locked
How can I filter only error messages using wevtutil.exe? RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi team!

      How can I filter only error messages using wevtutil.exe? Is the following filter right? Level=3? Where do I find the documentation for Level field? Numbers 1, 2, 3, 4, ...

    %SystemRoot%\System32\wevtutil.exe qe System "/q:*[System [(Level=3)]]" /rd:true /f:text /c:10 > System.log
      

      Still, do the same levels apply to the other logs? Application, Security? etc?

    Thanks.

    Doria

    Thursday, July 2, 2020 3:59 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Doria,

    Please remove /rd:true Parameter for UIManager_Channel and WINDOWS_KS_CHANNEL or set Direction to be false, then the command will work fine. As the picture below:

    Hope this can help you.

    Best Regards,

    Candy

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com   

    • Marked as answer by dydoria Friday, July 3, 2020 3:49 PM
    Friday, July 3, 2020 5:04 AM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    On time, I am creating a batch file to filter only errors from all log files available in the operating system, so I need to know if level = 3 applies to all logs or if there is some other way to filter only error messages...

    AMSI/Debug
Application
EndpointMapper
FirstUXPerf-Analytic
ForwardedEvents
HardwareEvents
Internet Explorer
Key Management Service
Microsoft-Client-Licensing-Platform/Admin
Microsoft-Client-Licensing-Platform/Debug
Microsoft-Client-Licensing-Platform/Diagnostic
Microsoft-Management-UI/Admin
Microsoft-Management-UI/Debug
Microsoft-OneCore-Setup/Analytic
Microsoft-Pef-WFP-MessageProvider/Diagnostic
Microsoft-Rdms-UI/Admin
Microsoft-Rdms-UI/Analytic
Microsoft-Rdms-UI/Debug
Microsoft-Rdms-UI/Operational
Microsoft-Windows-ADSI/Debug
Microsoft-Windows-ASN1/Operational
Microsoft-Windows-ATAPort/General
Microsoft-Windows-ATAPort/SATA-LPM
Microsoft-Windows-ActionQueue/Analytic
Microsoft-Windows-All-User-Install-Agent/Admin
Microsoft-Windows-AppID/Operational
Microsoft-Windows-AppLocker/EXE and DLL
Microsoft-Windows-AppLocker/MSI and Script
Microsoft-Windows-AppLocker/Packaged app-Deployment
Microsoft-Windows-AppLocker/Packaged app-Execution
Microsoft-Windows-AppModel-Runtime/Admin
Microsoft-Windows-AppModel-Runtime/Analytic
Microsoft-Windows-AppModel-Runtime/Debug
Microsoft-Windows-AppModel-Runtime/Diagnostics
Microsoft-Windows-AppModel-State/Debug
Microsoft-Windows-AppModel-State/Diagnostic
Microsoft-Windows-AppReadiness/Admin
Microsoft-Windows-AppReadiness/Debug
Microsoft-Windows-AppReadiness/Operational
Microsoft-Windows-AppXDeployment/Diagnostic
Microsoft-Windows-AppXDeployment/Operational
Microsoft-Windows-AppXDeploymentServer/Debug
Microsoft-Windows-AppXDeploymentServer/Diagnostic
Microsoft-Windows-AppXDeploymentServer/Operational
Microsoft-Windows-AppXDeploymentServer/Restricted
Microsoft-Windows-Application Server-Applications/Admin
Microsoft-Windows-Application Server-Applications/Analytic
Microsoft-Windows-Application Server-Applications/Debug
Microsoft-Windows-Application Server-Applications/Operational
Microsoft-Windows-AppxPackaging/Debug
Microsoft-Windows-AppxPackaging/Operational
Microsoft-Windows-AppxPackaging/Performance
Microsoft-Windows-AsynchronousCausality/Causality
Microsoft-Windows-Audit/Analytic
Microsoft-Windows-Authentication User Interface/Operational
Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController
Microsoft-Windows-Authentication/ProtectedUser-Client
Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController
Microsoft-Windows-Backup
Microsoft-Windows-Base-Filtering-Engine-Connections/Operational
Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational
Microsoft-Windows-Battery/Diagnostic
Microsoft-Windows-BestPractices/Operational
Microsoft-Windows-Bits-Client/Analytic
Microsoft-Windows-Bits-Client/Operational
Microsoft-Windows-CAPI2/Catalog Database Debug
Microsoft-Windows-CAPI2/Operational
Microsoft-Windows-CDROM/Operational
Microsoft-Windows-COM/Analytic
Microsoft-Windows-COM/ApartmentInitialize
Microsoft-Windows-COM/ApartmentUninitialize
Microsoft-Windows-COM/Call
Microsoft-Windows-COM/CreateInstance
Microsoft-Windows-COM/ExtensionCatalog
Microsoft-Windows-COM/FreeUnusedLibrary
Microsoft-Windows-COM/RundownInstrumentation
Microsoft-Windows-COMRuntime/Activations
Microsoft-Windows-COMRuntime/MessageProcessing
Microsoft-Windows-COMRuntime/Tracing
Microsoft-Windows-CertPoleEng/Operational
Microsoft-Windows-CertificateServices-Deployment/Operational
Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational
Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
Microsoft-Windows-CmiSetup/Analytic
Microsoft-Windows-CodeIntegrity/Operational
Microsoft-Windows-CodeIntegrity/Verbose
Microsoft-Windows-ComDlg32/Analytic
Microsoft-Windows-ComDlg32/Debug
Microsoft-Windows-Containers-BindFlt/Debug
Microsoft-Windows-Containers-BindFlt/Operational
Microsoft-Windows-Containers-Wcifs/Debug
Microsoft-Windows-Containers-Wcifs/Operational
Microsoft-Windows-Containers-Wcnfs/Debug
Microsoft-Windows-Containers-Wcnfs/Operational
Microsoft-Windows-CoreApplication/Diagnostic
Microsoft-Windows-CoreApplication/Operational
Microsoft-Windows-CoreApplication/Tracing
Microsoft-Windows-Crashdump/Operational
Microsoft-Windows-CredUI/Diagnostic
Microsoft-Windows-Crypto-BCRYPT/Analytic
Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc
Microsoft-Windows-Crypto-DPAPI/Debug
Microsoft-Windows-Crypto-DPAPI/Operational
Microsoft-Windows-Crypto-DSSEnh/Analytic
Microsoft-Windows-Crypto-NCrypt/Operational
Microsoft-Windows-Crypto-RSAEnh/Analytic
Microsoft-Windows-DAL-Provider/Analytic
Microsoft-Windows-DAL-Provider/Operational
Microsoft-Windows-DCLocator/Debug
Microsoft-Windows-DNS-Client/Operational
Microsoft-Windows-DSC/Admin
Microsoft-Windows-DSC/Analytic
Microsoft-Windows-DSC/Debug
Microsoft-Windows-DSC/Operational
Microsoft-Windows-DUI/Diagnostic
Microsoft-Windows-DUSER/Diagnostic
Microsoft-Windows-DXGI/Analytic
Microsoft-Windows-DXGI/Logging
Microsoft-Windows-DataIntegrityScan/Admin
Microsoft-Windows-DataIntegrityScan/CrashRecovery
Microsoft-Windows-DateTimeControlPanel/Analytic
Microsoft-Windows-DateTimeControlPanel/Debug
Microsoft-Windows-DateTimeControlPanel/Operational
Microsoft-Windows-Defrag-Core/Debug
Microsoft-Windows-Deplorch/Analytic
Microsoft-Windows-DeviceGuard/Operational
Microsoft-Windows-DeviceUpdateAgent/Operational
Microsoft-Windows-Dhcp-Client/Admin
Microsoft-Windows-Dhcp-Client/Operational
Microsoft-Windows-Dhcpv6-Client/Admin
Microsoft-Windows-Dhcpv6-Client/Operational
Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic
Microsoft-Windows-Diagnosis-DPS/Analytic
Microsoft-Windows-Diagnosis-DPS/Debug
Microsoft-Windows-Diagnosis-DPS/Operational
Microsoft-Windows-Diagnosis-PCW/Analytic
Microsoft-Windows-Diagnosis-PCW/Debug
Microsoft-Windows-Diagnosis-PCW/Operational
Microsoft-Windows-Diagnosis-PLA/Debug
Microsoft-Windows-Diagnosis-PLA/Operational
Microsoft-Windows-Diagnosis-Perfhost/Analytic
Microsoft-Windows-Diagnosis-WDI/Debug
Microsoft-Windows-Diagnostics-Networking/Debug
Microsoft-Windows-Diagnostics-Networking/Operational
Microsoft-Windows-Direct3D11/Analytic
Microsoft-Windows-Direct3D11/Logging
Microsoft-Windows-Direct3D11/PerfTiming
Microsoft-Windows-Direct3D12/Analytic
Microsoft-Windows-Direct3D12/Logging
Microsoft-Windows-Direct3D12/PerfTiming
Microsoft-Windows-Direct3D9/Analytic
Microsoft-Windows-DirectManipulation/Diagnostic
Microsoft-Windows-DirectoryServices-Deployment/Operational
Microsoft-Windows-Disk/Operational
Microsoft-Windows-Dism-Api/Analytic
Microsoft-Windows-Dism-Api/ExternalAnalytic
Microsoft-Windows-Dism-Api/InternalAnalytic
Microsoft-Windows-Dism-Cli/Analytic
Microsoft-Windows-DriverFrameworks-UserMode/Operational
Microsoft-Windows-Dwm-API/Diagnostic
Microsoft-Windows-DxgKrnl/Contention
Microsoft-Windows-DxgKrnl/Diagnostic
Microsoft-Windows-DxgKrnl/Performance
Microsoft-Windows-DxgKrnl/Power
Microsoft-Windows-EFS/Debug
Microsoft-Windows-ESE/IODiagnose
Microsoft-Windows-ESE/Operational
Microsoft-Windows-EapHost/Analytic
Microsoft-Windows-EapHost/Debug
Microsoft-Windows-EapHost/Operational
Microsoft-Windows-EapMethods-RasChap/Operational
Microsoft-Windows-EapMethods-RasTls/Operational
Microsoft-Windows-EapMethods-Sim/Operational
Microsoft-Windows-EapMethods-Ttls/Operational
Microsoft-Windows-EventCollector/Debug
Microsoft-Windows-EventCollector/Operational
Microsoft-Windows-EventLog-WMIProvider/Debug
Microsoft-Windows-EventLog/Analytic
Microsoft-Windows-EventLog/Debug
Microsoft-Windows-FMS/Analytic
Microsoft-Windows-FMS/Debug
Microsoft-Windows-FMS/Operational
Microsoft-Windows-FailoverClustering-Client/Diagnostic
Microsoft-Windows-FeatureConfiguration/Analytic
Microsoft-Windows-FeatureConfiguration/Operational
Microsoft-Windows-FederationServices-Deployment/Operational
Microsoft-Windows-FileInfoMinifilter/Operational
Microsoft-Windows-FileServices-ServerManager-EventProvider/Admin
Microsoft-Windows-FileServices-ServerManager-EventProvider/Debug
Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational
Microsoft-Windows-FileShareShadowCopyProvider/Operational
Microsoft-Windows-Forwarding/Debug
Microsoft-Windows-Forwarding/Operational
Microsoft-Windows-GPIO-ClassExtension/Analytic
Microsoft-Windows-GenericRoaming/Admin
Microsoft-Windows-GroupPolicy/Operational
Microsoft-Windows-HAL/Debug
Microsoft-Windows-Help/Operational
Microsoft-Windows-Host-Network-Service-Admin
Microsoft-Windows-Host-Network-Service-Analytic
Microsoft-Windows-Host-Network-Service-Operational
Microsoft-Windows-HttpService/Log
Microsoft-Windows-HttpService/Trace
Microsoft-Windows-Hyper-V-Compute-Admin
Microsoft-Windows-Hyper-V-Compute-Analytic
Microsoft-Windows-Hyper-V-Compute-Operational
Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
Microsoft-Windows-Hyper-V-Guest-Drivers/Debug
Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
Microsoft-Windows-Hyper-V-Hypervisor-Admin
Microsoft-Windows-Hyper-V-Hypervisor-Analytic
Microsoft-Windows-Hyper-V-Hypervisor-Operational
Microsoft-Windows-Hyper-V-NETVSC/Diagnostic
Microsoft-Windows-Hyper-V-VfpExt-Analytic
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Microsoft-Windows-Hyper-V-VmSwitch-Operational
Microsoft-Windows-IKE/Operational
Microsoft-Windows-IKEDBG/Debug
Microsoft-Windows-IME-Broker/Analytic
Microsoft-Windows-IME-CandidateUI/Analytic
Microsoft-Windows-IME-JPAPI/Analytic
Microsoft-Windows-IME-JPLMP/Analytic
Microsoft-Windows-IME-JPPRED/Analytic
Microsoft-Windows-IME-JPTIP/Analytic
Microsoft-Windows-IME-KRAPI/Analytic
Microsoft-Windows-IME-KRTIP/Analytic
Microsoft-Windows-IME-TCCORE/Analytic
Microsoft-Windows-IME-TCTIP/Analytic
Microsoft-Windows-IME-TIP/Analytic
Microsoft-Windows-IPNAT/Diagnostic
Microsoft-Windows-IPSEC-SRV/Diagnostic
Microsoft-Windows-InputSwitch/Diagnostic
Microsoft-Windows-International-RegionalOptionsControlPanel/Operational
Microsoft-Windows-International/Operational
Microsoft-Windows-Iphlpsvc/Debug
Microsoft-Windows-Iphlpsvc/Operational
Microsoft-Windows-Iphlpsvc/Trace
Microsoft-Windows-KdsSvc/Operational
Microsoft-Windows-Kerberos-KdcProxy/Operational
Microsoft-Windows-Kerberos/Operational
Microsoft-Windows-Kernel-Acpi/Diagnostic
Microsoft-Windows-Kernel-AppCompat/General
Microsoft-Windows-Kernel-AppCompat/Performance
Microsoft-Windows-Kernel-ApphelpCache/Analytic
Microsoft-Windows-Kernel-ApphelpCache/Debug
Microsoft-Windows-Kernel-ApphelpCache/Operational
Microsoft-Windows-Kernel-Boot/Analytic
Microsoft-Windows-Kernel-Boot/Operational
Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic
Microsoft-Windows-Kernel-Disk/Analytic
Microsoft-Windows-Kernel-EventTracing/Admin
Microsoft-Windows-Kernel-EventTracing/Analytic
Microsoft-Windows-Kernel-File/Analytic
Microsoft-Windows-Kernel-IO/Operational
Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic
Microsoft-Windows-Kernel-IoTrace/Diagnostic
Microsoft-Windows-Kernel-LiveDump/Analytic
Microsoft-Windows-Kernel-Memory/Analytic
Microsoft-Windows-Kernel-Network/Analytic
Microsoft-Windows-Kernel-Pdc/Diagnostic
Microsoft-Windows-Kernel-Pep/Diagnostic
Microsoft-Windows-Kernel-PnP/Boot Diagnostic
Microsoft-Windows-Kernel-PnP/Configuration
Microsoft-Windows-Kernel-PnP/Configuration Diagnostic
Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic
Microsoft-Windows-Kernel-PnP/Driver Diagnostic
Microsoft-Windows-Kernel-Power/Diagnostic
Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
Microsoft-Windows-Kernel-Power/Thermal-Operational
Microsoft-Windows-Kernel-Prefetch/Diagnostic
Microsoft-Windows-Kernel-Process/Analytic
Microsoft-Windows-Kernel-Processor-Power/Diagnostic
Microsoft-Windows-Kernel-Registry/Analytic
Microsoft-Windows-Kernel-Registry/Performance
Microsoft-Windows-Kernel-ShimEngine/Debug
Microsoft-Windows-Kernel-ShimEngine/Diagnostic
Microsoft-Windows-Kernel-ShimEngine/Operational
Microsoft-Windows-Kernel-StoreMgr/Analytic
Microsoft-Windows-Kernel-StoreMgr/Operational
Microsoft-Windows-Kernel-WDI/Analytic
Microsoft-Windows-Kernel-WDI/Debug
Microsoft-Windows-Kernel-WDI/Operational
Microsoft-Windows-Kernel-WHEA/Errors
Microsoft-Windows-Kernel-WHEA/Operational
Microsoft-Windows-Kernel-XDV/Analytic
Microsoft-Windows-Known Folders API Service
Microsoft-Windows-L2NA/Diagnostic
Microsoft-Windows-LDAP-Client/Debug
Microsoft-Windows-LSA/Diagnostic
Microsoft-Windows-LSA/Operational
Microsoft-Windows-LSA/Performance
Microsoft-Windows-LanguagePackSetup/Analytic
Microsoft-Windows-LanguagePackSetup/Debug
Microsoft-Windows-LanguagePackSetup/Operational
Microsoft-Windows-LimitsManagement/Diagnostic
Microsoft-Windows-MPS-CLNT/Diagnostic
Microsoft-Windows-MPS-DRV/Diagnostic
Microsoft-Windows-MPS-SRV/Diagnostic
Microsoft-Windows-MSFTEDIT/Diagnostic
Microsoft-Windows-MUI/Admin
Microsoft-Windows-MUI/Analytic
Microsoft-Windows-MUI/Debug
Microsoft-Windows-MUI/Operational
Microsoft-Windows-ManagementTools-RegistryProvider/Analytic
