Microsoft-Windows-USB-USBHUB
106 events across 2 channels
Event ID 1: USB Hub Added
#Event ID 2: USB Hub Removed
#Event ID 3: USB Hub Information
#Description
USB Hub Information.
Message #
Fields #
| Name | Description |
|---|---|
fid_USBHUB_HC UInt8 | |
fid_USBHUB_Hub Int64 | |
fid_USBHUB_Hub_State Binary | |
fid_USB_HubDescriptor Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-USB-USBHUB",
"guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
"event_source_name": "",
"event_id": 3,
"version": 0,
"level": 4,
"task": 1,
"opcode": 16,
"keywords": "0x0000000000000001",
"time_created": "2026-06-02T05:32:14.404+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 20896,
"thread_id": 19908
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"fid_USBHUB_HC": "000000000100020086802070",
"fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000",
"fid_USBHUB_Hub_State": "0100000004000000",
"fid_USB_HubDescriptor": "0929021B00010000FF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
},
"message": "USBHUB_HUB"
}
Event ID 10: Start Enumeration of Port
#Event ID 11: Enumeration Port Debounce Failed
#Event ID 12: Create PDO Failed
#Event ID 13: IoCreateDevice Failed
#Event ID 14: Create PnP ID Failed
#Event ID 15: Enumeration Port Reset Failure
#Event ID 16: Port Enabled but not Connected After First Reset
#Event ID 17: First Enumeration Port Reset Timed Out
#Event ID 18: Create Device Failed
#Event ID 19: Initialize Device Failed
#Event ID 20: Get Descriptors Request Failed
#Event ID 21: Valdiation of USB Configuration Descriptor Failed
#Event ID 22: Validation of USB Device Descriptor Failed
#Event ID 23: Request for Microsoft OS Descriptor Failed
#Event ID 24: Request for Serial Number String Descriptor Failed
#Event ID 25: Build PnP ID failed
#Event ID 26: Duplicate Serial Number Detected
#Event ID 27: Enumeration Timed Out Waiting for Previous Instance of USB Device to be Removed
#Event ID 28: Enumeration Failed Due to Registry Failure
#Event ID 29: Retrying Enumeration of Port
#Event ID 30: Hub Disconnected During Enumeration of Port
#Event ID 31: Enumeration Debounce Completed
#Event ID 32: PDO Created for Enumeration
#Event ID 33: First Enumeration Port Reset Complete
#Event ID 34: Enumeration - CreateDevice Complete
#Event ID 35: Second Enumeration Port Reset Complete
#Event ID 36: Enumeration - InitializeDevice Complete
#Event ID 37: Enumeration - SetupDevice Complete
#Event ID 39: Enumeration of Port Completed
#Event ID 40: Reset Recovery of Hub Started
#Event ID 41: Reset Recovery of Hub Queued
#Event ID 49: Reset Recovery of Hub Completed
#Event ID 50: Started Selective Suspend of Hub
#Event ID 51: Selective Suspend of Hub Failed to Pause Bus
#Event ID 59: Completed Selective Suspend of Hub
#Event ID 60: Started Resume of Hub from Selective Suspend
#Event ID 61: Resume of Hub Completed
#Event ID 62: Propagated Resume of Hub Downstream
#Event ID 63: Resumed Port for Hub Resume
#Event ID 64: Propagated Resume of Hub Upstream
#Event ID 70: USB Hub Query Device Relations (BusRelations) IRP Dispatched
#Event ID 71: USB Hub Query Device Relations IRP Completed
#Event ID 80: USB Hub Port Attributes
#Description
USB Hub Port Attributes.
Message #
Fields #
| Name | Description |
|---|---|
fid_USBHUB_HC UInt8 | |
fid_USBHUB_Hub Int64 | |
fid_PortNumber UInt32 | |
fid_PortAttributes UInt16 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-USB-USBHUB",
"guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
"event_source_name": "",
"event_id": 80,
"version": 0,
"level": 4,
"task": 9,
"opcode": 16,
"keywords": "0x0000000000000001",
"time_created": "2026-06-02T05:32:14.404+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 20896,
"thread_id": 19908
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"fid_PortAttributes": 0,
"fid_PortNumber": 1,
"fid_USBHUB_HC": "000000000100020086802070",
"fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
},
"message": "USBHUB_PORT_INFORMATION"
}
Event ID 81: ACPI USB Port Capabilities (_UPC)
#Event ID 82: ACPI Physical Device Location (_PLD)
#Event ID 83: Query for ACPI USB Port Capabilities (_UPC) Failed
#Event ID 84: Query for ACPI Physical Device Location (_PLD) Failed
#Event ID 100: USB Device Added
#Event ID 101: USB Device Removed
#Event ID 102: USB Device Information
#Description
USB Device Information.
Message #
Fields #
| Name | Description |
|---|---|
fid_USBHUB_HC UInt8 | |
fid_USBHUB_Device Int64 | |
fid_USBHUB_Device_State GUID | |
fid_DeviceDescriptor Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-USB-USBHUB",
"guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
"event_source_name": "",
"event_id": 102,
"version": 0,
"level": 4,
"task": 20,
"opcode": 16,
"keywords": "0x0000000000000001",
"time_created": "2026-06-02T05:32:14.404+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 20896,
"thread_id": 19908
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"fid_DeviceDescriptor": "120100020000000827060100000001030A01",
"fid_USBHUB_Device": "708DFBB28D87FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
"fid_USBHUB_Device_State": "03000000",
"fid_USBHUB_HC": "000000000100020086802070"
},
"message": "USBHUB_DEVICE"
}
Event ID 103: USB Device Description
#Description
USB Device Description.
