Microsoft-Windows-WinQuic

121 events across 1 channel

Event	Title	Channel	Sample
1	[ lib] Initialized; PartitionCount=.	Operational	N
2	[conn][.	Operational	N
3	[conn][.	Operational	N
4	[conn][.	Operational	N
5	[conn][.	Operational	N
6	Allocation of '{Desc}' failed.	Operational	N
7	[ lib] Rundown; PartitionCount=.	Operational	N
8	[ lib] ERROR; {ErrStr}.	Operational	N
9	[ lib] ERROR; {Status}; {ErrStr}.	Operational	N
10	[ lib] ASSERT; {File}:{Line} - {Expression}.	Operational	N
100	[strm][.	Operational	N
101	[strm][.	Operational	N
1000	[conn][.	Operational	N
1001	[conn][.	Operational	N
1002	[conn][.	Operational	N
1003	[strm][.	Operational	N
1004	[strm][.	Operational	N
1005	[conn][.	Operational	N
1006	[conn][.	Operational	N
1024	[ reg][.	Operational	N
1025	[ reg][.	Operational	N
1026	[ reg][.	Operational	N
1027	[ reg][.	Operational	N
1028	[ reg][.	Operational	N
1029	[ reg][.	Operational	N
2048	[wrkr][.	Operational	N
2049	[wrkr][.	Operational	N
2050	[wrkr][.	Operational	N
2051	[wrkr][.	Operational	N
2052	[wrkr][.	Operational	N
2053	[wrkr][.	Operational	N
2054	[wrkr][.	Operational	N
2055	[wrkr][.	Operational	N
2056	[wrkr][.	Operational	N
3072	[sess][.	Operational	N
3073	[sess][.	Operational	N
3074	[sess][.	Operational	N
3075	[sess][.	Operational	N
3076	[sess][.	Operational	N
3077	[sess][.	Operational	N
3078	[sess][.	Operational	N
4096	[list][.	Operational	N
4097	[list][.	Operational	N
4098	[list][.	Operational	N
4099	[list][.	Operational	N
4100	[list][.	Operational	N
4101	[list][.	Operational	N
4102	[list][.	Operational	N
5120	[conn][.	Operational	N
5121	[conn][.	Operational	N
5122	[conn][.	Operational	N
5123	[conn][.	Operational	N
5124	[conn][.	Operational	N
5125	[conn][.	Operational	N
5126	[conn][.	Operational	N
5127	[conn][.	Operational	N
5128	[conn][.	Operational	N
5129	[conn][.	Operational	N
5130	[conn][.	Operational	N
5131	[conn][.	Operational	N
5132	[conn][.	Operational	N
5133	[conn][.	Operational	N
5134	[conn][.	Operational	N
5135	[conn][.	Operational	N
5136	[conn][.	Operational	N
5137	[conn][.	Operational	N
5138	[conn][.	Operational	N
5139	[conn][.	Operational	N
5140	[conn][.	Operational	N
5141	[conn][.	Operational	N
5142	[conn][.	Operational	N
5143	[conn][.	Operational	N
5144	[conn][.	Operational	N
5145	[conn][.	Operational	N
5146	[conn][.	Operational	N
5147	[conn][.	Operational	N
5148	[conn][.	Operational	N
5149	[conn][.	Operational	N
5150	[conn][.	Operational	N
5151	[conn][.	Operational	N
5152	[conn][.	Operational	N
5153	[conn][.	Operational	N
5154	[conn][.	Operational	N
5155	[conn][.	Operational	N
5156	[conn][.	Operational	N
5157	[conn][.	Operational	N
5158	[conn][.	Operational	N
5159	[conn][.	Operational	N
5160	[conn][.	Operational	N
5161	[conn][.	Operational	N
5162	[conn][.	Operational	N
5163	[conn][.	Operational	N
5164	[conn][.	Operational	N
5165	[conn][.	Operational	N
5166	[conn][.	Operational	N
5167	[conn][.	Operational	N
6144	[strm][.	Operational	N
6145	[strm][.	Operational	N
6146	[strm][.	Operational	N
6147	[strm][.	Operational	N
6148	[strm][.	Operational	N
6149	[strm][.	Operational	N
6150	[strm][.	Operational	N
6151	[strm][.	Operational	N
7168	[bind][.	Operational	N
7169	[bind][.	Operational	N
7170	[bind][.	Operational	N
7171	[bind][.	Operational	N
7172	[bind][.	Operational	N
7173	[bind][.	Operational	N
7174	[bind][.	Operational	N
7175	[bind][.	Operational	N
7176	[bind][.	Operational	N
8192	[ tls][.	Operational	N
8193	[ tls][.	Operational	N
9215	[mitls] {Message}.	Operational	N
9216	[ udp][.	Operational	N
9217	[ udp][.	Operational	N
9218	[ udp][.	Operational	N
9219	[ udp][.	Operational	N
9220	[ udp][.	Operational	N

