Microsoft-Windows-Watchdog-Events

Event	Title	Channel	Sample	Rule
100	LogAssert	WdLog	N	N
101	LogError	WdLog	N	N
102	LogWarning	WdLog	N	N
103	LogEvent	WdLog	Y	N
104	LogTrace	WdLog	N	N
105	LogLowResource	WdLog	N	N
106	LogDmmEvent	WdLog	N	N
107	LogPresentTokenEvent	WdLog	Y	N
108	LogPower	WdLog	N	N
109	LogDebug	WdLog	N	N
110	LogUnknown	WdLog	N	N

Event ID 100: LogAssert

Channel: WdLog
Task: LogAssert

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Event ID 101: LogError

Channel: WdLog
Task: LogError

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Event ID 102: LogWarning

Channel: WdLog
Task: LogWarning

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Event ID 103: LogEvent

Channel: WdLog
Also via: realtime ETW trace
Task: LogEvent
Opcode: win:Info

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Watchdog-Events",
    "guid": "{70E74DD8-39DB-5F6F-6FD1-F5581B29E834}",
    "event_source_name": "",
    "event_id": 103,
    "version": 0,
    "level": 0,
    "task": 4,
    "opcode": 0,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T06:06:08.408+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 728
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Level": 4,
    "LogEntry": 11785281,
    "Param1": 18446670449002553360,
    "Param2": 270376,
    "Param3": 270374,
    "Param4": 0,
    "Param5": 0,
    "Return Address": "0xFFFFF80068C0EB25"
  },
  "message": "LogEvent"
}

Example keys not documented in the fields table: Return Address

Event ID 104: LogTrace

Channel: WdLog
Task: LogTrace

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Event ID 105: LogLowResource

Channel: WdLog
Task: LogLowResource

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Event ID 106: LogDmmEvent

Channel: WdLog
Task: LogDmmEvent

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Event ID 107: LogPresentTokenEvent

Channel: WdLog
Also via: realtime ETW trace
Task: LogPresentTokenEvent
Opcode: win:Info

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Watchdog-Events",
    "guid": "{70E74DD8-39DB-5F6F-6FD1-F5581B29E834}",
    "event_source_name": "",
    "event_id": 107,
    "version": 0,
    "level": 0,
    "task": 7,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T06:06:08.408+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 728
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Level": 8,
    "LogEntry": 11785285,
    "Param1": 18446630888022925664,
    "Param2": 54086,
    "Param3": 5722749,
    "Param4": 1,
    "Param5": 0,
    "Return Address": "0xFFFFF80068C1434C"
  },
  "message": "LogPresentTokenEvent"
}

Example keys not documented in the fields table: Return Address

Event ID 108: LogPower

Channel: WdLog
Task: LogPower

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Event ID 109: LogDebug

Channel: WdLog
Task: LogDebug

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Event ID 110: LogUnknown

Channel: WdLog
Task: LogUnknown

Fields #

Name	Description
`ReturnAddress` Pointer
`LogEntry` UInt32
`Level` UInt32
`Param1` UInt64
`Param2` UInt64
`Param3` UInt64
`Param4` UInt64
`Param5` UInt64

Provenance

ETW provider GUID {70E74DD8-39DB-5F6F-6FD1-F5581B29E834}

Defined in watchdog.sys, the binary that emits these events.

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB