detection.wiki

Microsoft-Windows-WebServices

EventTitleChannelSampleRule
1api API is called.TracingNN
2api API returned.TracingNN
3api API failed by result.TracingNN
4api API is pending completion.TracingNN
5api API completed.TracingNN
6api API failed to complete by result.TracingNN
7Error occurred: error - errorString.TracingNN
8operation IO operation started.TracingNN
9operation IO operation completed, size bytes transferred.TracingNN
10operation IO operation failed: error.TracingNN
11Sending message - bin (id: correlationId): message.TracingNN
12Received message - bin (id: correlationId): message.TracingNN
13Sending message (id: correlationId): message.TracingNN
14Received message (id: correlationId): message.TracingNN
15Sending Message Start (id: correlationId).TracingNN
16Sending Message Stop (id: correlationId).TracingNN
17Received Message Start (id: correlationId).TracingNN
18Received Message Stop (id: correlationId).TracingNN
19Sending following HTTP headers: length.TracingNN
20Receiving following HTTP headers: length.TracingNN
21Trace.TracingNN

Event ID 1: api API is called.

#
Channel
Tracing
Task
APIs
Opcode
APIEnter

Message #

%1 API is called.

Fields #

NameDescription
api UInt32

Event ID 2: api API returned.

#
Channel
Tracing
Task
APIs
Opcode
APIExitSyncSuccess

Message #

%1 API returned.

Fields #

NameDescription
api UInt32
result UInt32

Event ID 3: api API failed by result.

#
Channel
Tracing
Task
APIs
Opcode
APIExitSyncFailure

Message #

%1 API failed by %2

Fields #

NameDescription
api UInt32
result UInt32

Event ID 4: api API is pending completion.

#
Channel
Tracing
Task
APIs
Opcode
APIPending

Message #

%1 API is pending completion.

Fields #

NameDescription
api UInt32

Event ID 5: api API completed.

#
Channel
Tracing
Task
APIs
Opcode
APIExitAsyncSuccess

Message #

%1 API completed.

Fields #

NameDescription
api UInt32
result UInt32

Event ID 6: api API failed to complete by result.

#
Channel
Tracing
Task
APIs
Opcode
APIExitAsyncFailure

Message #

%1 API failed to complete by %2

Fields #

NameDescription
api UInt32
result UInt32

Event ID 7: Error occurred: error - errorString.

#
Channel
Tracing
Task
Errors
Opcode
Error

Message #

Error occurred: %1 - %2

Fields #

NameDescription
error UInt32
errorString UnicodeString

Event ID 8: operation IO operation started.

#
Channel
Tracing
Task
IOOperations
Opcode
IOStarted

Message #

%1 IO operation started.

Fields #

NameDescription
operation UInt32

Event ID 9: operation IO operation completed, size bytes transferred.

#
Channel
Tracing
Task
IOOperations
Opcode
IOCompleted

Message #

%1 IO operation completed, %2 bytes transferred.

Fields #

NameDescription
operation UInt32
size UInt32

Event ID 10: operation IO operation failed: error.

#
Channel
Tracing
Task
IOOperations
Opcode
IOFailed

Message #

%1 IO operation failed: %2

Fields #

NameDescription
operation UInt32
error UInt32

Event ID 11: Sending message - bin (id: correlationId): message.

#
Channel
Tracing
Task
MessageExchange
Opcode
SendingMessage_Binary

Description

Sending message - bin (id: correlationId).

Message #

Sending message - bin  (id: %1): 
%3

Fields #

NameDescription
correlationId UInt64
length UInt16
message UnicodeString

Event ID 12: Received message - bin (id: correlationId): message.

#
Channel
Tracing
Task
MessageExchange
Opcode
ReceivedMessage_Binary

Description

Received message - bin (id: correlationId).

Message #

Received message - bin (id: %1): 
%3

Fields #

NameDescription
correlationId UInt64
length UInt16
message UnicodeString

Event ID 13: Sending message (id: correlationId): message.

#
Channel
Tracing
Task
MessageExchange
Opcode
SendingMessage_Text

Description

Sending message (id: correlationId).

Message #

Sending message        (id: %1): 
%3

Fields #

NameDescription
correlationId UInt64
length UInt16
message UnicodeString

Event ID 14: Received message (id: correlationId): message.

#
Channel
Tracing
Task
MessageExchange
Opcode
ReceivedMessage_Text

Description

Received message (id: correlationId).

Message #

Received message       (id: %1): 
%3

Fields #

NameDescription
correlationId UInt64
length UInt16
message UnicodeString

Event ID 15: Sending Message Start (id: correlationId).

#
Channel
Tracing
Task
MessageExchange
Opcode
SendingMessageStart

Message #

Sending Message Start  (id: %1)

Fields #

NameDescription
correlationId UInt64

Event ID 16: Sending Message Stop (id: correlationId).

#
Channel
Tracing
Task
MessageExchange
Opcode
SendingMessageStop

Message #

Sending Message Stop   (id: %1)

Fields #

NameDescription
correlationId UInt64

Event ID 17: Received Message Start (id: correlationId).

#
Channel
Tracing
Task
MessageExchange
Opcode
ReceivedMessageStart

Message #

Received Message Start (id: %1)

Fields #

NameDescription
correlationId UInt64

Event ID 18: Received Message Stop (id: correlationId).

#
Channel
Tracing
Task
MessageExchange
Opcode
ReceivedMessageStop

Message #

Received Message Stop  (id: %1)

Fields #

NameDescription
correlationId UInt64

Event ID 19: Sending following HTTP headers: length.

#
Channel
Tracing
Task
APIs
Opcode
SendingHTTPheaders

Message #

Sending following HTTP headers: %1

Fields #

NameDescription
length UInt16
traceString UnicodeString

Event ID 20: Receiving following HTTP headers: length.

#
Channel
Tracing
Task
APIs
Opcode
ReceivingHTTPheaders

Message #

Receiving following HTTP headers: %1

Fields #

NameDescription
length UInt16
traceString UnicodeString

Event ID 21: Trace.

#
Channel
Tracing
Task
APIs
Opcode
Trace

Description

Trace: traceString

Message #

Trace: %1

Fields #

NameDescription
traceString UnicodeString

Provenance

ETW provider GUID e04fe2e0-c6cf-4273-b59d-5c97c9c374a4

Defined in WebServices.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB