????
Your IP : 3.148.179.161
��#pragma autorecover
#pragma classflags(64)
#pragma namespace("\\\\.\\Root\\WMI")
[Dynamic,Description("IIS: WWW Server"),Guid("{3a2a4e84-4c21-4981-ae10-3fda0d9b0f83}"),locale("MS\\0x409")]
class IIS_Trace : EventTrace
{
[DefineValues{"ETW_IIS_PER_URL", "ETW_IIS_AUTHENTICATION", "ETW_IIS_SECURITY", "ETW_IIS_FILTER", "ETW_IIS_STATIC_FILE", "ETW_IIS_CGI", "ETW_IIS_COMPRESSION", "ETW_IIS_CACHE", "ETW_IIS_REQUEST_NOTIFICATION", "ETW_IIS_MODULE", "ETW_IIS_FASTCGI", "ETW_IIS_ISAPI", "ETW_IIS_WEBSOCKET", "ETW_IIS_GENERAL", "ETW_IIS_ALL"},Values{"UseUrlFilter", "IISAuthentication", "IISSecurity", "IISFilter", "IISStaticFile", "IISCGI", "IISCompression", "IISCache", "IISRequestNotification", "IISModule", "IISFastCGI", "IISISAPI", "IISWebSocket", "IISGeneral", "IISAll"},ValueMap{"0x0001", "0x0002", "0x0004", "0x0008", "0x0010", "0x0020", "0x0040", "0x0080", "0x0100", "0x0200", "0x1000", "0x2000", "0x4000", "0x0000", "0x4FFE"}] uint32 Flags;
[DefineValues{"TRACE_LEVEL_FATAL", "TRACE_LEVEL_ERROR", "TRACE_LEVEL_WARNING", "TRACE_LEVEL_INFORMATION", "TRACE_LEVEL_VERBOSE"},Values{"Fatal", "Error", "Warning", "Information", "Verbose"},ValueMap{"0x1", "0x2", "0x3", "0x4", "0x5"},ValueType("index")] uint32 Level;
};
[Dynamic,Guid("{d42cf7ef-de92-473e-8b6c-621ea663113a}"),EventVersion(1),DisplayName("IISGeneral"),EventHttpRequest,locale("MS\\0x409")]
class IIS_Trans : IIS_Trace
{
};
[Dynamic,EventType(1),EventLevel(0)]
class W3GeneralStartNewRequest : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 SiteId;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string AppPoolId;
[WmiDataId(4),read] uint64 ConnId;
[WmiDataId(5),read] uint64 RawConnId;
[WmiDataId(6),StringTermination("NullTerminated"),format("w"),read] string RequestURL;
[WmiDataId(7),StringTermination("NullTerminated"),read] string RequestVerb;
};
[Dynamic,EventType(2),EventLevel(0)]
class W3GeneralEndNewRequest : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 BytesSent;
[WmiDataId(3),read] uint32 BytesReceived;
[WmiDataId(4),read] uint32 HttpStatus;
[WmiDataId(5),read] uint16 HttpSubStatus;
};
[Dynamic,EventType(10),EventLevel(0)]
class W3GeneralStaticFileHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
};
[Dynamic,EventType(11),EventLevel(0)]
class W3GeneralCGIHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(12),EventLevel(0)]
class W3GeneralISAPIHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(13),EventLevel(0)]
class W3GeneralOopISAPIHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 ProcessId;
[WmiDataId(3),read] uint32 TotalReqs;
[WmiDataId(4),read] uint32 CurrentReqs;
};
[Dynamic,EventType(14),EventLevel(0)]
class W3GeneralRedirectionHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string RedirectedURL;
};
[Dynamic,EventType(15),EventLevel(0)]
class W3GeneralDavHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
};
[Dynamic,EventType(16),EventLevel(0)]
class W3GeneralOptionsHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(17),EventLevel(0)]
class W3GeneralTraceHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(18),EventLevel(0)]
class W3GeneralHstsHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"HSTS_REDIRECT_HTTP_TO_HTTPS", "HSTS_ADD_HSTS_RESPONSE_HEADER"},Values{"HSTS_REDIRECT_HTTP_TO_HTTPS", "HSTS_ADD_HSTS_RESPONSE_HEADER"},ValueMap{"0", "1"},ValueType("index")] uint32 HstsOperation;
};
[Dynamic,EventType(30),EventLevel(4)]
class W3GeneralGetURLMetadata : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string PhysicalPath;
[WmiDataId(3),DefineValues{"MD_ACCESS_READ", "MD_ACCESS_WRITE", "MD_ACCESS_EXECUTE", "MD_ACCESS_SOURCE", "MD_ACCESS_SCRIPT", "MD_ACCESS_NO_REMOTE_WRITE", "MD_ACCESS_NO_REMOTE_READ", "MD_ACCESS_NO_REMOTE_EXECUTE", "MD_ACCESS_NO_REMOTE_SCRIPT", "MD_ACCESS_NO_PHYSICAL_DIR", "MD_ACCESS_SSL", "MD_ACCESS_NEGO_CERT", "MD_ACCESS_REQUIRE_CERT", "MD_ACCESS_MAP_CERT", "MD_ACCESS_SSL128"},Values{"Read", "Write", "Exec", "Source", "Script", "NoRemoteWrite", "NoRemoteRead", "NoRemoteExec", "NoRemoteScript", "NoPhysicalDir", "SSL", "CliCert", "ReqCliCert", "MapCliCert", "SSL128"},ValueMap{"0x00001", "0x00002", "0x00004", "0x00010", "0x00200", "0x00400", "0x01000", "0x02000", "0x04000", "0x08000", "0x00008", "0x00020", "0x00040", "0x00080", "0x00100"},format("x"),read] uint32 AccessPerms;
};
[Dynamic,EventType(31),EventLevel(0)]
class W3GeneralChildRequestStart : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 SiteId;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string RequestURL;
[WmiDataId(4),StringTermination("NullTerminated"),read] string RequestVerb;
[WmiDataId(5),read] uint32 RecursiveLevel;
};
[Dynamic,EventType(32),EventLevel(0)]
class W3GeneralChildRequestEnd : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 BytesSent;
[WmiDataId(3),read] uint32 HttpStatus;
[WmiDataId(4),read] uint16 HttpSubStatus;
};
[Dynamic,EventType(33),EventLevel(0)]
class W3GeneralSendCustomError : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 HttpStatus;
[WmiDataId(3),read] uint16 HttpSubStatus;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string FileNameOrURL;
};
[Dynamic,EventType(34),EventLevel(0)]
class W3GeneralMapHandler : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(35),EventLevel(4)]
class W3GeneralFlushResponseStart : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(36),EventLevel(4)]
class W3GeneralFlushResponseEnd : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 BytesSent;
[WmiDataId(3),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(37),EventLevel(4)]
class W3GeneralReadEntityStart : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(38),EventLevel(4)]
class W3GeneralReadEntityEnd : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 BytesReceived;
[WmiDataId(3),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(39),EventLevel(4)]
class IISGeneralFileChangeNotification : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FilePath;
};
[Dynamic,EventType(40),EventLevel(4)]
class IISGeneralConfigChangeNotification : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ConfigPath;
};
[Dynamic,EventType(41),EventLevel(4)]
class IISGeneralVirtualModuleUnresolved : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string Name;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Type;
};
[Dynamic,EventType(42),EventLevel(4)]
class IISGeneralUrlChanged : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string OldUrl;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string NewUrl;
};
[Dynamic,EventType(43),EventLevel(4)]
class IISGeneralHandlerChanged : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string OldHandlerName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string NewHandlerName;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string NewHandlerModules;
[WmiDataId(5),StringTermination("NullTerminated"),format("w"),read] string NewHandlerScriptProcessor;
[WmiDataId(6),StringTermination("NullTerminated"),format("w"),read] string NewHandlerType;
};
[Dynamic,EventType(44),EventLevel(4)]
class IISGeneralUserSet : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string AuthType;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string UserName;
[WmiDataId(4),read] boolean SupportsIsInRole;
};
[Dynamic,EventType(45),EventLevel(4)]
class IISGeneralModulePreconditionNotMatch : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string Name;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Precondition;
};
[Dynamic,EventType(46),EventLevel(4)]
class IISGeneralHandlerPreconditionNotMatch : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string Name;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Precondition;
};
[Dynamic,EventType(47),EventLevel(4)]
class W3GeneralResponseHeaders : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("a"),read] string Headers;
};
[Dynamic,EventType(48),EventLevel(5)]
class W3GeneralResponseEntityFile : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
[WmiDataId(3),read] uint64 Offset;
[WmiDataId(4),read] uint64 Size;
};
[Dynamic,EventType(49),EventLevel(5)]
class W3GeneralResponseEntityBuffer : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("a"),read] string Buffer;
};
[Dynamic,EventType(50),EventLevel(4)]
class W3GeneralRequestHeaders : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("a"),read] string Headers;
};
[Dynamic,EventType(51),EventLevel(5)]
class W3GeneralRequestEntity : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("a"),read] string Buffer;
};
[Dynamic,EventType(52),EventLevel(5)]
class W3GeneralNotSendCustomError : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"UNKNOWN", "SETSTATUS_SUCCESS", "SETSTATUS_TRYSKIP", "EXISTINGRESPONSE_PASSTHROUGH", "EXISTINGRESPONSE_AUTO"},Values{"UNKNOWN", "SETSTATUS_SUCCESS", "SETSTATUS_TRYSKIP", "EXISTINGRESPONSE_PASSTHROUGH", "EXISTINGRESPONSE_AUTO"},ValueMap{"0", "1", "2", "3", "4"},ValueType("index")] uint32 Reason;
};
[Dynamic,EventType(53),EventLevel(5)]
class W3GeneralSetRequestHeader : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string HeaderName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string HeaderValue;
[WmiDataId(4),read] boolean Replace;
};
[Dynamic,EventType(54),EventLevel(2)]
class W3GeneralModuleFactoryFailed : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(55),EventLevel(4)]
class W3GeneralEndpointInformation : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("a"),read] string RemoteAddress;
[WmiDataId(3),StringTermination("NullTerminated"),format("a"),read] string RemotePort;
[WmiDataId(4),StringTermination("NullTerminated"),format("a"),read] string LocalAddress;
[WmiDataId(5),StringTermination("NullTerminated"),format("a"),read] string LocalPort;
};
[Dynamic,EventType(56),EventLevel(4)]
class W3GeneralSetResponseHeader : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string HeaderName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string HeaderValue;
[WmiDataId(4),read] boolean Replace;
};
[Dynamic,EventType(57),EventLevel(4)]
class W3GeneralSetResponseTrailer : IIS_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string HeaderName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string HeaderValue;
[WmiDataId(4),read] boolean Replace;
};
[Dynamic,Guid("{c33bbe8f-985b-4080-81e6-005f1a06b9e2}"),EventVersion(1),DisplayName("IISAuthentication"),EventHttpRequest,locale("MS\\0x409")]
class IIS_Authentication_Trans : IIS_Trace
{
};
[Dynamic,EventType(10),EventLevel(4)]
class W3AuthStart : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"MD_AUTH_ANONYMOUS", "MD_AUTH_BASIC", "MD_AUTH_NT", "MD_AUTH_MD5", "MD_AUTH_PASSPORT", "MD_ACCESS_MAP_CERT"},Values{"Anonymous", "Basic", "NT", "Digest", "Passport", "MapCliCert"},ValueMap{"0x1", "0x2", "0x4", "0x10", "0x40", "0x80"},format("x"),read] uint32 AuthTypeSupported;
};
[Dynamic,EventType(11),EventLevel(4)]
class W3AuthSucceeded : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"MD_AUTH_ANONYMOUS", "MD_AUTH_BASIC", "MD_AUTH_NT", "MD_AUTH_MD5", "MD_AUTH_PASSPORT", "MD_ACCESS_MAP_CERT"},Values{"Anonymous", "Basic", "NT", "Digest", "Passport", "CertMap"},ValueMap{"0x1", "0x2", "0x4", "0x10", "0x40", "0x80"},format("x"),read] uint32 AuthType;
[WmiDataId(3),read] boolean NTLMUsed;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string RemoteUserName;
[WmiDataId(5),StringTermination("NullTerminated"),format("w"),read] string AuthUserName;
[WmiDataId(6),DefineValues{"IMPERSONATION_LEVEL_ANONYMOUS", "IMPERSONATION_LEVEL_IDENTIFY", "IMPERSONATION_LEVEL_IMPERSONATE", "IMPERSONATION_LEVEL_DELEGATE", "IMPERSONATION_LEVEL_UNKNOWN"},ValueMap{"0x0", "0x1", "0x2", "0x3", "0x4"},ValueType("index"),format("x"),read] uint32 TokenImpersonationLevel;
