Microsoft-Windows-UserDataAccess-UnifiedStore
81 events across 1 channel
Event ID 1: Error: P1_HResult Location: P2_String Line Number: P3_UInt32.
#Event ID 2: Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.
#Event ID 50: Info: P1_HResult Location: P2_String Line Number: P3_UInt32.
#Event ID 101: Error: P1_HResult Location: P2_String Line Number: P3_UInt32.
#Event ID 102: Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.
#Event ID 2000: Tombstone cleanup completed: store [Arg1], iterations [Arg2], duration [Arg3 s].
#Event ID 2001: Terminated suspended app [Prop_INT]: result [Prop_Handle].
#Event ID 2002: App lost change tracking [Arg1]: current rev [Arg2], deleted item rev [Arg3].
#Event ID 3000: Updating DB LCID, Invalidating all open sessions and handles
#Description
Updating DB LCID, Invalidating all open sessions and handles.
Message #
Event ID 3001: Unified store lock was held for Prop_UInt64 seconds.
#Event ID 3002: Unified store lock type Arg1 was not released even after Arg2 seconds.
#Event ID 3003: CeSeekDatabaseEx failed, Handle: Prop_Handle, HR: Prop_HRESULT SeekType: Prop_UINT.
#Event ID 3004: CeWriteRecordProps failed, Handle: Prop_Handle, HR: Prop_HRESULT, OIDRecord: Prop_UINT.
#Event ID 3005: CeReadRecordPropsEx failed, Handle: Prop_Handle, HR: Prop_HRESULT, Flags: Prop_UINT.
#Event ID 3006: Closed handle before refcount was 0, Handle: Prop_Handle, Outstanding refCount: Prop_INT.
#Event ID 3007: Missed Event Notification Dispatched
#Description
Missed Event Notification Dispatched.
Message #
Event ID 3009: Mutex acquire failed, WaitResult = Prop_UInt32, HR = Prop_Hex_UInt32.
#Event ID 3010: Deserialize Knowledge failed, HR = Prop_ErrorCode, cbKnowledge = Prop_FullKnowledgeSize, cbKnowledgeLogged = Prop_LoggedKnowledgeSize.
#Event ID 3011: Opening Table Prop_UInt32 without any index.
#Event ID 3012: Restriction Type = Prop_UInt32.
#Event ID 3013: PropertyRestriction: Operation Prop_Prop1, Property id Prop_Prop2.
#Event ID 3014: BitMaskRestriction: Operation Prop_Prop1, Property id Prop_Prop2.
#Event ID 3015: Seeked and read Prop_UInt32 rows before finding row with matching index.
#Event ID 3016: Count Count: Property ids: Array.
#Event ID 3017: MountDeviceVolume Error: P1_HResult.
#Event ID 3018: Remote notification dispatched, Event type: Prop_Handle, Object type: Prop_HRESULT, Object Id: Prop_UINT.
#Event ID 3019: Remote notification published, Event type: Prop_Handle, Object type: Prop_HRESULT, Object Id: Prop_UINT.
#Event ID 3020: Missed Event Notification Published
#Description
Missed Event Notification Published.
Message #
Event ID 3021: UnifiedStore delete store id = Prop_UInt32.
#Event ID 3022: UnifiedStore delete folder types = Prop_Handle, store = Prop_HRESULT, id = Prop_UINT.
#Event ID 3023: Table.
#Event ID 3024: Failed to commit transaction, attempting rollback recovery (error Prop_Prop1, session Prop_Prop2).
#Event ID 3025: Failed to rollback transaction (error Prop_Prop1, session Prop_Prop2).
#Event ID 3026: Recovery complete (error Prop_Prop1, session Prop_Prop2).
#Event ID 3028: Unified Store RPC Call: Function.
#Event ID 3029: Failed to set property ID Prop_Prop1, error Prop_Prop2.
#Event ID 3030: Process Prop_Prop1 underflowed its suspend/resume count, now is Prop_Prop2.
#Event ID 3031: Process Prop_Prop1 suspended its message queue, count Prop_Prop2.
#Event ID 3032: Process Prop_Prop1 resumed its message queue, count Prop_Prop2.
#Event ID 3033: Process with rundown identifier Prop_Prop1 aborted Prop_Prop2 transactions.
