OfficeLoggingLiblet

Event	Title	Channel	Sample	Rule
100	etwtaskLogging	General Logging	Y	N
101	etwtaskLogging101	General Logging	Y	N
102	etwtaskLogging102	General Logging	Y	N
103	etwtaskLogging103	General Logging	Y	N
104	etwtaskLogging104	General Logging	Y	N
105	Mso Logging Scope start event.	General Logging	Y	N
106	Mso Logging Scope short stop event.	General Logging	Y	N
107	Mso Logging Scope long stop event.	General Logging	Y	N
108	Mso Scenario start event.	General Logging	Y	N
109	Mso Scenario short stop event.	General Logging	Y	N
110	Mso Scenario long stop event.	General Logging	Y	N
200	ResouceUsagetask	General Logging	Y	N
201	ResouceUsagetask201	General Logging	Y	N
202	ResouceUsagetask202	General Logging	Y	N
1000	ResouceUsagetask1000	General Logging	Y	N
1001	ResouceUsagetask1001	General Logging	Y	N
1002	ResouceUsagetask1002	General Logging	Y	N
1003	ResouceUsagetask1003	General Logging	Y	N
1004	ResouceUsagetask1004	General Logging	Y	N
1005	ResouceUsagetask1005	General Logging	Y	N
1006	ResouceUsagetask1006	General Logging	Y	N
1007	ResouceUsagetask1007	General Logging	Y	N
1008	ResouceUsagetask1008	General Logging	Y	N
1009	ResouceUsagetask1009	General Logging	Y	N
1010	ResouceUsagetask1010	General Logging	Y	N

Event ID 100: etwtaskLogging

Channel: General Logging
Level: Error
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "100",
    "version": "0",
    "level": "2",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:43:16.343398800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "",
    "wzCategory": "Experiment Liblet",
    "wzTag": "9lvor",
    "wzMessage": "OptGates GetValue > Caller queried gate before Mso20 is initialized or after Mso20 is uninitialized. Returning default value. Fix the caller. {\"TeamEnum\": 61, \"FeatureName\": \"ChangeGate.9790726.CastGuardEnforcement\"}"
  },
  "message": ""
}

Event ID 101: etwtaskLogging101

Channel: General Logging
Level: Warning
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "101",
    "version": "0",
    "level": "3",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:43:17.012542500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "Microsoft Word",
    "wzCategory": "Licensing client liblet",
    "wzTag": "cmo2w",
    "wzMessage": "NULDataProvider::RefreshData - No best license available"
  },
  "message": ""
}

Event ID 102: etwtaskLogging102

Channel: General Logging
Level: Informational
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "102",
    "version": "0",
    "level": "4",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:43:16.743491400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "",
    "wzCategory": "Activity",
    "wzTag": "bjtct",
    "wzMessage": "ActivityStarted {\"Name\": \"Office.Performance.Boot\", \"CV\": \"VkHAh2AShk+MQ/PwqFHUOg.1\"}"
  },
  "message": ""
}

Event ID 103: etwtaskLogging103

Channel: General Logging
Level: Verbose
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "103",
    "version": "0",
    "level": "5",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:41:53.990674000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7864",
      "thread_id": "9352"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "",
    "wzCategory": "Click-To-Run",
    "wzTag": "arqlf",
    "wzMessage": "ServiceStartupBehavior::ServiceMain - Notifying timer listener"
  },
  "message": ""
}

Event ID 104: etwtaskLogging104

Channel: General Logging
Level: VerboseEx
Task: etwtaskLogging
Opcode: Info

Fields #

Name	Description
`wzProduct` UnicodeString → string
`wzCategory` UnicodeString → string
`wzTag` UnicodeString → string
`wzMessage` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "104",
    "version": "0",
    "level": "16",
    "task": "1",
    "opcode": "0",
    "keywords": 9223372036854784000,
    "time_created": "2026-03-14T21:43:17.440814700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzProduct": "Microsoft Word",
    "wzCategory": "Privacy Options and Consent Providers",
    "wzTag": "c773e",
    "wzMessage": "Constructing IdBasedPrivacyConsentProvider"
  },
  "message": ""
}

Event ID 105: Mso Logging Scope start event.

Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Start

Fields #

Name	Description
`EventData`

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "105",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "1",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-14T21:43:17.632691400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{950a4155-008f-4925-9ba1-670c18121265}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventData": ""
  },
  "message": ""
}

Event ID 106: Mso Logging Scope short stop event.

Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Stop

Fields #

Name	Description
`EventData`

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "106",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "2",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-14T21:43:17.633141100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{950a4155-008f-4925-9ba1-670c18121265}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventData": ""
  },
  "message": ""
}

Event ID 107: Mso Logging Scope long stop event.

Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Mso Logging Scope long stop Opcode

Fields #

Name	Description
`EventData`

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "107",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "10",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-14T21:43:17.633186400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventData": ""
  },
  "message": ""
}

Event ID 108: Mso Scenario start event.

Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Start

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`lpScenarioName` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "108",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "1",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwInstanceId": "0",
    "lpScenarioName": ""
  },
  "message": ""
}

Event ID 109: Mso Scenario short stop event.

Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Stop

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "109",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "2",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwInstanceId": "0"
  },
  "message": ""
}

Event ID 110: Mso Scenario long stop event.

Channel: General Logging
Level: Informational
Task: Mso Logging Scope task
Opcode: Mso Logging Scope long stop Opcode

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`bWasSuccessful` Boolean → boolean
`bWasErrorCodeSet` Boolean → boolean
`ErrorCode` Int32 → int

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "110",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "10",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwInstanceId": "0",
    "bWasSuccessful": "false",
    "bWasErrorCodeSet": "false",
    "ErrorCode": "0"
  },
  "message": ""
}

Event ID 200: ResouceUsagetask

Channel: General Logging
Level: Informational
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`FilesCreated` Int64 → long
`NumberOfFileReads` Int64 → long
`TotalBytesRead` Int64 → long
`NumberOfFileWrites` Int64 → long
`TotalBytesWritten` Int64 → long
`NumberOfSetEndOfFiles` Int64 → long
`NumberOfSeeks` Int64 → long
`NumberOfLocks` Int64 → long
`NumberOfUnlocks` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "200",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-14T22:55:14.544627000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "2584",
      "thread_id": "10100"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": " 5789059",
    "dwInstanceId": "    3716",
    "FilesCreated": "2",
    "NumberOfFileReads": "0",
    "TotalBytesRead": "0",
    "NumberOfFileWrites": "4",
    "TotalBytesWritten": "4322",
    "NumberOfSetEndOfFiles": "4",
    "NumberOfSeeks": "17",
    "NumberOfLocks": "0",
    "NumberOfUnlocks": "0"
  },
  "message": ""
}

Event ID 201: ResouceUsagetask201

Channel: General Logging
Level: Informational
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`Requests` Int64 → long
`BytesSent` Int64 → long
`ElapsedMilliseconds` Int64 → long
`BytesReceived` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "201",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854776832,
    "time_created": "2026-03-14T22:50:51.511474700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": " 5646235",
    "dwInstanceId": "     193",
    "Requests": "1",
    "BytesSent": "0",
    "ElapsedMilliseconds": "180",
    "BytesReceived": "0"
  },
  "message": ""
}

Event ID 202: ResouceUsagetask202

Channel: General Logging
Level: Informational
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`dwTag` UInt32 → unsignedInt
`dwInstanceId` UInt32 → unsignedInt
`BytesUsedDelta` Int64 → long
`BytesUsedAtComplete` UInt64 → unsignedLong

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "202",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854779904,
    "time_created": "2026-03-14T21:43:17.633158800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "19255818",
    "dwInstanceId": "       2",
    "BytesUsedDelta": "81920",
    "BytesUsedAtComplete": "66998272"
  },
  "message": ""
}

Event ID 1000: ResouceUsagetask1000

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ResourceScopePtr` Pointer → HexInt64
`FileUsagePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1000",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:55:03.844782400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "2584",
      "thread_id": "9480"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": " 5646235",
    "InstanceId": "      42",
    "ResourceScopePtr": "0x229426F1428",
    "FileUsagePtr": "0x22945D37340"
  },
  "message": ""
}

