint change to {AudioEndpoint}.

Message #

[CellularAudio] Notified of audio routing endpoint change to {AudioEndpoint}

Fields #

Name	Description
`AudioEndpoint`

Event ID 722: [CellularAudio] Notified of bluetooth state change to {BluetoothState}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Notified of bluetooth state change to {BluetoothState}.

Message #

[CellularAudio] Notified of bluetooth state change to {BluetoothState}

Fields #

Name	Description
`BluetoothState`

Event ID 723: [CellularAudio] Enabling phone call audio to endpoint {Endpoint}; IsIncoming {IsIncoming}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Enabling phone call audio to endpoint {Endpoint}; IsIncoming {IsIncoming}.

Message #

[CellularAudio] Enabling phone call audio to endpoint {Endpoint}; IsIncoming {IsIncoming}

Fields #

Name	Description
`Endpoint`
`IsIncoming`

Event ID 726: Phone service failed to initialize UDM or CallHistoryItemWriter.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone service failed to initialize UDM or CallHistoryItemWriter. Call history entries will not be written. HRESULT: {Prop_HexInt32_1}.

Message #

Phone service failed to initialize UDM or CallHistoryItemWriter.  Call history entries will not be written.  HRESULT: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 727: Phone service failed to initialize External VVM manager.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone service failed to initialize External VVM manager. VVM apps will not be able to control audio. HRESULT: {Prop_HexInt32_1}.

Message #

Phone service failed to initialize External VVM manager.  VVM apps will not be able to control audio. HRESULT: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 728: Phone service failed to initialize POOM.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone service failed to initialize POOM. Caller ID information will not be available. HRESULT: {Prop_HexInt32_1}.

Message #

Phone service failed to initialize POOM.  Caller ID information will not be available. HRESULT: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 729: [CellularAudio] Tone Notification: {ToneType}; digits {ToneDigits}; on {OnTime}; off {OffTime}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Tone Notification: {ToneType}; digits {ToneDigits}; on {OnTime}; off {OffTime}.

Message #

[CellularAudio] Tone Notification: {ToneType}; digits {ToneDigits}; on {OnTime}; off {OffTime}

Fields #

Name	Description
`ToneType`
`ToneDigits`
`OnTime`
`OffTime`

Event ID 730: Controller OnFinished called for requestId {RequestId} hr: {HResult}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Controller OnFinished called for requestId {RequestId} hr: {HResult}.

Message #

Controller OnFinished called for requestId {RequestId} hr: {HResult}

Fields #

Name	Description
`RequestId`
`HResult`

Event ID 731: Rejected incoming call.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Rejected incoming call. Line id: {LineId} Call Id: {CallId} reason: {Reason}.

Message #

Rejected incoming call. Line id: {LineId} Call Id: {CallId} reason: {Reason}

Fields #

Name	Description
`LineId`
`CallId`
`Reason`

Event ID 732: [CellularAudio] Enabling cellular audio: {AudioType} on executor {ExecutorIndex}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Enabling cellular audio: {AudioType} on executor {ExecutorIndex}.

Message #

[CellularAudio] Enabling cellular audio: {AudioType} on executor {ExecutorIndex}

Fields #

Name	Description
`AudioType`
`ExecutorIndex`

Event ID 733: [CellularAudio] Disabling cellular audio: {AudioType} on executor {ExecutorIndex}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Disabling cellular audio: {AudioType} on executor {ExecutorIndex}.

Message #

[CellularAudio] Disabling cellular audio: {AudioType} on executor {ExecutorIndex}

Fields #

Name	Description
`AudioType`
`ExecutorIndex`

Event ID 738: PhoneController - phone line added.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneController - phone line added. id: {Prop_Guid}; type: {Prop_Guid2}.

Message #

PhoneController - phone line added. id: {Prop_Guid}; type: {Prop_Guid2}

Fields #

Name	Description
`Prop_Guid`
`Prop_Guid2`

Event ID 739: PhoneController - phone line removed.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneController - phone line removed. id: {Prop_Guid}.

Message #

PhoneController - phone line removed. id: {Prop_Guid}

Fields #

Name	Description
`Prop_Guid`

Event ID 740: PhoneController - line property: {property} value: {string} for line ID:{guid}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneController - line property: {property} value: {string} for line ID:{guid}.

Message #

PhoneController - line property: {property} value: {string} for line ID:{guid}

Fields #

Name	Description
`property`
`string`
`guid`

Event ID 741: PhoneController - line property: {property} value: {int} for line ID:{guid}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneController - line property: {property} value: {int} for line ID:{guid}.

Message #

PhoneController - line property: {property} value: {int} for line ID:{guid}

Fields #

Name	Description
`property`
`int`
`guid`

Event ID 742: [CellularAudio] ExecutorIndex: {Prop_HexInt32_1} already initialized for audio.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] ExecutorIndex: {Prop_HexInt32_1} already initialized for audio.

Message #

[CellularAudio] ExecutorIndex: {Prop_HexInt32_1} already initialized for audio

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 743: [CellularAudio] Muting cellular TX audio: {AudioType} on executor {ExecutorIndex}; muted: {Muted}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Muting cellular TX audio: {AudioType} on executor {ExecutorIndex}; muted: {Muted}.

Message #

[CellularAudio] Muting cellular TX audio: {AudioType} on executor {ExecutorIndex}; muted: {Muted}

Fields #

Name	Description
`AudioType`
`ExecutorIndex`
`Muted`

Event ID 744: [CellularAudio] Muting cellular RX audio: {AudioType} on executor {ExecutorIndex}; muted: {Muted}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Muting cellular RX audio: {AudioType} on executor {ExecutorIndex}; muted: {Muted}.

