Microsoft-WindowsPhone-CoreMessaging

141 events across 1 channel

Event	Title	Channel	Sample
1000	CoreUI ETW - Initialized (pid=hex).	Unknown	N
1001	CoreUI ETW - Uninitialized (pid=hex).	Unknown	N
1050	CoreUI System - Out of Memory!	Unknown	N
2900	CoreUI Service server-thread started	Unknown	N
2901	CoreUI Service server-thread exiting	Unknown	N
2902	CoreUI InitializeService called	Unknown	N
2903	CoreUI UninitializeService called	Unknown	N
2904	CoreUI ServiceObjectCreated called (serviceType={coreUIServiceType}).	Unknown	N
2905	CoreUI ServiceObjectDestroyed called	Unknown	N
2906	CoreUI UpdateServiceStatus called	Unknown	N
2907	CoreUI ServiceObjectServiceMain called	Unknown	N
2908	CoreUI CoreUI ServiceMain called with unknown service name pwsz.	Unknown	N
3100	Session - CoreUICreate - Start	Unknown	N
3101	Session - CoreUICreate - Stop	Unknown	N
3102	Session_CoreUICreate_InitializeCnContextStart	Unknown	N
3103	Session_CoreUICreate_InitializeCnContextStop	Unknown	N
3106	Session_CoreUICreate_ExportSessionStart	Unknown	N
3107	Session_CoreUICreate_ExportSessionStop	Unknown	N
3110	Session_ConstructThreadContextStart	Unknown	N
3111	Session_ConstructThreadContextStop	Unknown	N
3210	Dispatcher_DispatchLoop	Unknown	Y
3211	Dispatcher_DispatchLoop	Unknown	Y
3214	Dispatcher - DispatchItem - Start (internalPriority=InternalPriority).	Unknown	Y
3215	Dispatcher - DispatchItem - Stop (internalPriority=InternalPriority).	Unknown	Y
3216	Dispatcher - WakeLevel - UpdateWakeLevel (bits=unParam old=InternalPriority …	Unknown	Y
3220	Dispatcher - DoWait - Start (timeout=hex).	Unknown	Y
3221	Dispatcher - DoWait - Stop (status=unParam handle=unParam2).	Unknown	Y
3222	Dispatcher - CallDispatchCallback - Start (awake=fBool reference=unParam).	Unknown	N
3223	Dispatcher - CallDispatchCallback - Stop (timeout=unParam).	Unknown	N
3224	UserAdapter - ScheduleDispatch (threadid=unParam userPriority=UserPriority).	Unknown	N
3225	UserAdapter - HostModeRun - Start (runMode=RunMode stopping=fBool).	Unknown	N
3226	UserAdapter - HostModeRun - Stop	Unknown	N
3227	UserAdapter - OnUserDispatch - Start (priority=UserPriority).	Unknown	N
3228	UserAdapter - OnUserDispatch - Stop.	Unknown	N
3229	UserAdapter - IntegratedLoopWait - Start	Unknown	N
3230	UserAdapter - IntegratedLoopWait - Stop	Unknown	N
3231	UserAdapter - PostMessage - Failed due to post message queue full	Unknown	N
3232	UserAdapter - PostMessage - User failed to schedule an asynchronous …	Unknown	N
3300	RegistrarClient - Initialize - Start	Unknown	N
3301	RegistrarClient - Initialize - Stop	Unknown	N
3310	RegistrarClient_ConnectToRegistrarServerStart	Unknown	N
3311	RegistrarClient_ConnectToRegistrarServerStop	Unknown	N
3400	RemoteRegistrarClient_ConnectStart	Unknown	N
3401	RemoteRegistrarClient_ConnectStop	Unknown	N
3402	RemoteRegistrarClient_RegisterThreadStart	Unknown	N
3403	RemoteRegistrarClient_RegisterThreadStop	Unknown	N
3404	RemoteRegistrarClient_RegisterPortStart	Unknown	N
3405	RemoteRegistrarClient_RegisterPortStop	Unknown	N
3406	RemoteRegistrarClient_UnregisterPortStart	Unknown	N
3407	RemoteRegistrarClient_UnregisterPortStop	Unknown	N
3408	RemoteRegistrarClient_PrepareConnectionStart	Unknown	N
3409	RemoteRegistrarClient_PrepareConnectionStop	Unknown	N
3410	RemoteRegistrarClient_CloseConnectionStart	Unknown	N
3411	RemoteRegistrarClient_CloseConnectionStop	Unknown	N
3412	RemoteRegistrarClient_CompleteCrossProcConnectionStart	Unknown	N
3413	RemoteRegistrarClient_CompleteCrossProcConnectionStop	Unknown	N
3414	RemoteRegistrarClient_CrossProcClientDisconnectedStart	Unknown	N
3415	RemoteRegistrarClient_CrossProcClientDisconnectedStop	Unknown	N
3416	RemoteRegistrarClient_FreeServerGroupIDForClientStart	Unknown	N
3417	RemoteRegistrarClient_FreeServerGroupIDForClientStop	Unknown	N
3418	RemoteRegistrarClient_RegisterObjectStart	Unknown	N
3419	RemoteRegistrarClient_RegisterObjectStop	Unknown	N
3420	RemoteRegistrarClient_UnregisterObjectStart	Unknown	N
3421	RemoteRegistrarClient_UnregisterObjectStop	Unknown	N
3424	RemoteRegistrarClient_FindObjectStart	Unknown	N
3425	RemoteRegistrarClient_FindObjectStop	Unknown	N
3426	RemoteRegistrarClient_CompleteLocalConnectionStart	Unknown	N
3427	RemoteRegistrarClient_CompleteLocalConnectionStop	Unknown	N
3428	RemoteRegistrarClient_LocalClientDisconnectedStart	Unknown	N
3429	RemoteRegistrarClient_LocalClientDisconnectedStop	Unknown	N
3430	RemoteRegistrarClient_GetOrCreateReverseConnectionPortIDStart	Unknown	N
3431	RemoteRegistrarClient_GetOrCreateReverseConnectionPortIDStop	Unknown	N
3432	RemoteRegistrarClient_UnregisterReverseConnectionPortStart	Unknown	N
3433	RemoteRegistrarClient_UnregisterReverseConnectionPortStop	Unknown	N
3436	RemoteRegistrarClient_RegisterConversationStart	Unknown	N
3437	RemoteRegistrarClient_RegisterConversationStop	Unknown	N
3438	RemoteRegistrarClient_ReleaseConversationServerStart	Unknown	N
3439	RemoteRegistrarClient_ReleaseConversationServerStop	Unknown	N
3440	RemoteRegistrarClient_RegisterConversationClientStart	Unknown	N
3441	RemoteRegistrarClient_RegisterConversationClientStop	Unknown	N
3442	RemoteRegistrarClient_ConnectPendingConversationClientStart	Unknown	N
3443	RemoteRegistrarClient_ConnectPendingConversationClientStop	Unknown	N
3444	RemoteRegistrarClient_RegisterPendingConversationClientForServerStart	Unknown	N
3445	RemoteRegistrarClient_RegisterPendingConversationClientForServerStop	Unknown	N
3446	RemoteRegistrarClient_ReleaseConversationClientConnectionStart	Unknown	N
3447	RemoteRegistrarClient_ReleaseConversationClientConnectionStop	Unknown	N
3450	RemoteRegistrarClient_FindPendingConversationClientStart	Unknown	N
3451	RemoteRegistrarClient_FindPendingConversationClientStop	Unknown	N
3452	RemoteRegistrarClient_FindCrossProcConnectionStart	Unknown	N
3453	RemoteRegistrarClient_FindCrossProcConnectionStop	Unknown	N
3454	RemoteRegistrarClient_ReleaseConversationClientStart	Unknown	N
3455	RemoteRegistrarClient_ReleaseConversationClientStop	Unknown	N
3456	RemoteRegistrarClient_ClientConversationAttachedStart	Unknown	N
3457	RemoteRegistrarClient_ClientConversationAttachedStop	Unknown	N
4000	Messaging_ConstructMessageSessionStart	Unknown	N
4001	Messaging_ConstructMessageSessionStop	Unknown	N
4010	Messaging - CreateConnection - Start (destProcessId=unParam; …	Unknown	N
4011	Messaging - CreateConnection - Stop (destProcessId=unParam; …	Unknown	N
4020	Messaging - AllocatedMessage (externalPriority=ExternalPriority; size=unParam; …	Unknown	N
4021	Messaging - Message stream dirty (processId=hex threadId=hex2).	Unknown	N
4022	Messaging - FlushPendingStreams - Start (externalPriority=ExternalPriority).	Unknown	N
4023	Messaging - FlushPendingStreams - Stop	Unknown	N
4030	Messaging_LocalReceiveStart	Unknown	N
4031	Messaging - LocalReceive - Statistics (messages=unParam; size=unParam2).	Unknown	N
4041	Messaging - InterconnectSend - Statistics (buffers=unParam; size=unParam2).	Unknown	N
4042	Messaging - InterconnectFlush - Start (externalPriority=ExternalPriority; …	Unknown	N
4043	Messaging - InterconnectFlush - Stop (externalPriority=ExternalPriority; …	Unknown	N
4044	Messaging_InterconnectReceiveStart	Unknown	N
4045	Messaging - InterconnectReceive - Statistics (senderTid=unParam; …	Unknown	N
4051	Messaging - AlpcSend - Statistics (buffers=unParam; size=unParam2).	Unknown	N
4052	Messaging - AlpcFlush - Start (externalPriority=ExternalPriority; …	Unknown	N
4053	Messaging - AlpcFlush - Stop (externalPriority=ExternalPriority; …	Unknown	N
4054	Messaging_AlpcReceiveStart	Unknown	N
4055	Messaging - AlpcReceive - Statistics (senderPid=unParam; senderTid=unParam2; …	Unknown	N
5050	Formatting - Message Method ({pwsz}).	Unknown	N
5052	Proxy - Message Event ({pwsz}).	Unknown	N
5054	Proxy - Property Update ({pwsz}).	Unknown	N
7000	CoreMessagingRegistrar ObjectRegistered 'pwsz' (type RegisteredObjectType scope …	Unknown	N
7001	CoreMessagingRegistrar ObjectRevoked 'pwsz' (type RegisteredObjectType scope …	Unknown	N
7002	CoreUI server disconnected pid hex tid hex2 id guid.	Unknown	N
7003	Conversation pwsz has run out of PeerID handles to allocate.	Unknown	N
7004	Client connection to conversation 'pwsz' failed, max clients already connected.	Unknown	N
7005	IdentityTable uniqueness bits protected us: index hex requestedUniq hex2 …	Unknown	N
7006	IdentityTable uniqueness bits reached max for slot index {hex}.	Unknown	N
7007	IdentityTable slot {hex} passed over (diff: {hex2}).	Unknown	N
7008	IdentityTable grown to max index {hex} (after {hex2} times through the loop).	Unknown	N
8000	NtAssociateWaitCompletionPacket succeeded: packet ptr1 target ptr2 keyContext …	Unknown	N
8001	NtAssociateWaitCompletionPacket failed, packet ptr1 port ptr2 handle ptr3 status …	Unknown	N
8002	NtCancelWaitCompletionPacket results: packet ptr status hex signaled fBool1 …	Unknown	N
8003	Created RegisteredWait: packet ptr1 target ptr2 cloned fBool.	Unknown	N
8004	UserAdapter HandleCompletion: packet ptr1 target ptr2.	Unknown	N
8005	Calling completion handler: ApcContext ptr1 KeyContext ptr2.	Unknown	N
8006	Removed end of batch completion.	Unknown	N
8007	Removed completion: ApcContext ptr1 KeyContext ptr2.	Unknown	N
20000	CoreUI SelfHostError - ThrownException (type=pwsz; hr=hex; message=pwsz2).	Unknown	N
20001	CoreMessagingRegistrar Object 'pwsz' not found (type=RegisteredObjectType; …	Unknown	N
20002	CoreUI Connection failed to pid hex tid hex2 id guid.	Unknown	N
20003	CoreUI forcibly disconnecting client pid hex tid hex2.	Unknown	N
20004	CoreUI NtAlpcConnectPort 'pwsz' failed with hr=hresult.	Unknown	N
20005	CoreMessagingRegistrar Conversation '{pwsz}' not found.	Unknown	N
20006	CoreUI Conversation ignoring client pid hex errorCode hex2 errorMessage pwsz.	Unknown	N

Event ID 1000: CoreUI ETW - Initialized (pid=hex).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: ETW_Init

Description

CoreUI ETW - Initialized (pid=hex).

Message #

CoreUI ETW - Initialized (pid=%1)

Fields #

Name	Description
`hex` UInt32

Event ID 1001: CoreUI ETW - Uninitialized (pid=hex).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: ETW_Uninit

Description

CoreUI ETW - Uninitialized (pid=hex).

Message #

CoreUI ETW - Uninitialized (pid=%1)

Fields #

Name	Description
`hex` UInt32

Event ID 1050: CoreUI System - Out of Memory!

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: System_OutOfMemory

Description

CoreUI System - Out of Memory!

Message #

CoreUI System - Out of Memory!

Event ID 2900: CoreUI Service server-thread started

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: CoreUIService_ServerThread_Started

Description

CoreUI Service server-thread started.

Message #

CoreUI Service server-thread started

Event ID 2901: CoreUI Service server-thread exiting

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: CoreUIService_ServerThread_Exiting

Description

CoreUI Service server-thread exiting.

Message #

CoreUI Service server-thread exiting

Event ID 2902: CoreUI InitializeService called

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: CoreUIService_InitializeService

Description

CoreUI InitializeService called.

Message #

CoreUI InitializeService called

Event ID 2903: CoreUI UninitializeService called

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: CoreUIService_UninitializeService

Description

CoreUI UninitializeService called.

Message #

CoreUI UninitializeService called

Event ID 2904: CoreUI ServiceObjectCreated called (serviceType={coreUIServiceType}).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown

Description

CoreUI ServiceObjectCreated called (serviceType={coreUIServiceType}).

Message #

CoreUI ServiceObjectCreated called (serviceType={coreUIServiceType})

Fields #

Name	Description
`coreUIServiceType`

Event ID 2905: CoreUI ServiceObjectDestroyed called

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: CoreUIService_ServiceObjectDestroyed

Description

CoreUI ServiceObjectDestroyed called.

Message #

CoreUI ServiceObjectDestroyed called

Event ID 2906: CoreUI UpdateServiceStatus called

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: CoreUIService_UpdateServiceStatus

Description

CoreUI UpdateServiceStatus called.

Message #

CoreUI UpdateServiceStatus called

Event ID 2907: CoreUI ServiceObjectServiceMain called

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: CoreUIService_ServiceObjectServiceMain

Description

CoreUI ServiceObjectServiceMain called.

Message #

CoreUI ServiceObjectServiceMain called

Event ID 2908: CoreUI CoreUI ServiceMain called with unknown service name pwsz.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: CoreUIService_CoreUIServiceMain_UnknownService

Description

CoreUI CoreUI ServiceMain called with unknown service name pwsz.

Message #

CoreUI CoreUI ServiceMain called with unknown service name %1

Fields #

Name	Description
`pwsz` UnicodeString

Event ID 3100: Session - CoreUICreate - Start

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Session_CoreUICreate
Opcode: Start

Description

Session - CoreUICreate - Start.

Message #

Session - CoreUICreate - Start

Event ID 3101: Session - CoreUICreate - Stop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Session_CoreUICreate
Opcode: Stop

Description

Session - CoreUICreate - Stop.

Message #

Session - CoreUICreate - Stop

Event ID 3102: Session_CoreUICreate_InitializeCnContextStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Session_CoreUICreate_InitializeCnContext
Opcode: Start

Event ID 3103: Session_CoreUICreate_InitializeCnContextStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Session_CoreUICreate_InitializeCnContext
Opcode: Stop

Event ID 3106: Session_CoreUICreate_ExportSessionStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Session_CoreUICreate_ExportSession
Opcode: Start

Event ID 3107: Session_CoreUICreate_ExportSessionStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Session_CoreUICreate_ExportSession
Opcode: Stop

Event ID 3110: Session_ConstructThreadContextStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Session_ConstructThreadContext
Opcode: Start

Event ID 3111: Session_ConstructThreadContextStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Session_ConstructThreadContext
Opcode: Stop

Event ID 3210: Dispatcher_DispatchLoop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Level: Verbose
Task: Dispatcher_DispatchLoop
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3210,
    "version": 0,
    "level": 5,
    "task": 50,
    "opcode": 1,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Dispatcher_DispatchLoop"
}

Event ID 3211: Dispatcher_DispatchLoop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Level: Verbose
Task: Dispatcher_DispatchLoop
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3211,
    "version": 0,
    "level": 5,
    "task": 50,
    "opcode": 2,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Dispatcher_DispatchLoop"
}

Event ID 3214: Dispatcher - DispatchItem - Start (internalPriority=InternalPriority).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Also via: realtime ETW trace
Level: Verbose
Task: Dispatcher_DispatchItem
Opcode: Start

Description

Dispatcher - DispatchItem - Start (internalPriority=InternalPriority).

Message #

Dispatcher - DispatchItem - Start (internalPriority=%1)

Fields #

Name	Description
`InternalPriority` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3214,
    "version": 0,
    "level": 5,
    "task": 51,
    "opcode": 1,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "InternalPriority": 2
  },
  "message": "Dispatcher_DispatchItem"
}

Event ID 3215: Dispatcher - DispatchItem - Stop (internalPriority=InternalPriority).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Also via: realtime ETW trace
Level: Verbose
Task: Dispatcher_DispatchItem
Opcode: Stop

Description

Dispatcher - DispatchItem - Stop (internalPriority=InternalPriority).

Message #

Dispatcher - DispatchItem - Stop (internalPriority=%1)

Fields #

Name	Description
`InternalPriority` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3215,
    "version": 0,
    "level": 5,
    "task": 51,
    "opcode": 2,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "InternalPriority": 0
  },
  "message": "Dispatcher_DispatchItem"
}

Event ID 3216: Dispatcher - WakeLevel - UpdateWakeLevel (bits=unParam old=InternalPriority new=InternalPriority2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Also via: realtime ETW trace
Level: Verbose
Task: Dispatcher_WakeLevel_UpdateWakeLevel
Opcode: win:Info

Description

Dispatcher - WakeLevel - UpdateWakeLevel (bits=unParam old=InternalPriority new=InternalPriority2).

