detection.wiki

Microsoft-Windows-UserDataAccess-PimIndexMaintenance

EventTitleChannelSampleRule
1Error: P1_HResult Location: P2_String Line Number: P3_UInt32.OperationalNN
2Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.OperationalNN
3TraceOperationalNN
1000PimIndexMaintenance::Prop_FUNC_AnsiString: Failed at line Prop_LINE_UInt32 with …OperationalNN
1001PimIndexMaintenance::Starting to process store changesOperationalNN
1002PimIndexMaintenance::Done processing store changesOperationalNN
1003PimIndexMaintenance::Starting to process folder changesOperationalNN
1004PimIndexMaintenance::Done processing folder changesOperationalNN
1005PimIndexMaintenance::Starting to handle store count changesOperationalNN
1006PimIndexMaintenance::Done processing store count changesOperationalNN
1007PimIndexMaintenance::Starting sync session to collect changesOperationalNN
1008PimIndexMaintenance::Ending sync sessionOperationalNN
1009PimIndexMaintenance::Enumerated PROP_UInt32_1 contacts to update aggregate for …OperationalNN
1010PimIndexMaintenance::Error getting next change, Error = Prop_Hr_UInt32.OperationalNN
1011PimIndexMaintenance::Rebuilding indexesOperationalNN
1012PimIndexMaintenance::Unexpected event code PROP_UInt32 found in thread proc with …OperationalNN
1013PimIndexMaintenance::Could not get new info about item changed in stage …OperationalNN
1014PimIndexMaintenance::Could not get old info about item changed with hr …OperationalNN
1015PimIndexMaintenance::AddSyncPartner adding partner for store PROP_FILE_uint.OperationalNN
1016PimIndexMaintenance::Aggregates processed on store delete: Total: …OperationalNN
1017PimIndexMaintenance::Aggregate processed on store delete: ID: PROP_UInt32_1 …OperationalNN
1018PimIndexMaintenance::Rebuilding indexes finished- aggregates processed: …OperationalNN
1019PimIndexMaintenance::GetAggregate in HandleDeleteStore failed with: …OperationalNN
1020PimIndexMaintenance::Getting the store mask in HandleDeleteStore failed with: …OperationalNN
1021PimIndexMaintenance::HandleAggregateForDeleteStore failed with result: …OperationalNN
1022PimIndexMaintenance::Received transition to user idle message in thread procOperationalNN
1023PimIndexMaintenance::Saw power state change with message PROP_UInt32_1 and flags …OperationalNN
1024PimIndexMaintenance::Initialization Failure.OperationalNN
1025PimIndexMaintenance::Service is already running.OperationalNN
1026PimIndexMaintenance::Service aborted due to invalid parameter.OperationalNN
1027PimIndexMaintenance::OnEvent saw a lost notification.OperationalNN
1028PimIndexMaintenance::OnEvent saw a store create/delete, event = PROP_FILE_uint.OperationalNN
1029PimIndexMaintenance::HandleAdd on deleted item, Id = PROP_FILE_uint.OperationalNN
1030PimIndexMaintenance::Processing PROP_UInt32_1 contacts in store PROP_UInt32_2.OperationalNN
1031PimIndexMaintenance::Failed to process contact PROP_UInt32 image: …OperationalNN
1032PimIndexMaintenance::Processing contact PROP_FILE_uint image.OperationalNN
1033PimIndexMaintenance::Processing contact: version (size: PROP_ByteCount, data: …OperationalNN
1034Attempting to restore store and folder settingsOperationalNN
1035Settings restore timeout has been reachedOperationalNN
1040Removing application store App (Result from package manager).OperationalNN
1041Rundown index filter Prop_Prop.OperationalNN
1042Rundown search provider Prop_Prop.OperationalNN
1043Startup Update: P1_String.OperationalNN
2000PimIndexMaintenance::Service startedOperationalNN
2001THREAD_PREPStopOperationalNN
2002ON_BOOTStartOperationalNN
2003ON_BOOTStopOperationalNN
2004ON_EVENTStartOperationalNN
2005ON_EVENTStopOperationalNN
2006CONFIGURE_SYNCStartOperationalNN
2007CONFIGURE_SYNCStopOperationalNN
2008UPDATE_STOREStartOperationalNN
2009UPDATE_STOREStopOperationalNN
2010SETUPStartOperationalNN
2011SETUPStopOperationalNN
2012UPDATE_FOLDERStartOperationalNN
2013UPDATE_FOLDERStopOperationalNN
2014COLLECT_CHANGESStartOperationalNN
2015COLLECT_CHANGESStopOperationalNN
2016SYNC_SESSIONStartOperationalNN
2017SYNC_SESSIONStopOperationalNN
2018END_TRANSACTIONStartOperationalNN
2019END_TRANSACTIONStopOperationalNN
2020UPDATE_PICTUREStartOperationalNN
2021UPDATE_PICTUREStopOperationalNN
2022HANDLE_CHANGESStartOperationalNN
2023HANDLE_CHANGESStopOperationalNN
2024HANDLE_ADD_OR_EDITStartOperationalNN
2025HANDLE_ADD_OR_EDITStopOperationalNN
2026HANDLE_DELETEStartOperationalNN
2027HANDLE_DELETEStopOperationalNN
2028COMMIT_CHANGESStartOperationalNN
2029COMMIT_CHANGESStopOperationalNN
2030AUTO_LINKStartOperationalNN
2031AUTO_LINKStopOperationalNN
2032AUTO_LINK_PHONE_CORROBORATIONStartOperationalNN
2033AUTO_LINK_PHONE_CORROBORATIONStopOperationalNN
2034AUTO_LINK_EMAIL_CORROBORATIONStartOperationalNN
2035AUTO_LINK_EMAIL_CORROBORATIONStopOperationalNN
7001IndexFilter IndexSource initialization startingOperationalNN
7002IndexFilter IndexSource initialization doneOperationalNN
7003Data Source and Index generations mismatch.OperationalNN
8002Finished the knowledge defragmentation task.OperationalNN
8003Starting the knowledge defragmentation task for all sync partners associated …OperationalNN
8004Finished the knowledge defragmentation task for all sync partners associated …OperationalNN