#Event ID 3034: Client process Prop_Prop has lost events.
#Event ID 3035: Client process Prop_Prop has resumed fetching events.
#Event ID 3036: Property should be added in schema.
#Event ID 3037: Advisee in service process (vtable Function) has lost events.
#Event ID 3039: Final transaction rollback attempt failed, Error: P1_HResult.
#Event ID 3040: Closing active table id: Prop_Prop.
#Event ID 3041: UNIFIED_STORE_VOLUME_MOUNTStart
#Event ID 3042: UNIFIED_STORE_VOLUME_MOUNTStop
#Event ID 3043: Unified store process identifier Prop_Prop created for process.
#Event ID 3044: Process exit callback for process with identifier Prop_Prop.
#Event ID 3045: Unified store rundown for process Prop_Prop1 with identifier Prop_Prop2.
#Event ID 3046: Store id: Prop_Prop1 Supported Types changed to: Prop_Prop2.
#Event ID 3047: DBSession::_UpgradeDatabase Error: P1_HResult.
#Event ID 3048: JetAttachDatabase Error: P1_HResult.
#Event ID 3049: Upgrading database, lcidChanged: Prop_Handle, storeVersionChanged: Prop_HRESULT, isIndexCorrupt: Prop_UINT.
#Event ID 3050: Creating Missing indexes, table ID: Prop_Prop1, count: Prop_Prop2.
#Event ID 3051: Number of indexes changed unexpectedly, table ID: Prop_Prop1, numExistingIndex: Prop_Prop2.
#Event ID 3052: The database was corrupted, and recovered
#Description
The database was corrupted, and recovered.
Message #
Event ID 3053: Simulation of database corruption
#Description
Simulation of database corruption.
Message #
Event ID 3070: Attempting to defragment scope knowledge.
#Description
Attempting to defragment scope knowledge. Partner id: Arg1, scope id: Arg2, exceptions: Arg3 positive and Arg4 negative, min vector size: Arg5, max vector size: Arg6, starting tick count: Arg7.
Message #
Fields #
| Name | Description |
|---|---|
Arg1 HexInt32 | |
Arg2 HexInt32 | |
Arg3 UInt32 | |
Arg4 UInt32 | |
Arg5 UInt32 | |
Arg6 UInt32 | |
Arg7 HexInt64 |
Event ID 3071: Defragmented scope knowledge.
#Event ID 3072: Done defragmenting scope knowledge.
#Event ID 3073: Attempting to defragment partner knowledge.
#Event ID 3074: The knowledge for partner id Arg1 has Arg2 scopes, Arg3 positive exceptions, Arg4 negative exceptions, min vector size: Arg5 and max vector size: Arg6.
#Event ID 3075: Successfully defragmented Arg2 scopes out of Arg3 for partner id Arg1.
#Event ID 3076: Defragmented partner knowledge.
#Event ID 3077: Done defragmenting partner knowledge.
#Event ID 3078: Failed to reduce the knowledge size for partner id Arg1 below Arg2% of the maximum size (size: Arg3, maximum size: Arg4).
#Event ID 3079: The knowledge size for partner id Arg1 exceeds Arg3% of the maximum size (size: Arg2, maximum size: Arg4).
#Event ID 3080: The knowledge size for partner id Arg1 exceeds Arg3% of the maximum size (size: Arg2, maximum size: Arg4).
#Event ID 3081: The knowledge size for partner id Arg1 exceeds the maximum size (size: Arg2, maximum size: Arg3).
#Event ID 3100: Closing stale notify context Handle on behalf of rundown id Rundown.
#Event ID 3101: Closing stale object Handle on behalf of rundown id Rundown.
#Event ID 3110: [store upgrade] The current store version is Prop_Prop.
#Event ID 3112: [store upgrade] Performing upgrade task TaskType.
#Event ID 3113: [store upgrade] Prop_Prop appointments updated.
#Event ID 4001: UnifiedStore_OnBoot_UpdateIndexesStart
#Event ID 4002: UnifiedStore_OnBoot_UpdateIndexesStop
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 56f519ab-9df6-4345-8491-a4ba21ac825b
Defined in unistore.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, captured 2026-06-02