Message #

Dispatcher - WakeLevel - UpdateWakeLevel (bits=%1 old=%2 new=%3)

Fields #

Name	Description
`unParam` UInt32
`InternalPriority` UInt32
`InternalPriority2` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3216,
    "version": 0,
    "level": 5,
    "task": 52,
    "opcode": 0,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "InternalPriority": 0,
    "InternalPriority2": 2,
    "unParam": 4
  },
  "message": "Dispatcher_WakeLevel_UpdateWakeLevel"
}

Event ID 3220: Dispatcher - DoWait - Start (timeout=hex).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Also via: realtime ETW trace
Level: Verbose
Task: Dispatcher_DoWait
Opcode: Start

Description

Dispatcher - DoWait - Start (timeout=hex).

Message #

Dispatcher - DoWait - Start (timeout=%1)

Fields #

Name	Description
`hex` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3220,
    "version": 0,
    "level": 5,
    "task": 53,
    "opcode": 1,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "hex": 0
  },
  "message": "Dispatcher_DoWait"
}

Event ID 3221: Dispatcher - DoWait - Stop (status=unParam handle=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Also via: realtime ETW trace
Level: Verbose
Task: Dispatcher_DoWait
Opcode: Stop

Description

Dispatcher - DoWait - Stop (status=unParam handle=unParam2).

Message #

Dispatcher - DoWait - Stop (status=%1 handle=%2)

Fields #

Name	Description
`unParam` UInt32
`unParam2` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3221,
    "version": 0,
    "level": 5,
    "task": 53,
    "opcode": 2,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.704+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "unParam": 43963,
    "unParam2": 0
  },
  "message": "Dispatcher_DoWait"
}

Event ID 3222: Dispatcher - CallDispatchCallback - Start (awake=fBool reference=unParam).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Dispatcher_CallDispatchCallback
Opcode: Start

Description

Dispatcher - CallDispatchCallback - Start (awake=fBool reference=unParam).

Message #

Dispatcher - CallDispatchCallback - Start (awake=%1 reference=%2)

Fields #

Name	Description
`fBool` Boolean
`unParam` UInt64

Event ID 3223: Dispatcher - CallDispatchCallback - Stop (timeout=unParam).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Dispatcher_CallDispatchCallback
Opcode: Stop

Description

Dispatcher - CallDispatchCallback - Stop (timeout=unParam).

Message #

Dispatcher - CallDispatchCallback - Stop            (timeout=%1)

Fields #

Name	Description
`unParam` UInt64

Event ID 3224: UserAdapter - ScheduleDispatch (threadid=unParam userPriority=UserPriority).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_ScheduleDispatch

Description

UserAdapter - ScheduleDispatch (threadid=unParam userPriority=UserPriority).

Message #

UserAdapter - ScheduleDispatch (threadid=%1 userPriority=%2)

Fields #

Name	Description
`unParam` UInt32
`UserPriority` UInt32

Event ID 3225: UserAdapter - HostModeRun - Start (runMode=RunMode stopping=fBool).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_HostModeRun
Opcode: Start

Description

UserAdapter - HostModeRun - Start (runMode=RunMode stopping=fBool).

Message #

UserAdapter - HostModeRun - Start (runMode=%1 stopping=%2)

Fields #

Name	Description
`RunMode` UInt32
`fBool` Boolean

Event ID 3226: UserAdapter - HostModeRun - Stop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_HostModeRun
Opcode: Stop

Description

UserAdapter - HostModeRun - Stop.

Message #

UserAdapter - HostModeRun - Stop

Event ID 3227: UserAdapter - OnUserDispatch - Start (priority=UserPriority).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_OnUserDispatch
Opcode: Start

Description

UserAdapter - OnUserDispatch - Start (priority=UserPriority).

Message #

UserAdapter - OnUserDispatch - Start (priority=%1)

Fields #

Name	Description
`UserPriority` UInt32

Event ID 3228: UserAdapter - OnUserDispatch - Stop.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_OnUserDispatch
Opcode: Stop

Description

UserAdapter - OnUserDispatch - Stop (discarded? fBool).

Message #

UserAdapter - OnUserDispatch - Stop (discarded? %1)

Fields #

Name	Description
`fBool` Boolean

Event ID 3229: UserAdapter - IntegratedLoopWait - Start

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_IntegratedLoopWait
Opcode: Start

Description

UserAdapter - IntegratedLoopWait - Start.

Message #

UserAdapter - IntegratedLoopWait - Start

Event ID 3230: UserAdapter - IntegratedLoopWait - Stop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_IntegratedLoopWait
Opcode: Stop

Description

UserAdapter - IntegratedLoopWait - Stop.

Message #

UserAdapter - IntegratedLoopWait - Stop

Event ID 3231: UserAdapter - PostMessage - Failed due to post message queue full

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_PostMessageError_QueueFull

Description

UserAdapter - PostMessage - Failed due to post message queue full.

Message #

UserAdapter - PostMessage - Failed due to post message queue full

Event ID 3232: UserAdapter - PostMessage - User failed to schedule an asynchronous DISPATCHNOTIFY_COMPLETION

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Adapter_KernelPostMessageError

Description

UserAdapter - PostMessage - User failed to schedule an asynchronous DISPATCHNOTIFY_COMPLETION.

Message #

UserAdapter - PostMessage - User failed to schedule an asynchronous DISPATCHNOTIFY_COMPLETION

Event ID 3300: RegistrarClient - Initialize - Start

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RegistrarClient_Initialize
Opcode: Start

Description

RegistrarClient - Initialize - Start.

Message #

RegistrarClient - Initialize - Start

Event ID 3301: RegistrarClient - Initialize - Stop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RegistrarClient_Initialize
Opcode: Stop

Description

RegistrarClient - Initialize - Stop.

