| 200 | Windows Event Log |
Windows Event Log |
| 201 | This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system. |
This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system. |
| 0x14 | The event logging service encountered an error %1 while obtaining or processing configuration for channel %2. |
The event logging service encountered an error %1 while obtaining or processing configuration for channel %2. |
| 0x15 | The event logging service encountered a configuration-related error (res=%1) for channel %2. The error was encountered while processing the %3 configuration property. |
The event logging service encountered a configuration-related error (res=%1) for channel %2. The error was encountered while processing the %3 configuration property. |
| 0x16 | The event logging service encountered an error while initializing publishing resources for channel %2. If channel type is Analytic or Debug, then this could mean there was an error initializing logging resources as well. |
The event logging service encountered an error while initializing publishing resources for channel %2. If channel type is Analytic or Debug, then this could mean there was an error initializing logging resources as well. |
| 0x17 | The event logging service encountered an error (res=%1) while initializing logging resources for channel %2. |
The event logging service encountered an error (res=%1) while initializing logging resources for channel %2. |
| 0x19 | The event logging service encountered a corrupt log file for channel %1. The log was renamed with a .corrupt extension. |
The event logging service encountered a corrupt log file for channel %1. The log was renamed with a .corrupt extension. |
| 0x1A | The event logging service encountered a log file for channel %1 which is an unsupported version. The log was renamed with a .UnsupportedVer extension. |
The event logging service encountered a log file for channel %1 which is an unsupported version. The log was renamed with a .UnsupportedVer extension. |
| 0x1B | The event logging service encountered an error (res=%1) while opening log file for channel %2. Trying again using default log file path %3. |
The event logging service encountered an error (res=%1) while opening log file for channel %2. Trying again using default log file path %3. |
| 0x1C | The event logging service encountered an error (res=%1) while parsing filter for channel %2. Will continue without filter. |
The event logging service encountered an error (res=%1) while parsing filter for channel %2. Will continue without filter. |
| 0x1D | The event logging service encountered a fatal error (res=%1) when applying settings to the %2 channel. The service is shutting down since this channel is vital to its operation. |
The event logging service encountered a fatal error (res=%1) when applying settings to the %2 channel. The service is shutting down since this channel is vital to its operation. |
| 0x1E | The event logging service encountered an error (%1) while enabling publisher %3 to channel %2. This does not affect channel operation, but does affect the ability of the publisher to raise events to the channel. One common reason for this error is that the Provider is using ETW Provider Security and has not granted enable permissions to the Event Log service identity. |
The event logging service encountered an error (%1) while enabling publisher %3 to channel %2. This does not affect channel operation, but does affect the ability of the publisher to raise events to the channel. One common reason for this error is that the Provider is using ETW Provider Security and has not granted enable permissions to the Event Log service identity. |
| 0x1F | The event logging service encountered an error (res=%1) while opening configuration for primary channel %2. Trying again using default configuration. This problem usually occurs if registry has been corrupted or explicitly misconfigured. |
The event logging service encountered an error (res=%1) while opening configuration for primary channel %2. Trying again using default configuration. This problem usually occurs if registry has been corrupted or explicitly misconfigured. |
| 0x28 | The event logging service encountered an error when attempting to apply one or more policy settings. |
The event logging service encountered an error when attempting to apply one or more policy settings. |
| 0x68 | The %3 log file was cleared. |