};
[Dynamic,EventType(12),EventLevel(3)]
class W3AuthTypeNotSupported : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(13),EventLevel(2)]
class W3AuthInvalidAnonAccount : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(14),EventLevel(3)]
class W3AuthPasswdChangeNeeded : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(15),EventLevel(3)]
class W3AuthPasswdChangeDisabled : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(16),EventLevel(3)]
class W3AuthBadBasicHeader : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(17),EventLevel(3)]
class W3AuthBasicLogonFailed : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(18),EventLevel(3)]
class W3AuthWDigestLogonFailed : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(19),EventLevel(3)]
class W3AuthIISDigestLogonFailed : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(20),EventLevel(3)]
class W3AuthPassportLogonFailed : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(21),EventLevel(3)]
class W3AuthSSPILogonFailed : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(22),EventLevel(3)]
class W3AuthNTLMNullSession : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(23),EventLevel(4)]
class W3AuthSSPIContinueNeeded : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string PackageName;
};
[Dynamic,EventType(55),EventLevel(3)]
class W3AuthKerberosFailed : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] boolean KMUsed;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string APUserName;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string SPNName;
[WmiDataId(5),read] boolean ADConfigIsOK;
[WmiDataId(6),StringTermination("NullTerminated"),format("w"),read] string KerberosInfo;
};
[Dynamic,EventType(24),EventLevel(2)]
class W3AuthAnonPasswdChangeNeeded : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(27),EventLevel(4)]
class W3AuthRequestAuthType : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"MD_AUTH_ANONYMOUS", "MD_AUTH_BASIC", "MD_AUTH_NT", "MD_AUTH_MD5", "MD_AUTH_PASSPORT", "MD_ACCESS_MAP_CERT"},Values{"Anonymous", "Basic", "NT", "Digest", "Passport", "CertMap"},ValueMap{"0x1", "0x2", "0x4", "0x10", "0x40", "0x80"},format("x"),read] uint32 RequestAuthType;
};
[Dynamic,EventType(28),EventLevel(4)]
class W3AuthEnd : IIS_Authentication_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,Guid("{29347ffb-ba48-41e6-bffd-469c5e543ca5}"),EventVersion(1),EventHttpRequest,DisplayName("IISSecurity"),locale("MS\\0x409")]
class IIS_Security_Trans : IIS_Trace
{
};
[Dynamic,EventType(10),EventLevel(3)]
class W3SecIllegalShortFilename : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
};
[Dynamic,EventType(11),EventLevel(3)]
class W3SecRejectedIP : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string IPAddress;
};
[Dynamic,EventType(12),EventLevel(3)]
class W3SecRejectedHostname : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string HostName;
};
[Dynamic,EventType(13),EventLevel(3)]
class W3SecRequireSSL128 : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(14),EventLevel(3)]
class W3SecFileAccessDenied : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string AccountName;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string DomainName;
};
[Dynamic,EventType(15),EventLevel(3)]
class W3SecDeniedByMimemap : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
};
[Dynamic,EventType(16),EventLevel(3)]
class W3SecDeniedByISAPIRestriction : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ImageName;
};
[Dynamic,EventType(17),EventLevel(3)]
class W3SecDeniedByCGIRestriction : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ImageName;
};
[Dynamic,EventType(18),EventLevel(3)]
class W3SecDeniedByAccessFlags : IIS_Security_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 CurrentFlags;
[WmiDataId(3),format("x"),read] uint32 NeededFlags;
};
[Dynamic,Guid("{00237f0d-73eb-4bcf-a232-126693595847}"),EventVersion(1),EventHttpRequest,DisplayName("IISFilter"),locale("MS\\0x409")]
class IIS_Filter_Trans : IIS_Trace
{
};
[Dynamic,EventType(1),EventLevel(0)]
class W3FilterStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FilterName;
};
[Dynamic,EventType(2),EventLevel(0)]
class W3FilterEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"SF_STATUS_REQ_FINISHED", "SF_STATUS_REQ_FINISHED_KEEP_CONN", "SF_STATUS_REQ_NEXT_NOTIFICATION", "SF_STATUS_REQ_HANDLED_NOTIFICATION", "SF_STATUS_REQ_ERROR", "SF_STATUS_REQ_READ_NEXT"},Values{"SF_STATUS_REQ_FINISHED", "SF_STATUS_REQ_FINISHED_KEEP_CONN", "SF_STATUS_REQ_NEXT_NOTIFICATION", "SF_STATUS_REQ_HANDLED_NOTIFICATION", "SF_STATUS_REQ_ERROR", "SF_STATUS_REQ_READ_NEXT"},ValueMap{"0x08000000", "0x08000001", "0x08000002", "0x08000003", "0x08000004", "0x08000005"},ValueType("index")] uint32 NotificationStatus;
};
[Dynamic,EventType(12),EventLevel(2)]
class W3FilterError : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(13),EventLevel(4)]
class W3FilterPreprocStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(14),EventLevel(4)]
class W3FilterPreprocEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(15),EventLevel(4)]
class W3FilterURLMapStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string OrigURL;
[WmiDataId(3),StringTermination("NullTerminated"),read] string OrigPath;
[WmiDataId(4),format("x"),read] uint32 AccessPerms;
[WmiDataId(5),read] uint32 MatchingPath;
[WmiDataId(6),read] uint32 MatchingURL;
[WmiDataId(7),StringTermination("NullTerminated"),read] string ScriptMapEntry;
};
[Dynamic,EventType(16),EventLevel(4)]
class W3FilterURLMapEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string FinalURL;