Message #

RegistrarClient - Initialize - Stop

Event ID 3310: RegistrarClient_ConnectToRegistrarServerStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RegistrarClient_ConnectToRegistrarServer
Opcode: Start

Event ID 3311: RegistrarClient_ConnectToRegistrarServerStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RegistrarClient_ConnectToRegistrarServer
Opcode: Stop

Event ID 3400: RemoteRegistrarClient_ConnectStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_Connect
Opcode: Start

Event ID 3401: RemoteRegistrarClient_ConnectStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_Connect
Opcode: Stop

Event ID 3402: RemoteRegistrarClient_RegisterThreadStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterThread
Opcode: Start

Event ID 3403: RemoteRegistrarClient_RegisterThreadStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterThread
Opcode: Stop

Event ID 3404: RemoteRegistrarClient_RegisterPortStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterPort
Opcode: Start

Event ID 3405: RemoteRegistrarClient_RegisterPortStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterPort
Opcode: Stop

Event ID 3406: RemoteRegistrarClient_UnregisterPortStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_UnregisterPort
Opcode: Start

Event ID 3407: RemoteRegistrarClient_UnregisterPortStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_UnregisterPort
Opcode: Stop

Event ID 3408: RemoteRegistrarClient_PrepareConnectionStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_PrepareConnection
Opcode: Start

Event ID 3409: RemoteRegistrarClient_PrepareConnectionStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_PrepareConnection
Opcode: Stop

Event ID 3410: RemoteRegistrarClient_CloseConnectionStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_CloseConnection
Opcode: Start

Event ID 3411: RemoteRegistrarClient_CloseConnectionStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_CloseConnection
Opcode: Stop

Event ID 3412: RemoteRegistrarClient_CompleteCrossProcConnectionStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_CompleteCrossProcConnection
Opcode: Start

Event ID 3413: RemoteRegistrarClient_CompleteCrossProcConnectionStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_CompleteCrossProcConnection
Opcode: Stop

Event ID 3414: RemoteRegistrarClient_CrossProcClientDisconnectedStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_CrossProcClientDisconnected
Opcode: Start

Event ID 3415: RemoteRegistrarClient_CrossProcClientDisconnectedStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_CrossProcClientDisconnected
Opcode: Stop

Event ID 3416: RemoteRegistrarClient_FreeServerGroupIDForClientStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_FreeServerGroupIDForClient
Opcode: Start

Event ID 3417: RemoteRegistrarClient_FreeServerGroupIDForClientStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_FreeServerGroupIDForClient
Opcode: Stop

Event ID 3418: RemoteRegistrarClient_RegisterObjectStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterObject
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString

Event ID 3419: RemoteRegistrarClient_RegisterObjectStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterObject
Opcode: Stop

Event ID 3420: RemoteRegistrarClient_UnregisterObjectStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_UnregisterObject
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString

Event ID 3421: RemoteRegistrarClient_UnregisterObjectStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_UnregisterObject
Opcode: Stop

Event ID 3424: RemoteRegistrarClient_FindObjectStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_FindObject
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString

Event ID 3425: RemoteRegistrarClient_FindObjectStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_FindObject
Opcode: Stop

Event ID 3426: RemoteRegistrarClient_CompleteLocalConnectionStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_CompleteLocalConnection
Opcode: Start

Event ID 3427: RemoteRegistrarClient_CompleteLocalConnectionStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_CompleteLocalConnection
Opcode: Stop

Event ID 3428: RemoteRegistrarClient_LocalClientDisconnectedStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_LocalClientDisconnected
Opcode: Start

Event ID 3429: RemoteRegistrarClient_LocalClientDisconnectedStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_LocalClientDisconnected
Opcode: Stop

Event ID 3430: RemoteRegistrarClient_GetOrCreateReverseConnectionPortIDStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_GetOrCreateReverseConnectionPortID
Opcode: Start

Event ID 3431: RemoteRegistrarClient_GetOrCreateReverseConnectionPortIDStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_GetOrCreateReverseConnectionPortID
Opcode: Stop

Event ID 3432: RemoteRegistrarClient_UnregisterReverseConnectionPortStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_UnregisterReverseConnectionPort
Opcode: Start

Event ID 3433: RemoteRegistrarClient_UnregisterReverseConnectionPortStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_UnregisterReverseConnectionPort
Opcode: Stop

Event ID 3436: RemoteRegistrarClient_RegisterConversationStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterConversation
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString

Event ID 3437: RemoteRegistrarClient_RegisterConversationStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterConversation
Opcode: Stop

Event ID 3438: RemoteRegistrarClient_ReleaseConversationServerStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ReleaseConversationServer
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString
`unParam` UInt32

Event ID 3439: RemoteRegistrarClient_ReleaseConversationServerStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ReleaseConversationServer
Opcode: Stop

Event ID 3440: RemoteRegistrarClient_RegisterConversationClientStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterConversationClient
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString

Event ID 3441: RemoteRegistrarClient_RegisterConversationClientStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterConversationClient
Opcode: Stop

Event ID 3442: RemoteRegistrarClient_ConnectPendingConversationClientStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ConnectPendingConversationClient
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString
`unParam` UInt32
`unParam2` UInt64

Event ID 3443: RemoteRegistrarClient_ConnectPendingConversationClientStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ConnectPendingConversationClient
Opcode: Stop

Event ID 3444: RemoteRegistrarClient_RegisterPendingConversationClientForServerStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterPendingConversationClientForServer
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString
`unParam` UInt32
`unParam2` UInt32

Event ID 3445: RemoteRegistrarClient_RegisterPendingConversationClientForServerStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_RegisterPendingConversationClientForServer
Opcode: Stop

Event ID 3446: RemoteRegistrarClient_ReleaseConversationClientConnectionStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ReleaseConversationClientConnection
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString
`unParam` UInt32
`unParam2` UInt32
`unParam3` UInt32

Event ID 3447: RemoteRegistrarClient_ReleaseConversationClientConnectionStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ReleaseConversationClientConnection
Opcode: Stop

Event ID 3450: RemoteRegistrarClient_FindPendingConversationClientStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_FindPendingConversationClient
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString
`unParam` UInt32
`unParam2` UInt64