Microsoft-Windows-ManagementTools-RegistryProvider/Operational
Microsoft-Windows-ManagementTools-TaskManagerProvider/Analytic
Microsoft-Windows-ManagementTools-TaskManagerProvider/Debug
Microsoft-Windows-ManagementTools-TaskManagerProvider/Operational
Microsoft-Windows-MiStreamProvider/Debug
Microsoft-Windows-MiStreamProvider/Operational
Microsoft-Windows-Minstore/Analytic
Microsoft-Windows-Minstore/Debug
Microsoft-Windows-MsLbfoProvider/Operational
Microsoft-Windows-NDF-HelperClassDiscovery/Debug
Microsoft-Windows-NDIS-PacketCapture/Diagnostic
Microsoft-Windows-NDIS/Diagnostic
Microsoft-Windows-NDIS/Operational
Microsoft-Windows-NTLM/Operational
Microsoft-Windows-Ncasvc/Operational
Microsoft-Windows-NdisImPlatform/Operational
Microsoft-Windows-Network-Setup/Diagnostic
Microsoft-Windows-NetworkProfile/Diagnostic
Microsoft-Windows-NetworkProfile/Operational
Microsoft-Windows-NetworkProvider/Operational
Microsoft-Windows-NetworkSecurity/Debug
Microsoft-Windows-Networking-Correlation/Diagnostic
Microsoft-Windows-NlaSvc/Diagnostic
Microsoft-Windows-NlaSvc/Operational
Microsoft-Windows-Ntfs/Operational
Microsoft-Windows-Ntfs/Performance
Microsoft-Windows-Ntfs/WHC
Microsoft-Windows-OLE/Clipboard-Performance
Microsoft-Windows-OLEACC/Debug
Microsoft-Windows-OLEACC/Diagnostic
Microsoft-Windows-OOBE-Machine-Core/Diagnostic
Microsoft-Windows-OobeLdr/Analytic
Microsoft-Windows-PCI/Diagnostic
Microsoft-Windows-Partition/Analytic
Microsoft-Windows-Partition/Diagnostic
Microsoft-Windows-PersistentMemory-Nvdimm/Analytic
Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic
Microsoft-Windows-PersistentMemory-Nvdimm/Operational
Microsoft-Windows-PersistentMemory-PmemDisk/Analytic
Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic
Microsoft-Windows-PersistentMemory-PmemDisk/Operational
Microsoft-Windows-PersistentMemory-ScmBus/Analytic
Microsoft-Windows-PersistentMemory-ScmBus/Certification
Microsoft-Windows-PersistentMemory-ScmBus/Diagnose
Microsoft-Windows-PersistentMemory-ScmBus/Operational
Microsoft-Windows-Policy/Analytic
Microsoft-Windows-Policy/Operational
Microsoft-Windows-Power-Meter-Polling/Diagnostic
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational
Microsoft-Windows-PowerShell/Admin
Microsoft-Windows-PowerShell/Analytic
Microsoft-Windows-PowerShell/Debug
Microsoft-Windows-PowerShell/Operational
Microsoft-Windows-PriResources-Deployment/Diagnostic
Microsoft-Windows-PriResources-Deployment/Operational
Microsoft-Windows-QoS-Pacer/Diagnostic
Microsoft-Windows-RPC-Proxy/Debug
Microsoft-Windows-RPC/Debug
Microsoft-Windows-RPC/EEInfo
Microsoft-Windows-RRAS/Debug
Microsoft-Windows-RRAS/Operational
Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic
Microsoft-Windows-RasAgileVpn/Debug
Microsoft-Windows-RasAgileVpn/Operational
Microsoft-Windows-ReFS/Operational
Microsoft-Windows-ReadyBoost/Analytic
Microsoft-Windows-ReadyBoost/Operational
Microsoft-Windows-Regsvr32/Operational
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin
Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug
Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug
Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational
Microsoft-Windows-Remotefs-Rdbss/Diagnostic
Microsoft-Windows-Remotefs-Rdbss/Operational
Microsoft-Windows-Resource-Exhaustion-Detector/Operational
Microsoft-Windows-RestartManager/Operational
Microsoft-Windows-Runtime-Graphics/Analytic
Microsoft-Windows-Runtime/CreateInstance
Microsoft-Windows-Runtime/Error
Microsoft-Windows-SENSE/Operational
Microsoft-Windows-SMBClient/Analytic
Microsoft-Windows-SMBClient/HelperClassDiagnostic
Microsoft-Windows-SMBClient/ObjectStateDiagnostic
Microsoft-Windows-SMBClient/Operational
Microsoft-Windows-SMBDirect/Admin
Microsoft-Windows-SMBDirect/Debug
Microsoft-Windows-SMBDirect/Netmon
Microsoft-Windows-SMBServer/Analytic
Microsoft-Windows-SMBServer/Audit
Microsoft-Windows-SMBServer/Connectivity
Microsoft-Windows-SMBServer/Diagnostic
Microsoft-Windows-SMBServer/Operational
Microsoft-Windows-SMBServer/Performance
Microsoft-Windows-SMBServer/Security
Microsoft-Windows-SMBWitnessClient/Admin
Microsoft-Windows-SMBWitnessClient/Informational
Microsoft-Windows-SPB-ClassExtension/Analytic
Microsoft-Windows-Schannel-Events/Perf
Microsoft-Windows-Security-Adminless/Operational
Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic
Microsoft-Windows-Security-Audit-Configuration-Client/Operational
Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational
Microsoft-Windows-Security-Mitigations/KernelMode
Microsoft-Windows-Security-Mitigations/UserMode
Microsoft-Windows-Security-Netlogon/Operational
Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter
Microsoft-Windows-Security-SPP-UX/Analytic
Microsoft-Windows-Security-SPP/Perf
Microsoft-Windows-Security-Vault/Performance
Microsoft-Windows-Sens/Debug
Microsoft-Windows-SenseIR/Operational
Microsoft-Windows-Serial-ClassExtension/Analytic
Microsoft-Windows-ServerManager-ConfigureSMRemoting/Debug
Microsoft-Windows-ServerManager-ConfigureSMRemoting/Operational
Microsoft-Windows-ServerManager-DeploymentProvider/Debug
Microsoft-Windows-ServerManager-DeploymentProvider/Operational
Microsoft-Windows-ServerManager-MgmtProvider/Debug
Microsoft-Windows-ServerManager-MgmtProvider/Operational
Microsoft-Windows-ServerManager-MultiMachine/Admin
Microsoft-Windows-ServerManager-MultiMachine/Debug
Microsoft-Windows-ServerManager-MultiMachine/Operational
Microsoft-Windows-ServiceReportingApi/Debug
Microsoft-Windows-Services-Svchost/Diagnostic
Microsoft-Windows-Services/Diagnostic
Microsoft-Windows-Servicing/Debug
Microsoft-Windows-Setup/Analytic
Microsoft-Windows-SetupCl/Analytic
Microsoft-Windows-SetupPlatform/Analytic
Microsoft-Windows-SetupQueue/Analytic
Microsoft-Windows-SetupUGC/Analytic
Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic
Microsoft-Windows-Shell-AuthUI-Common/Diagnostic
Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic
Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic
Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic
Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic
Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic
Microsoft-Windows-Shell-OpenWith/Diagnostic
Microsoft-Windows-SilProvider/Debug
Microsoft-Windows-SilProvider/Operational
Microsoft-Windows-SleepStudy/Diagnostic
Microsoft-Windows-SmartCard-Audit/Authentication
Microsoft-Windows-SmartCard-DeviceEnum/Operational
Microsoft-Windows-SmbClient/Audit
Microsoft-Windows-SmbClient/Connectivity
Microsoft-Windows-SmbClient/Diagnostic
Microsoft-Windows-SmbClient/Security
Microsoft-Windows-SruMon/Diagnostic
Microsoft-Windows-StateRepository/Debug
Microsoft-Windows-StateRepository/Diagnostic
Microsoft-Windows-StateRepository/Operational
Microsoft-Windows-StateRepository/Restricted
Microsoft-Windows-StorDiag/Operational
Microsoft-Windows-StorPort/Operational
Microsoft-Windows-Storage-ATAPort/Admin
Microsoft-Windows-Storage-ATAPort/Analytic
Microsoft-Windows-Storage-ATAPort/Debug
Microsoft-Windows-Storage-ATAPort/Diagnose
Microsoft-Windows-Storage-ATAPort/Operational
Microsoft-Windows-Storage-ClassPnP/Admin
Microsoft-Windows-Storage-ClassPnP/Analytic
Microsoft-Windows-Storage-ClassPnP/Debug
Microsoft-Windows-Storage-ClassPnP/Diagnose
Microsoft-Windows-Storage-ClassPnP/Operational
Microsoft-Windows-Storage-Disk/Admin
Microsoft-Windows-Storage-Disk/Analytic
Microsoft-Windows-Storage-Disk/Debug
Microsoft-Windows-Storage-Disk/Diagnose
Microsoft-Windows-Storage-Disk/Operational
Microsoft-Windows-Storage-Storport/Admin
Microsoft-Windows-Storage-Storport/Analytic
Microsoft-Windows-Storage-Storport/Debug
Microsoft-Windows-Storage-Storport/Diagnose
Microsoft-Windows-Storage-Storport/Health
Microsoft-Windows-Storage-Storport/Operational
Microsoft-Windows-Storage-Tiering-IoHeat/Heat
Microsoft-Windows-Storage-Tiering/Admin
Microsoft-Windows-StorageManagement/Debug
Microsoft-Windows-StorageManagement/Operational
Microsoft-Windows-StorageSpaces-Driver/Diagnostic
Microsoft-Windows-StorageSpaces-Driver/Operational
Microsoft-Windows-StorageSpaces-Driver/Performance
Microsoft-Windows-StorageSpaces-ManagementAgent/WHC
Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic
Microsoft-Windows-StorageSpaces-SpaceManager/Operational
Microsoft-Windows-Subsys-Csr/Operational
Microsoft-Windows-Subsys-SMSS/Operational
Microsoft-Windows-Superfetch/Main
Microsoft-Windows-Superfetch/PfApLog
Microsoft-Windows-Superfetch/StoreLog
Microsoft-Windows-Sysprep/Analytic
Microsoft-Windows-SystemDataArchiver/Diagnostic
Microsoft-Windows-TCPIP/Diagnostic
Microsoft-Windows-TCPIP/Operational
Microsoft-Windows-TSF-msctf/Debug
Microsoft-Windows-TSF-msctf/Diagnostic
Microsoft-Windows-TSF-msutb/Debug
Microsoft-Windows-TSF-msutb/Diagnostic
Microsoft-Windows-TWinAPI/Diagnostic
Microsoft-Windows-TZSync/Analytic
Microsoft-Windows-TZSync/Operational
Microsoft-Windows-TZUtil/Operational
Microsoft-Windows-TaskScheduler/Debug
Microsoft-Windows-TaskScheduler/Diagnostic
Microsoft-Windows-TaskScheduler/Maintenance
Microsoft-Windows-TaskScheduler/Operational
Microsoft-Windows-TerminalServices-LocalSessionManager/Admin
Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic
Microsoft-Windows-TerminalServices-LocalSessionManager/Debug
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Microsoft-Windows-TerminalServices-PnPDevices/Admin
Microsoft-Windows-TerminalServices-PnPDevices/Analytic
Microsoft-Windows-TerminalServices-PnPDevices/Debug
Microsoft-Windows-TerminalServices-PnPDevices/Operational
Microsoft-Windows-TerminalServices-Printers/Admin
Microsoft-Windows-TerminalServices-Printers/Analytic
Microsoft-Windows-TerminalServices-Printers/Debug
Microsoft-Windows-TerminalServices-Printers/Operational
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin
Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic
Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug
Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational
Microsoft-Windows-TerminalServices-SessionBroker-Client/Admin
Microsoft-Windows-TerminalServices-SessionBroker-Client/Analytic
Microsoft-Windows-TerminalServices-SessionBroker-Client/Debug
Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational
Microsoft-Windows-Threat-Intelligence/Analytic
Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational
Microsoft-Windows-Time-Service/Operational
Microsoft-Windows-TunnelDriver
Microsoft-Windows-UAC/Operational
Microsoft-Windows-UIAutomationCore/Debug
Microsoft-Windows-UIAutomationCore/Diagnostic
Microsoft-Windows-UIAutomationCore/Perf
Microsoft-Windows-USB-UCX-Analytic
Microsoft-Windows-UniversalTelemetryClient/Operational
Microsoft-Windows-User Profile Service/Diagnostic
Microsoft-Windows-User Profile Service/Operational
Microsoft-Windows-User-Loader/Analytic
Microsoft-Windows-User-Loader/Operational
Microsoft-Windows-UserModePowerService/Diagnostic
Microsoft-Windows-UserPnp/ActionCenter
Microsoft-Windows-UserPnp/DeviceInstall
Microsoft-Windows-UserPnp/DeviceMetadata/Debug
Microsoft-Windows-UserPnp/Performance
Microsoft-Windows-UserPnp/SchedulerOperations
Microsoft-Windows-VDRVROOT/Operational
Microsoft-Windows-VHDMP-Analytic
Microsoft-Windows-VHDMP-Operational
Microsoft-Windows-VIRTDISK-Analytic
Microsoft-Windows-VPN/Operational
Microsoft-Windows-VerifyHardwareSecurity/Admin
Microsoft-Windows-VerifyHardwareSecurity/Operational
Microsoft-Windows-Volume/Diagnostic
Microsoft-Windows-VolumeSnapshot-Driver/Analytic
Microsoft-Windows-VolumeSnapshot-Driver/Operational
Microsoft-Windows-WER-PayloadHealth/Operational
Microsoft-Windows-WFP/Analytic
Microsoft-Windows-WFP/Operational
Microsoft-Windows-WMI-Activity/Debug
Microsoft-Windows-WMI-Activity/Operational
Microsoft-Windows-WMI-Activity/Trace
Microsoft-Windows-WUSA/Debug
Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic
Microsoft-Windows-WebIO-NDF/Diagnostic
Microsoft-Windows-WebIO/Diagnostic
Microsoft-Windows-WebServices/Tracing
Microsoft-Windows-Websocket-Protocol-Component/Tracing
Microsoft-Windows-Win32k/Concurrency
Microsoft-Windows-Win32k/Contention
Microsoft-Windows-Win32k/Messages
Microsoft-Windows-Win32k/Operational
Microsoft-Windows-Win32k/Power
Microsoft-Windows-Win32k/Render
Microsoft-Windows-Win32k/Tracing
Microsoft-Windows-Win32k/UIPI
Microsoft-Windows-WinHTTP-NDF/Diagnostic
Microsoft-Windows-WinHttp/Diagnostic
Microsoft-Windows-WinINet-Capture/Analytic
Microsoft-Windows-WinINet-Config/ProxyConfigChanged
Microsoft-Windows-WinINet/Analytic
Microsoft-Windows-WinINet/UsageLog
Microsoft-Windows-WinINet/WebSocket
Microsoft-Windows-WinNat/Oper
Microsoft-Windows-WinNat/Trace
Microsoft-Windows-WinRM/Analytic
Microsoft-Windows-WinRM/Debug
Microsoft-Windows-WinRM/Operational
Microsoft-Windows-WinURLMon/Analytic
Microsoft-Windows-Windeploy/Analytic
Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity
Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
Microsoft-Windows-Windows Firewall With Advanced Security/FirewallDiagnostics
Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose
Microsoft-Windows-WindowsColorSystem/Debug
Microsoft-Windows-WindowsColorSystem/Operational
Microsoft-Windows-WindowsUIImmersive/Diagnostic
Microsoft-Windows-WindowsUIImmersive/Operational
Microsoft-Windows-WindowsUpdateClient/Analytic
Microsoft-Windows-WindowsUpdateClient/Operational
Microsoft-Windows-Wininit/Diagnostic
Microsoft-Windows-Winlogon/Diagnostic
Microsoft-Windows-Winlogon/Operational
Microsoft-Windows-Winsock-AFD/Operational
Microsoft-Windows-Winsock-NameResolution/Operational
Microsoft-Windows-Winsock-WS2HELP/Operational
Microsoft-Windows-Winsrv/Analytic
Microsoft-Windows-Wnv/Trace
Microsoft-Windows-ntshrui
Microsoft-Windows-ntshrui-perf
Network Isolation Operational
OpenSSH/Admin
OpenSSH/Debug
OpenSSH/Operational
RTWorkQueueExtended
RTWorkQueueTheading
Security
Setup
SmbWmiAnalytic
System
SystemEventsBroker
TimeBroker
UIManager_Channel
WINDOWS_KS_CHANNEL
Windows PowerShell