Message #

[CellularAudio] Muting cellular RX audio: {AudioType} on executor {ExecutorIndex}; muted: {Muted}

Fields #

Name	Description
`AudioType`
`ExecutorIndex`
`Muted`

Event ID 745: EndUpgradeOriginationCall invoked for upgrade guid {Prop_Guid}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

EndUpgradeOriginationCall invoked for upgrade guid {Prop_Guid}.

Message #

EndUpgradeOriginationCall invoked for upgrade guid {Prop_Guid}

Fields #

Name	Description
`Prop_Guid`

Event ID 746: CancelUpgrade invoked for upgrade guid {Prop_Guid}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CancelUpgrade invoked for upgrade guid {Prop_Guid}.

Message #

CancelUpgrade invoked for upgrade guid {Prop_Guid}

Fields #

Name	Description
`Prop_Guid`

Event ID 747: [CellularAudio] Enabling cellular provider change; [executorIndex=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Enabling cellular provider change; [executorIndex={ExecutorIndex}][cellularAudioType={AudioType}][operation={Operation}].

Message #

[CellularAudio] Enabling cellular provider change; [executorIndex={ExecutorIndex}][cellularAudioType={AudioType}][operation={Operation}]

Fields #

Name	Description
`ExecutorIndex`
`AudioType`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 748: [CellularAudio] Invalid cellular provider change attempted; [executorIndex=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Message #

[CellularAudio] Invalid cellular provider change attempted; [executorIndex={ExecutorIndex}][targetAudioType={TargetAudioType}][operation={Operation}][currentAudioType={CurrentAudioType}][isInHandover={isInHandover}]

Fields #

Name	Description
`ExecutorIndex`
`TargetAudioType`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`CurrentAudioType`
`isInHandover`

Event ID 749: [CellularAudio] Handover in progress; cellular audio type change not allowed [executorIndex=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[CellularAudio] Handover in progress; cellular audio type change not allowed [executorIndex={executorIndex}][cellularAudioType={cellularAudioType}][audioActive={audioActive}].

Message #

[CellularAudio] Handover in progress; cellular audio type change not allowed [executorIndex={executorIndex}][cellularAudioType={cellularAudioType}][audioActive={audioActive}]

Fields #

Name	Description
`executorIndex`
`cellularAudioType`
`audioActive`

Event ID 750: Phone call swap was ignored.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone call swap was ignored. Call to hold: {CallToHold}. Call to unhold: {CallToUnhold}.

Message #

Phone call swap was ignored. Call to hold: {CallToHold}. Call to unhold: {CallToUnhold}.

Fields #

Name	Description
`CallToHold`
`CallToUnhold`

Event ID 751: Calculation for time between call swaps was completed.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Message #

Calculation for time between call swaps was completed. Allow swap is {AllowSwap}. Last successful swap was {TimeSinceLast} ms ago. The device is configured to wait at least {MinTime} ms in between swaps.

Fields #

Name	Description
`AllowSwap`
`TimeSinceLast`
`MinTime`

Event ID 752: CallProgress - Determined sound configuration according to country code; [LineId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallProgress - Determined sound configuration according to country code; [LineId={lineId}][CountryCode={homeMcc}][InCallToneType={inCallToneType}][InCallToneName={inCallToneName}].

Message #

CallProgress - Determined sound configuration according to country code; [LineId={lineId}][CountryCode={homeMcc}][InCallToneType={inCallToneType}][InCallToneName={inCallToneName}]

Fields #

Name	Description
`lineId`
`homeMcc`
`inCallToneType`
`inCallToneName`

Event ID 753: Disable and enable cellular audio.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Disable and enable cellular audio. Disable Executor Index: {DisableExecutorIndex}; Enable Executor Index: {EnableExecutorIndex}; Cellular Audio Type: {AudioType}; Audio Active: {audioActive}.

Message #

Disable and enable cellular audio. Disable Executor Index: {DisableExecutorIndex}; Enable Executor Index: {EnableExecutorIndex}; Cellular Audio Type: {AudioType}; Audio Active: {audioActive}

Fields #

Name	Description
`DisableExecutorIndex`
`EnableExecutorIndex`
`AudioType`
`audioActive`

Event ID 754: CallProgress - Using override country code for determining tone configuration; [CountryCode=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallProgress - Using override country code for determining tone configuration; [CountryCode={homeMcc}][OverrideCountryCode={overrideMcc}].

Message #

CallProgress - Using override country code for determining tone configuration; [CountryCode={homeMcc}][OverrideCountryCode={overrideMcc}]

Fields #

Name	Description
`homeMcc`
`overrideMcc`

Event ID 755: CallProgress - Failed to get 3GPP in call tone for type and mcc; [CountryCode=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallProgress - Failed to get 3GPP in call tone for type and mcc; [CountryCode={mcc}][InCallToneType={inCallToneType}][HRESULT={Code}].

Message #

CallProgress - Failed to get 3GPP in call tone for type and mcc; [CountryCode={mcc}][InCallToneType={inCallToneType}][HRESULT={Code}]

Fields #

Name	Description
`mcc`
`inCallToneType`
`Code`

Event ID 756: CallProgress - Failed to get 3GPP in call tone; [HRESULT=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallProgress - Failed to get 3GPP in call tone; [HRESULT={Code}].