Event ID 1: [ lib] Initialized; PartitionCount=.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ lib] Initialized; PartitionCount={PartitionCount} DatapathFeatures={DatapathFeatures}.

Message #

[ lib] Initialized; PartitionCount={PartitionCount} DatapathFeatures={DatapathFeatures}

Fields #

Name	Description
`PartitionCount`
`DatapathFeatures`

Event ID 2: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] End.

Message #

[conn][{Connection}] End

Fields #

Name	Description
`Connection`

Event ID 3: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Handshake complete.

Message #

[conn][{Connection}] Handshake complete

Fields #

Name	Description
`Connection`

Event ID 4: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Scheduling: {State}.

Message #

[conn][{Connection}] Scheduling: {State}

Fields #

Name	Description
`Connection`
`State`

Event ID 5: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Execute: {Type}.

Message #

[conn][{Connection}] Execute: {Type}

Fields #

Name	Description
`Connection`
`Type`

Event ID 6: Allocation of '{Desc}' failed.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

Allocation of '{Desc}' failed. ({ByteCount} bytes).

Message #

Allocation of '{Desc}' failed. ({ByteCount} bytes)

Fields #

Name	Description
`Desc`
`ByteCount`

Event ID 7: [ lib] Rundown; PartitionCount=.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ lib] Rundown; PartitionCount={PartitionCount} DatapathFeatures={DatapathFeatures}.

Message #

[ lib] Rundown; PartitionCount={PartitionCount} DatapathFeatures={DatapathFeatures}

Fields #

Name	Description
`PartitionCount`
`DatapathFeatures`

Event ID 8: [ lib] ERROR; {ErrStr}.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ lib] ERROR; {ErrStr}.

Message #

[ lib] ERROR; {ErrStr}.

Fields #

Name	Description
`ErrStr`

Event ID 9: [ lib] ERROR; {Status}; {ErrStr}.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ lib] ERROR; {Status}; {ErrStr}.

Message #

[ lib] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Status`	NTSTATUS reference
`ErrStr`

Event ID 10: [ lib] ASSERT; {File}:{Line} - {Expression}.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ lib] ASSERT; {File}:{Line} - {Expression}.

Message #

[ lib] ASSERT; {File}:{Line} - {Expression}.

Fields #

Name	Description
`File`
`Line`
`Expression`

Event ID 100: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] Begin; Conn={Connection} ID={ID}.

Message #

[strm][{Stream}] Begin; Conn={Connection} ID={ID}

Fields #

Name	Description
`Stream`
`Connection`
`ID`

Event ID 101: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] End.

Message #

[strm][{Stream}] End

Fields #

Name	Description
`Stream`

Event ID 1000: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Message #

[conn][{Connection}] FS: BytesSent={BytesSent} InFlight={BytesInFlight} InFlightMax={BytesInFlightMax} CWnd={CongestionWindow} SSThresh={SlowStartThreshold} InRecov={IsInRecovery} ConnFC={ConnectionFlowControl} StreamFC={StreamFlowControl} ISB={Connection}0 PostedBytes={Connection}1 SRtt={Connection}2

Fields #

Name	Description
`Connection`
`BytesSent`
`BytesInFlight`
`BytesInFlightMax`
`CongestionWindow`
`SlowStartThreshold`
`IsInRecovery`
`ConnectionFlowControl`
`StreamFlowControl`

Event ID 1001: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] BLOCKED: {Reason}.

Message #

[conn][{Connection}] BLOCKED: {Reason}

Fields #

Name	Description
`Connection`
`Reason`

Event ID 1002: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] UNBLOCKED: {Reason}.