    Doria

    Thursday, July 2, 2020 4:06 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    The following script will get all error events from the System event log:

    wevtutil qe System /rd:true /f:text /q:*[System[(Level=2)]] > C:\Temp\ErrorEvents.txt

    The following will get the last 10 errors events from the System event log:

    wevtutil qe System /rd:true /f:text /c:10 /q:*[System[(Level=2)]] > C:\Temp\ErrorEvents.txt


    Best regards,
    Leon

    Blog: https://thesystemcenterblog.com LinkedIn:

    Thursday, July 2, 2020 4:12 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks for your answer!

      However, it appears that it does not work for some other log files. I wonder why...

    Doria

    Friday, July 3, 2020 1:26 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Doria,

    Please remove /rd:true Parameter for UIManager_Channel and WINDOWS_KS_CHANNEL or set Direction to be false, then the command will work fine. As the picture below:

    Hope this can help you.

    Best Regards,

    Candy

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com   

    • Marked as answer by dydoria Friday, July 3, 2020 3:49 PM
    Friday, July 3, 2020 5:04 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    The following should work:

    wevtutil qe "Windows PowerShell" /q:"*[System[(Level=0)]]" /c:10 /rd:true /f:text >C:\Temp\PowerShellEvents.txt

    Blog: https://thesystemcenterblog.com LinkedIn:

    Friday, July 3, 2020 5:17 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Leon,

    This command doesn't work on UIManager_Channel and WINDOWS_KS_CHANNEL. It seems they cannot add /rd:true Parameter.

    Best Regards,

    Candy

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com   

    Friday, July 3, 2020 5:29 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    I don't have a "WINDOWS_KS_CHANNEL" event log to try with, but for PowerShell the command works at least, the /rd parameter is not a must have, so it can be left out.

    Blog: https://thesystemcenterblog.com LinkedIn:

    Friday, July 3, 2020 5:40 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Doria,

    Please remove /rd:true Parameter for UIManager_Channel and WINDOWS_KS_CHANNEL or set Direction to be false, then the command will work fine. As the picture below:

    Hope this can help you.

    Best Regards,

    Candy

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com   

      It did! Excellent!

    Thanks.

    Doria

    Friday, July 3, 2020 3:49 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks for all other answers, but after changing the parameter to false solved the issue. I take the opportunity to share the batch script.

    @echo off
rem by Doria

  echo dump OS log...
  for /f "delims=: tokens=1,2" %%i in (alllogs.txt) do %SystemRoot%\System32\wevtutil.exe qe "%%i" /rd:false /f:text /c:100 /q:*[System[(Level=2)]] > %%j.log
  exit /b

    Doria





    • Edited by dydoria Friday, July 3, 2020 4:03 PM
    Friday, July 3, 2020 3:58 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    You are welcome. ：）

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com   

    Friday, July 3, 2020 3:59 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    The 'alllogs.txt' file captured by '%SystemRoot%\System32\wevtutil.exe el' command. The delimiter and the second token were added later.