Event ID 1: Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

#
Channel
Operational

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 2: Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

#
Channel
Operational

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 3: Trace

#
Channel
Operational
Task
Trace

Fields #

NameDescription
Message Pointer

Event ID 1000: PimIndexMaintenance::Prop_FUNC_AnsiString: Failed at line Prop_LINE_UInt32 with HR: Prop_Hr_Int32.

#
Channel
Operational

Message #

PimIndexMaintenance::%1: Failed at line %2 with HR: %3

Fields #

NameDescription
Prop_FUNC_AnsiString AnsiString
Prop_LINE_UInt32 UInt32
Prop_Hr_Int32 Int32

Event ID 1001: PimIndexMaintenance::Starting to process store changes

#
Channel
Operational

Event ID 1002: PimIndexMaintenance::Done processing store changes

#
Channel
Operational

Event ID 1003: PimIndexMaintenance::Starting to process folder changes

#
Channel
Operational

Event ID 1004: PimIndexMaintenance::Done processing folder changes

#
Channel
Operational

Event ID 1005: PimIndexMaintenance::Starting to handle store count changes

#
Channel
Operational

Event ID 1006: PimIndexMaintenance::Done processing store count changes

#
Channel
Operational

Event ID 1007: PimIndexMaintenance::Starting sync session to collect changes

#
Channel
Operational

Event ID 1008: PimIndexMaintenance::Ending sync session

#
Channel
Operational

Event ID 1009: PimIndexMaintenance::Enumerated PROP_UInt32_1 contacts to update aggregate for in store PROP_UInt32_2.