Message #

CallProgress - Failed to get 3GPP in call tone; [HRESULT={Code}]

Fields #

Name	Description
`Code`

Event ID 900: Event sound: {Prop_UnicodeString}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Event sound: {Prop_UnicodeString}.

Message #

Event sound: {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1048: Emergency Number: received updated list {Prop_UnicodeString}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Emergency Number: received updated list {Prop_UnicodeString}.

Message #

Emergency Number: received updated list {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1049: Emergency Number: Dial request for callid {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Emergency Number: Dial request for callid {Prop_HexInt32_1}.

Message #

Emergency Number: Dial request for callid {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1052: OperationWatchdog: '{OperationId}' timed out.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

OperationWatchdog: '{OperationId}' timed out. Context: {OperationContext}. Timeout value: {OperationTimeout}ms. Still waiting after: {ElapsedTime}ms.

Message #

OperationWatchdog: '{OperationId}' timed out.  Context: {OperationContext}.  Timeout value: {OperationTimeout}ms.  Still waiting after: {ElapsedTime}ms.

Fields #

Name	Description
`OperationId`
`OperationContext`
`OperationTimeout`
`ElapsedTime`

Event ID 1053: OperationWatchdog: '{OperationId}' completed.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

OperationWatchdog: '{OperationId}' completed. Context: {OperationContext}. Actual time: {OperationActualTime}ms.

Message #

OperationWatchdog: '{OperationId}' completed.  Context: {OperationContext}.  Actual time: {OperationActualTime}ms

Fields #

Name	Description
`OperationId`
`OperationContext`
`OperationActualTime`

Event ID 1054: Async API context {Prop_HexInt32_1} completed with result {Prop_HexInt32_2}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Async API context {Prop_HexInt32_1} completed with result {Prop_HexInt32_2}.

Message #

Async API context {Prop_HexInt32_1} completed with result {Prop_HexInt32_2}

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_HexInt32_2`

Event ID 1055: Phone service listener added: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone service listener added: {Prop_HexInt32_1}.

Message #

Phone service listener added: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1056: Phone service listener removed: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone service listener removed: {Prop_HexInt32_1}.

Message #

Phone service listener removed: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1057: Phone service listener lost notifications: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone service listener lost notifications: {Prop_HexInt32_1}.

Message #

Phone service listener lost notifications: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1058: Phone service listener lost notifications: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone service listener lost notifications: {Prop_HexInt32_1}.

Message #

Phone service listener lost notifications: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1059: Phone service listener rundown: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone service listener rundown: {Prop_HexInt32_1}.

Message #

Phone service listener rundown: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1060: Phone notification sent: {ChangeEvent} error: {Error}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Phone notification sent: {ChangeEvent} error: {Error}.

Message #

Phone notification sent: {ChangeEvent} error: {Error}

Fields #

Name	Description
`ChangeEvent`
`Error`

Event ID 1065: Call Upgrade state for CallId: {CallId} Changed From: {OldUpgradeState} To: {NewUpgradeState}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Call Upgrade state for CallId: {CallId} Changed From: {OldUpgradeState} To: {NewUpgradeState}.

Message #

Call Upgrade state for CallId: {CallId} Changed From: {OldUpgradeState} To: {NewUpgradeState}

Fields #

Name	Description
`CallId`
`OldUpgradeState`
`NewUpgradeState`

Event ID 1066: Data Connectivity State: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Data Connectivity State: {Prop_HexInt32_1}.

Message #

Data Connectivity State: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1071: Connection Manager Error.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Connection Manager Error. Connection Manager Result: {Prop_HexInt32_1}.

Message #

Connection Manager Error. Connection Manager Result: {Prop_HexInt32_1}.

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1072: Call Line Change for CallId: {Prop_HexInt32_1} from LineId: {Prop_Guid1} to LineId: {Prop_Guid2}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Call Line Change for CallId: {Prop_HexInt32_1} from LineId: {Prop_Guid1} to LineId: {Prop_Guid2}.

Message #

Call Line Change for CallId: {Prop_HexInt32_1} from LineId: {Prop_Guid1} to LineId: {Prop_Guid2}

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_Guid1`
`Prop_Guid2`

Event ID 1074: PhoneTileManager: Creating secondary Phone Tile with id: {Prop_UnicodeString}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneTileManager: Creating secondary Phone Tile with id: {Prop_UnicodeString}.

Message #

PhoneTileManager: Creating secondary Phone Tile with id: {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1075: PhoneTileManager: Setting the primary Phone Tile to be assigned to PhoneLineId: {Prop_Guid}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneTileManager: Setting the primary Phone Tile to be assigned to PhoneLineId: {Prop_Guid}.

Message #

PhoneTileManager: Setting the primary Phone Tile to be assigned to PhoneLineId: {Prop_Guid}

Fields #

Name	Description
`Prop_Guid`

Event ID 1076: PhoneTileManager: Deleting Phone Tile with id: {Prop_UnicodeString}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneTileManager: Deleting Phone Tile with id: {Prop_UnicodeString}.