Message #

[conn][{Connection}] UNBLOCKED: {Reason}

Fields #

Name	Description
`Connection`
`Reason`

Event ID 1003: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] BLOCKED: {Reason}.

Message #

[strm][{Stream}] BLOCKED: {Reason}

Fields #

Name	Description
`Stream`
`Reason`

Event ID 1004: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] UNBLOCKED: {Reason}.

Message #

[strm][{Stream}] UNBLOCKED: {Reason}

Fields #

Name	Description
`Stream`
`Reason`

Event ID 1005: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] CUBIC: SlowStartThreshold={SlowStartThreshold} K={K} WindowMax={WindowMax} WindowLastMax={WindowLastMax}.

Message #

[conn][{Connection}] CUBIC: SlowStartThreshold={SlowStartThreshold} K={K} WindowMax={WindowMax} WindowLastMax={WindowLastMax}

Fields #

Name	Description
`Connection`
`SlowStartThreshold`
`K`
`WindowMax`
`WindowLastMax`

Event ID 1006: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Congestion Event.

Message #

[conn][{Connection}] Congestion Event

Fields #

Name	Description
`Connection`

Event ID 1024: [ reg][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ reg][{Registration}] Created; AppName={AppName}.

Message #

[ reg][{Registration}] Created; AppName={AppName}

Fields #

Name	Description
`Registration`
`AppName`

Event ID 1025: [ reg][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ reg][{Registration}] Destroyed.

Message #

[ reg][{Registration}] Destroyed

Fields #

Name	Description
`Registration`

Event ID 1026: [ reg][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ reg][{Registration}] Cleaning up.

Message #

[ reg][{Registration}] Cleaning up

Fields #

Name	Description
`Registration`

Event ID 1027: [ reg][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ reg][{Registration}] Rundown; AppName={AppName}.

Message #

[ reg][{Registration}] Rundown; AppName={AppName}

Fields #

Name	Description
`Registration`
`AppName`

Event ID 1028: [ reg][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ reg][{Registration}] ERROR; {ErrStr}.

Message #

[ reg][{Registration}] ERROR; {ErrStr}.

Fields #

Name	Description
`Registration`
`ErrStr`

Event ID 1029: [ reg][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ reg][{Registration}] ERROR; {Status}; {ErrStr}.

Message #

[ reg][{Registration}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Registration`
`Status`	NTSTATUS reference
`ErrStr`

Event ID 2048: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] Created; IdealProc={IdealProcessor} Owner={Owner}.

Message #

[wrkr][{Worker}] Created; IdealProc={IdealProcessor} Owner={Owner}

Fields #

Name	Description
`Worker`
`IdealProcessor`
`Owner`

Event ID 2049: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] Start.

Message #

[wrkr][{Worker}] Start

Fields #

Name	Description
`Worker`

Event ID 2050: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] Stop.

Message #

[wrkr][{Worker}] Stop

Fields #

Name	Description
`Worker`

Event ID 2051: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] IsActive = {IsActive}; Arg = {Arg}.

Message #

[wrkr][{Worker}] IsActive = {IsActive}; Arg = {Arg}

Fields #

Name	Description
`Worker`
`IsActive`
`Arg`

Event ID 2052: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] QueueDelay = {QueueDelay}.

Message #

[wrkr][{Worker}] QueueDelay = {QueueDelay}

Fields #

Name	Description
`Worker`
`QueueDelay`

Event ID 2053: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] Destroyed.

Message #

[wrkr][{Worker}] Destroyed

Fields #

Name	Description
`Worker`

Event ID 2054: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] Cleaning up.

Message #

[wrkr][{Worker}] Cleaning up

Fields #

Name	Description
`Worker`

Event ID 2055: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] ERROR; {ErrStr}.

Message #

[wrkr][{Worker}] ERROR; {ErrStr}.

Fields #

Name	Description
`Worker`
`ErrStr`

Event ID 2056: [wrkr][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[wrkr][{Worker}] ERROR; {Status}; {ErrStr}.

Message #

[wrkr][{Worker}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Worker`
`Status`	NTSTATUS reference
`ErrStr`

Event ID 3072: [sess][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[sess][{Session}] Created; Registration={Registration}; Alpn={AppName}.

Message #

[sess][{Session}] Created; Registration={Registration}; Alpn={AppName}

Fields #

Name	Description
`Session`
`Registration`
`AppName`

Event ID 3073: [sess][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[sess][{Session}] Destroyed.

