detection.wiki

ReFS

EventTitleChannelSampleRule
130The file system structure on volume {VolumeId} has now been repaired.SystemNN
131The file system structure on volume {VolumeId} cannot be corrected.SystemNN
132The file system detected a checksum error and was able to correct it.SystemNN
133The file system detected a checksum error and was not able to correct it.SystemNN
134The file system was unable to write metadata to the media backing volume …SystemNN
135Volume {VolumeId} is formatted as ReFS but ReFS is unable to mount it; ReFS …SystemNN
136Volume '{VolumeId}' was mounted in an older version of Windows.SystemNN
513The file system detected a corruption on a file.SystemNN
514The file system detected a corruption on a file.SystemNN
515The file system detected a corruption on a folder.SystemNN
516The file system detected a corruption on a folder.SystemNN
519The file system detected a corruption on file system metadata.SystemNN
520The file system detected a corruption on file system metadata.SystemNN
521Volume '{ObjectName}' detected a corruption on file system metadata.SystemNN

Event ID 130: The file system structure on volume {VolumeId} has now been repaired.

#
Channel
System

Fields #

NameDescription
VolumeId

Event ID 131: The file system structure on volume {VolumeId} cannot be corrected.

#
Channel
System

Fields #

NameDescription
VolumeId

Event ID 132: The file system detected a checksum error and was able to correct it.

#
Channel
System

Description

The file system detected a checksum error and was able to correct it. The name of the file or folder is '{ObjectName}'.

Message #

The file system detected a checksum error and was able to correct it. The name of the file or folder is '{ObjectName}'.

Fields #

NameDescription
ObjectName

Event ID 133: The file system detected a checksum error and was not able to correct it.

#
Channel
System

Description

The file system detected a checksum error and was not able to correct it. The name of the file or folder is '{ObjectName}'.

Message #

The file system detected a checksum error and was not able to correct it. The name of the file or folder is '{ObjectName}'.

Fields #

NameDescription
ObjectName

Event ID 134: The file system was unable to write metadata to the media backing volume {VolumeId}.

#
Channel
System

Message #

The file system was unable to write metadata to the media backing volume {VolumeId}. A write failed with status '{FailureReason}' ReFS will take the volume offline. It may be mounted again automatically.

Fields #

NameDescription
VolumeId
FailureReason
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 135: Volume {VolumeId} is formatted as ReFS but ReFS is unable to mount it; ReFS encountered status {FailureReason}.

#
Channel
System

Fields #

NameDescription
VolumeId
FailureReason
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 136: Volume '{VolumeId}' was mounted in an older version of Windows.

#
Channel
System

Description

Volume '{VolumeId}' was mounted in an older version of Windows. Some features may be lost.

Message #

Volume '{VolumeId}' was mounted in an older version of Windows. Some features may be lost.

Fields #

NameDescription
VolumeId

Event ID 513: The file system detected a corruption on a file.

#
Channel
System

Description

The file system detected a corruption on a file. The file has been removed from the file system namespace. The name of the file is '{ObjectName}'.

Message #

The file system detected a corruption on a file. The file has been removed from the file system namespace. The name of the file is '{ObjectName}'.

Fields #

NameDescription
ObjectName

Event ID 514: The file system detected a corruption on a file.

#
Channel
System

Description

The file system detected a corruption on a file. The file system may have failed to remove it from the file system namespace. The name of the file is '{ObjectName}'.

Message #

The file system detected a corruption on a file. The file system may have failed to remove it from the file system namespace. The name of the file is '{ObjectName}'.

Fields #

NameDescription
ObjectName

Event ID 515: The file system detected a corruption on a folder.

#
Channel
System

Description

The file system detected a corruption on a folder. Contents of the folder have been removed from the file system namespace. The name of the folder is '{ObjectName}'.

Message #

The file system detected a corruption on a folder. Contents of the folder have been removed from the file system namespace. The name of the folder is '{ObjectName}'.

Fields #

NameDescription
ObjectName

Event ID 516: The file system detected a corruption on a folder.

#
Channel
System

Description

The file system detected a corruption on a folder. The file system may have failed to remove contents of the folder from the file system namespace. The name of the folder is '{ObjectName}'.

Message #

The file system detected a corruption on a folder. The file system may have failed to remove contents of the folder from the file system namespace. The name of the folder is '{ObjectName}'.

Fields #

NameDescription
ObjectName

Event ID 519: The file system detected a corruption on file system metadata.

#
Channel
System

Description

The file system detected a corruption on file system metadata. The name of the stream is '{ObjectName}'.

Message #

The file system detected a corruption on file system metadata. The name of the stream is '{ObjectName}'.

Fields #

NameDescription
ObjectName

Event ID 520: The file system detected a corruption on file system metadata.

#
Channel
System

Description

The file system detected a corruption on file system metadata. The name of the stream is '{ObjectName}'.

Message #

The file system detected a corruption on file system metadata. The name of the stream is '{ObjectName}'.

Fields #

NameDescription
ObjectName

Event ID 521: Volume '{ObjectName}' detected a corruption on file system metadata.

#
Channel
System

Description

Volume '{ObjectName}' detected a corruption on file system metadata. It will lose self-healing features.

Message #

Volume '{ObjectName}' detected a corruption on file system metadata. It will lose self-healing features.

Fields #

NameDescription
ObjectName