Event ID 3451: RemoteRegistrarClient_FindPendingConversationClientStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_FindPendingConversationClient
Opcode: Stop

Event ID 3452: RemoteRegistrarClient_FindCrossProcConnectionStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_FindCrossProcConnection
Opcode: Start

Event ID 3453: RemoteRegistrarClient_FindCrossProcConnectionStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_FindCrossProcConnection
Opcode: Stop

Event ID 3454: RemoteRegistrarClient_ReleaseConversationClientStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ReleaseConversationClient
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString
`unParam` UInt32

Event ID 3455: RemoteRegistrarClient_ReleaseConversationClientStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ReleaseConversationClient
Opcode: Stop

Event ID 3456: RemoteRegistrarClient_ClientConversationAttachedStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ClientConversationAttached
Opcode: Start

Fields #

Name	Description
`pwsz` UnicodeString
`unParam` UInt32
`unParam2` UInt32

Event ID 3457: RemoteRegistrarClient_ClientConversationAttachedStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: RemoteRegistrarClient_ClientConversationAttached
Opcode: Stop

Event ID 4000: Messaging_ConstructMessageSessionStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_ConstructMessageSession
Opcode: Start

Event ID 4001: Messaging_ConstructMessageSessionStop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_ConstructMessageSession
Opcode: Stop

Event ID 4010: Messaging - CreateConnection - Start (destProcessId=unParam; destThreadId=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_CreateConnection
Opcode: Start

Description

Messaging - CreateConnection - Start (destProcessId=unParam; destThreadId=unParam2).

Message #

Messaging - CreateConnection - Start (destProcessId=%1; destThreadId=%2)

Fields #

Name	Description
`unParam` UInt32
`unParam2` UInt32

Event ID 4011: Messaging - CreateConnection - Stop (destProcessId=unParam; destThreadId=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_CreateConnection
Opcode: Stop

Description

Messaging - CreateConnection - Stop (destProcessId=unParam; destThreadId=unParam2).

Message #

Messaging - CreateConnection - Stop (destProcessId=%1; destThreadId=%2)

Fields #

Name	Description
`unParam` UInt32
`unParam2` UInt32

Event ID 4020: Messaging - AllocatedMessage (externalPriority=ExternalPriority; size=unParam; destProcessId=hex; destThreadId=hex2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_AllocatedMessage

Description

Messaging - AllocatedMessage (externalPriority=ExternalPriority; size=unParam; destProcessId=hex; destThreadId=hex2).

Message #

Messaging - AllocatedMessage (externalPriority=%1; size=%2; destProcessId=%3; destThreadId=%4)

Fields #

Name	Description
`ExternalPriority` UInt32
`unParam` UInt32
`hex` UInt32
`hex2` UInt32

Event ID 4021: Messaging - Message stream dirty (processId=hex threadId=hex2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_StreamDirty

Description

Messaging - Message stream dirty (processId=hex threadId=hex2).

Message #

Messaging - Message stream dirty (processId=%1 threadId=%2)

Fields #

Name	Description
`hex` UInt32
`hex2` UInt32

Event ID 4022: Messaging - FlushPendingStreams - Start (externalPriority=ExternalPriority).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_FlushPendingStreams
Opcode: Start

Description

Messaging - FlushPendingStreams - Start (externalPriority=ExternalPriority).

Message #

Messaging - FlushPendingStreams - Start (externalPriority=%1)

Fields #

Name	Description
`ExternalPriority` UInt32

Event ID 4023: Messaging - FlushPendingStreams - Stop

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_FlushPendingStreams
Opcode: Stop

Description

Messaging - FlushPendingStreams - Stop.

Message #

Messaging - FlushPendingStreams - Stop

Event ID 4030: Messaging_LocalReceiveStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_LocalReceive
Opcode: Start

Event ID 4031: Messaging - LocalReceive - Statistics (messages=unParam; size=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_LocalReceive
Opcode: Stop

Description

Messaging - LocalReceive - Statistics (messages=unParam; size=unParam2).

Message #

Messaging - LocalReceive - Statistics (messages=%1; size=%2)

Fields #

Name	Description
`unParam` UInt32
`unParam2` UInt32

Event ID 4041: Messaging - InterconnectSend - Statistics (buffers=unParam; size=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_InterconnectSend

Description

Messaging - InterconnectSend - Statistics (buffers=unParam; size=unParam2).

Message #

Messaging - InterconnectSend - Statistics (buffers=%1; size=%2)

Fields #

Name	Description
`unParam` UInt32
`unParam2` UInt32

Event ID 4042: Messaging - InterconnectFlush - Start (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_InterconnectFlush
Opcode: Start

Description

Messaging - InterconnectFlush - Start (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

Message #

Messaging - InterconnectFlush - Start (externalPriority=%1; destProcessId=%2; destThreadId=%3)

Fields #

Name	Description
`ExternalPriority` UInt32
`unParam` UInt32
`unParam2` UInt32

Event ID 4043: Messaging - InterconnectFlush - Stop (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_InterconnectFlush
Opcode: Stop

Description

Messaging - InterconnectFlush - Stop (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

Message #

Messaging - InterconnectFlush - Stop (externalPriority=%1; destProcessId=%2; destThreadId=%3)

Fields #

Name	Description
`ExternalPriority` UInt32
`unParam` UInt32
`unParam2` UInt32

Event ID 4044: Messaging_InterconnectReceiveStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_InterconnectReceive
Opcode: Start

Event ID 4045: Messaging - InterconnectReceive - Statistics (senderTid=unParam; messages=unParam2; size=unParam3).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_InterconnectReceive
Opcode: Stop

Description

Messaging - InterconnectReceive - Statistics (senderTid=unParam; messages=unParam2; size=unParam3).

Message #

Messaging - InterconnectReceive - Statistics (senderTid=%1; messages=%2; size=%3)

Fields #

Name	Description
`unParam` UInt32
`unParam2` UInt32
`unParam3` UInt32

Event ID 4051: Messaging - AlpcSend - Statistics (buffers=unParam; size=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_AlpcSend

Description

Messaging - AlpcSend - Statistics (buffers=unParam; size=unParam2).