#
Channel
Operational

Message #

PimIndexMaintenance::Enumerated %1 contacts to update aggregate for in store %2.

Fields #

NameDescription
PROP_UInt32_1 UInt32
PROP_UInt32_2 UInt32

Event ID 1010: PimIndexMaintenance::Error getting next change, Error = Prop_Hr_UInt32.

#
Channel
Operational

Message #

PimIndexMaintenance::Error getting next change, Error = %1

Fields #

NameDescription
Prop_Hr_UInt32 Int32

Event ID 1011: PimIndexMaintenance::Rebuilding indexes

#
Channel
Operational

Event ID 1012: PimIndexMaintenance::Unexpected event code PROP_UInt32 found in thread proc with last error Prop_Hr_UInt32.

#
Channel
Operational

Message #

PimIndexMaintenance::Unexpected event code %1 found in thread proc with last error %2

Fields #

NameDescription
PROP_UInt32 UInt32
Prop_Hr_UInt32 Int32

Event ID 1013: PimIndexMaintenance::Could not get new info about item changed in stage PROP_UInt32 with hr Prop_Hr_UInt32.

#
Channel
Operational

Message #

PimIndexMaintenance::Could not get new info about item changed in stage %1 with hr %2

Fields #

NameDescription
PROP_UInt32 UInt32
Prop_Hr_UInt32 Int32

Event ID 1014: PimIndexMaintenance::Could not get old info about item changed with hr Prop_Hr_UInt32.

#
Channel
Operational

Message #

PimIndexMaintenance::Could not get old info about item changed with hr %1

Fields #

NameDescription
Prop_Hr_UInt32 Int32

Event ID 1015: PimIndexMaintenance::AddSyncPartner adding partner for store PROP_FILE_uint.

#
Channel
Operational

Message #

PimIndexMaintenance::AddSyncPartner adding partner for store %1

Fields #

NameDescription
PROP_FILE_uint UInt32

Event ID 1016: PimIndexMaintenance::Aggregates processed on store delete: Total: {PROP_UInt32_1} Changed: {PROP_UInt32_2} Deleted: {PROP_UInt32_3} Skipped: {PROP_...

#
Channel
Operational

Description

PimIndexMaintenance::Aggregates processed on store delete: Total: {PROP_UInt32_1} Changed: {PROP_UInt32_2} Deleted: {PROP_UInt32_3} Skipped: {PROP_UInt32_4} Failed: {PROP_UInt32_5}.

Message #

PimIndexMaintenance::Aggregates processed on store delete: Total: {PROP_UInt32_1} Changed: {PROP_UInt32_2} Deleted: {PROP_UInt32_3} Skipped: {PROP_UInt32_4} Failed: {PROP_UInt32_5}

Fields #

NameDescription
PROP_UInt32_1
PROP_UInt32_2
PROP_UInt32_3
PROP_UInt32_4
PROP_UInt32_5

Event ID 1017: PimIndexMaintenance::Aggregate processed on store delete: ID: PROP_UInt32_1 Components: PROP_UInt32_2.

#
Channel
Operational

Message #

PimIndexMaintenance::Aggregate processed on store delete: ID: %1 Components: %2

Fields #

NameDescription
PROP_UInt32_1 UInt32
PROP_UInt32_2 UInt32

Event ID 1018: PimIndexMaintenance::Rebuilding indexes finished- aggregates processed: PROP_FILE_uint.

#
Channel
Operational

Message #

PimIndexMaintenance::Rebuilding indexes finished- aggregates processed: %1

Fields #

NameDescription
PROP_FILE_uint UInt32

Event ID 1019: PimIndexMaintenance::GetAggregate in HandleDeleteStore failed with: {Prop_Hr_UInt32}.

#
Channel
Operational

Fields #

NameDescription
Prop_Hr_UInt32

Event ID 1020: PimIndexMaintenance::Getting the store mask in HandleDeleteStore failed with: {Prop_Hr_UInt32}.