[WmiDataId(3),StringTermination("NullTerminated"),read] string FinalPath;
[WmiDataId(4),format("x"),read] uint32 AccessPerms;
[WmiDataId(5),read] uint32 MatchingPath;
[WmiDataId(6),read] uint32 MatchingURL;
[WmiDataId(7),StringTermination("NullTerminated"),read] string ScriptMapEntry;
};
[Dynamic,EventType(17),EventLevel(4)]
class W3FilterAuthenticationStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string OrigUserName;
};
[Dynamic,EventType(18),EventLevel(4)]
class W3FilterAuthenticationEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string FinalUserName;
[WmiDataId(3),read] boolean PasswordChanged;
};
[Dynamic,EventType(19),EventLevel(4)]
class W3FilterAuthCompleteStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(20),EventLevel(4)]
class W3FilterAuthCompleteEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(21),EventLevel(4)]
class W3FilterSendResponseStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 HttpStatus;
};
[Dynamic,EventType(22),EventLevel(4)]
class W3FilterSendResponseEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(23),EventLevel(4)]
class W3FilterEndOfRequestStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(24),EventLevel(4)]
class W3FilterEndOfRequestEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(25),EventLevel(4)]
class W3FilterLogStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string OrigClientHostName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string OrigClientUserName;
[WmiDataId(4),StringTermination("NullTerminated"),read] string OrigServerName;
[WmiDataId(5),StringTermination("NullTerminated"),read] string OrigOperation;
[WmiDataId(6),StringTermination("NullTerminated"),read] string OrigTarget;
[WmiDataId(7),StringTermination("NullTerminated"),read] string OrigParameters;
[WmiDataId(8),read] uint32 OrigHttpStatus;
[WmiDataId(9),read] uint32 OrigWin32Status;
};
[Dynamic,EventType(26),EventLevel(4)]
class W3FilterLogEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string FinalClientHostName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string FinalClientUserName;
[WmiDataId(4),StringTermination("NullTerminated"),read] string FinalServerName;
[WmiDataId(5),StringTermination("NullTerminated"),read] string FinalOperation;
[WmiDataId(6),StringTermination("NullTerminated"),read] string FinalTarget;
[WmiDataId(7),StringTermination("NullTerminated"),read] string FinalParameters;
[WmiDataId(8),read] uint32 FinalHttpStatus;
[WmiDataId(9),read] uint32 FinalWin32Status;
};
[Dynamic,EventType(27),EventLevel(4)]
class W3FilterSendRawDataStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(28),EventLevel(4)]
class W3FilterSendRawDataEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(29),EventLevel(4)]
class W3FilterAccessDeniedStart : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string RequestedURL;
[WmiDataId(3),StringTermination("NullTerminated"),read] string PhysicalPath;
[WmiDataId(4),read] uint32 DenialReason;
};
[Dynamic,EventType(30),EventLevel(4)]
class W3FilterAccessDeniedEnd : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(31),EventLevel(4)]
class W3FilterSetReqHeader : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string HeaderName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string HeaderValue;
};
[Dynamic,EventType(32),EventLevel(4)]
class W3FilterAddReqHeader : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string HeaderName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string HeaderValue;
};
[Dynamic,EventType(33),EventLevel(4)]
class W3FilterSetRespHeader : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string HeaderName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string HeaderValue;
};
[Dynamic,EventType(34),EventLevel(4)]
class W3FilterAddRespHeader : IIS_Filter_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string HeaderName;
[WmiDataId(3),StringTermination("NullTerminated"),read] string HeaderValue;
};
[Dynamic,Guid("{79b02104-0db9-4cda-a552-058d97c2ecfd}"),EventVersion(1),DisplayName("IISStaticFile"),locale("MS\\0x409")]
class IIS_Static_File_Trans : IIS_Trace
{
};
[Dynamic,Guid("{2e94e6c7-eda0-4b73-9010-2529edce1c27}"),EventVersion(1),EventHttpRequest,DisplayName("IISISAPI"),locale("MS\\0x409")]
class Isapi_Trans : IIS_Trace
{
};
[Dynamic,EventType{1},EventLevel(0)]
class W3ISAPIStart : Isapi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{2},EventLevel(0)]
class W3ISAPIEnd : Isapi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,Guid("{e2e55403-0d2e-4609-a470-be0da04013c0}"),EventVersion(1),EventHttpRequest,DisplayName("IISCGI"),locale("MS\\0x409")]
class IIS_Cgi_Trans : IIS_Trace
{
};
[Dynamic,EventType{1},EventLevel(0)]
class W3CGIStart : IIS_Cgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{2},EventLevel(0)]
class W3CGIEnd : IIS_Cgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{3},EventLevel(4)]
class W3CGILaunch : IIS_Cgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string CommandLine;
[WmiDataId(3),format("x"),read] uint32 ErrorCode;
[WmiDataId(4),read] uint32 ProcessId;
};
[Dynamic,EventType{4},EventLevel(4)]
class W3CGITimeout : IIS_Cgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string Headers;
};
[Dynamic,EventType{5},EventLevel(4)]
class W3CGIPrematureTermination : IIS_Cgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),read] string Headers;
};
[Dynamic,EventType{6},EventLevel(4)]
class W3CGIRequestEntitySent : IIS_Cgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{7},EventLevel(4)]
class W3CGIHeadersReceived : IIS_Cgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,Guid("{e3642acc-3627-42b0-8372-867baa033b07}"),EventVersion(1),EventHttpRequest,DisplayName("IISFastCGI"),locale("MS\\0x409")]
class IIS_FastCgi_Trans : IIS_Trace
{
};
[Dynamic,EventType{1},EventLevel(2)]