Message #

Messaging - AlpcSend - Statistics (buffers=%1; size=%2)

Fields #

Name	Description
`unParam` UInt32
`unParam2` UInt32

Event ID 4052: Messaging - AlpcFlush - Start (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_AlpcFlush
Opcode: Start

Description

Messaging - AlpcFlush - Start (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

Message #

Messaging - AlpcFlush - Start (externalPriority=%1; destProcessId=%2; destThreadId=%3)

Fields #

Name	Description
`ExternalPriority` UInt32
`unParam` UInt32
`unParam2` UInt32

Event ID 4053: Messaging - AlpcFlush - Stop (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_AlpcFlush
Opcode: Stop

Description

Messaging - AlpcFlush - Stop (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

Message #

Messaging - AlpcFlush - Stop (externalPriority=%1; destProcessId=%2; destThreadId=%3)

Fields #

Name	Description
`ExternalPriority` UInt32
`unParam` UInt32
`unParam2` UInt32

Event ID 4054: Messaging_AlpcReceiveStart

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_AlpcReceive
Opcode: Start

Event ID 4055: Messaging - AlpcReceive - Statistics (senderPid=unParam; senderTid=unParam2; messages=unParam3; size=unParam4).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: Messaging_AlpcReceive
Opcode: Stop

Description

Messaging - AlpcReceive - Statistics (senderPid=unParam; senderTid=unParam2; messages=unParam3; size=unParam4).

Message #

Messaging - AlpcReceive - Statistics (senderPid=%1; senderTid=%2; messages=%3; size=%4)

Fields #

Name	Description
`unParam` UInt32
`unParam2` UInt32
`unParam3` UInt32
`unParam4` UInt32

Event ID 5050: Formatting - Message Method ({pwsz}).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown

Description

Formatting - Message Method ({pwsz}).

Message #

Formatting - Message Method ({pwsz})

Fields #

Name	Description
`pwsz`

Event ID 5052: Proxy - Message Event ({pwsz}).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown

Description

Proxy - Message Event ({pwsz}).

Message #

Proxy - Message Event ({pwsz})

Fields #

Name	Description
`pwsz`

Event ID 5054: Proxy - Property Update ({pwsz}).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown

Description

Proxy - Property Update ({pwsz}).

Message #

Proxy - Property Update ({pwsz})

Fields #

Name	Description
`pwsz`

Event ID 7000: CoreMessagingRegistrar ObjectRegistered 'pwsz' (type RegisteredObjectType scope RegistrarScope session hex pid hex2 tid hex3).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostInfo_ObjectRegistered

Description

CoreMessagingRegistrar ObjectRegistered 'pwsz' (type RegisteredObjectType scope RegistrarScope session hex pid hex2 tid hex3).

Message #

CoreMessagingRegistrar ObjectRegistered '%1' (type %2 scope %3 session %4 pid %5 tid %6)

Fields #

Name	Description
`pwsz` UnicodeString
`RegisteredObjectType` UInt32
`RegistrarScope` UInt32
`hex` UInt32
`hex2` UInt32
`hex3` UInt32

Event ID 7001: CoreMessagingRegistrar ObjectRevoked 'pwsz' (type RegisteredObjectType scope RegistrarScope session hex pid hex2 tid hex3 Orphaned=fBool).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostInfo_ObjectRevoked

Description

CoreMessagingRegistrar ObjectRevoked 'pwsz' (type RegisteredObjectType scope RegistrarScope session hex pid hex2 tid hex3 Orphaned=fBool).

Message #

CoreMessagingRegistrar ObjectRevoked '%1' (type %2 scope %3 session %4 pid %5 tid %6 Orphaned=%7)

Fields #

Name	Description
`pwsz` UnicodeString
`RegisteredObjectType` UInt32
`RegistrarScope` UInt32
`hex` UInt32
`hex2` UInt32
`hex3` UInt32
`fBool` Boolean

Event ID 7002: CoreUI server disconnected pid hex tid hex2 id guid.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostInfo_ConnectionSevered

Description

CoreUI server disconnected pid hex tid hex2 id guid.

Message #

CoreUI server disconnected pid %1 tid %2 id %3

Fields #

Name	Description
`hex` UInt32
`hex2` UInt32
`guid` GUID

Event ID 7003: Conversation pwsz has run out of PeerID handles to allocate.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostInfo_OutOfConversationPeerHandles

Description

Conversation pwsz has run out of PeerID handles to allocate.

Message #

Conversation %1 has run out of PeerID handles to allocate

Fields #

Name	Description
`pwsz` UnicodeString

Event ID 7004: Client connection to conversation 'pwsz' failed, max clients already connected.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostInfo_MaxConversationClientsConnected

Description

Client connection to conversation 'pwsz' failed, max clients already connected.

Message #

Client connection to conversation '%1' failed, max clients already connected

Fields #

Name	Description
`pwsz` UnicodeString

Event ID 7005: IdentityTable uniqueness bits protected us: index hex requestedUniq hex2 currentUniq hex3.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostInfo_UniquenessProtectedUs

Description

IdentityTable uniqueness bits protected us: index hex requestedUniq hex2 currentUniq hex3.

Message #

IdentityTable uniqueness bits protected us: index %1  requestedUniq %2  currentUniq %3

Fields #

Name	Description
`hex` UInt32
`hex2` UInt32
`hex3` UInt32

Event ID 7006: IdentityTable uniqueness bits reached max for slot index {hex}.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown

Description

IdentityTable uniqueness bits reached max for slot index {hex}.

Message #

IdentityTable uniqueness bits reached max for slot index {hex}

Fields #

Name	Description
`hex`

Event ID 7007: IdentityTable slot {hex} passed over (diff: {hex2}).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown

Description

IdentityTable slot {hex} passed over (diff: {hex2}).

Message #

IdentityTable slot {hex} passed over (diff: {hex2})

Fields #

Name	Description
`hex`
`hex2`

Event ID 7008: IdentityTable grown to max index {hex} (after {hex2} times through the loop).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown

Description

IdentityTable grown to max index {hex} (after {hex2} times through the loop).

Message #

IdentityTable grown to max index {hex} (after {hex2} times through the loop).