Message #

PhoneTileManager: Deleting Phone Tile with id: {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1078: PhoneTile: Committed an update to the Phone Tile with tile id: {TileId}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Message #

PhoneTile: Committed an update to the Phone Tile with tile id: {TileId}. Title {Title}; Tile mode: {TileMode}; has voicemail: {HasVoicemail}; missed call count: {MissedCallCount}; has large content: {HasLargeContent}

Fields #

Name	Description
`TileId`
`Title`
`TileMode`
`HasVoicemail`
`MissedCallCount`
`HasLargeContent`

Event ID 1080: PhoneTileControllerSink: The PhoneLine ({Prop_Guid}) has been removed.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneTileControllerSink: The PhoneLine ({Prop_Guid}) has been removed. Removing its tile and updating any remaining tiles as necessary.

Message #

PhoneTileControllerSink: The PhoneLine ({Prop_Guid}) has been removed.  Removing its tile and updating any remaining tiles as necessary.

Fields #

Name	Description
`Prop_Guid`

Event ID 1087: PhoneTileControllerSink: ShellReadyState changed to {Prop_BOOL}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

PhoneTileControllerSink: ShellReadyState changed to {Prop_BOOL}.

Message #

PhoneTileControllerSink: ShellReadyState changed to {Prop_BOOL}

Fields #

Name	Description
`Prop_BOOL`

Event ID 1088: SystemEventTriggerControllerSink: LineChangedTrigger fired with: LineId {LineId}: PhoneLineChangeKind {PhoneLineChangeKind}: PhoneLineProperties: {...

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: LineChangedTrigger fired with: LineId {LineId}: PhoneLineChangeKind {PhoneLineChangeKind}: PhoneLineProperties: {PhoneLineProperties}: hr: {HResult}.

Message #

SystemEventTriggerControllerSink: LineChangedTrigger fired with: LineId {LineId}: PhoneLineChangeKind {PhoneLineChangeKind}: PhoneLineProperties: {PhoneLineProperties}: hr: {HResult}

Fields #

Name	Description
`LineId`
`PhoneLineChangeKind`
`PhoneLineProperties`
`HResult`

Event ID 1089: SystemEventTriggerControllerSink: NewVoicemailMessageTrigger fired with: LineId {LineId}: voicemailCount {VoicemailCount}: VoicemailMessage: {Voice...

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: NewVoicemailMessageTrigger fired with: LineId {LineId}: voicemailCount {VoicemailCount}: VoicemailMessage: {VoicemailMessageString}: hr: {HResult}.

Message #

SystemEventTriggerControllerSink: NewVoicemailMessageTrigger fired with: LineId {LineId}: voicemailCount {VoicemailCount}: VoicemailMessage: {VoicemailMessageString}: hr: {HResult}

Fields #

Name	Description
`LineId`
`VoicemailCount`
`VoicemailMessageString`
`HResult`

Event ID 1090: SystemEventTriggerControllerSink: CallOriginDataRequestTrigger fired with: RequestId {RequestId}: PhoneNumber: {PhoneNumber}: hr: {HResult}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: CallOriginDataRequestTrigger fired with: RequestId {RequestId}: PhoneNumber: {PhoneNumber}: hr: {HResult}.

Message #

SystemEventTriggerControllerSink: CallOriginDataRequestTrigger fired with: RequestId {RequestId}: PhoneNumber: {PhoneNumber}: hr: {HResult}

Fields #

Name	Description
`RequestId`
`PhoneNumber`
`HResult`

Event ID 1091: SystemEventTriggerControllerSink: CallHistoryChanged fired with: hr: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: CallHistoryChanged fired with: hr: {Prop_HexInt32_1}.

Message #

SystemEventTriggerControllerSink: CallHistoryChanged fired with: hr: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1092: SystemEventTriggerControllerSink: AirplaneModeDisabledForEmergencyCall fired with: hr: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: AirplaneModeDisabledForEmergencyCall fired with: hr: {Prop_HexInt32_1}.

Message #

SystemEventTriggerControllerSink: AirplaneModeDisabledForEmergencyCall fired with: hr: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1093: SystemEventTriggerControllerSink: OnCallEvent called with: event: {UdmCallItemEventType}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: OnCallEvent called with: event: {UdmCallItemEventType}.

Message #

SystemEventTriggerControllerSink: OnCallEvent called with: event: {UdmCallItemEventType}

Fields #

Name	Description
`UdmCallItemEventType`

Event ID 1094: SystemEventTriggerControllerSink: Attempted to advise to CallHistorySession with: hr: {Prop_HexInt32_1}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: Attempted to advise to CallHistorySession with: hr: {Prop_HexInt32_1}.

Message #

SystemEventTriggerControllerSink: Attempted to advise to CallHistorySession with: hr: {Prop_HexInt32_1}

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1098: SystemEventTriggerControllerSink: LineChangedTrigger suppressed [LineId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: LineChangedTrigger suppressed [LineId={LineId}][PhoneLineChangeKind={PhoneLineChangeKind}][PhoneLineProperties={PhoneLineProperties}].

Message #

SystemEventTriggerControllerSink: LineChangedTrigger suppressed [LineId={LineId}][PhoneLineChangeKind={PhoneLineChangeKind}][PhoneLineProperties={PhoneLineProperties}]

Fields #

Name	Description
`LineId`
`PhoneLineChangeKind`
`PhoneLineProperties`

Event ID 1100: SystemEventTriggerControllerSink: OnShellReady started [existingInitialBootSequenceComplete=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: OnShellReady started [existingInitialBootSequenceComplete={existingInitialBootSequenceComplete}][cachedLineCount={cachedLineCount}].