class W3CGIFActivityTimeout : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{2},EventLevel(2)]
class W3CGIFRequestTimeout : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{3},EventLevel(2)]
class W3CGIFUnexpectedExit : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{4},EventLevel(2)]
class W3CGIFRapidFailureProtection : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{5},EventLevel(2)]
class W3CGIFPathNotFound : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{6},EventLevel(2)]
class W3CGIFScriptProcessorMissing : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{7},EventLevel(2)]
class W3CGIFAddJobObjectFail : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{8},EventLevel(2)]
class W3CGIFAppMgrShutdown : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{9},EventLevel(2)]
class W3CGIFQueueFull : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{10},EventLevel(2)]
class W3CGIFUnknownError : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType{11},EventLevel(4)]
class W3CGIFResponseWritten : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{12},EventLevel(5)]
class W3CGIFWaitingForResponse : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{13},EventLevel(2)]
class W3CGIFTraceError : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string Message;
};
[Dynamic,EventType{14},EventLevel(3)]
class W3CGIFTraceWarning : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string Message;
};
[Dynamic,EventType{15},EventLevel(5)]
class W3CGIFTraceInfo : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string Message;
};
[Dynamic,EventType{16},EventLevel(0)]
class W3CGIFQueueRequest : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 PositionInQueue;
[WmiDataId(3),read] uint32 MaxInstances;
};
[Dynamic,EventType{17},EventLevel(0)]
class W3CGIFAssignProcess : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string CommandLine;
[WmiDataId(3),read] boolean IsNewProcess;
[WmiDataId(4),read] uint32 ProcessId;
[WmiDataId(5),read] uint32 RequestNumber;
};
[Dynamic,EventType{18},EventLevel(0)]
class W3CGIFStart : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{19},EventLevel(0)]
class W3CGIFEnd : IIS_FastCgi_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,Guid("{2ce74327-08be-425c-bfc5-1534fe7fefa6}"),EventVersion(1),EventHttpRequest,DisplayName("IISWebSocket"),locale("MS\\0x409")]
class IIS_WebSocket_Trans : IIS_Trace
{
};
[Dynamic,EventType{1},EventLevel(4)]
class W3WebSocketInitializeNotSuccess : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType{2},EventLevel(5)]
class W3WebSocketStart : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{3},EventLevel(5)]
class W3WebSocketEndSuccess : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{4},EventLevel(4)]
class W3WebSocketEndFailure : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType{5},EventLevel(5)]
class W3WebSocketReadFragmentStart : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 BufferSize;
};
[Dynamic,EventType{6},EventLevel(5)]
class W3WebSocketReadFragmentEndPending : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{7},EventLevel(5)]
class W3WebSocketReadFragmentEndSuccess : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 BytesReceived;
};
[Dynamic,EventType{8},EventLevel(4)]
class W3WebSocketReadFragmentEndFailure : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType{9},EventLevel(5)]
class W3WebSocketWriteFragmentStart : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 DataType;
[WmiDataId(3),format("x"),read] uint32 DataSize;
};
[Dynamic,EventType{10},EventLevel(5)]
class W3WebSocketWriteFragmentEndPending : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{11},EventLevel(5)]
class W3WebSocketWriteFragmentEndSuccess : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 BytesSent;
};
[Dynamic,EventType{12},EventLevel(4)]
class W3WebSocketWriteFragmentEndFailure : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType{13},EventLevel(4)]
class W3WebSocketApplicationCloseConnection : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{14},EventLevel(4)]
class W3WebSocketModuleCloseConnection : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"PING_TIMEOUT"},Values{"PING_TIMEOUT"},ValueMap{"1"},ValueType("index")] uint32 Reason;
};
[Dynamic,EventType{15},EventLevel(4)]
class W3WebSocketReadIoFailed : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType{16},EventLevel(4)]
class W3WebSocketWriteIoFailed : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType{17},EventLevel(5)]
class W3WebSocketCloseReceived : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 Status;
[WmiDataId(3),format("w"),read] string Reason;
};
[Dynamic,EventType{18},EventLevel(5)]
class W3WebSocketCloseSendStart : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 Status;
[WmiDataId(3),format("w"),read] string Reason;
};
[Dynamic,EventType{19},EventLevel(5)]
class W3WebSocketCloseSendSuccess : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{20},EventLevel(4)]
class W3WebSocketCloseSendFailure : IIS_WebSocket_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,Guid("{e60cee96-4472-448d-a13c-2170b18220ec}"),EventVersion(1),EventHttpRequest,DisplayName("IISCompression"),locale("MS\\0x409")]
class IIS_Compression_Trans : IIS_Trace
{
};
[Dynamic,EventType{1},EventLevel(4)]
class W3StaticCompressionStart : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{2},EventLevel(4)]
class W3StaticCompressionSuccess : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{3},EventLevel(4)]