Fields #

Name	Description
`hex`
`hex2`

Event ID 8000: NtAssociateWaitCompletionPacket succeeded: packet ptr1 target ptr2 keyContext ptr3 apcContext ptr4.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: IoCompletionPort

Description

NtAssociateWaitCompletionPacket succeeded: packet ptr1 target ptr2 keyContext ptr3 apcContext ptr4.

Message #

NtAssociateWaitCompletionPacket succeeded: packet %1 target %2 keyContext %3 apcContext %4

Fields #

Name	Description
`ptr1` Pointer
`ptr2` Pointer
`ptr3` Pointer
`ptr4` Pointer

Event ID 8001: NtAssociateWaitCompletionPacket failed, packet ptr1 port ptr2 handle ptr3 status hex.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: IoCompletionPort

Description

NtAssociateWaitCompletionPacket failed, packet ptr1 port ptr2 handle ptr3 status hex.

Message #

NtAssociateWaitCompletionPacket failed, packet %1 port %2 handle %3 status %4

Fields #

Name	Description
`ptr1` Pointer
`ptr2` Pointer
`ptr3` Pointer
`hex` UInt32

Event ID 8002: NtCancelWaitCompletionPacket results: packet ptr status hex signaled fBool1 canceled fBool2.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: IoCompletionPort

Description

NtCancelWaitCompletionPacket results: packet ptr status hex signaled fBool1 canceled fBool2.

Message #

NtCancelWaitCompletionPacket results: packet %1 status %2 signaled %3 canceled %4

Fields #

Name	Description
`ptr` Pointer
`hex` UInt32
`fBool1` Boolean
`fBool2` Boolean

Event ID 8003: Created RegisteredWait: packet ptr1 target ptr2 cloned fBool.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: IoCompletionPort

Description

Created RegisteredWait: packet ptr1 target ptr2 cloned fBool.

Message #

Created RegisteredWait: packet %1 target %2 cloned %3

Fields #

Name	Description
`ptr1` Pointer
`ptr2` Pointer
`fBool` Boolean

Event ID 8004: UserAdapter HandleCompletion: packet ptr1 target ptr2.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: IoCompletionPort

Description

UserAdapter HandleCompletion: packet ptr1 target ptr2.

Message #

UserAdapter HandleCompletion: packet %1 target %2

Fields #

Name	Description
`ptr1` Pointer
`ptr2` Pointer

Event ID 8005: Calling completion handler: ApcContext ptr1 KeyContext ptr2.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: IoCompletionPort

Description

Calling completion handler: ApcContext ptr1 KeyContext ptr2.

Message #

Calling completion handler: ApcContext %1 KeyContext %2

Fields #

Name	Description
`ptr1` Pointer
`ptr2` Pointer

Event ID 8006: Removed end of batch completion.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: IoCompletionPort

Description

Removed end of batch completion.

Message #

Removed end of batch completion.

Event ID 8007: Removed completion: ApcContext ptr1 KeyContext ptr2.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: IoCompletionPort

Description

Removed completion: ApcContext ptr1 KeyContext ptr2.

Message #

Removed completion: ApcContext %1 KeyContext %2

Fields #

Name	Description
`ptr1` Pointer
`ptr2` Pointer

Event ID 20000: CoreUI SelfHostError - ThrownException (type=pwsz; hr=hex; message=pwsz2).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostError_ThrownException

Description

CoreUI SelfHostError - ThrownException (type=pwsz; hr=hex; message=pwsz2).

Message #

CoreUI SelfHostError - ThrownException (type=%1; hr=%2; message=%3)

Fields #

Name	Description
`pwsz` UnicodeString
`hex` UInt32
`pwsz2` UnicodeString

Event ID 20001: CoreMessagingRegistrar Object 'pwsz' not found (type=RegisteredObjectType; scope=RegistrarScope).

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostError_ObjectNotFound

Description

CoreMessagingRegistrar Object 'pwsz' not found (type=RegisteredObjectType; scope=RegistrarScope).

Message #

CoreMessagingRegistrar Object '%1' not found (type=%2; scope=%3)

Fields #

Name	Description
`pwsz` UnicodeString
`RegisteredObjectType` UInt32
`RegistrarScope` UInt32

Event ID 20002: CoreUI Connection failed to pid hex tid hex2 id guid.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostError_ConnectionFailed

Description

CoreUI Connection failed to pid hex tid hex2 id guid.

Message #

CoreUI Connection failed to pid %1 tid %2 id %3

Fields #

Name	Description
`hex` UInt32
`hex2` UInt32
`guid` GUID

Event ID 20003: CoreUI forcibly disconnecting client pid hex tid hex2.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostError_DisconnectClient

Description

CoreUI forcibly disconnecting client pid hex tid hex2.

Message #

CoreUI forcibly disconnecting client pid %1 tid %2

Fields #

Name	Description
`hex` UInt32
`hex2` UInt32

Event ID 20004: CoreUI NtAlpcConnectPort 'pwsz' failed with hr=hresult.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostError_AlpcConnectionFailed

Description

CoreUI NtAlpcConnectPort 'pwsz' failed with hr=hresult.

Message #

CoreUI NtAlpcConnectPort '%1' failed with hr=%2

Fields #

Name	Description
`pwsz` UnicodeString
`hresult` Int32

Event ID 20005: CoreMessagingRegistrar Conversation '{pwsz}' not found.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown

Description

CoreMessagingRegistrar Conversation '{pwsz}' not found.

Message #

CoreMessagingRegistrar Conversation '{pwsz}' not found

Fields #

Name	Description
`pwsz`

Event ID 20006: CoreUI Conversation ignoring client pid hex errorCode hex2 errorMessage pwsz.

Provider: Microsoft-WindowsPhone-CoreMessaging
Channel: Unknown
Task: SelfHostError_ConversationPeerSoftBlocked

Description

CoreUI Conversation ignoring client pid hex errorCode hex2 errorMessage pwsz.

Message #

CoreUI Conversation ignoring client pid %1 errorCode %2 errorMessage %3

Fields #

Name	Description
`hex` UInt32
`hex2` UInt32
`pwsz` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {922CDCF3-6123-42DA-A877-1A24F23E39C5}

Defined in CoreMessaging.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.3692, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3692, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)