Message #

[sess][{Session}] Destroyed

Fields #

Name	Description
`Session`

Event ID 3074: [sess][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[sess][{Session}] Cleaning up.

Message #

[sess][{Session}] Cleaning up

Fields #

Name	Description
`Session`

Event ID 3075: [sess][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[sess][{Session}] Shutting down connections; Flags={Flags}; ErrorCode={ErrorCode}.

Message #

[sess][{Session}] Shutting down connections; Flags={Flags}; ErrorCode={ErrorCode}

Fields #

Name	Description
`Session`
`Flags`
`ErrorCode`

Event ID 3076: [sess][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[sess][{Session}] Rundown; Registration={Registration}; Alpn={AppName}.

Message #

[sess][{Session}] Rundown; Registration={Registration}; Alpn={AppName}

Fields #

Name	Description
`Session`
`Registration`
`AppName`

Event ID 3077: [sess][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[sess][{Session}] ERROR; {ErrStr}.

Message #

[sess][{Session}] ERROR; {ErrStr}.

Fields #

Name	Description
`Session`
`ErrStr`

Event ID 3078: [sess][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[sess][{Session}] ERROR; {Status}; {ErrStr}.

Message #

[sess][{Session}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Session`
`Status`	NTSTATUS reference
`ErrStr`

Event ID 4096: [list][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[list][{Listener}] Created; Session={Session}.

Message #

[list][{Listener}] Created; Session={Session}

Fields #

Name	Description
`Listener`
`Session`

Event ID 4097: [list][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[list][{Listener}] Destroyed.

Message #

[list][{Listener}] Destroyed

Fields #

Name	Description
`Listener`

Event ID 4098: [list][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[list][{Listener}] Started; Binding={Binding}; LocalAddr={Addr}.

Message #

[list][{Listener}] Started; Binding={Binding}; LocalAddr={Addr}

Fields #

Name	Description
`Listener`
`Binding`
`Addr`

Event ID 4099: [list][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[list][{Listener}] Stopped.

Message #

[list][{Listener}] Stopped

Fields #

Name	Description
`Listener`

Event ID 4100: [list][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[list][{Listener}] Rundown; Session={Session}.

Message #

[list][{Listener}] Rundown; Session={Session}

Fields #

Name	Description
`Listener`
`Session`

Event ID 4101: [list][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[list][{Listener}] ERROR; {ErrStr}.

Message #

[list][{Listener}] ERROR; {ErrStr}.

Fields #

Name	Description
`Listener`
`ErrStr`

Event ID 4102: [list][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[list][{Listener}] ERROR; {Status}; {ErrStr}.

Message #

[list][{Listener}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Listener`
`Status`	NTSTATUS reference
`ErrStr`

Event ID 5120: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Created; IsServer={IsServer}.

Message #

[conn][{Connection}] Created; IsServer={IsServer}

Fields #

Name	Description
`Connection`
`IsServer`

Event ID 5121: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Destroyed.

Message #

[conn][{Connection}] Destroyed

Fields #

Name	Description
`Connection`

Event ID 5122: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Handshake complete.

Message #

[conn][{Connection}] Handshake complete

Fields #

Name	Description
`Connection`

Event ID 5123: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Scheduling: {State}.

Message #

[conn][{Connection}] Scheduling: {State}

Fields #

Name	Description
`Connection`
`State`

Event ID 5124: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Execute: {Type}.

Message #

[conn][{Connection}] Execute: {Type}

Fields #

Name	Description
`Connection`
`Type`

Event ID 5125: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Execute: {Type}.

Message #

[conn][{Connection}] Execute: {Type}

Fields #

Name	Description
`Connection`
`Type`

Event ID 5126: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Execute: {Type}.

Message #

[conn][{Connection}] Execute: {Type}

Fields #

Name	Description
`Connection`
`Type`

Event ID 5127: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] New Local IP: {Addr}.

Message #

[conn][{Connection}] New Local IP: {Addr}

Fields #

Name	Description
`Connection`
`Addr`

Event ID 5128: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] New Remote IP: {Addr}.

Message #

[conn][{Connection}] New Remote IP: {Addr}

Fields #

Name	Description
`Connection`
`Addr`

Event ID 5129: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Removed Local IP: {Addr}.