    AMSI/Debug:amsi_debug
Application:application
EndpointMapper:endpointmapper
FirstUXPerf-Analytic:firstuxperf_analytic
ForwardedEvents:forwardedevents
HardwareEvents:hardwareevents
Internet Explorer:internet_explorer
Key Management Service:key_management_service
Microsoft-Client-Licensing-Platform/Admin:microsoft_client_licensing_platform_admin
Microsoft-Client-Licensing-Platform/Debug:microsoft_client_licensing_platform_debug
Microsoft-Client-Licensing-Platform/Diagnostic:microsoft_client_licensing_platform_diagnostic
Microsoft-Management-UI/Admin:microsoft_management_ui_admin
Microsoft-Management-UI/Debug:microsoft_management_ui_debug
Microsoft-OneCore-Setup/Analytic:microsoft_onecore_setup_analytic
Microsoft-Pef-WFP-MessageProvider/Diagnostic:microsoft_pef_wfp_messageprovider_diagnostic
Microsoft-Rdms-UI/Admin:microsoft_rdms_ui_admin
Microsoft-Rdms-UI/Analytic:microsoft_rdms_ui_analytic
Microsoft-Rdms-UI/Debug:microsoft_rdms_ui_debug
Microsoft-Rdms-UI/Operational:microsoft_rdms_ui_operational
Microsoft-Windows-ADSI/Debug:microsoft_windows_adsi_debug
Microsoft-Windows-ASN1/Operational:microsoft_windows_asn1_operational
Microsoft-Windows-ATAPort/General:microsoft_windows_ataport_general
Microsoft-Windows-ATAPort/SATA-LPM:microsoft_windows_ataport_sata_lpm
Microsoft-Windows-ActionQueue/Analytic:microsoft_windows_actionqueue_analytic
Microsoft-Windows-All-User-Install-Agent/Admin:microsoft_windows_all_user_install_agent_admin
Microsoft-Windows-AppID/Operational:microsoft_windows_appid_operational
Microsoft-Windows-AppLocker/EXE and DLL:microsoft_windows_applocker_exe_and_dll
Microsoft-Windows-AppLocker/MSI and Script:microsoft_windows_applocker_msi_and_script
Microsoft-Windows-AppLocker/Packaged app-Deployment:microsoft_windows_applocker_packaged_app_deployment
Microsoft-Windows-AppLocker/Packaged app-Execution:microsoft_windows_applocker_packaged_app_execution
Microsoft-Windows-AppModel-Runtime/Admin:microsoft_windows_appmodel_runtime_admin
Microsoft-Windows-AppModel-Runtime/Analytic:microsoft_windows_appmodel_runtime_analytic
Microsoft-Windows-AppModel-Runtime/Debug:microsoft_windows_appmodel_runtime_debug
Microsoft-Windows-AppModel-Runtime/Diagnostics:microsoft_windows_appmodel_runtime_diagnostics
Microsoft-Windows-AppModel-State/Debug:microsoft_windows_appmodel_state_debug
Microsoft-Windows-AppModel-State/Diagnostic:microsoft_windows_appmodel_state_diagnostic
Microsoft-Windows-AppReadiness/Admin:microsoft_windows_appreadiness_admin
Microsoft-Windows-AppReadiness/Debug:microsoft_windows_appreadiness_debug
Microsoft-Windows-AppReadiness/Operational:microsoft_windows_appreadiness_operational
Microsoft-Windows-AppXDeployment/Diagnostic:microsoft_windows_appxdeployment_diagnostic
Microsoft-Windows-AppXDeployment/Operational:microsoft_windows_appxdeployment_operational
Microsoft-Windows-AppXDeploymentServer/Debug:microsoft_windows_appxdeploymentserver_debug
Microsoft-Windows-AppXDeploymentServer/Diagnostic:microsoft_windows_appxdeploymentserver_diagnostic
Microsoft-Windows-AppXDeploymentServer/Operational:microsoft_windows_appxdeploymentserver_operational
Microsoft-Windows-AppXDeploymentServer/Restricted:microsoft_windows_appxdeploymentserver_restricted
Microsoft-Windows-Application Server-Applications/Admin:microsoft_windows_application_server_applications_admin
Microsoft-Windows-Application Server-Applications/Analytic:microsoft_windows_application_server_applications_analytic
Microsoft-Windows-Application Server-Applications/Debug:microsoft_windows_application_server_applications_debug
Microsoft-Windows-Application Server-Applications/Operational:microsoft_windows_application_server_applications_operational
Microsoft-Windows-AppxPackaging/Debug:microsoft_windows_appxpackaging_debug
Microsoft-Windows-AppxPackaging/Operational:microsoft_windows_appxpackaging_operational
Microsoft-Windows-AppxPackaging/Performance:microsoft_windows_appxpackaging_performance
Microsoft-Windows-AsynchronousCausality/Causality:microsoft_windows_asynchronouscausality_causality
Microsoft-Windows-Audit/Analytic:microsoft_windows_audit_analytic
Microsoft-Windows-Authentication User Interface/Operational:microsoft_windows_authentication_user_interface_operational
Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController:microsoft_windows_authentication_authenticationpolicyfailures_domaincontroller
Microsoft-Windows-Authentication/ProtectedUser-Client:microsoft_windows_authentication_protecteduser_client
Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController:microsoft_windows_authentication_protecteduserfailures_domaincontroller
Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController:microsoft_windows_authentication_protectedusersuccesses_domaincontroller
Microsoft-Windows-Backup:microsoft_windows_backup
Microsoft-Windows-Base-Filtering-Engine-Connections/Operational:microsoft_windows_base_filtering_engine_connections_operational
Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational:microsoft_windows_base_filtering_engine_resource_flows_operational
Microsoft-Windows-Battery/Diagnostic:microsoft_windows_battery_diagnostic
Microsoft-Windows-BestPractices/Operational:microsoft_windows_bestpractices_operational
Microsoft-Windows-Bits-Client/Analytic:microsoft_windows_bits_client_analytic
Microsoft-Windows-Bits-Client/Operational:microsoft_windows_bits_client_operational
Microsoft-Windows-CAPI2/Catalog Database Debug:microsoft_windows_capi2_catalog_database_debug
Microsoft-Windows-CAPI2/Operational:microsoft_windows_capi2_operational
Microsoft-Windows-CDROM/Operational:microsoft_windows_cdrom_operational
Microsoft-Windows-COM/Analytic:microsoft_windows_com_analytic
Microsoft-Windows-COM/ApartmentInitialize:microsoft_windows_com_apartmentinitialize
Microsoft-Windows-COM/ApartmentUninitialize:microsoft_windows_com_apartmentuninitialize
Microsoft-Windows-COM/Call:microsoft_windows_com_call
Microsoft-Windows-COM/CreateInstance:microsoft_windows_com_createinstance
Microsoft-Windows-COM/ExtensionCatalog:microsoft_windows_com_extensioncatalog
Microsoft-Windows-COM/FreeUnusedLibrary:microsoft_windows_com_freeunusedlibrary
Microsoft-Windows-COM/RundownInstrumentation:microsoft_windows_com_rundowninstrumentation
Microsoft-Windows-COMRuntime/Activations:microsoft_windows_comruntime_activations
Microsoft-Windows-COMRuntime/MessageProcessing:microsoft_windows_comruntime_messageprocessing
Microsoft-Windows-COMRuntime/Tracing:microsoft_windows_comruntime_tracing
Microsoft-Windows-CertPoleEng/Operational:microsoft_windows_certpoleeng_operational
Microsoft-Windows-CertificateServices-Deployment/Operational:microsoft_windows_certificateservices_deployment_operational
Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational:microsoft_windows_certificateservicesclient_credentialroaming_operational
Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational:microsoft_windows_certificateservicesclient_lifecycle_system_operational
Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational:microsoft_windows_certificateservicesclient_lifecycle_user_operational
Microsoft-Windows-CmiSetup/Analytic:microsoft_windows_cmisetup_analytic
Microsoft-Windows-CodeIntegrity/Operational:microsoft_windows_codeintegrity_operational
Microsoft-Windows-CodeIntegrity/Verbose:microsoft_windows_codeintegrity_verbose
Microsoft-Windows-ComDlg32/Analytic:microsoft_windows_comdlg32_analytic
Microsoft-Windows-ComDlg32/Debug:microsoft_windows_comdlg32_debug
Microsoft-Windows-Containers-BindFlt/Debug:microsoft_windows_containers_bindflt_debug
Microsoft-Windows-Containers-BindFlt/Operational:microsoft_windows_containers_bindflt_operational
Microsoft-Windows-Containers-Wcifs/Debug:microsoft_windows_containers_wcifs_debug
Microsoft-Windows-Containers-Wcifs/Operational:microsoft_windows_containers_wcifs_operational
Microsoft-Windows-Containers-Wcnfs/Debug:microsoft_windows_containers_wcnfs_debug
Microsoft-Windows-Containers-Wcnfs/Operational:microsoft_windows_containers_wcnfs_operational
Microsoft-Windows-CoreApplication/Diagnostic:microsoft_windows_coreapplication_diagnostic
Microsoft-Windows-CoreApplication/Operational:microsoft_windows_coreapplication_operational
Microsoft-Windows-CoreApplication/Tracing:microsoft_windows_coreapplication_tracing
Microsoft-Windows-Crashdump/Operational:microsoft_windows_crashdump_operational
Microsoft-Windows-CredUI/Diagnostic:microsoft_windows_credui_diagnostic
Microsoft-Windows-Crypto-BCRYPT/Analytic:microsoft_windows_crypto_bcrypt_analytic
Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc:microsoft_windows_crypto_dpapi_backupkeysvc
Microsoft-Windows-Crypto-DPAPI/Debug:microsoft_windows_crypto_dpapi_debug
Microsoft-Windows-Crypto-DPAPI/Operational:microsoft_windows_crypto_dpapi_operational
Microsoft-Windows-Crypto-DSSEnh/Analytic:microsoft_windows_crypto_dssenh_analytic
Microsoft-Windows-Crypto-NCrypt/Operational:microsoft_windows_crypto_ncrypt_operational
Microsoft-Windows-Crypto-RSAEnh/Analytic:microsoft_windows_crypto_rsaenh_analytic
Microsoft-Windows-DAL-Provider/Analytic:microsoft_windows_dal_provider_analytic
Microsoft-Windows-DAL-Provider/Operational:microsoft_windows_dal_provider_operational
Microsoft-Windows-DCLocator/Debug:microsoft_windows_dclocator_debug
Microsoft-Windows-DNS-Client/Operational:microsoft_windows_dns_client_operational
Microsoft-Windows-DSC/Admin:microsoft_windows_dsc_admin
Microsoft-Windows-DSC/Analytic:microsoft_windows_dsc_analytic
Microsoft-Windows-DSC/Debug:microsoft_windows_dsc_debug
Microsoft-Windows-DSC/Operational:microsoft_windows_dsc_operational
Microsoft-Windows-DUI/Diagnostic:microsoft_windows_dui_diagnostic
Microsoft-Windows-DUSER/Diagnostic:microsoft_windows_duser_diagnostic
Microsoft-Windows-DXGI/Analytic:microsoft_windows_dxgi_analytic
Microsoft-Windows-DXGI/Logging:microsoft_windows_dxgi_logging
Microsoft-Windows-DataIntegrityScan/Admin:microsoft_windows_dataintegrityscan_admin
Microsoft-Windows-DataIntegrityScan/CrashRecovery:microsoft_windows_dataintegrityscan_crashrecovery
Microsoft-Windows-DateTimeControlPanel/Analytic:microsoft_windows_datetimecontrolpanel_analytic
Microsoft-Windows-DateTimeControlPanel/Debug:microsoft_windows_datetimecontrolpanel_debug
Microsoft-Windows-DateTimeControlPanel/Operational:microsoft_windows_datetimecontrolpanel_operational
Microsoft-Windows-Defrag-Core/Debug:microsoft_windows_defrag_core_debug
Microsoft-Windows-Deplorch/Analytic:microsoft_windows_deplorch_analytic
Microsoft-Windows-DeviceGuard/Operational:microsoft_windows_deviceguard_operational
Microsoft-Windows-DeviceUpdateAgent/Operational:microsoft_windows_deviceupdateagent_operational
Microsoft-Windows-Dhcp-Client/Admin:microsoft_windows_dhcp_client_admin
Microsoft-Windows-Dhcp-Client/Operational:microsoft_windows_dhcp_client_operational
Microsoft-Windows-Dhcpv6-Client/Admin:microsoft_windows_dhcpv6_client_admin
Microsoft-Windows-Dhcpv6-Client/Operational:microsoft_windows_dhcpv6_client_operational
Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic:microsoft_windows_diagnosis_advancedtaskmanager_analytic