Message #

SystemEventTriggerControllerSink: OnShellReady started [existingInitialBootSequenceComplete={existingInitialBootSequenceComplete}][cachedLineCount={cachedLineCount}]

Fields #

Name	Description
`existingInitialBootSequenceComplete`
`cachedLineCount`

Event ID 1101: SystemEventTriggerControllerSink: OnShellReady triggering deferred notification [LineId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: OnShellReady triggering deferred notification [LineId={LineId}][PhoneLineChangeKind={PhoneLineChangeKind}][PhoneLineProperties={PhoneLineProperties}].

Message #

SystemEventTriggerControllerSink: OnShellReady triggering deferred notification [LineId={LineId}][PhoneLineChangeKind={PhoneLineChangeKind}][PhoneLineProperties={PhoneLineProperties}]

Fields #

Name	Description
`LineId`
`PhoneLineChangeKind`
`PhoneLineProperties`

Event ID 1102: SystemEventTriggerControllerSink: Received screen state change notification [monitorState=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: Received screen state change notification [monitorState={Prop_UInt32_1}].

Message #

SystemEventTriggerControllerSink: Received screen state change notification [monitorState={Prop_UInt32_1}].

Fields #

Name	Description
`Prop_UInt32_1`

Event ID 1103: SystemEventTriggerControllerSink: OnScreenStateChange started [existingSuppressLineChangedTrigger=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: OnScreenStateChange started [existingSuppressLineChangedTrigger={existingSuppressLineChangedTrigger}][screenIsOn={screenIsOn}].

Message #

SystemEventTriggerControllerSink: OnScreenStateChange started [existingSuppressLineChangedTrigger={existingSuppressLineChangedTrigger}][screenIsOn={screenIsOn}]

Fields #

Name	Description
`existingSuppressLineChangedTrigger`
`screenIsOn`

Event ID 1104: SystemEventTriggerControllerSink: OnScreenStateChange triggering deferred notification [LineId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: OnScreenStateChange triggering deferred notification [LineId={LineId}][PhoneLineChangeKind={PhoneLineChangeKind}][PhoneLineProperties={PhoneLineProperties}].

Message #

SystemEventTriggerControllerSink: OnScreenStateChange triggering deferred notification [LineId={LineId}][PhoneLineChangeKind={PhoneLineChangeKind}][PhoneLineProperties={PhoneLineProperties}]

Fields #

Name	Description
`LineId`
`PhoneLineChangeKind`
`PhoneLineProperties`

Event ID 1105: SystemEventTriggerControllerSink: LineChangedTrigger skipped [LineId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

SystemEventTriggerControllerSink: LineChangedTrigger skipped [LineId={Prop_Guid}].

Message #

SystemEventTriggerControllerSink: LineChangedTrigger skipped [LineId={Prop_Guid}]

Fields #

Name	Description
`Prop_Guid`

Event ID 1201: InteractiveUserNotificationSink: New Incoming Call State Changed [callId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

InteractiveUserNotificationSink: New Incoming Call State Changed [callId={Prop_HexInt32_1}].

Message #

InteractiveUserNotificationSink: New Incoming Call State Changed [callId={Prop_HexInt32_1}].

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1202: InteractiveUserNotificationSink: Show Incoming Call Toast [callId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

InteractiveUserNotificationSink: Show Incoming Call Toast [callId={Prop_HexInt32_1}].

Message #

InteractiveUserNotificationSink: Show Incoming Call Toast [callId={Prop_HexInt32_1}].

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1203: Supplementary service code: {Prop_UnicodeString} was converted from erase to deactivate command due override setting.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Supplementary service code: {Prop_UnicodeString} was converted from erase to deactivate command due override setting.

Message #

Supplementary service code: {Prop_UnicodeString} was converted from erase to deactivate command due override setting.

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1204: InteractiveUserNotificationSink: Call belongs to Win32 app; skipping [callId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

InteractiveUserNotificationSink: Call belongs to Win32 app; skipping [callId={Prop_HexInt32_1}].

Message #

InteractiveUserNotificationSink: Call belongs to Win32 app; skipping [callId={Prop_HexInt32_1}].

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1501: Call data collection item added for CallId: [.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Call data collection item added for CallId: [{Prop_HexInt32_1}].

Message #

Call data collection item added for CallId: [{Prop_HexInt32_1}]

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1502: Call data collection item removed for CallId: [.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Call data collection item removed for CallId: [{Prop_HexInt32_1}].

Message #

Call data collection item removed for CallId: [{Prop_HexInt32_1}]

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1503: Call data collection item dropped an idle call for CallId: [.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Call data collection item dropped an idle call for CallId: [{Prop_HexInt32_1}].

Message #

Call data collection item dropped an idle call for CallId: [{Prop_HexInt32_1}]

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1504: CallHistoryItemWriter: Call with id {Prop_HexInt32_1} is added.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallHistoryItemWriter: Call with id {Prop_HexInt32_1} is added.

Message #

CallHistoryItemWriter: Call with id {Prop_HexInt32_1} is added.

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1505: CallHistoryItemWriter: Call with id {Prop_HexInt32_1} is updated.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallHistoryItemWriter: Call with id {Prop_HexInt32_1} is updated.

Message #

CallHistoryItemWriter: Call with id {Prop_HexInt32_1} is updated.

Fields #

Name	Description
`Prop_HexInt32_1`

Event ID 1506: CallAnnotationsLookupConnecting: Establishing RPC connection.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallAnnotationsLookupConnecting: Establishing RPC connection. Endpoint: {Prop_UnicodeString}.