Message #

[conn][{Connection}] Removed Local IP: {Addr}

Fields #

Name	Description
`Connection`
`Addr`

Event ID 5130: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Removed Remote IP: {Addr}.

Message #

[conn][{Connection}] Removed Remote IP: {Addr}

Fields #

Name	Description
`Connection`
`Addr`

Event ID 5131: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Assigned worker: {Worker}.

Message #

[conn][{Connection}] Assigned worker: {Worker}

Fields #

Name	Description
`Connection`
`Worker`

Event ID 5132: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Handshake start.

Message #

[conn][{Connection}] Handshake start

Fields #

Name	Description
`Connection`

Event ID 5133: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Registered with session: {Session}.

Message #

[conn][{Connection}] Registered with session: {Session}

Fields #

Name	Description
`Connection`
`Session`

Event ID 5134: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Unregistered from session: {Session}.

Message #

[conn][{Connection}] Unregistered from session: {Session}

Fields #

Name	Description
`Connection`
`Session`

Event ID 5135: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Transport Shutdown: {ErrorCode} (Remote={IsRemoteShutdown}) (QS={IsQuicStatus}).

Message #

[conn][{Connection}] Transport Shutdown: {ErrorCode} (Remote={IsRemoteShutdown}) (QS={IsQuicStatus})

Fields #

Name	Description
`Connection`
`ErrorCode`
`IsRemoteShutdown`
`IsQuicStatus`

Event ID 5136: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] App Shutdown: {ErrorCode} (Remote={IsRemoteShutdown}).

Message #

[conn][{Connection}] App Shutdown: {ErrorCode} (Remote={IsRemoteShutdown})

Fields #

Name	Description
`Connection`
`ErrorCode`
`IsRemoteShutdown`

Event ID 5137: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Initialize complete.

Message #

[conn][{Connection}] Initialize complete

Fields #

Name	Description
`Connection`

Event ID 5138: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Handle closed.

Message #

[conn][{Connection}] Handle closed

Fields #

Name	Description
`Connection`

Event ID 5139: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Version = {Value}.

Message #

[conn][{Connection}] Version = {Value}

Fields #

Name	Description
`Connection`
`Value`

Event ID 5140: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Message #

[conn][{Connection}] OUT: BytesSent={BytesSent} InFlight={BytesInFlight} InFlightMax={BytesInFlightMax} CWnd={CongestionWindow} SSThresh={SlowStartThreshold} ConnFC={ConnectionFlowControl} StreamFC={StreamFlowControl} ISB={IdealBytes} PostedBytes={Connection}0 SRtt={Connection}1

Fields #

Name	Description
`Connection`
`BytesSent`
`BytesInFlight`
`BytesInFlightMax`
`CongestionWindow`
`SlowStartThreshold`
`ConnectionFlowControl`
`StreamFlowControl`
`IdealBytes`

Event ID 5141: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Send Blocked Flags: {ReasonFlags}.

Message #

[conn][{Connection}] Send Blocked Flags: {ReasonFlags}

Fields #

Name	Description
`Connection`
`ReasonFlags`

Event ID 5142: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] IN: BytesRecv={BytesReceived}.

Message #

[conn][{Connection}] IN: BytesRecv={BytesReceived}

Fields #

Name	Description
`Connection`
`BytesReceived`

Event ID 5143: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] CUBIC: SlowStartThreshold={SlowStartThreshold} K={K} WindowMax={WindowMax} WindowLastMax={WindowLastMax}.

Message #

[conn][{Connection}] CUBIC: SlowStartThreshold={SlowStartThreshold} K={K} WindowMax={WindowMax} WindowLastMax={WindowLastMax}

Fields #

Name	Description
`Connection`
`SlowStartThreshold`
`K`
`WindowMax`
`WindowLastMax`

Event ID 5144: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Congestion event.

Message #

[conn][{Connection}] Congestion event

Fields #

Name	Description
`Connection`

Event ID 5145: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Persistent congestion event.

Message #

[conn][{Connection}] Persistent congestion event

Fields #

Name	Description
`Connection`

Event ID 5146: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Recovery complete.

Message #

[conn][{Connection}] Recovery complete

Fields #

Name	Description
`Connection`

Event ID 5147: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Rundown; IsServer={IsServer}.