Microsoft-Windows-Diagnosis-DPS/Analytic:microsoft_windows_diagnosis_dps_analytic
Microsoft-Windows-Diagnosis-DPS/Debug:microsoft_windows_diagnosis_dps_debug
Microsoft-Windows-Diagnosis-DPS/Operational:microsoft_windows_diagnosis_dps_operational
Microsoft-Windows-Diagnosis-PCW/Analytic:microsoft_windows_diagnosis_pcw_analytic
Microsoft-Windows-Diagnosis-PCW/Debug:microsoft_windows_diagnosis_pcw_debug
Microsoft-Windows-Diagnosis-PCW/Operational:microsoft_windows_diagnosis_pcw_operational
Microsoft-Windows-Diagnosis-PLA/Debug:microsoft_windows_diagnosis_pla_debug
Microsoft-Windows-Diagnosis-PLA/Operational:microsoft_windows_diagnosis_pla_operational
Microsoft-Windows-Diagnosis-Perfhost/Analytic:microsoft_windows_diagnosis_perfhost_analytic
Microsoft-Windows-Diagnosis-WDI/Debug:microsoft_windows_diagnosis_wdi_debug
Microsoft-Windows-Diagnostics-Networking/Debug:microsoft_windows_diagnostics_networking_debug
Microsoft-Windows-Diagnostics-Networking/Operational:microsoft_windows_diagnostics_networking_operational
Microsoft-Windows-Direct3D11/Analytic:microsoft_windows_direct3d11_analytic
Microsoft-Windows-Direct3D11/Logging:microsoft_windows_direct3d11_logging
Microsoft-Windows-Direct3D11/PerfTiming:microsoft_windows_direct3d11_perftiming
Microsoft-Windows-Direct3D12/Analytic:microsoft_windows_direct3d12_analytic
Microsoft-Windows-Direct3D12/Logging:microsoft_windows_direct3d12_logging
Microsoft-Windows-Direct3D12/PerfTiming:microsoft_windows_direct3d12_perftiming
Microsoft-Windows-Direct3D9/Analytic:microsoft_windows_direct3d9_analytic
Microsoft-Windows-DirectManipulation/Diagnostic:microsoft_windows_directmanipulation_diagnostic
Microsoft-Windows-DirectoryServices-Deployment/Operational:microsoft_windows_directoryservices_deployment_operational
Microsoft-Windows-Disk/Operational:microsoft_windows_disk_operational
Microsoft-Windows-Dism-Api/Analytic:microsoft_windows_dism_api_analytic
Microsoft-Windows-Dism-Api/ExternalAnalytic:microsoft_windows_dism_api_externalanalytic
Microsoft-Windows-Dism-Api/InternalAnalytic:microsoft_windows_dism_api_internalanalytic
Microsoft-Windows-Dism-Cli/Analytic:microsoft_windows_dism_cli_analytic
Microsoft-Windows-DriverFrameworks-UserMode/Operational:microsoft_windows_driverframeworks_usermode_operational
Microsoft-Windows-Dwm-API/Diagnostic:microsoft_windows_dwm_api_diagnostic
Microsoft-Windows-DxgKrnl/Contention:microsoft_windows_dxgkrnl_contention
Microsoft-Windows-DxgKrnl/Diagnostic:microsoft_windows_dxgkrnl_diagnostic
Microsoft-Windows-DxgKrnl/Performance:microsoft_windows_dxgkrnl_performance
Microsoft-Windows-DxgKrnl/Power:microsoft_windows_dxgkrnl_power
Microsoft-Windows-EFS/Debug:microsoft_windows_efs_debug
Microsoft-Windows-ESE/IODiagnose:microsoft_windows_ese_iodiagnose
Microsoft-Windows-ESE/Operational:microsoft_windows_ese_operational
Microsoft-Windows-EapHost/Analytic:microsoft_windows_eaphost_analytic
Microsoft-Windows-EapHost/Debug:microsoft_windows_eaphost_debug
Microsoft-Windows-EapHost/Operational:microsoft_windows_eaphost_operational
Microsoft-Windows-EapMethods-RasChap/Operational:microsoft_windows_eapmethods_raschap_operational
Microsoft-Windows-EapMethods-RasTls/Operational:microsoft_windows_eapmethods_rastls_operational
Microsoft-Windows-EapMethods-Sim/Operational:microsoft_windows_eapmethods_sim_operational
Microsoft-Windows-EapMethods-Ttls/Operational:microsoft_windows_eapmethods_ttls_operational
Microsoft-Windows-EventCollector/Debug:microsoft_windows_eventcollector_debug
Microsoft-Windows-EventCollector/Operational:microsoft_windows_eventcollector_operational
Microsoft-Windows-EventLog-WMIProvider/Debug:microsoft_windows_eventlog_wmiprovider_debug
Microsoft-Windows-EventLog/Analytic:microsoft_windows_eventlog_analytic
Microsoft-Windows-EventLog/Debug:microsoft_windows_eventlog_debug
Microsoft-Windows-FMS/Analytic:microsoft_windows_fms_analytic
Microsoft-Windows-FMS/Debug:microsoft_windows_fms_debug
Microsoft-Windows-FMS/Operational:microsoft_windows_fms_operational
Microsoft-Windows-FailoverClustering-Client/Diagnostic:microsoft_windows_failoverclustering_client_diagnostic
Microsoft-Windows-FeatureConfiguration/Analytic:microsoft_windows_featureconfiguration_analytic
Microsoft-Windows-FeatureConfiguration/Operational:microsoft_windows_featureconfiguration_operational
Microsoft-Windows-FederationServices-Deployment/Operational:microsoft_windows_federationservices_deployment_operational
Microsoft-Windows-FileInfoMinifilter/Operational:microsoft_windows_fileinfominifilter_operational
Microsoft-Windows-FileServices-ServerManager-EventProvider/Admin:microsoft_windows_fileservices_servermanager_eventprovider_admin
Microsoft-Windows-FileServices-ServerManager-EventProvider/Debug:microsoft_windows_fileservices_servermanager_eventprovider_debug
Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational:microsoft_windows_fileservices_servermanager_eventprovider_operational
Microsoft-Windows-FileShareShadowCopyProvider/Operational:microsoft_windows_fileshareshadowcopyprovider_operational
Microsoft-Windows-Forwarding/Debug:microsoft_windows_forwarding_debug
Microsoft-Windows-Forwarding/Operational:microsoft_windows_forwarding_operational
Microsoft-Windows-GPIO-ClassExtension/Analytic:microsoft_windows_gpio_classextension_analytic
Microsoft-Windows-GenericRoaming/Admin:microsoft_windows_genericroaming_admin
Microsoft-Windows-GroupPolicy/Operational:microsoft_windows_grouppolicy_operational
Microsoft-Windows-HAL/Debug:microsoft_windows_hal_debug
Microsoft-Windows-Help/Operational:microsoft_windows_help_operational
Microsoft-Windows-Host-Network-Service-Admin:microsoft_windows_host_network_service_admin
Microsoft-Windows-Host-Network-Service-Analytic:microsoft_windows_host_network_service_analytic
Microsoft-Windows-Host-Network-Service-Operational:microsoft_windows_host_network_service_operational
Microsoft-Windows-HttpService/Log:microsoft_windows_httpservice_log
Microsoft-Windows-HttpService/Trace:microsoft_windows_httpservice_trace
Microsoft-Windows-Hyper-V-Compute-Admin:microsoft_windows_hyper_v_compute_admin
Microsoft-Windows-Hyper-V-Compute-Analytic:microsoft_windows_hyper_v_compute_analytic
Microsoft-Windows-Hyper-V-Compute-Operational:microsoft_windows_hyper_v_compute_operational
Microsoft-Windows-Hyper-V-Guest-Drivers/Admin:microsoft_windows_hyper_v_guest_drivers_admin
Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic:microsoft_windows_hyper_v_guest_drivers_analytic
Microsoft-Windows-Hyper-V-Guest-Drivers/Debug:microsoft_windows_hyper_v_guest_drivers_debug
Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose:microsoft_windows_hyper_v_guest_drivers_diagnose
Microsoft-Windows-Hyper-V-Guest-Drivers/Operational:microsoft_windows_hyper_v_guest_drivers_operational
Microsoft-Windows-Hyper-V-Hypervisor-Admin:microsoft_windows_hyper_v_hypervisor_admin
Microsoft-Windows-Hyper-V-Hypervisor-Analytic:microsoft_windows_hyper_v_hypervisor_analytic
Microsoft-Windows-Hyper-V-Hypervisor-Operational:microsoft_windows_hyper_v_hypervisor_operational
Microsoft-Windows-Hyper-V-NETVSC/Diagnostic:microsoft_windows_hyper_v_netvsc_diagnostic
Microsoft-Windows-Hyper-V-VfpExt-Analytic:microsoft_windows_hyper_v_vfpext_analytic
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic:microsoft_windows_hyper_v_vmswitch_diagnostic
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic:microsoft_windows_hyper_v_vmswitch_diagnostic_traffic
Microsoft-Windows-Hyper-V-VmSwitch-Operational:microsoft_windows_hyper_v_vmswitch_operational
Microsoft-Windows-IKE/Operational:microsoft_windows_ike_operational
Microsoft-Windows-IKEDBG/Debug:microsoft_windows_ikedbg_debug
Microsoft-Windows-IME-Broker/Analytic:microsoft_windows_ime_broker_analytic
Microsoft-Windows-IME-CandidateUI/Analytic:microsoft_windows_ime_candidateui_analytic
Microsoft-Windows-IME-JPAPI/Analytic:microsoft_windows_ime_jpapi_analytic
Microsoft-Windows-IME-JPLMP/Analytic:microsoft_windows_ime_jplmp_analytic
Microsoft-Windows-IME-JPPRED/Analytic:microsoft_windows_ime_jppred_analytic
Microsoft-Windows-IME-JPTIP/Analytic:microsoft_windows_ime_jptip_analytic
Microsoft-Windows-IME-KRAPI/Analytic:microsoft_windows_ime_krapi_analytic
Microsoft-Windows-IME-KRTIP/Analytic:microsoft_windows_ime_krtip_analytic
Microsoft-Windows-IME-TCCORE/Analytic:microsoft_windows_ime_tccore_analytic
Microsoft-Windows-IME-TCTIP/Analytic:microsoft_windows_ime_tctip_analytic
Microsoft-Windows-IME-TIP/Analytic:microsoft_windows_ime_tip_analytic
Microsoft-Windows-IPNAT/Diagnostic:microsoft_windows_ipnat_diagnostic
Microsoft-Windows-IPSEC-SRV/Diagnostic:microsoft_windows_ipsec_srv_diagnostic
Microsoft-Windows-InputSwitch/Diagnostic:microsoft_windows_inputswitch_diagnostic
Microsoft-Windows-International-RegionalOptionsControlPanel/Operational:microsoft_windows_international_regionaloptionscontrolpanel_operational
Microsoft-Windows-International/Operational:microsoft_windows_international_operational
Microsoft-Windows-Iphlpsvc/Debug:microsoft_windows_iphlpsvc_debug
Microsoft-Windows-Iphlpsvc/Operational:microsoft_windows_iphlpsvc_operational
Microsoft-Windows-Iphlpsvc/Trace:microsoft_windows_iphlpsvc_trace
Microsoft-Windows-KdsSvc/Operational:microsoft_windows_kdssvc_operational
Microsoft-Windows-Kerberos-KdcProxy/Operational:microsoft_windows_kerberos_kdcproxy_operational
Microsoft-Windows-Kerberos/Operational:microsoft_windows_kerberos_operational
Microsoft-Windows-Kernel-Acpi/Diagnostic:microsoft_windows_kernel_acpi_diagnostic
Microsoft-Windows-Kernel-AppCompat/General:microsoft_windows_kernel_appcompat_general
Microsoft-Windows-Kernel-AppCompat/Performance:microsoft_windows_kernel_appcompat_performance
Microsoft-Windows-Kernel-ApphelpCache/Analytic:microsoft_windows_kernel_apphelpcache_analytic
Microsoft-Windows-Kernel-ApphelpCache/Debug:microsoft_windows_kernel_apphelpcache_debug
Microsoft-Windows-Kernel-ApphelpCache/Operational:microsoft_windows_kernel_apphelpcache_operational
Microsoft-Windows-Kernel-Boot/Analytic:microsoft_windows_kernel_boot_analytic
Microsoft-Windows-Kernel-Boot/Operational:microsoft_windows_kernel_boot_operational
Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic:microsoft_windows_kernel_bootdiagnostics_diagnostic
Microsoft-Windows-Kernel-Disk/Analytic:microsoft_windows_kernel_disk_analytic
Microsoft-Windows-Kernel-EventTracing/Admin:microsoft_windows_kernel_eventtracing_admin
Microsoft-Windows-Kernel-EventTracing/Analytic:microsoft_windows_kernel_eventtracing_analytic
Microsoft-Windows-Kernel-File/Analytic:microsoft_windows_kernel_file_analytic
Microsoft-Windows-Kernel-IO/Operational:microsoft_windows_kernel_io_operational
Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic:microsoft_windows_kernel_interrupt_steering_diagnostic
Microsoft-Windows-Kernel-IoTrace/Diagnostic:microsoft_windows_kernel_iotrace_diagnostic
Microsoft-Windows-Kernel-LiveDump/Analytic:microsoft_windows_kernel_livedump_analytic
Microsoft-Windows-Kernel-Memory/Analytic:microsoft_windows_kernel_memory_analytic