Message #
Fields #
| Name | Description |
|---|---|
fid_USBHUB_HC Int8 | |
fid_USBHUB_Device UInt32 | |
fid_DeviceDescription UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-USB-USBHUB",
"guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
"event_source_name": "",
"event_id": 103,
"version": 0,
"level": 4,
"task": 20,
"opcode": 16,
"keywords": "0x0000400000000001",
"time_created": "2026-06-02T05:32:14.404+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 20896,
"thread_id": 19908
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"fid_DeviceDescription": "USB Input Device",
"fid_USBHUB_Device": "708DFBB28D87FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
"fid_USBHUB_HC": "000000000100020086802070"
},
"message": "USBHUB_DEVICE"
}
Event ID 110: USB Device Start IRP Dispatched
#Event ID 111: Restart of USB Device Failed Due to Device Reset Failure
#Event ID 112: Start Device Failed for USB Device Due to Registry Failure
#Event ID 113: Unable to Create Symbolic Link for USB Device
#Event ID 114: New USB Device Description
#Event ID 119: USB Device Start IRP Completed
#Event ID 120: USB Device Set D0 Device Power IRP Dispatched
#Event ID 121: USB Device Set D0 Device Power IRP Completed
#Event ID 122: USB Device Set Dx Device Power IRP Dispatched
#Event ID 123: USB Device Set Dx Device Power IRP Completed
#Event ID 130: USB Device IOCTL_INTERNAL_USB_SUBMIT_IDLE_NOTIFICATION Dispatched
#Event ID 139: USB Device IOCTL_INTERNAL_USB_SUBMIT_IDLE_NOTIFICATION Completed
#Event ID 140: USB Device Wait Wake IRP Dispatched
#Event ID 149: USB Device Wait Wake IRP Completed
#Event ID 150: USB Hub Wait Wake IRP Started
#Event ID 151: USB Hub Wait Wake IRP Dispatched
#Event ID 159: USB Hub Wait Wake IRP Completed
#Event ID 160: USB Hub Set Dx Device Power IRP Started
#Event ID 161: USB Hub Set Dx Device Power IRP Dispatched
#Event ID 169: USB Hub Set Dx Device Power IRP Completed
#Event ID 170: USB Hub Set D0 Device Power IRP Started
#Event ID 171: USB Hub Set D0 Device Power IRP Dispatched
#Event ID 172: USB Hub Cold Start
#Event ID 173: USB Hub Disconnected During Cold Start
#Event ID 174: USB Device Disconnected During Cold Start of Hub
#Event ID 175: USB Device Connected During Cold Start of Hub
#Event ID 176: Device Lost Power During Cold Start of Hub
#Event ID 177: USB Device Needs to be Reset During Cold Start of Hub
#Event ID 178: USB Hub Cold Start Completed
#Event ID 179: USB Hub Warm Start
#Event ID 180: USB Device Failed to Resume During Warm Start of Hub
#Event ID 181: USB Device Requires Reset During Warm Start of Hub
#Event ID 183: USB Hub Warm Start Completed
#Event ID 184: USB Hub Lost Power During System Suspend
#Event ID 185: USB Hub Was Disconnected During System Suspend
#Event ID 189: USB Hub Set D0 Device Power IRP Completed
#Event ID 190: USB Hub Set Sx System Power IRP Dispatched
#Event ID 199: USB Hub Set Sx System Power IRP Completed
#Event ID 200: USB Hub Set S0 System Power IRP Dispatched
#Event ID 209: USB Hub Set S0 System Power IRP Complete
#Event ID 210: USB Hub Exception Logged
#Event ID 211: USB Hub Port Status Change
#Event ID 212: USB Hub Timer Disabled
#Event ID 213: USB Hub Timer Enabled
#Event ID 214: USB Hub Timer Callback
#Event ID 220: USB Device Internal Reset Started
#Event ID 229: USB Device Internal Reset Completed
#Event ID 230: USB Hub Past Exception Logged
#Description
USB Hub Past Exception Logged.
Message #
Fields #
| Name | Description |
|---|---|
fid_TimeElapsedBeforeLogStart UInt64 | |
fid_USBHUB_HC UInt32 | |
fid_USBHUB_Hub Boolean | |
fid_PortNumber UInt32 | |
fid_Class UInt32 | |
fid_NtStatus UInt32 | |
fid_UsbdStatus UInt32 | |
fid_DebugText AnsiString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-USB-USBHUB",
"guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
"event_source_name": "",
"event_id": 230,
"version": 0,
"level": 4,
"task": 28,
"opcode": 17,
"keywords": "0x0000000000000001",
"time_created": "2026-06-02T05:32:14.404+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 20896,
"thread_id": 19908
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"fid_Class": 100,
"fid_DebugText": "PnpErr_LegacyDevice",
"fid_NtStatus": 0,
"fid_PortNumber": 1,
"fid_TimeElapsedBeforeLogStart": 2188854863381,
"fid_USBHUB_HC": "000000000100020086802070",
"fid_USBHUB_Hub": false,
"fid_UsbdStatus": 0
},
"message": "USBHUB_HUB_PAST_EXCEPTION"
}
Event ID 231: Start IOCTL_INTERNAL_USB_RESET_PORT
#Event ID 232: Complete IOCTL_INTERNAL_USB_RESET_PORT
#Event ID 233: Request for Microsoft OS 2.
#Event ID 234: Validation of Microsoft OS 2.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID {7426A56B-E2D5-4B30-BDEF-B31815C1A74A}
Defined in usbhub.sys, the binary that emits these events.
Observed on:
- WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02