Message #

[conn][{Connection}] Rundown; IsServer={IsServer}

Fields #

Name	Description
`Connection`
`IsServer`

Event ID 5148: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] New Source CID: {Cid}.

Message #

[conn][{Connection}] New Source CID: {Cid}

Fields #

Name	Description
`Connection`
`Cid`

Event ID 5149: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] New Destination CID: {Cid}.

Message #

[conn][{Connection}] New Destination CID: {Cid}

Fields #

Name	Description
`Connection`
`Cid`

Event ID 5150: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Removed Source CID: {Cid}.

Message #

[conn][{Connection}] Removed Source CID: {Cid}

Fields #

Name	Description
`Connection`
`Cid`

Event ID 5151: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Removed Destination CID: {Cid}.

Message #

[conn][{Connection}] Removed Destination CID: {Cid}

Fields #

Name	Description
`Connection`
`Cid`

Event ID 5152: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Setting loss detection {Type} timer for {DelayMs} ms. (ProbeCount={ProbeCount}).

Message #

[conn][{Connection}] Setting loss detection {Type} timer for {DelayMs} ms. (ProbeCount={ProbeCount})

Fields #

Name	Description
`Connection`
`Type`
`DelayMs`
`ProbeCount`

Event ID 5153: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Cancelling loss detection timer.

Message #

[conn][{Connection}] Cancelling loss detection timer.

Fields #

Name	Description
`Connection`

Event ID 5154: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Owner}] DROP packet[{PktNum}] Src={RemoteAddr} Dst={LocalAddr} Reason={Reason}.

Message #

[conn][{Owner}] DROP packet[{PktNum}] Src={RemoteAddr} Dst={LocalAddr} Reason={Reason}.

Fields #

Name	Description
`Owner`
`PktNum`
`RemoteAddr`
`LocalAddr`
`Reason`

Event ID 5155: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Owner}] DROP packet[{PktNum}] Src={RemoteAddr} Dst={LocalAddr} Reason={Reason}; {Value}.

Message #

[conn][{Owner}] DROP packet[{PktNum}] Src={RemoteAddr} Dst={LocalAddr} Reason={Reason}; {Value}.

Fields #

Name	Description
`Owner`
`PktNum`
`RemoteAddr`
`LocalAddr`
`Reason`
`Value`

Event ID 5156: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] ERROR; {ErrStr}.

Message #

[conn][{Connection}] ERROR; {ErrStr}.

Fields #

Name	Description
`Connection`
`ErrStr`

Event ID 5157: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] ERROR; {Status}; {ErrStr}.

Message #

[conn][{Connection}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Connection`
`Status`	NTSTATUS reference
`ErrStr`

Event ID 5158: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] New packet keys created successfully.

Message #

[conn][{Connection}] New packet keys created successfully.

Fields #

Name	Description
`Connection`

Event ID 5159: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Key phase change (locally initiated={IsLocallyInitiated}).

Message #

[conn][{Connection}] Key phase change (locally initiated={IsLocallyInitiated}).

Fields #

Name	Description
`Connection`
`IsLocallyInitiated`

Event ID 5160: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Message #

[conn][{Connection}] STATS: LifeTimeUs={LifeTimeUs} SendTotalPackets={SendTotalPackets} SendSuspectedLostPackets={SendSuspectedLostPackets} SendSpuriousLostPackets={SendSpuriousLostPackets} RecvTotalPackets={RecvTotalPackets} RecvReorderedPackets={RecvReorderedPackets} RecvDroppedPackets={RecvDroppedPackets} RecvDuplicatePackets={RecvDuplicatePackets} RecvDecryptionFailures={Connection}0 CongestionCount={Connection}1 PersistentCongestionCount={Connection}2 SendTotalBytes={Connection}3 RecvTotalBytes={Connection}4

Fields #

Name	Description
`Connection`
`LifeTimeUs`
`SendTotalPackets`
`SendSuspectedLostPackets`
`SendSpuriousLostPackets`
`RecvTotalPackets`
`RecvReorderedPackets`
`RecvDroppedPackets`
`RecvDuplicatePackets`

Event ID 5161: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Shutdown complete; PeerFailedToAcknowledged={Value}.

Message #

[conn][{Connection}] Shutdown complete; PeerFailedToAcknowledged={Value}.

Fields #

Name	Description
`Connection`
`Value`

Event ID 5162: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Read Key Updated; {NewValue}.