Microsoft-Windows-Kernel-Network/Analytic:microsoft_windows_kernel_network_analytic
Microsoft-Windows-Kernel-Pdc/Diagnostic:microsoft_windows_kernel_pdc_diagnostic
Microsoft-Windows-Kernel-Pep/Diagnostic:microsoft_windows_kernel_pep_diagnostic
Microsoft-Windows-Kernel-PnP/Boot Diagnostic:microsoft_windows_kernel_pnp_boot_diagnostic
Microsoft-Windows-Kernel-PnP/Configuration:microsoft_windows_kernel_pnp_configuration
Microsoft-Windows-Kernel-PnP/Configuration Diagnostic:microsoft_windows_kernel_pnp_configuration_diagnostic
Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic:microsoft_windows_kernel_pnp_device_enumeration_diagnostic
Microsoft-Windows-Kernel-PnP/Driver Diagnostic:microsoft_windows_kernel_pnp_driver_diagnostic
Microsoft-Windows-Kernel-Power/Diagnostic:microsoft_windows_kernel_power_diagnostic
Microsoft-Windows-Kernel-Power/Thermal-Diagnostic:microsoft_windows_kernel_power_thermal_diagnostic
Microsoft-Windows-Kernel-Power/Thermal-Operational:microsoft_windows_kernel_power_thermal_operational
Microsoft-Windows-Kernel-Prefetch/Diagnostic:microsoft_windows_kernel_prefetch_diagnostic
Microsoft-Windows-Kernel-Process/Analytic:microsoft_windows_kernel_process_analytic
Microsoft-Windows-Kernel-Processor-Power/Diagnostic:microsoft_windows_kernel_processor_power_diagnostic
Microsoft-Windows-Kernel-Registry/Analytic:microsoft_windows_kernel_registry_analytic
Microsoft-Windows-Kernel-Registry/Performance:microsoft_windows_kernel_registry_performance
Microsoft-Windows-Kernel-ShimEngine/Debug:microsoft_windows_kernel_shimengine_debug
Microsoft-Windows-Kernel-ShimEngine/Diagnostic:microsoft_windows_kernel_shimengine_diagnostic
Microsoft-Windows-Kernel-ShimEngine/Operational:microsoft_windows_kernel_shimengine_operational
Microsoft-Windows-Kernel-StoreMgr/Analytic:microsoft_windows_kernel_storemgr_analytic
Microsoft-Windows-Kernel-StoreMgr/Operational:microsoft_windows_kernel_storemgr_operational
Microsoft-Windows-Kernel-WDI/Analytic:microsoft_windows_kernel_wdi_analytic
Microsoft-Windows-Kernel-WDI/Debug:microsoft_windows_kernel_wdi_debug
Microsoft-Windows-Kernel-WDI/Operational:microsoft_windows_kernel_wdi_operational
Microsoft-Windows-Kernel-WHEA/Errors:microsoft_windows_kernel_whea_errors
Microsoft-Windows-Kernel-WHEA/Operational:microsoft_windows_kernel_whea_operational
Microsoft-Windows-Kernel-XDV/Analytic:microsoft_windows_kernel_xdv_analytic
Microsoft-Windows-Known Folders API Service:microsoft_windows_known_folders_api_service
Microsoft-Windows-L2NA/Diagnostic:microsoft_windows_l2na_diagnostic
Microsoft-Windows-LDAP-Client/Debug:microsoft_windows_ldap_client_debug
Microsoft-Windows-LSA/Diagnostic:microsoft_windows_lsa_diagnostic
Microsoft-Windows-LSA/Operational:microsoft_windows_lsa_operational
Microsoft-Windows-LSA/Performance:microsoft_windows_lsa_performance
Microsoft-Windows-LanguagePackSetup/Analytic:microsoft_windows_languagepacksetup_analytic
Microsoft-Windows-LanguagePackSetup/Debug:microsoft_windows_languagepacksetup_debug
Microsoft-Windows-LanguagePackSetup/Operational:microsoft_windows_languagepacksetup_operational
Microsoft-Windows-LimitsManagement/Diagnostic:microsoft_windows_limitsmanagement_diagnostic
Microsoft-Windows-MPS-CLNT/Diagnostic:microsoft_windows_mps_clnt_diagnostic
Microsoft-Windows-MPS-DRV/Diagnostic:microsoft_windows_mps_drv_diagnostic
Microsoft-Windows-MPS-SRV/Diagnostic:microsoft_windows_mps_srv_diagnostic
Microsoft-Windows-MSFTEDIT/Diagnostic:microsoft_windows_msftedit_diagnostic
Microsoft-Windows-MUI/Admin:microsoft_windows_mui_admin
Microsoft-Windows-MUI/Analytic:microsoft_windows_mui_analytic
Microsoft-Windows-MUI/Debug:microsoft_windows_mui_debug
Microsoft-Windows-MUI/Operational:microsoft_windows_mui_operational
Microsoft-Windows-ManagementTools-RegistryProvider/Analytic:microsoft_windows_managementtools_registryprovider_analytic
Microsoft-Windows-ManagementTools-RegistryProvider/Operational:microsoft_windows_managementtools_registryprovider_operational
Microsoft-Windows-ManagementTools-TaskManagerProvider/Analytic:microsoft_windows_managementtools_taskmanagerprovider_analytic
Microsoft-Windows-ManagementTools-TaskManagerProvider/Debug:microsoft_windows_managementtools_taskmanagerprovider_debug
Microsoft-Windows-ManagementTools-TaskManagerProvider/Operational:microsoft_windows_managementtools_taskmanagerprovider_operational
Microsoft-Windows-MiStreamProvider/Debug:microsoft_windows_mistreamprovider_debug
Microsoft-Windows-MiStreamProvider/Operational:microsoft_windows_mistreamprovider_operational
Microsoft-Windows-Minstore/Analytic:microsoft_windows_minstore_analytic
Microsoft-Windows-Minstore/Debug:microsoft_windows_minstore_debug
Microsoft-Windows-MsLbfoProvider/Operational:microsoft_windows_mslbfoprovider_operational
Microsoft-Windows-NDF-HelperClassDiscovery/Debug:microsoft_windows_ndf_helperclassdiscovery_debug
Microsoft-Windows-NDIS-PacketCapture/Diagnostic:microsoft_windows_ndis_packetcapture_diagnostic
Microsoft-Windows-NDIS/Diagnostic:microsoft_windows_ndis_diagnostic
Microsoft-Windows-NDIS/Operational:microsoft_windows_ndis_operational
Microsoft-Windows-NTLM/Operational:microsoft_windows_ntlm_operational
Microsoft-Windows-Ncasvc/Operational:microsoft_windows_ncasvc_operational
Microsoft-Windows-NdisImPlatform/Operational:microsoft_windows_ndisimplatform_operational
Microsoft-Windows-Network-Setup/Diagnostic:microsoft_windows_network_setup_diagnostic
Microsoft-Windows-NetworkProfile/Diagnostic:microsoft_windows_networkprofile_diagnostic
Microsoft-Windows-NetworkProfile/Operational:microsoft_windows_networkprofile_operational
Microsoft-Windows-NetworkProvider/Operational:microsoft_windows_networkprovider_operational
Microsoft-Windows-NetworkSecurity/Debug:microsoft_windows_networksecurity_debug
Microsoft-Windows-Networking-Correlation/Diagnostic:microsoft_windows_networking_correlation_diagnostic
Microsoft-Windows-NlaSvc/Diagnostic:microsoft_windows_nlasvc_diagnostic
Microsoft-Windows-NlaSvc/Operational:microsoft_windows_nlasvc_operational
Microsoft-Windows-Ntfs/Operational:microsoft_windows_ntfs_operational
Microsoft-Windows-Ntfs/Performance:microsoft_windows_ntfs_performance
Microsoft-Windows-Ntfs/WHC:microsoft_windows_ntfs_whc
Microsoft-Windows-OLE/Clipboard-Performance:microsoft_windows_ole_clipboard_performance
Microsoft-Windows-OLEACC/Debug:microsoft_windows_oleacc_debug
Microsoft-Windows-OLEACC/Diagnostic:microsoft_windows_oleacc_diagnostic
Microsoft-Windows-OOBE-Machine-Core/Diagnostic:microsoft_windows_oobe_machine_core_diagnostic
Microsoft-Windows-OobeLdr/Analytic:microsoft_windows_oobeldr_analytic
Microsoft-Windows-PCI/Diagnostic:microsoft_windows_pci_diagnostic
Microsoft-Windows-Partition/Analytic:microsoft_windows_partition_analytic
Microsoft-Windows-Partition/Diagnostic:microsoft_windows_partition_diagnostic
Microsoft-Windows-PersistentMemory-Nvdimm/Analytic:microsoft_windows_persistentmemory_nvdimm_analytic
Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic:microsoft_windows_persistentmemory_nvdimm_diagnostic
Microsoft-Windows-PersistentMemory-Nvdimm/Operational:microsoft_windows_persistentmemory_nvdimm_operational
Microsoft-Windows-PersistentMemory-PmemDisk/Analytic:microsoft_windows_persistentmemory_pmemdisk_analytic
Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic:microsoft_windows_persistentmemory_pmemdisk_diagnostic
Microsoft-Windows-PersistentMemory-PmemDisk/Operational:microsoft_windows_persistentmemory_pmemdisk_operational
Microsoft-Windows-PersistentMemory-ScmBus/Analytic:microsoft_windows_persistentmemory_scmbus_analytic
Microsoft-Windows-PersistentMemory-ScmBus/Certification:microsoft_windows_persistentmemory_scmbus_certification
Microsoft-Windows-PersistentMemory-ScmBus/Diagnose:microsoft_windows_persistentmemory_scmbus_diagnose
Microsoft-Windows-PersistentMemory-ScmBus/Operational:microsoft_windows_persistentmemory_scmbus_operational
Microsoft-Windows-Policy/Analytic:microsoft_windows_policy_analytic
Microsoft-Windows-Policy/Operational:microsoft_windows_policy_operational
Microsoft-Windows-Power-Meter-Polling/Diagnostic:microsoft_windows_power_meter_polling_diagnostic
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic:microsoft_windows_powershell_desiredstateconfiguration_filedownloadmanager_analytic
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug:microsoft_windows_powershell_desiredstateconfiguration_filedownloadmanager_debug
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational:microsoft_windows_powershell_desiredstateconfiguration_filedownloadmanager_operational
Microsoft-Windows-PowerShell/Admin:microsoft_windows_powershell_admin
Microsoft-Windows-PowerShell/Analytic:microsoft_windows_powershell_analytic
Microsoft-Windows-PowerShell/Debug:microsoft_windows_powershell_debug
Microsoft-Windows-PowerShell/Operational:microsoft_windows_powershell_operational
Microsoft-Windows-PriResources-Deployment/Diagnostic:microsoft_windows_priresources_deployment_diagnostic
Microsoft-Windows-PriResources-Deployment/Operational:microsoft_windows_priresources_deployment_operational
Microsoft-Windows-QoS-Pacer/Diagnostic:microsoft_windows_qos_pacer_diagnostic
Microsoft-Windows-RPC-Proxy/Debug:microsoft_windows_rpc_proxy_debug
Microsoft-Windows-RPC/Debug:microsoft_windows_rpc_debug
Microsoft-Windows-RPC/EEInfo:microsoft_windows_rpc_eeinfo
Microsoft-Windows-RRAS/Debug:microsoft_windows_rras_debug
Microsoft-Windows-RRAS/Operational:microsoft_windows_rras_operational
Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic:microsoft_windows_ras_ndiswanpacketcapture_diagnostic
Microsoft-Windows-RasAgileVpn/Debug:microsoft_windows_rasagilevpn_debug
Microsoft-Windows-RasAgileVpn/Operational:microsoft_windows_rasagilevpn_operational
Microsoft-Windows-ReFS/Operational:microsoft_windows_refs_operational
Microsoft-Windows-ReadyBoost/Analytic:microsoft_windows_readyboost_analytic
Microsoft-Windows-ReadyBoost/Operational:microsoft_windows_readyboost_operational
Microsoft-Windows-Regsvr32/Operational:microsoft_windows_regsvr32_operational
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin:microsoft_windows_remotedesktopservices_rdpcorets_admin
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug:microsoft_windows_remotedesktopservices_rdpcorets_debug
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational:microsoft_windows_remotedesktopservices_rdpcorets_operational
Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin:microsoft_windows_remotedesktopservices_remotefx_synth3dvsc_admin
Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug:microsoft_windows_remotedesktopservices_remotefx_vm_kernel_mode_transport_debug
Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug:microsoft_windows_remotedesktopservices_remotefx_vm_user_mode_transport_debug
Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational:microsoft_windows_remotedesktopservices_sessionservices_operational
Microsoft-Windows-Remotefs-Rdbss/Diagnostic:microsoft_windows_remotefs_rdbss_diagnostic
Microsoft-Windows-Remotefs-Rdbss/Operational:microsoft_windows_remotefs_rdbss_operational