class W3StaticCompressionNotSuccess : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"NO_ACCEPT_ENCODING", "COMPRESSION_DISABLED", "NO_COMPRESSION_10", "NO_COMPRESSION_PROXY", "NO_MATCHING_SCHEME", "UNKNOWN_ERROR", "NO_COMPRESSION_RANGE", "FILE_TOO_SMALL", "FILE_ENCRYPTED", "COMPRESS_FILE_NOT_FOUND", "COMPRESS_FILE_STALE", "NO_MATCHING_CONTENT_TYPE", "FOOTER_ENABLED", "NOT_FREQUENTLY_HIT", "FAIL_TO_COMPRESS"},Values{"NO_ACCEPT_ENCODING", "COMPRESSION_DISABLED", "NO_COMPRESSION_10", "NO_COMPRESSION_PROXY", "NO_MATCHING_SCHEME", "UNKNOWN_ERROR", "NO_COMPRESSION_RANGE", "FILE_TOO_SMALL", "FILE_ENCRYPTED", "COMPRESS_FILE_NOT_FOUND", "COMPRESS_FILE_STALE", "NO_MATCHING_CONTENT_TYPE", "FOOTER_ENABLED", "NOT_FREQUENTLY_HIT", "FAIL_TO_COMPRESS"},ValueMap{"1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15"},ValueType("index")] uint32 Reason;
};
[Dynamic,EventType{4},EventLevel(4)]
class W3StaticCompressionCreateStart : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string OriginalFileName;
};
[Dynamic,EventType{5},EventLevel(4)]
class W3StaticCompressionCreateEnd : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string OriginalFileName;
[WmiDataId(4),read] uint32 OriginalFileSize;
[WmiDataId(5),StringTermination("NullTerminated"),format("w"),read] string CompressedFileName;
[WmiDataId(6),read] uint32 CompressedFileSize;
};
[Dynamic,EventType{6},EventLevel(4)]
class W3DynamicCompressionStart : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{7},EventLevel(4)]
class W3DynamicCompressionSuccess : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{8},EventLevel(4)]
class W3DynamicCompressionNotSuccess : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"NO_ACCEPT_ENCODING", "COMPRESSION_DISABLED", "NO_COMPRESSION_10", "NO_COMPRESSION_PROXY", "NO_MATCHING_SCHEME", "UNKNOWN_ERROR", "HEADERS_SENT_TWICE", "NO_HEADER_SENT", "NOT_SUCCESS_STATUS", "ALREADY_CONTENT_ENCODING", "NO_COMPRESSION_RANGE", "NO_MATCHING_CONTENT_TYPE"},Values{"NO_ACCEPT_ENCODING", "COMPRESSION_DISABLED", "NO_COMPRESSION_10", "NO_COMPRESSION_PROXY", "NO_MATCHING_SCHEME", "UNKNOWN_ERROR", "HEADERS_SENT_TWICE", "NO_HEADER_SENT", "NOT_SUCCESS_STATUS", "ALREADY_CONTENT_ENCODING", "NO_COMPRESSION_RANGE", "NO_MATCHING_CONTENT_TYPE"},ValueMap{"1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12"},ValueType("index")] uint32 Reason;
};
[Dynamic,EventType{9},EventLevel(5)]
class W3DynamicCompressionDo : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] uint32 OriginalSize;
[WmiDataId(3),read] uint32 CompressedSize;
};
[Dynamic,EventType{10},EventLevel(4)]
class W3DynamicCompressionEnd : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType{11},EventLevel(4)]
class W3StaticCompressionEnd : IIS_Compression_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,Guid("{ac1d69f1-bf33-4ca0-9313-bca13873e1dc}"),EventVersion(1),DisplayName("IISCache"),locale("MS\\0x409")]
class IIS_Cache_Trans : IIS_Trace
{
};
[Dynamic,EventType(10),EventLevel(4)]
class W3CacheFileCacheAccessStart : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string UserName;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string DomainName;
};
[Dynamic,EventType(11),EventLevel(4)]
class W3CacheFileCacheAccessEnd : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] boolean Successful;
[WmiDataId(3),read] boolean FileFromCache;
[WmiDataId(4),read] boolean FileAddedToCache;
[WmiDataId(5),read] boolean FileDirmoned;
[WmiDataId(6),read] boolean LastModCheckErrorIgnored;
[WmiDataId(7),format("x"),read] uint32 ErrorCode;
[WmiDataId(8),StringTermination("NullTerminated"),format("a"),read] string LastModifiedTime;
};
[Dynamic,EventType(12),EventLevel(4)]
class W3CacheURLCacheAccessStart : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string RequestURL;
};
[Dynamic,EventType(13),EventLevel(4)]
class W3CacheURLCacheAccessEnd : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string PhysicalPath;
[WmiDataId(3),read] boolean URLInfoFromCache;
[WmiDataId(4),read] boolean URLInfoAddedToCache;
[WmiDataId(5),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(14),EventLevel(4),EventHttpRequest]
class W3CacheHttpsysCacheable : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),read] boolean HttpsysCacheable;
[WmiDataId(3),DefineValues{"OK", "NO_METADATA", "HTTPSYS_CACHE_DISABLED", "FILE_COMPRESSIBLE", "FOOTER_ENABLED", "SUPRESSING_ENTITY", "URL_CHANGE_BY_FILTER", "HTTP_STATUS_NOT_OK", "CHILD_REQUEST", "HANDLER_HTTPSYS_UNFRIENDLY", "FILTER_CACHE_UNAWARE", "NON_ANONYMOUS_ACCESS", "IP_RESTRICTION_SET", "CUSTOM_LOGGING", "SSL_RESTRICTION", "ISAPI_NOT_CACHING", "STATIC_REQUEST_QUERYSTRING", "RESPONSE_MORE_DATA", "FILE_NOT_CACHED", "RESPONSE_SENDING_RAW_HEADERS", "DYNAMIC_COMPRESSION_ENABLED", "NO_PIPELINE_ENABLE", "VERB_NOT_GET", "NO_CACHE_INVALIDATOR", "HANDLER_CHANGED", "REQUEST_FILTER_RULE"},Values{"OK", "NO_METADATA", "HTTPSYS_CACHE_DISABLED", "FILE_COMPRESSIBLE", "FOOTER_ENABLED", "SUPRESSING_ENTITY", "URL_CHANGE_BY_FILTER", "HTTP_STATUS_NOT_OK", "CHILD_REQUEST", "HANDLER_HTTPSYS_UNFRIENDLY", "FILTER_CACHE_UNAWARE", "NON_ANONYMOUS_ACCESS", "IP_RESTRICTION_SET", "CUSTOM_LOGGING", "SSL_RESTRICTION", "ISAPI_NOT_CACHING", "STATIC_REQUEST_QUERYSTRING", "RESPONSE_MORE_DATA", "FILE_NOT_CACHED", "RESPONSE_SENDING_RAW_HEADERS", "DYNAMIC_COMPRESSION_ENABLED", "NO_PIPELINE_ENABLE", "VERB_NOT_GET", "NO_CACHE_INVALIDATOR", "HANDLER_CHANGED", "REQUEST_FILTER_RULE"},ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25"},ValueType("index")] uint32 Reason;
[WmiDataId(4),DefineValues{"NO_CACHE", "USER_INVALIDATES", "TIME_TO_LIVE"},Values{"NO_CACHE", "USER_INVALIDATES", "TIME_TO_LIVE"},ValueMap{"0", "1", "2"},ValueType("index")] uint32 CachePolicy;
[WmiDataId(5),read] uint32 TimeToLive;
};
[Dynamic,EventType(15),EventLevel(4),EventHttpRequest]
class W3OutputCacheLookupStart : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(16),EventLevel(4),EventHttpRequest]