#
Channel
Operational

Fields #

NameDescription
Prop_Hr_UInt32

Event ID 1021: PimIndexMaintenance::HandleAggregateForDeleteStore failed with result: {Prop_Hr_UInt32}.

#
Channel
Operational

Fields #

NameDescription
Prop_Hr_UInt32

Event ID 1022: PimIndexMaintenance::Received transition to user idle message in thread proc

#
Channel
Operational

Event ID 1023: PimIndexMaintenance::Saw power state change with message PROP_UInt32_1 and flags PROP_UInt32_2.

#
Channel
Operational

Message #

PimIndexMaintenance::Saw power state change with message %1 and flags %2

Fields #

NameDescription
PROP_UInt32_1 UInt32
PROP_UInt32_2 UInt32
PROP_UInt32_3 UInt32
PROP_UInt32_4 UInt32
PROP_UInt32_5 UInt32

Event ID 1024: PimIndexMaintenance::Initialization Failure.

#
Channel
Operational

Description

PimIndexMaintenance::Initialization Failure. Delaying for PROP_FILE_uint mins.

Message #

PimIndexMaintenance::Initialization Failure. Delaying for %1 mins.

Fields #

NameDescription
PROP_FILE_uint UInt32

Event ID 1025: PimIndexMaintenance::Service is already running.

#
Channel
Operational

Event ID 1026: PimIndexMaintenance::Service aborted due to invalid parameter.

#
Channel
Operational

Event ID 1027: PimIndexMaintenance::OnEvent saw a lost notification.

#
Channel
Operational

Event ID 1028: PimIndexMaintenance::OnEvent saw a store create/delete, event = PROP_FILE_uint.

#
Channel
Operational

Message #

PimIndexMaintenance::OnEvent saw a store create/delete, event = %1.

Fields #

NameDescription
PROP_FILE_uint UInt32

Event ID 1029: PimIndexMaintenance::HandleAdd on deleted item, Id = PROP_FILE_uint.

#
Channel
Operational

Message #

PimIndexMaintenance::HandleAdd on deleted item, Id = %1.

Fields #

NameDescription
PROP_FILE_uint UInt32

Event ID 1030: PimIndexMaintenance::Processing PROP_UInt32_1 contacts in store PROP_UInt32_2.

#
Channel
Operational

Message #

PimIndexMaintenance::Processing %1 contacts in store %2.

Fields #

NameDescription
PROP_UInt32_1 UInt32
PROP_UInt32_2 UInt32

Event ID 1031: PimIndexMaintenance::Failed to process contact PROP_UInt32 image: Prop_Hr_UInt32.

#
Channel
Operational

Message #

PimIndexMaintenance::Failed to process contact %1 image: %2

Fields #

NameDescription
PROP_UInt32 UInt32
Prop_Hr_UInt32 Int32

Event ID 1032: PimIndexMaintenance::Processing contact PROP_FILE_uint image.

#
Channel
Operational

Message #

PimIndexMaintenance::Processing contact %1 image

Fields #

NameDescription
PROP_FILE_uint UInt32

Event ID 1033: PimIndexMaintenance::Processing contact: version (size: PROP_ByteCount, data: PROP_Bytes).

#
Channel
Operational

Message #

PimIndexMaintenance::Processing contact: version (size: %1, data: %2)

Fields #

NameDescription
PROP_ByteCount UInt32
PROP_Bytes Binary

Event ID 1034: Attempting to restore store and folder settings

#
Channel
Operational

Event ID 1035: Settings restore timeout has been reached

#
Channel
Operational

Event ID 1040: Removing application store App (Result from package manager).

#
Channel
Operational

Message #

Removing application store %1 (%2 from package manager)

Fields #

NameDescription
App GUID
Result Int32

Event ID 1041: Rundown index filter Prop_Prop.