Microsoft-Windows-Resource-Exhaustion-Detector/Operational:microsoft_windows_resource_exhaustion_detector_operational
Microsoft-Windows-RestartManager/Operational:microsoft_windows_restartmanager_operational
Microsoft-Windows-Runtime-Graphics/Analytic:microsoft_windows_runtime_graphics_analytic
Microsoft-Windows-Runtime/CreateInstance:microsoft_windows_runtime_createinstance
Microsoft-Windows-Runtime/Error:microsoft_windows_runtime_error
Microsoft-Windows-SENSE/Operational:microsoft_windows_sense_operational
Microsoft-Windows-SMBClient/Analytic:microsoft_windows_smbclient_analytic
Microsoft-Windows-SMBClient/HelperClassDiagnostic:microsoft_windows_smbclient_helperclassdiagnostic
Microsoft-Windows-SMBClient/ObjectStateDiagnostic:microsoft_windows_smbclient_objectstatediagnostic
Microsoft-Windows-SMBClient/Operational:microsoft_windows_smbclient_operational
Microsoft-Windows-SMBDirect/Admin:microsoft_windows_smbdirect_admin
Microsoft-Windows-SMBDirect/Debug:microsoft_windows_smbdirect_debug
Microsoft-Windows-SMBDirect/Netmon:microsoft_windows_smbdirect_netmon
Microsoft-Windows-SMBServer/Analytic:microsoft_windows_smbserver_analytic
Microsoft-Windows-SMBServer/Audit:microsoft_windows_smbserver_audit
Microsoft-Windows-SMBServer/Connectivity:microsoft_windows_smbserver_connectivity
Microsoft-Windows-SMBServer/Diagnostic:microsoft_windows_smbserver_diagnostic
Microsoft-Windows-SMBServer/Operational:microsoft_windows_smbserver_operational
Microsoft-Windows-SMBServer/Performance:microsoft_windows_smbserver_performance
Microsoft-Windows-SMBServer/Security:microsoft_windows_smbserver_security
Microsoft-Windows-SMBWitnessClient/Admin:microsoft_windows_smbwitnessclient_admin
Microsoft-Windows-SMBWitnessClient/Informational:microsoft_windows_smbwitnessclient_informational
Microsoft-Windows-SPB-ClassExtension/Analytic:microsoft_windows_spb_classextension_analytic
Microsoft-Windows-Schannel-Events/Perf:microsoft_windows_schannel_events_perf
Microsoft-Windows-Security-Adminless/Operational:microsoft_windows_security_adminless_operational
Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic:microsoft_windows_security_audit_configuration_client_diagnostic
Microsoft-Windows-Security-Audit-Configuration-Client/Operational:microsoft_windows_security_audit_configuration_client_operational
Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational:microsoft_windows_security_lessprivilegedappcontainer_operational
Microsoft-Windows-Security-Mitigations/KernelMode:microsoft_windows_security_mitigations_kernelmode
Microsoft-Windows-Security-Mitigations/UserMode:microsoft_windows_security_mitigations_usermode
Microsoft-Windows-Security-Netlogon/Operational:microsoft_windows_security_netlogon_operational
Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter:microsoft_windows_security_spp_ux_notifications_actioncenter
Microsoft-Windows-Security-SPP-UX/Analytic:microsoft_windows_security_spp_ux_analytic
Microsoft-Windows-Security-SPP/Perf:microsoft_windows_security_spp_perf
Microsoft-Windows-Security-Vault/Performance:microsoft_windows_security_vault_performance
Microsoft-Windows-Sens/Debug:microsoft_windows_sens_debug
Microsoft-Windows-SenseIR/Operational:microsoft_windows_senseir_operational
Microsoft-Windows-Serial-ClassExtension/Analytic:microsoft_windows_serial_classextension_analytic
Microsoft-Windows-ServerManager-ConfigureSMRemoting/Debug:microsoft_windows_servermanager_configuresmremoting_debug
Microsoft-Windows-ServerManager-ConfigureSMRemoting/Operational:microsoft_windows_servermanager_configuresmremoting_operational
Microsoft-Windows-ServerManager-DeploymentProvider/Debug:microsoft_windows_servermanager_deploymentprovider_debug
Microsoft-Windows-ServerManager-DeploymentProvider/Operational:microsoft_windows_servermanager_deploymentprovider_operational
Microsoft-Windows-ServerManager-MgmtProvider/Debug:microsoft_windows_servermanager_mgmtprovider_debug
Microsoft-Windows-ServerManager-MgmtProvider/Operational:microsoft_windows_servermanager_mgmtprovider_operational
Microsoft-Windows-ServerManager-MultiMachine/Admin:microsoft_windows_servermanager_multimachine_admin
Microsoft-Windows-ServerManager-MultiMachine/Debug:microsoft_windows_servermanager_multimachine_debug
Microsoft-Windows-ServerManager-MultiMachine/Operational:microsoft_windows_servermanager_multimachine_operational
Microsoft-Windows-ServiceReportingApi/Debug:microsoft_windows_servicereportingapi_debug
Microsoft-Windows-Services-Svchost/Diagnostic:microsoft_windows_services_svchost_diagnostic
Microsoft-Windows-Services/Diagnostic:microsoft_windows_services_diagnostic
Microsoft-Windows-Servicing/Debug:microsoft_windows_servicing_debug
Microsoft-Windows-Setup/Analytic:microsoft_windows_setup_analytic
Microsoft-Windows-SetupCl/Analytic:microsoft_windows_setupcl_analytic
Microsoft-Windows-SetupPlatform/Analytic:microsoft_windows_setupplatform_analytic
Microsoft-Windows-SetupQueue/Analytic:microsoft_windows_setupqueue_analytic
Microsoft-Windows-SetupUGC/Analytic:microsoft_windows_setupugc_analytic
Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic:microsoft_windows_shell_authui_bootanim_diagnostic
Microsoft-Windows-Shell-AuthUI-Common/Diagnostic:microsoft_windows_shell_authui_common_diagnostic
Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic:microsoft_windows_shell_authui_credui_diagnostic
Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic:microsoft_windows_shell_authui_credentialprovideruser_diagnostic
Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic:microsoft_windows_shell_authui_logon_diagnostic
Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic:microsoft_windows_shell_authui_logonui_diagnostic
Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic:microsoft_windows_shell_authui_shutdown_diagnostic
Microsoft-Windows-Shell-OpenWith/Diagnostic:microsoft_windows_shell_openwith_diagnostic
Microsoft-Windows-SilProvider/Debug:microsoft_windows_silprovider_debug
Microsoft-Windows-SilProvider/Operational:microsoft_windows_silprovider_operational
Microsoft-Windows-SleepStudy/Diagnostic:microsoft_windows_sleepstudy_diagnostic
Microsoft-Windows-SmartCard-Audit/Authentication:microsoft_windows_smartcard_audit_authentication
Microsoft-Windows-SmartCard-DeviceEnum/Operational:microsoft_windows_smartcard_deviceenum_operational
Microsoft-Windows-SmbClient/Audit:microsoft_windows_smbclient_audit
Microsoft-Windows-SmbClient/Connectivity:microsoft_windows_smbclient_connectivity
Microsoft-Windows-SmbClient/Diagnostic:microsoft_windows_smbclient_diagnostic
Microsoft-Windows-SmbClient/Security:microsoft_windows_smbclient_security
Microsoft-Windows-SruMon/Diagnostic:microsoft_windows_srumon_diagnostic
Microsoft-Windows-StateRepository/Debug:microsoft_windows_staterepository_debug
Microsoft-Windows-StateRepository/Diagnostic:microsoft_windows_staterepository_diagnostic
Microsoft-Windows-StateRepository/Operational:microsoft_windows_staterepository_operational
Microsoft-Windows-StateRepository/Restricted:microsoft_windows_staterepository_restricted
Microsoft-Windows-StorDiag/Operational:microsoft_windows_stordiag_operational
Microsoft-Windows-StorPort/Operational:microsoft_windows_storport_operational
Microsoft-Windows-Storage-ATAPort/Admin:microsoft_windows_storage_ataport_admin
Microsoft-Windows-Storage-ATAPort/Analytic:microsoft_windows_storage_ataport_analytic
Microsoft-Windows-Storage-ATAPort/Debug:microsoft_windows_storage_ataport_debug
Microsoft-Windows-Storage-ATAPort/Diagnose:microsoft_windows_storage_ataport_diagnose
Microsoft-Windows-Storage-ATAPort/Operational:microsoft_windows_storage_ataport_operational
Microsoft-Windows-Storage-ClassPnP/Admin:microsoft_windows_storage_classpnp_admin
Microsoft-Windows-Storage-ClassPnP/Analytic:microsoft_windows_storage_classpnp_analytic
Microsoft-Windows-Storage-ClassPnP/Debug:microsoft_windows_storage_classpnp_debug
Microsoft-Windows-Storage-ClassPnP/Diagnose:microsoft_windows_storage_classpnp_diagnose
Microsoft-Windows-Storage-ClassPnP/Operational:microsoft_windows_storage_classpnp_operational
Microsoft-Windows-Storage-Disk/Admin:microsoft_windows_storage_disk_admin
Microsoft-Windows-Storage-Disk/Analytic:microsoft_windows_storage_disk_analytic
Microsoft-Windows-Storage-Disk/Debug:microsoft_windows_storage_disk_debug
Microsoft-Windows-Storage-Disk/Diagnose:microsoft_windows_storage_disk_diagnose
Microsoft-Windows-Storage-Disk/Operational:microsoft_windows_storage_disk_operational
Microsoft-Windows-Storage-Storport/Admin:microsoft_windows_storage_storport_admin
Microsoft-Windows-Storage-Storport/Analytic:microsoft_windows_storage_storport_analytic
Microsoft-Windows-Storage-Storport/Debug:microsoft_windows_storage_storport_debug
Microsoft-Windows-Storage-Storport/Diagnose:microsoft_windows_storage_storport_diagnose
Microsoft-Windows-Storage-Storport/Health:microsoft_windows_storage_storport_health
Microsoft-Windows-Storage-Storport/Operational:microsoft_windows_storage_storport_operational
Microsoft-Windows-Storage-Tiering-IoHeat/Heat:microsoft_windows_storage_tiering_ioheat_heat
Microsoft-Windows-Storage-Tiering/Admin:microsoft_windows_storage_tiering_admin
Microsoft-Windows-StorageManagement/Debug:microsoft_windows_storagemanagement_debug
Microsoft-Windows-StorageManagement/Operational:microsoft_windows_storagemanagement_operational
Microsoft-Windows-StorageSpaces-Driver/Diagnostic:microsoft_windows_storagespaces_driver_diagnostic
Microsoft-Windows-StorageSpaces-Driver/Operational:microsoft_windows_storagespaces_driver_operational
Microsoft-Windows-StorageSpaces-Driver/Performance:microsoft_windows_storagespaces_driver_performance
Microsoft-Windows-StorageSpaces-ManagementAgent/WHC:microsoft_windows_storagespaces_managementagent_whc
Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic:microsoft_windows_storagespaces_spacemanager_diagnostic
Microsoft-Windows-StorageSpaces-SpaceManager/Operational:microsoft_windows_storagespaces_spacemanager_operational
Microsoft-Windows-Subsys-Csr/Operational:microsoft_windows_subsys_csr_operational
Microsoft-Windows-Subsys-SMSS/Operational:microsoft_windows_subsys_smss_operational
Microsoft-Windows-Superfetch/Main:microsoft_windows_superfetch_main
Microsoft-Windows-Superfetch/PfApLog:microsoft_windows_superfetch_pfaplog
Microsoft-Windows-Superfetch/StoreLog:microsoft_windows_superfetch_storelog
Microsoft-Windows-Sysprep/Analytic:microsoft_windows_sysprep_analytic
Microsoft-Windows-SystemDataArchiver/Diagnostic:microsoft_windows_systemdataarchiver_diagnostic
Microsoft-Windows-TCPIP/Diagnostic:microsoft_windows_tcpip_diagnostic
Microsoft-Windows-TCPIP/Operational:microsoft_windows_tcpip_operational
Microsoft-Windows-TSF-msctf/Debug:microsoft_windows_tsf_msctf_debug
Microsoft-Windows-TSF-msctf/Diagnostic:microsoft_windows_tsf_msctf_diagnostic
Microsoft-Windows-TSF-msutb/Debug:microsoft_windows_tsf_msutb_debug
Microsoft-Windows-TSF-msutb/Diagnostic:microsoft_windows_tsf_msutb_diagnostic
Microsoft-Windows-TWinAPI/Diagnostic:microsoft_windows_twinapi_diagnostic