Message #

CallAnnotationsLookupConnecting: Establishing RPC connection.  Endpoint: {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1507: CallAnnotationsLookup: Querying location.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallAnnotationsLookup: Querying location. Phone number: {Prop_UnicodeString}.

Message #

CallAnnotationsLookup: Querying location.  Phone number: {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1508: CallAnnotationsLookup: Completed location query.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallAnnotationsLookup: Completed location query. Location: {Prop_UnicodeString}.

Message #

CallAnnotationsLookup: Completed location query.  Location: {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1510: CallAnnotationsManager: Call: {CallId} LookupState: {LookupState}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallAnnotationsManager: Call: {CallId} LookupState: {LookupState}.

Message #

CallAnnotationsManager: Call: {CallId} LookupState: {LookupState}

Fields #

Name	Description
`CallId`
`LookupState`

Event ID 1512: Service Idle Callback received.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Service Idle Callback received. Idle status: {Prop_HexInt32_1}; Phone calls exist: {Prop_HexInt32_2}.

Message #

Service Idle Callback received. Idle status: {Prop_HexInt32_1}; Phone calls exist: {Prop_HexInt32_2}

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_HexInt32_2`

Event ID 1513: CallRecording VALID state change from '{CurrentState}' to '{DesiredState}' on executor {Executor}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording VALID state change from '{CurrentState}' to '{DesiredState}' on executor {Executor}.

Message #

CallRecording VALID state change from '{CurrentState}' to '{DesiredState}' on executor {Executor}

Fields #

Name	Description
`CurrentState`
`DesiredState`
`Executor`

Event ID 1514: CallRecording: INVALID state change from '{CurrentState}' to '{DesiredState}' on executor {Executor}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: INVALID state change from '{CurrentState}' to '{DesiredState}' on executor {Executor}.

Message #

CallRecording: INVALID state change from '{CurrentState}' to '{DesiredState}' on executor {Executor}

Fields #

Name	Description
`CurrentState`
`DesiredState`
`Executor`

Event ID 1515: CallRecording: Recorded call is now idle.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: Recorded call is now idle. Recording will end. LineId:{LineId}; CallId:{CallId}; ConferenceCallId:{ConferenceCallId}.

Message #

CallRecording: Recorded call is now idle.  Recording will end.  LineId:{LineId}; CallId:{CallId}; ConferenceCallId:{ConferenceCallId}

Fields #

Name	Description
`LineId`
`CallId`
`ConferenceCallId`

Event ID 1516: CallRecording: Recorded call is now held.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: Recorded call is now held. Recording will pause and may finish. LineId:{LineId}; CallId:{CallId}; ConferenceCallId:{ConferenceCallId}.

Message #

CallRecording: Recorded call is now held.  Recording will pause and may finish.  LineId:{LineId}; CallId:{CallId}; ConferenceCallId:{ConferenceCallId}

Fields #

Name	Description
`LineId`
`CallId`
`ConferenceCallId`

Event ID 1517: CallRecording: A call that is not being recorded is talking.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: A call that is not being recorded is talking. Recording will finish. LineId:{LineId}; CallId:{CallId}; ConferenceCallId:{ConferenceCallId}.

Message #

CallRecording: A call that is not being recorded is talking.  Recording will finish.  LineId:{LineId}; CallId:{CallId}; ConferenceCallId:{ConferenceCallId}

Fields #

Name	Description
`LineId`
`CallId`
`ConferenceCallId`

Event ID 1518: CallRecording: Recorded call no longer exists.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: Recorded call no longer exists. Recording will finish. LineId:{Prop_Guid}; CallId:{Prop_HexInt32_1}.

Message #

CallRecording: Recorded call no longer exists.  Recording will finish.  LineId:{Prop_Guid}; CallId:{Prop_HexInt32_1}

Fields #

Name	Description
`Prop_Guid`
`Prop_HexInt32_1`

Event ID 1519: CallRecording: Preferred recording application changed.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: Preferred recording application changed. Old Package Family Name: '{Prop_UnicodeString_1}'; New Package Family Name: '{Prop_UnicodeString_2}'.

Message #

CallRecording: Preferred recording application changed.  Old Package Family Name: '{Prop_UnicodeString_1}'; New Package Family Name: '{Prop_UnicodeString_2}'

Fields #

Name	Description
`Prop_UnicodeString_1`
`Prop_UnicodeString_2`

Event ID 1520: Call [callId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Call [callId={Prop_HexInt32_1}] marked as handover merged due to being conferenced with call [callState={Prop_HexInt32_2}] that ended with handover merged reason.

Message #

Call [callId={Prop_HexInt32_1}] marked as handover merged due to being conferenced with call [callState={Prop_HexInt32_2}] that ended with handover merged reason

Fields #

Name	Description
`Prop_HexInt32_1`
`Prop_HexInt32_2`

Event ID 1521: CallRecordingOff: {callRecordingOff}; Preferred Recording app PFN: {Prop_UnicodeString}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecordingOff: {callRecordingOff}; Preferred Recording app PFN: {Prop_UnicodeString}.

Message #

CallRecordingOff: {callRecordingOff}; Preferred Recording app PFN: {Prop_UnicodeString}

Fields #

Name	Description
`callRecordingOff`
`Prop_UnicodeString`

Event ID 1522: CallRecordingApplication {Prop_UnicodeString} detected.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecordingApplication {Prop_UnicodeString} detected.

Message #

CallRecordingApplication {Prop_UnicodeString} detected

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1600: [RcsPresence] Request Capabilities: {TelString}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Request Capabilities: {TelString}.