Message #

[conn][{Connection}] Read Key Updated; {NewValue}.

Fields #

Name	Description
`Connection`
`NewValue`

Event ID 5163: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Connection}] Write Key Updated; {NewValue}.

Message #

[conn][{Connection}] Write Key Updated; {NewValue}.

Fields #

Name	Description
`Connection`
`NewValue`

Event ID 5164: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Owner}][TX][{Number}] {Type} ({Length} bytes).

Message #

[conn][{Owner}][TX][{Number}] {Type} ({Length} bytes)

Fields #

Name	Description
`Owner`
`Number`
`Type`
`Length`

Event ID 5165: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Owner}][RX][{Number}] {Type} ({Length} bytes).

Message #

[conn][{Owner}][RX][{Number}] {Type} ({Length} bytes)

Fields #

Name	Description
`Owner`
`Number`
`Type`
`Length`

Event ID 5166: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Owner}][TX][{Number}] {Type} Lost: {Reason}.

Message #

[conn][{Owner}][TX][{Number}] {Type} Lost: {Reason}

Fields #

Name	Description
`Owner`
`Number`
`Type`
`Reason`

Event ID 5167: [conn][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[conn][{Owner}][TX][{Number}] {Type} ACKed.

Message #

[conn][{Owner}][TX][{Number}] {Type} ACKed

Fields #

Name	Description
`Owner`
`Number`
`Type`

Event ID 6144: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] Created; Conn={Connection} ID={ID} IsLocal={IsLocalOwned}.

Message #

[strm][{Stream}] Created; Conn={Connection} ID={ID} IsLocal={IsLocalOwned}

Fields #

Name	Description
`Stream`
`Connection`
`ID`
`IsLocalOwned`

Event ID 6145: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] Destroyed.

Message #

[strm][{Stream}] Destroyed

Fields #

Name	Description
`Stream`

Event ID 6146: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] Send Blocked Flags: {ReasonFlags}.

Message #

[strm][{Stream}] Send Blocked Flags: {ReasonFlags}

Fields #

Name	Description
`Stream`
`ReasonFlags`

Event ID 6147: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] Rundown; Conn={Connection} ID={ID} IsLocal={IsLocalOwned}.

Message #

[strm][{Stream}] Rundown; Conn={Connection} ID={ID} IsLocal={IsLocalOwned}

Fields #

Name	Description
`Stream`
`Connection`
`ID`
`IsLocalOwned`

Event ID 6148: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] Send State: {State}.

Message #

[strm][{Stream}] Send State: {State}

Fields #

Name	Description
`Stream`
`State`

Event ID 6149: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] Recv State: {State}.

Message #

[strm][{Stream}] Recv State: {State}

Fields #

Name	Description
`Stream`
`State`

Event ID 6150: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] ERROR; {ErrStr}.

Message #

[strm][{Stream}] ERROR; {ErrStr}.

Fields #

Name	Description
`Stream`
`ErrStr`

Event ID 6151: [strm][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[strm][{Stream}] ERROR; {Status}; {ErrStr}.

Message #

[strm][{Stream}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Stream`
`Status`	NTSTATUS reference
`ErrStr`

Event ID 7168: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Binding}] Created; Udp={DatapathBinding} LocalAddr={LocalAddr} RemoteAddr={RemoteAddr}.

Message #

[bind][{Binding}] Created; Udp={DatapathBinding} LocalAddr={LocalAddr} RemoteAddr={RemoteAddr}

Fields #

Name	Description
`Binding`
`DatapathBinding`
`LocalAddr`
`RemoteAddr`

Event ID 7169: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Binding}] Rundown; Udp={DatapathBinding} LocalAddr={LocalAddr} RemoteAddr={RemoteAddr}.

Message #

[bind][{Binding}] Rundown; Udp={DatapathBinding} LocalAddr={LocalAddr} RemoteAddr={RemoteAddr}

Fields #

Name	Description
`Binding`
`DatapathBinding`
`LocalAddr`
`RemoteAddr`

Event ID 7170: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Binding}] Destroyed.

Message #

[bind][{Binding}] Destroyed

Fields #

Name	Description
`Binding`

Event ID 7171: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Binding}] Cleaning up.