#
Channel
Operational

Message #

Rundown index filter %1

Fields #

NameDescription
Prop_Prop UInt32

Event ID 1042: Rundown search provider Prop_Prop.

#
Channel
Operational

Message #

Rundown search provider %1

Fields #

NameDescription
Prop_Prop UInt32

Event ID 1043: Startup Update: P1_String.

#
Channel
Operational

Message #

Startup Update: %1

Fields #

NameDescription
P1_String AnsiString

Event ID 2000: PimIndexMaintenance::Service started

#
Channel
Operational
Task
THREAD_PREP
Opcode
Start

Event ID 2001: THREAD_PREPStop

#
Channel
Operational
Task
THREAD_PREP
Opcode
Stop

Event ID 2002: ON_BOOTStart

#
Channel
Operational
Task
ON_BOOT
Opcode
Start

Event ID 2003: ON_BOOTStop

#
Channel
Operational
Task
ON_BOOT
Opcode
Stop

Event ID 2004: ON_EVENTStart

#
Channel
Operational
Task
ON_EVENT
Opcode
Start

Event ID 2005: ON_EVENTStop

#
Channel
Operational
Task
ON_EVENT
Opcode
Stop

Event ID 2006: CONFIGURE_SYNCStart

#
Channel
Operational
Task
CONFIGURE_SYNC
Opcode
Start

Event ID 2007: CONFIGURE_SYNCStop

#
Channel
Operational
Task
CONFIGURE_SYNC
Opcode
Stop

Event ID 2008: UPDATE_STOREStart

#
Channel
Operational
Task
UPDATE_STORE
Opcode
Start

Event ID 2009: UPDATE_STOREStop

#
Channel
Operational
Task
UPDATE_STORE
Opcode
Stop

Event ID 2010: SETUPStart

#
Channel
Operational
Task
SETUP
Opcode
Start

Event ID 2011: SETUPStop

#
Channel
Operational
Task
SETUP
Opcode
Stop

Event ID 2012: UPDATE_FOLDERStart

#
Channel
Operational
Task
UPDATE_FOLDER
Opcode
Start

Event ID 2013: UPDATE_FOLDERStop

#
Channel
Operational
Task
UPDATE_FOLDER
Opcode
Stop

Event ID 2014: COLLECT_CHANGESStart

#
Channel
Operational
Task
COLLECT_CHANGES
Opcode
Start

Event ID 2015: COLLECT_CHANGESStop

#
Channel
Operational
Task
COLLECT_CHANGES
Opcode
Stop

Event ID 2016: SYNC_SESSIONStart

#
Channel
Operational
Task
SYNC_SESSION
Opcode
Start

Event ID 2017: SYNC_SESSIONStop

#
Channel
Operational
Task
SYNC_SESSION
Opcode
Stop

Event ID 2018: END_TRANSACTIONStart

#
Channel
Operational
Task
END_TRANSACTION
Opcode
Start

Fields #

NameDescription
uint UInt32

Event ID 2019: END_TRANSACTIONStop

#
Channel
Operational
Task
END_TRANSACTION
Opcode
Stop

Fields #

NameDescription
uint UInt32

Event ID 2020: UPDATE_PICTUREStart

#
Channel
Operational
Task
UPDATE_PICTURE
Opcode
Start

Event ID 2021: UPDATE_PICTUREStop

#
Channel
Operational
Task
UPDATE_PICTURE
Opcode
Stop

Event ID 2022: HANDLE_CHANGESStart

#
Channel
Operational
Task
HANDLE_CHANGES
Opcode
Start

Fields #

NameDescription
uint UInt32

Event ID 2023: HANDLE_CHANGESStop

#
Channel
Operational
Task
HANDLE_CHANGES
Opcode
Stop

Fields #

NameDescription
uint UInt32

Event ID 2024: HANDLE_ADD_OR_EDITStart

#
Channel
Operational
Task
HANDLE_ADD_OR_EDIT
Opcode
Start

Event ID 2025: HANDLE_ADD_OR_EDITStop

#
Channel
Operational
Task