Message #

[RcsPresence] Request Capabilities: {TelString}

Fields #

Name	Description
`TelString`

Event ID 1601: [RcsPresence] Received query response; [responseCode=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Received query response; [responseCode={ResponseCode}][reason={Reason}].

Message #

[RcsPresence] Received query response; [responseCode={ResponseCode}][reason={Reason}]

Fields #

Name	Description
`ResponseCode`
`Reason`

Event ID 1602: [RcsPresence] Received {Count} capability tuple(s).

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Received {Count} capability tuple(s).

Message #

[RcsPresence] Received {Count} capability tuple(s)

Fields #

Name	Description
`Count`

Event ID 1603: [RcsPresence] Tuple {TupleIndex}; MediaType not video capable: {MediaType}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Tuple {TupleIndex}; MediaType not video capable: {MediaType}.

Message #

[RcsPresence] Tuple {TupleIndex}; MediaType not video capable: {MediaType}

Fields #

Name	Description
`TupleIndex`
`MediaType`

Event ID 1604: [RcsPresence] Tuple {TupleIndex}; ServiceIdentifier not video capable: {ServiceIdentifier}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Tuple {TupleIndex}; ServiceIdentifier not video capable: {ServiceIdentifier}.

Message #

[RcsPresence] Tuple {TupleIndex}; ServiceIdentifier not video capable: {ServiceIdentifier}

Fields #

Name	Description
`TupleIndex`
`ServiceIdentifier`

Event ID 1605: [RcsPresence] Tuple {TupleIndex} is video capable.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Tuple {TupleIndex} is video capable.

Message #

[RcsPresence] Tuple {TupleIndex} is video capable.

Fields #

Name	Description
`TupleIndex`

Event ID 1606: [RcsPresence] RcsPresenceCache hit; [TelUri string=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] RcsPresenceCache hit; [TelUri string={telUriString}][Capabilities returned={Capabilities}].

Message #

[RcsPresence] RcsPresenceCache hit; [TelUri string={telUriString}][Capabilities returned={Capabilities}]

Fields #

Name	Description
`telUriString`
`Capabilities`

Event ID 1607: [RcsPresence] Query suppressed due to capabilities sharing opt-in settings; [TelUri string=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Query suppressed due to capabilities sharing opt-in settings; [TelUri string={telUriString}][Capabilities returned={Capabilities}].

Message #

[RcsPresence] Query suppressed due to capabilities sharing opt-in settings; [TelUri string={telUriString}][Capabilities returned={Capabilities}]

Fields #

Name	Description
`telUriString`
`Capabilities`

Event ID 1608: Checking for device support of video calling.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Checking for device support of video calling. This service ({Prop_UnicodeString}) exists; thus video calling is supported.

Message #

Checking for device support of video calling. This service ({Prop_UnicodeString}) exists; thus video calling is supported.

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1609: Checking for device support of video calling.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Message #

Checking for device support of video calling. This service ({Prop_UnicodeString_1}) does NOT exist due to error code {Prop_UInt32_1}; thus a different service would have to exist for video calling to be supported.

Fields #

Name	Description
`Prop_UnicodeString_1`
`Prop_UInt32_1`

Event ID 1610: PhoneController - Updating video calling settings; [lineId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Message #

PhoneController - Updating video calling settings; [lineId={lineId}][videoCallingSetting={videoCallingSetting}][cacheVideoCallingSetting={cacheVideoCallingSetting}][userRequest={userRequest}][TTYEnabled={TTYEnabled}][cellularDataEnabled={cellularDataEnabled}]

Fields #

Name	Description
`lineId`
`videoCallingSetting`
`cacheVideoCallingSetting`
`userRequest`
`TTYEnabled`
`cellularDataEnabled`

Event ID 1611: CallRecording: Deferred request to disable cellular audio: {AudioType} on executor {ExecutorIndex}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: Deferred request to disable cellular audio: {AudioType} on executor {ExecutorIndex}.

Message #

CallRecording: Deferred request to disable cellular audio: {AudioType} on executor {ExecutorIndex}

Fields #

Name	Description
`AudioType`
`ExecutorIndex`

Event ID 1612: CallRecording: Cancelled request to defer disabling of cellular audio: {AudioTypeCancelled} due to enabling of: {AudioTypeBeingEnabled} on executor...

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: Cancelled request to defer disabling of cellular audio: {AudioTypeCancelled} due to enabling of: {AudioTypeBeingEnabled} on executor {ExecutorIndex}.

Message #

CallRecording: Cancelled request to defer disabling of cellular audio: {AudioTypeCancelled} due to enabling of: {AudioTypeBeingEnabled} on executor {ExecutorIndex}

Fields #

Name	Description
`AudioTypeCancelled`
`AudioTypeBeingEnabled`
`ExecutorIndex`

Event ID 1613: CallRecording: An audio type change prevented deferring of audio disable.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: An audio type change prevented deferring of audio disable. New audio type: {AudioTypeBeingEnabled}; Audio type being disabled: {AudioTypeCancelled} on executor {ExecutorIndex}.

Message #

CallRecording: An audio type change prevented deferring of audio disable.  New audio type: {AudioTypeBeingEnabled}; Audio type being disabled: {AudioTypeCancelled} on executor {ExecutorIndex}

Fields #

Name	Description
`AudioTypeBeingEnabled`
`AudioTypeCancelled`
`ExecutorIndex`

Event ID 1614: CallRecording: Performing deferred request to disable cellular audio: {AudioType} on executor {ExecutorIndex}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

CallRecording: Performing deferred request to disable cellular audio: {AudioType} on executor {ExecutorIndex}.