Message #

[bind][{Binding}] Cleaning up

Fields #

Name	Description
`Binding`

Event ID 7172: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Owner}] DROP packet[{PktNum}] Src={RemoteAddr} Dst={LocalAddr} Reason={Reason}.

Message #

[bind][{Owner}] DROP packet[{PktNum}] Src={RemoteAddr} Dst={LocalAddr} Reason={Reason}.

Fields #

Name	Description
`Owner`
`PktNum`
`RemoteAddr`
`LocalAddr`
`Reason`

Event ID 7173: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Owner}] DROP packet[{PktNum}] Src={RemoteAddr} Dst={LocalAddr} Reason={Reason}; {Value}.

Message #

[bind][{Owner}] DROP packet[{PktNum}] Src={RemoteAddr} Dst={LocalAddr} Reason={Reason}; {Value}.

Fields #

Name	Description
`Owner`
`PktNum`
`RemoteAddr`
`LocalAddr`
`Reason`
`Value`

Event ID 7174: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Binding}] ERROR; {ErrStr}.

Message #

[bind][{Binding}] ERROR; {ErrStr}.

Fields #

Name	Description
`Binding`
`ErrStr`

Event ID 7175: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Binding}] ERROR; {Status}; {ErrStr}.

Message #

[bind][{Binding}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Binding`
`Status`	NTSTATUS reference
`ErrStr`

Event ID 7176: [bind][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[bind][{Binding}] Execute: {Type}.

Message #

[bind][{Binding}] Execute: {Type}

Fields #

Name	Description
`Binding`
`Type`

Event ID 8192: [ tls][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ tls][{Connection}] ERROR; {ErrStr}.

Message #

[ tls][{Connection}] ERROR; {ErrStr}.

Fields #

Name	Description
`Connection`
`ErrStr`

Event ID 8193: [ tls][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ tls][{Connection}] ERROR; {Status}; {ErrStr}.

Message #

[ tls][{Connection}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`Connection`
`Status`	NTSTATUS reference
`ErrStr`

Event ID 9215: [mitls] {Message}.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[mitls] {Message}.

Message #

[mitls] {Message}

Fields #

Name	Description
`Message`

Event ID 9216: [ udp][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ udp][{UdpBinding}] Send {TotalSize} bytes in {BufferCount} buffers (segment={SegmentSize}) Dst={RemoteAddr}.

Message #

[ udp][{UdpBinding}] Send {TotalSize} bytes in {BufferCount} buffers (segment={SegmentSize}) Dst={RemoteAddr}

Fields #

Name	Description
`UdpBinding`
`TotalSize`
`BufferCount`
`SegmentSize`
`RemoteAddr`

Event ID 9217: [ udp][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ udp][{UdpBinding}] Send {TotalSize} bytes in {BufferCount} buffers (segment={SegmentSize}) Src={LocalAddr} Dst={RemoteAddr}.

Message #

[ udp][{UdpBinding}] Send {TotalSize} bytes in {BufferCount} buffers (segment={SegmentSize}) Src={LocalAddr} Dst={RemoteAddr}

Fields #

Name	Description
`UdpBinding`
`TotalSize`
`BufferCount`
`SegmentSize`
`LocalAddr`
`RemoteAddr`

Event ID 9218: [ udp][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ udp][{UdpBinding}] Recv {TotalSize} bytes (segment={SegmentSize}) Src={LocalAddrLength} Dst={RemoteAddrLength}.

Message #

[ udp][{UdpBinding}] Recv {TotalSize} bytes (segment={SegmentSize}) Src={LocalAddrLength} Dst={RemoteAddrLength}

Fields #

Name	Description
`UdpBinding`
`TotalSize`
`SegmentSize`
`LocalAddrLength`
`RemoteAddrLength`

Event ID 9219: [ udp][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ udp][{UdpBinding}] ERROR; {ErrStr}.

Message #

[ udp][{UdpBinding}] ERROR; {ErrStr}.

Fields #

Name	Description
`UdpBinding`
`ErrStr`

Event ID 9220: [ udp][.

Provider: Microsoft-Windows-WinQuic
Channel: Operational

Description

[ udp][{UdpBinding}] ERROR; {Status}; {ErrStr}.

Message #

[ udp][{UdpBinding}] ERROR; {Status}; {ErrStr}.

Fields #

Name	Description
`UdpBinding`
`Status`	NTSTATUS reference
`ErrStr`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)