Event ID 1001: ResouceUsagetask1001

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ScopePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "1001",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": "0",
    "InstanceId": "0",
    "ScopePtr": "0x0"
  },
  "message": ""
}

Event ID 1002: ResouceUsagetask1002

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ResourceScopePtr` Pointer → HexInt64
`NetworkUsagePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1002",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.509455800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": " 5646235",
    "InstanceId": "     193",
    "ResourceScopePtr": "0x23713C3CE58",
    "NetworkUsagePtr": "0x2370FDCD160"
  },
  "message": ""
}

Event ID 1003: ResouceUsagetask1003

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`ChildScopePtr` Pointer → HexInt64
`ParentScopePtr` Pointer → HexInt64
`TypeOfData` UnicodeString → string

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1003",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.511503000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ChildScopePtr": "0x2370FDCD160",
    "ParentScopePtr": "0x2370FDCC9B0",
    "TypeOfData": "Network"
  },
  "message": ""
}

Event ID 1004: ResouceUsagetask1004

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Result` Boolean → boolean
`StartCounter` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1004",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T21:43:17.549720000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9176"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": "true",
    "StartCounter": "356204661992"
  },
  "message": ""
}

Event ID 1005: ResouceUsagetask1005

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Result` Boolean → boolean
`StartCounter` Int64 → long
`StopCounter` Int64 → long
`ElapsedCounters` Int64 → long
`ElapsedMilliseconds` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1005",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.509458700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": "true",
    "StartCounter": "396742446362",
    "StopCounter": "396744247464",
    "ElapsedCounters": "1801102",
    "ElapsedMilliseconds": "180"
  },
  "message": ""
}

Event ID 1006: ResouceUsagetask1006

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Result` Boolean → boolean
`Frequency` Int64 → long

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1006",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.509457300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": "true",
    "Frequency": "10000000"
  },
  "message": ""
}

Event ID 1007: ResouceUsagetask1007

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`FunctionName` UnicodeString → string
`CurrentResourcePrt` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1007",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T22:50:51.509450700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FunctionName": "Mso::Http::Details::ResourceUsageNetworkMonitorTemplate<class Mso::Http::Details::NetworkUsageProductionBase>::ReportResponseReceived",
    "CurrentResourcePrt": "0x23713C3CE50"
  },
  "message": ""
}

Event ID 1008: ResouceUsagetask1008

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ScopePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "1008",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": "0",
    "InstanceId": "0",
    "ScopePtr": "0x0"
  },
  "message": ""
}

Event ID 1009: ResouceUsagetask1009

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ResourceScopePtr` Pointer → HexInt64
`MemoryUsagePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{f50d9315-e17e-43c1-8370-3edf6cc057be}",
    "event_source_name": "",
    "event_id": "1009",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-14T21:43:17.632671200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "8208"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": "19255818",
    "InstanceId": "       2",
    "ResourceScopePtr": "0x1FF3A501078",
    "MemoryUsagePtr": "0x1FF3A7E4B70"
  },
  "message": ""
}

Event ID 1010: ResouceUsagetask1010

Channel: General Logging
Level: VerboseEx
Task: Resouce Usage task
Opcode: Info

Fields #

Name	Description
`Tag` UInt32 → unsignedInt
`InstanceId` UInt32 → unsignedInt
`ScopePtr` Pointer → HexInt64

Example Event #

{
  "system": {
    "provider": "OfficeLoggingLiblet",
    "guid": "{F50D9315-E17E-43C1-8370-3EDF6CC057BE}",
    "event_source_name": "",
    "event_id": "1010",
    "version": "0",
    "level": "16",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854777856,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "General Logging",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Tag": "0",
    "InstanceId": "0",
    "ScopePtr": "0x0"
  },
  "message": ""
}

Provenance

ETW provider GUID f50d9315-e17e-43c1-8370-3edf6cc057be

Defined in Program, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 16.0.17726.20016, captured 2026-06-02 — Manifest XML pack, 2.0 MB