Microsoft-Windows-TZSync/Analytic:microsoft_windows_tzsync_analytic
Microsoft-Windows-TZSync/Operational:microsoft_windows_tzsync_operational
Microsoft-Windows-TZUtil/Operational:microsoft_windows_tzutil_operational
Microsoft-Windows-TaskScheduler/Debug:microsoft_windows_taskscheduler_debug
Microsoft-Windows-TaskScheduler/Diagnostic:microsoft_windows_taskscheduler_diagnostic
Microsoft-Windows-TaskScheduler/Maintenance:microsoft_windows_taskscheduler_maintenance
Microsoft-Windows-TaskScheduler/Operational:microsoft_windows_taskscheduler_operational
Microsoft-Windows-TerminalServices-LocalSessionManager/Admin:microsoft_windows_terminalservices_localsessionmanager_admin
Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic:microsoft_windows_terminalservices_localsessionmanager_analytic
Microsoft-Windows-TerminalServices-LocalSessionManager/Debug:microsoft_windows_terminalservices_localsessionmanager_debug
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational:microsoft_windows_terminalservices_localsessionmanager_operational
Microsoft-Windows-TerminalServices-PnPDevices/Admin:microsoft_windows_terminalservices_pnpdevices_admin
Microsoft-Windows-TerminalServices-PnPDevices/Analytic:microsoft_windows_terminalservices_pnpdevices_analytic
Microsoft-Windows-TerminalServices-PnPDevices/Debug:microsoft_windows_terminalservices_pnpdevices_debug
Microsoft-Windows-TerminalServices-PnPDevices/Operational:microsoft_windows_terminalservices_pnpdevices_operational
Microsoft-Windows-TerminalServices-Printers/Admin:microsoft_windows_terminalservices_printers_admin
Microsoft-Windows-TerminalServices-Printers/Analytic:microsoft_windows_terminalservices_printers_analytic
Microsoft-Windows-TerminalServices-Printers/Debug:microsoft_windows_terminalservices_printers_debug
Microsoft-Windows-TerminalServices-Printers/Operational:microsoft_windows_terminalservices_printers_operational
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin:microsoft_windows_terminalservices_remoteconnectionmanager_admin
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic:microsoft_windows_terminalservices_remoteconnectionmanager_analytic
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug:microsoft_windows_terminalservices_remoteconnectionmanager_debug
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational:microsoft_windows_terminalservices_remoteconnectionmanager_operational
Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin:microsoft_windows_terminalservices_serverusbdevices_admin
Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic:microsoft_windows_terminalservices_serverusbdevices_analytic
Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug:microsoft_windows_terminalservices_serverusbdevices_debug
Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational:microsoft_windows_terminalservices_serverusbdevices_operational
Microsoft-Windows-TerminalServices-SessionBroker-Client/Admin:microsoft_windows_terminalservices_sessionbroker_client_admin
Microsoft-Windows-TerminalServices-SessionBroker-Client/Analytic:microsoft_windows_terminalservices_sessionbroker_client_analytic
Microsoft-Windows-TerminalServices-SessionBroker-Client/Debug:microsoft_windows_terminalservices_sessionbroker_client_debug
Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational:microsoft_windows_terminalservices_sessionbroker_client_operational
Microsoft-Windows-Threat-Intelligence/Analytic:microsoft_windows_threat_intelligence_analytic
Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational:microsoft_windows_time_service_ptp_provider_ptp_operational
Microsoft-Windows-Time-Service/Operational:microsoft_windows_time_service_operational
Microsoft-Windows-TunnelDriver:microsoft_windows_tunneldriver
Microsoft-Windows-UAC/Operational:microsoft_windows_uac_operational
Microsoft-Windows-UIAutomationCore/Debug:microsoft_windows_uiautomationcore_debug
Microsoft-Windows-UIAutomationCore/Diagnostic:microsoft_windows_uiautomationcore_diagnostic
Microsoft-Windows-UIAutomationCore/Perf:microsoft_windows_uiautomationcore_perf
Microsoft-Windows-USB-UCX-Analytic:microsoft_windows_usb_ucx_analytic
Microsoft-Windows-UniversalTelemetryClient/Operational:microsoft_windows_universaltelemetryclient_operational
Microsoft-Windows-User Profile Service/Diagnostic:microsoft_windows_user_profile_service_diagnostic
Microsoft-Windows-User Profile Service/Operational:microsoft_windows_user_profile_service_operational
Microsoft-Windows-User-Loader/Analytic:microsoft_windows_user_loader_analytic
Microsoft-Windows-User-Loader/Operational:microsoft_windows_user_loader_operational
Microsoft-Windows-UserModePowerService/Diagnostic:microsoft_windows_usermodepowerservice_diagnostic
Microsoft-Windows-UserPnp/ActionCenter:microsoft_windows_userpnp_actioncenter
Microsoft-Windows-UserPnp/DeviceInstall:microsoft_windows_userpnp_deviceinstall
Microsoft-Windows-UserPnp/DeviceMetadata/Debug:microsoft_windows_userpnp_devicemetadata_debug
Microsoft-Windows-UserPnp/Performance:microsoft_windows_userpnp_performance
Microsoft-Windows-UserPnp/SchedulerOperations:microsoft_windows_userpnp_scheduleroperations
Microsoft-Windows-VDRVROOT/Operational:microsoft_windows_vdrvroot_operational
Microsoft-Windows-VHDMP-Analytic:microsoft_windows_vhdmp_analytic
Microsoft-Windows-VHDMP-Operational:microsoft_windows_vhdmp_operational
Microsoft-Windows-VIRTDISK-Analytic:microsoft_windows_virtdisk_analytic
Microsoft-Windows-VPN/Operational:microsoft_windows_vpn_operational
Microsoft-Windows-VerifyHardwareSecurity/Admin:microsoft_windows_verifyhardwaresecurity_admin
Microsoft-Windows-VerifyHardwareSecurity/Operational:microsoft_windows_verifyhardwaresecurity_operational
Microsoft-Windows-Volume/Diagnostic:microsoft_windows_volume_diagnostic
Microsoft-Windows-VolumeSnapshot-Driver/Analytic:microsoft_windows_volumesnapshot_driver_analytic
Microsoft-Windows-VolumeSnapshot-Driver/Operational:microsoft_windows_volumesnapshot_driver_operational
Microsoft-Windows-WER-PayloadHealth/Operational:microsoft_windows_wer_payloadhealth_operational
Microsoft-Windows-WFP/Analytic:microsoft_windows_wfp_analytic
Microsoft-Windows-WFP/Operational:microsoft_windows_wfp_operational
Microsoft-Windows-WMI-Activity/Debug:microsoft_windows_wmi_activity_debug
Microsoft-Windows-WMI-Activity/Operational:microsoft_windows_wmi_activity_operational
Microsoft-Windows-WMI-Activity/Trace:microsoft_windows_wmi_activity_trace
Microsoft-Windows-WUSA/Debug:microsoft_windows_wusa_debug
Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic:microsoft_windows_wwan_ndisuio_events_diagnostic
Microsoft-Windows-WebIO-NDF/Diagnostic:microsoft_windows_webio_ndf_diagnostic
Microsoft-Windows-WebIO/Diagnostic:microsoft_windows_webio_diagnostic
Microsoft-Windows-WebServices/Tracing:microsoft_windows_webservices_tracing
Microsoft-Windows-Websocket-Protocol-Component/Tracing:microsoft_windows_websocket_protocol_component_tracing
Microsoft-Windows-Win32k/Concurrency:microsoft_windows_win32k_concurrency
Microsoft-Windows-Win32k/Contention:microsoft_windows_win32k_contention
Microsoft-Windows-Win32k/Messages:microsoft_windows_win32k_messages
Microsoft-Windows-Win32k/Operational:microsoft_windows_win32k_operational
Microsoft-Windows-Win32k/Power:microsoft_windows_win32k_power
Microsoft-Windows-Win32k/Render:microsoft_windows_win32k_render
Microsoft-Windows-Win32k/Tracing:microsoft_windows_win32k_tracing
Microsoft-Windows-Win32k/UIPI:microsoft_windows_win32k_uipi
Microsoft-Windows-WinHTTP-NDF/Diagnostic:microsoft_windows_winhttp_ndf_diagnostic
Microsoft-Windows-WinHttp/Diagnostic:microsoft_windows_winhttp_diagnostic
Microsoft-Windows-WinINet-Capture/Analytic:microsoft_windows_wininet_capture_analytic
Microsoft-Windows-WinINet-Config/ProxyConfigChanged:microsoft_windows_wininet_config_proxyconfigchanged
Microsoft-Windows-WinINet/Analytic:microsoft_windows_wininet_analytic
Microsoft-Windows-WinINet/UsageLog:microsoft_windows_wininet_usagelog
Microsoft-Windows-WinINet/WebSocket:microsoft_windows_wininet_websocket
Microsoft-Windows-WinNat/Oper:microsoft_windows_winnat_oper
Microsoft-Windows-WinNat/Trace:microsoft_windows_winnat_trace
Microsoft-Windows-WinRM/Analytic:microsoft_windows_winrm_analytic
Microsoft-Windows-WinRM/Debug:microsoft_windows_winrm_debug
Microsoft-Windows-WinRM/Operational:microsoft_windows_winrm_operational
Microsoft-Windows-WinURLMon/Analytic:microsoft_windows_winurlmon_analytic
Microsoft-Windows-Windeploy/Analytic:microsoft_windows_windeploy_analytic
Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity:microsoft_windows_windows_firewall_with_advanced_security_connectionsecurity
Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose:microsoft_windows_windows_firewall_with_advanced_security_connectionsecurityverbose
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall:microsoft_windows_windows_firewall_with_advanced_security_firewall
Microsoft-Windows-Windows Firewall With Advanced Security/FirewallDiagnostics:microsoft_windows_windows_firewall_with_advanced_security_firewalldiagnostics
Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose:microsoft_windows_windows_firewall_with_advanced_security_firewallverbose
Microsoft-Windows-WindowsColorSystem/Debug:microsoft_windows_windowscolorsystem_debug
Microsoft-Windows-WindowsColorSystem/Operational:microsoft_windows_windowscolorsystem_operational
Microsoft-Windows-WindowsUIImmersive/Diagnostic:microsoft_windows_windowsuiimmersive_diagnostic
Microsoft-Windows-WindowsUIImmersive/Operational:microsoft_windows_windowsuiimmersive_operational
Microsoft-Windows-WindowsUpdateClient/Analytic:microsoft_windows_windowsupdateclient_analytic
Microsoft-Windows-WindowsUpdateClient/Operational:microsoft_windows_windowsupdateclient_operational
Microsoft-Windows-Wininit/Diagnostic:microsoft_windows_wininit_diagnostic
Microsoft-Windows-Winlogon/Diagnostic:microsoft_windows_winlogon_diagnostic
Microsoft-Windows-Winlogon/Operational:microsoft_windows_winlogon_operational
Microsoft-Windows-Winsock-AFD/Operational:microsoft_windows_winsock_afd_operational
Microsoft-Windows-Winsock-NameResolution/Operational:microsoft_windows_winsock_nameresolution_operational
Microsoft-Windows-Winsock-WS2HELP/Operational:microsoft_windows_winsock_ws2help_operational
Microsoft-Windows-Winsrv/Analytic:microsoft_windows_winsrv_analytic
Microsoft-Windows-Wnv/Trace:microsoft_windows_wnv_trace
Microsoft-Windows-ntshrui:microsoft_windows_ntshrui
Microsoft-Windows-ntshrui-perf:microsoft_windows_ntshrui_perf
Network Isolation Operational:network_isolation_operational
OpenSSH/Admin:openssh_admin
OpenSSH/Debug:openssh_debug
OpenSSH/Operational:openssh_operational
RTWorkQueueExtended:rtworkqueueextended
RTWorkQueueTheading:rtworkqueuetheading
Security:security
Setup:setup
SmbWmiAnalytic:smbwmianalytic
System:system
SystemEventsBroker:systemeventsbroker
TimeBroker:timebroker
UIManager_Channel:uimanager_channel
WINDOWS_KS_CHANNEL:windows_ks_channel
Windows PowerShell:windows_powershell

    Doria

    Friday, July 3, 2020 4:06 PM