HANDLE_ADD_OR_EDIT
Opcode
Stop

Event ID 2026: HANDLE_DELETEStart

#
Channel
Operational
Task
HANDLE_DELETE
Opcode
Start

Event ID 2027: HANDLE_DELETEStop

#
Channel
Operational
Task
HANDLE_DELETE
Opcode
Stop

Event ID 2028: COMMIT_CHANGESStart

#
Channel
Operational
Task
COMMIT_CHANGES
Opcode
Start

Event ID 2029: COMMIT_CHANGESStop

#
Channel
Operational
Task
COMMIT_CHANGES
Opcode
Stop

Event ID 2030: AUTO_LINKStart

#
Channel
Operational
Task
AUTO_LINK
Opcode
Start

Event ID 2031: AUTO_LINKStop

#
Channel
Operational
Task
AUTO_LINK
Opcode
Stop

Event ID 2032: AUTO_LINK_PHONE_CORROBORATIONStart

#
Channel
Operational
Task
AUTO_LINK_PHONE_CORROBORATION
Opcode
Start

Event ID 2033: AUTO_LINK_PHONE_CORROBORATIONStop

#
Channel
Operational
Task
AUTO_LINK_PHONE_CORROBORATION
Opcode
Stop

Event ID 2034: AUTO_LINK_EMAIL_CORROBORATIONStart

#
Channel
Operational
Task
AUTO_LINK_EMAIL_CORROBORATION
Opcode
Start

Event ID 2035: AUTO_LINK_EMAIL_CORROBORATIONStop

#
Channel
Operational
Task
AUTO_LINK_EMAIL_CORROBORATION
Opcode
Stop

Event ID 7001: IndexFilter IndexSource initialization starting

#
Channel
Operational

Event ID 7002: IndexFilter IndexSource initialization done

#
Channel
Operational

Event ID 7003: Data Source and Index generations mismatch.

#
Channel
Operational

Description

Data Source and Index generations mismatch (store.vol: PROP_UInt32_1, PimIndex.vol: PROP_UInt32_2).

Message #

Data Source and Index generations mismatch (store.vol: %1, PimIndex.vol: %2)

Fields #

NameDescription
PROP_UInt32_1 UInt32
PROP_UInt32_2 UInt32

Event ID 8002: Finished the knowledge defragmentation task.

#
Channel
Operational

Message #

Finished the knowledge defragmentation task. Examined {PROP_UInt32_1} stores and {PROP_UInt32_2} partners out of which defragmentation succeeded for {PROP_UInt32_3}; partially succeeded for {PROP_UInt32_4} and failed for {PROP_UInt32_5}.

Fields #

NameDescription
PROP_UInt32_1
PROP_UInt32_2
PROP_UInt32_3
PROP_UInt32_4
PROP_UInt32_5

Event ID 8003: Starting the knowledge defragmentation task for all sync partners associated with store {Prop_Prop}.

#
Channel
Operational

Fields #

NameDescription
Prop_Prop

Event ID 8004: Finished the knowledge defragmentation task for all sync partners associated with store {PROP_UInt32_1}.

#
Channel
Operational

Message #

Finished the knowledge defragmentation task for all sync partners associated with store {PROP_UInt32_1}. Examined {PROP_UInt32_2} partners out of which defragmentation succeeded for {PROP_UInt32_3}; partially succeeded for {PROP_UInt32_4} and failed for {PROP_UInt32_5}.

Fields #

NameDescription
PROP_UInt32_1
PROP_UInt32_2
PROP_UInt32_3
PROP_UInt32_4
PROP_UInt32_5

Provenance

ETW provider GUID 99c66ba7-5a97-40d5-aa01-8a07fb3db292

Defined in PimIndexMaintenance.dll, which carries the event manifest.