class W3OutputCacheLookupEnd : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"NOT_FOUND", "FOUND", "ACCEPT_NOT_MATCH", "ACCEPT_ENCODING_NOT_MATCH", "CACHING_DISABLED", "CONDITIONAL_HEADERS_PRESENT"},Values{"NOT_FOUND", "FOUND", "ACCEPT_NOT_MATCH", "ACCEPT_ENCODING_NOT_MATCH", "CACHING_DISABLED", "CONDITIONAL_HEADERS_PRESENT"},ValueMap{"0", "1", "2", "3", "4", "5"},ValueType("index")] uint32 Result;
};
[Dynamic,EventType(17),EventLevel(4),EventHttpRequest]
class W3OutputCacheUpdateStart : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"NO_CACHE", "USER_INVALIDATES", "TIME_TO_LIVE"},Values{"NO_CACHE", "USER_INVALIDATES", "TIME_TO_LIVE"},ValueMap{"0", "1", "2"},ValueType("index")] uint32 CachePolicy;
[WmiDataId(3),read] uint32 TimeToLive;
};
[Dynamic,EventType(18),EventLevel(4),EventHttpRequest]
class W3OutputCacheUpdateEnd : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),DefineValues{"ADDED", "UNKNOWN_ERROR", "NOT_FREQUENTLY_HIT", "HEADERS_FLUSHED", "HEADERS_SUPPRESSED", "VERB_NOT_GET", "STATUS_NOT_OK", "CACHING_DISABLED", "RESPONSE_TOO_BIG", "CACHE_FULL", "VARY_BY_NOT_MATCH", "ENTRY_EXISTS", "ALREADY_CACHED"},Values{"ADDED", "UNKNOWN_ERROR", "NOT_FREQUENTLY_HIT", "HEADERS_FLUSHED", "HEADERS_SUPPRESSED", "VERB_NOT_GET", "STATUS_NOT_OK", "CACHING_DISABLED", "RESPONSE_TOO_BIG", "CACHE_FULL", "VARY_BY_NOT_MATCH", "ENTRY_EXISTS", "ALREADY_CACHED"},ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12"},ValueType("index")] uint32 Result;
};
[Dynamic,EventType(19),EventLevel(4),EventHttpRequest]
class W3OutputCacheDisabled : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
};
[Dynamic,EventType(20),EventLevel(4)]
class W3CacheFileCacheCreateFile : IIS_Cache_Trans
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string UserName;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string DomainName;
};
[Dynamic,Guid("{002e91e3-e7ae-44ab-8e07-99230ffa6ade}"),EventVersion(1),EventHttpRequest,DisplayName("IISRequestNotification"),locale("MS\\0x409")]
class IISRequestNotificationEvents : IIS_Trace
{
};
[Dynamic,EventType(1),EventLevel(5)]
class IISRequestNotificationEventsStart : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),DefineValues{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},Values{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},ValueMap{"0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020", "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800", "0x10000000", "0x20000000", "0x40000000", "0x80000000"},ValueType("index")] uint32 Notification;
[WmiDataId(4),read] boolean fIsPostNotification;
};
[Dynamic,EventType(2),EventLevel(5)]
class IISRequestNotificationEventsEnd : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),DefineValues{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},Values{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},ValueMap{"0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020", "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800", "0x10000000", "0x20000000", "0x40000000", "0x80000000"},ValueType("index")] uint32 Notification;
[WmiDataId(4),read] boolean fIsPostNotificationEvent;
[WmiDataId(5),DefineValues{"NOTIFICATION_CONTINUE", "NOTIFICATION_FINISH_REQUEST"},Values{"NOTIFICATION_CONTINUE", "NOTIFICATION_FINISH_REQUEST"},ValueMap{"0", "2"},ValueType("index")] uint32 NotificationStatus;
};
[Dynamic,EventType(3),EventLevel(5)]
class IISRequestNotificationEventsCompletion : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),DefineValues{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},Values{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},ValueMap{"0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020", "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800", "0x10000000", "0x20000000", "0x40000000", "0x80000000"},ValueType("index")] uint32 Notification;
[WmiDataId(4),read] boolean fIsPostNotificationEvent;
[WmiDataId(5),read] uint32 CompletionBytes;
[WmiDataId(6),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(4),EventLevel(5)]
class IISRequestNotificationPreBeginStart : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
};
[Dynamic,EventType(5),EventLevel(5)]
class IISRequestNotificationPreBeginEnd : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),DefineValues{"NOTIFICATION_CONTINUE", "NOTIFICATION_HANDLED"},Values{"NOTIFICATION_CONTINUE", "NOTIFICATION_HANDLED"},ValueMap{"0", "1"},ValueType("index")] uint32 NotificationStatus;
};
[Dynamic,EventType(15),EventLevel(2)]
class IISRequestNotificationEventsError : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),DefineValues{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},Values{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},ValueMap{"0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020", "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800", "0x10000000", "0x20000000", "0x40000000", "0x80000000"},ValueType("index")] uint32 Notification;
[WmiDataId(4),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(16),EventLevel(3)]
class IISRequestNotificationEventsResponseErrorStatus : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),DefineValues{"PRE_BEGIN_REQUEST", "BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},Values{"PRE_BEGIN_REQUEST", "BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},ValueMap{"0x00000000", "0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020", "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800", "0x10000000", "0x20000000", "0x40000000", "0x80000000"},ValueType("index")] uint32 Notification;
[WmiDataId(4),read] uint32 HttpStatus;
[WmiDataId(5),StringTermination("NullTerminated"),format("a"),read] string HttpReason;
[WmiDataId(6),read] uint16 HttpSubStatus;
[WmiDataId(7),format("x"),read] uint32 ErrorCode;
[WmiDataId(8),StringTermination("NullTerminated"),format("w"),read] string ConfigExceptionInfo;
};