Message #

CallRecording: Performing deferred request to disable cellular audio: {AudioType} on executor {ExecutorIndex}

Fields #

Name	Description
`AudioType`
`ExecutorIndex`

Event ID 1617: [RcsPresence] Video capability sharing settings update requested [isCapabilitySharingEnabled=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Video capability sharing settings update requested [isCapabilitySharingEnabled={isCapabilitySharingEnabled}][previousValue={previousValue}].

Message #

[RcsPresence] Video capability sharing settings update requested [isCapabilitySharingEnabled={isCapabilitySharingEnabled}][previousValue={previousValue}].

Fields #

Name	Description
`isCapabilitySharingEnabled`
`previousValue`

Event ID 1618: [RcsPresence] Cache initialized [cacheExpirationInSeconds=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Cache initialized [cacheExpirationInSeconds={Prop_UInt32_1}].

Message #

[RcsPresence] Cache initialized [cacheExpirationInSeconds={Prop_UInt32_1}]

Fields #

Name	Description
`Prop_UInt32_1`

Event ID 1619: [RcsPresence] Publishing capabilities [.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Publishing capabilities [{Capabilities}].

Message #

[RcsPresence] Publishing capabilities [{Capabilities}]

Fields #

Name	Description
`Capabilities`

Event ID 1621: [RcsPresence] RCS presence service status queried; [status=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] RCS presence service status queried; [status={rcsServiceStatus}].

Message #

[RcsPresence] RCS presence service status queried; [status={rcsServiceStatus}]

Fields #

Name	Description
`rcsServiceStatus`

Event ID 1623: [RcsPresence] Received publish response; [responseCode=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Received publish response; [responseCode={ResponseCode}][reason={Reason}].

Message #

[RcsPresence] Received publish response; [responseCode={ResponseCode}][reason={Reason}]

Fields #

Name	Description
`ResponseCode`
`Reason`

Event ID 1624: [RcsPresence] Received OnNetworkSupportVideoChanged; [updatedValue=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Received OnNetworkSupportVideoChanged; [updatedValue={updatedValue}][previousValue={previousValue}].

Message #

[RcsPresence] Received OnNetworkSupportVideoChanged; [updatedValue={updatedValue}][previousValue={previousValue}]

Fields #

Name	Description
`updatedValue`
`previousValue`

Event ID 1625: [RcsPresence] Saved last published capabilities; [updatedValue=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Saved last published capabilities; [updatedValue={updatedValue}][previousValue={previousValue}].

Message #

[RcsPresence] Saved last published capabilities; [updatedValue={updatedValue}][previousValue={previousValue}]

Fields #

Name	Description
`updatedValue`
`previousValue`

Event ID 1626: [RcsPresence] Publish capabilities requested; [reason=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

[RcsPresence] Publish capabilities requested; [reason={reason}][networkType={networkType}].

Message #

[RcsPresence] Publish capabilities requested; [reason={reason}][networkType={networkType}]

Fields #

Name	Description
`reason`
`networkType`

Event ID 1627: Attempting audio routing {{Prop_AudioRoutingState}} as per settings.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Attempting audio routing {{Prop_AudioRoutingState}} as per settings.

Message #

Attempting audio routing {{Prop_AudioRoutingState}} as per settings.

Fields #

Name	Description
`Prop_AudioRoutingState`

Event ID 1628: Updating callInfo with remote party hold status [callId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Updating callInfo with remote party hold status [callId={callId}][supSvcCode={supSvcCode}].

Message #

Updating callInfo with remote party hold status [callId={callId}][supSvcCode={supSvcCode}]

Fields #

Name	Description
`callId`
`supSvcCode`

Event ID 1629: Caller ID privacy header set to: {{value}}.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Caller ID privacy header set to: {{value}}.

Message #

Caller ID privacy header set to: {{value}}

Fields #

Name	Description
`value`

Event ID 1630: The prefix {{Prop_UnicodeString}} was dialed which is prohibited.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

The prefix {{Prop_UnicodeString}} was dialed which is prohibited. The call failed.

Message #

The prefix {{Prop_UnicodeString}} was dialed which is prohibited. The call failed.

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 1632: Adding call to conference [lineId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Adding call to conference [lineId={LineId}][callId={CallId}][conferenceId={ConferenceCallId}].

Message #

Adding call to conference [lineId={LineId}][callId={CallId}][conferenceId={ConferenceCallId}]

Fields #

Name	Description
`LineId`
`CallId`
`ConferenceCallId`

Event ID 1633: Removing call from conference [lineId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Removing call from conference [lineId={LineId}][callId={CallId}][conferenceId={ConferenceCallId}].

Message #

Removing call from conference [lineId={LineId}][callId={CallId}][conferenceId={ConferenceCallId}]

Fields #

Name	Description
`LineId`
`CallId`
`ConferenceCallId`

Event ID 1634: Updating CallInfo confererence participant property [callId=.

Provider: Microsoft-Windows-Telephony-PhoneService
Channel: Operational

Description

Updating CallInfo confererence participant property [callId={Prop_UInt32}][isParticipant={Prop_Boolean}].

Message #

Updating CallInfo confererence participant property [callId={Prop_UInt32}][isParticipant={Prop_Boolean}]

Fields #

Name	Description
`Prop_UInt32`
`Prop_Boolean`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)