The %3 log file was cleared. |
| 0x69 | Event log automatic backup%n%tLog:%t%1%n%tFile:%t%2%n |
Event log automatic backup%n%tLog:%t%1%n%tFile:%t%2%n |
| 0x6A | Corruption was detected in the log for the %1 channel and some data was erased. |
Corruption was detected in the log for the %1 channel and some data was erased. |
| 0x6C | The previous system shutdown was unexpected. |
The previous system shutdown was unexpected. |
| 0x44C | The event logging service has shut down. |
The event logging service has shut down. |
| 0x44D | Audit events have been dropped by the transport. %1 |
Audit events have been dropped by the transport. %1 |
| 0x44E | The audit log was cleared.%nSubject:%n%tSecurity ID:%t%1%n%tAccount Name:%t%2%n%tDomain Name:%t%3%n%tLogon ID:%t%4 |
The audit log was cleared.%nSubject:%n%tSecurity ID:%t%1%n%tAccount Name:%t%2%n%tDomain Name:%t%3%n%tLogon ID:%t%4 |
| 0x44F | The security log is now %1 percent full. |
The security log is now %1 percent full. |
| 0x450 | The security log is now full. |
The security log is now full. |
| 0x452 | Events have been dropped by the event logging service. The reason code is %1. |
Events have been dropped by the event logging service. The reason code is %1. |
| 0x453 | The event logging service encountered an error while processing an incoming event from publisher %3 and trying to process the metadata for it. |
The event logging service encountered an error while processing an incoming event from publisher %3 and trying to process the metadata for it. |
| 0x454 | The event logging service encountered an error while processing an incoming event published from %3. |
The event logging service encountered an error while processing an incoming event published from %3. |
| 0x1770 | The %1 log file is full. |
The %1 log file is full. |
| 0x10000012 | Service availability |
Service availability |
| 0x10000013 | Service configuration |
Service configuration |
| 0x10000014 | System availability |
System availability |
| 0x10000036 | Audit Success |
Audit Success |
| 0x30000001 | Start |
Start |
| 0x30000002 | Stop |
Stop |
| 0x50000001 | Critical |
Critical |
| 0x50000002 | Error |
Error |
| 0x50000003 | Warning |
Warning |
| 0x50000004 | Information |
Information |
| 0x50000005 | Verbose |
Verbose |
| 0x70000064 | Service startup |
Service startup |
| 0x70000065 | Event processing |
Event processing |
| 0x70000067 | Service shutdown |
Service shutdown |
| 0x70000068 | Log clear |
Log clear |
| 0x70000069 | Log automatic backup |
Log automatic backup |
| 0x7000006C | System Abnormal Shutdown |
System Abnormal Shutdown |
| 0x90000001 | Microsoft-Windows-Eventlog |
Microsoft-Windows-Eventlog |
| 0x90000002 | System |
System |
| 0x90000003 | Security |
Security |
| 0x90000004 | Setup |
Setup |
| 0x90000005 | Debug |
Debug |
| 0x90000006 | Analytic |
Analytic |
| 0xB0000067 | Events have been dropped by the transport. The session name is %2 and the reason code is %1. |
Events have been dropped by the transport. The session name is %2 and the reason code is %1. |
| 0xB000006B | The event logging service encountered an error %1 while going through publisher configuration. The publisher %2 is already installed with GUID %3. |
The event logging service encountered an error %1 while going through publisher configuration. The publisher %2 is already installed with GUID %3. |
| 0xB000006E | Loading metadata for publisher %2 (%1) and trying to process the metadata for it. |
Loading metadata for publisher %2 (%1) and trying to process the metadata for it. |
| 0xB000006F | Finished loading metadata for publisher %2 (%1), with %3 event metadatas processed. |
Finished loading metadata for publisher %2 (%1), with %3 event metadatas processed. |
| 0xB0000070 | Failed to load metadata for publisher %2 (%1). The reason code is %3. |
Failed to load metadata for publisher %2 (%1). The reason code is %3. |
| 0xD0000001 | Events were lost because there were no free buffers. Flushing to disk could not catch up with incoming events. |
Events were lost because there were no free buffers. Flushing to disk could not catch up with incoming events. |
| 0xD0000002 | One or more buffers were dropped because a real time consumer could not catch up. |
One or more buffers were dropped because a real time consumer could not catch up. |
| 0xD0000003 | The real time backup file was corrupt due to improper shutdown. |
The real time backup file was corrupt due to improper shutdown. |