[Dynamic,EventType(17),EventLevel(4)]
class IISRequestNotificationEventsResponseSuccessStatus : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),DefineValues{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},Values{"BEGIN_REQUEST", "AUTHENTICATE_REQUEST", "AUTHORIZE_REQUEST", "RESOLVE_REQUEST_CACHE", "MAP_REQUEST_HANDLER", "REQUEST_ACQUIRE_STATE", "PRE_EXECUTE_REQUEST_HANDLER", "EXECUTE_REQUEST_HANDLER", "RELEASE_REQUEST_STATE", "UPDATE_REQUEST_CACHE", "LOG_REQUEST", "END_REQUEST", "CUSTOM_NOTIFICATION", "SEND_RESPONSE", "READ_ENTITY", "MAP_PATH"},ValueMap{"0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020", "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800", "0x10000000", "0x20000000", "0x40000000", "0x80000000"},ValueType("index")] uint32 Notification;
[WmiDataId(4),read] uint32 HttpStatus;
[WmiDataId(5),StringTermination("NullTerminated"),format("a"),read] string HttpReason;
};
[Dynamic,EventType(18),EventLevel(3)]
class IISRequestNotificationEventsResponseErrorDescription : IISRequestNotificationEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ErrorDescription;
};
[Dynamic,Guid("{d79a948e-95f1-417b-a731-b7a79dec7ae5}"),EventVersion(1),EventHttpRequest,DisplayName("IISModule"),locale("MS\\0x409")]
class IISModuleEvents : IIS_Trace
{
};
[Dynamic,EventType(1),EventLevel(4)]
class IISModuleEventsModuleStart : IISModuleEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Data1;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string Data2;
[WmiDataId(5),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(2),EventLevel(4)]
class IISModuleEventsModuleEnd : IISModuleEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Data1;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string Data2;
[WmiDataId(5),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(3),EventLevel(1)]
class IISModuleEventsModuleCriticalError : IISModuleEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Data1;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string Data2;
[WmiDataId(5),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(4),EventLevel(2)]
class IISModuleEventsModuleError : IISModuleEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Data1;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string Data2;
[WmiDataId(5),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(5),EventLevel(3)]
class IISModuleEventsModuleWarning : IISModuleEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Data1;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string Data2;
[WmiDataId(5),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(6),EventLevel(4)]
class IISModuleEventsModuleInformation : IISModuleEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Data1;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string Data2;
[WmiDataId(5),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(7),EventLevel(5)]
class IISModuleEventsModuleVerbose : IISModuleEvents
{
[WmiDataId(1),extension("Guid"),ActivityID,read] object ContextId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string ModuleName;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string Data1;
[WmiDataId(4),StringTermination("NullTerminated"),format("w"),read] string Data2;
[WmiDataId(5),format("x"),read] uint32 ErrorCode;
};
[Dynamic,Guid("{d42cf7ef-de92-473e-8b6c-621ea663113a}"),EventVersion(0),EventDeprecated,EventArea(0),DisplayName("W3Server"),locale("MS\\0x409")]
class IIS_Trans_V0 : IIS_Trace
{
};
[Dynamic,EventType(1),EventLevel(0)]
class W3ReceiveNewRequest : IIS_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
[WmiDataId(2),read] uint32 BytesReceived;
};
[Dynamic,EventType{2, 16, 17, 18, 19, 20, 21, 22, 23, 24},EventLevel(0)]
class W3SendResponse : IIS_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
[WmiDataId(2),read] uint32 BytesSent;
};
[Dynamic,EventType(10),EventLevel(0)]
class W3FileRequest : IIS_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FileName;
};
[Dynamic,EventType(11),EventLevel(0)]
class W3CGIRequest : IIS_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
};
[Dynamic,EventType(12),EventLevel(0)]
class W3IsapiRequest : IIS_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
};
[Dynamic,EventType(13),EventLevel(0)]
class W3OopRequest : IIS_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
[WmiDataId(2),read] uint32 ProcessId;
[WmiDataId(3),read] uint32 TotalReqs;
[WmiDataId(4),read] uint32 CurrentReqs;
};
[Dynamic,Guid("{00237f0d-73eb-4bcf-a232-126693595847}"),EventVersion(0),EventArea(0),EventDeprecated,DisplayName("W3Filter"),locale("MS\\0x409")]
class IIS_Filter_Trans_V0 : IIS_Trace
{
};
[Dynamic,EventType(1),EventLevel(0)]
class W3FilterTransStart : IIS_Filter_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
[WmiDataId(2),StringTermination("NullTerminated"),format("w"),read] string FilterName;
};
[Dynamic,EventType(2),EventLevel(0)]
class W3FilterTransEnd : IIS_Filter_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
};
[Dynamic,Guid("{e2e55403-0d2e-4609-a470-be0da04013c0}"),EventVersion(0),EventArea(0),EventDeprecated,DisplayName("W3Cgi"),locale("MS\\0x409")]
class IIS_Cgi_Trans_V0 : IIS_Trace
{
};
[Dynamic,EventType{1, 2},EventLevel(0)]
class W3CgiTrans : IIS_Cgi_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
};
[Dynamic,Guid("{2e94e6c7-eda0-4b73-9010-2529edce1c27}"),EventVersion(0),EventDeprecated,EventArea(0),DisplayName("Isapi"),locale("MS\\0x409")]
class Isapi_Trans_V0 : IIS_Trace
{
};
[Dynamic,EventType(1),EventLevel(0)]
class IsapiMapRequestId : Isapi_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
[WmiDataId(2),pointer,read] uint32 connID;
[WmiDataId(3),read] uint32 fOop;
};
[Dynamic,EventLevel(0),EventType{2, 10, 11, 12, 13, 14, 15}]
class IsapiDeleteContext : Isapi_Trans_V0
{
[WmiDataId(1),read] uint64 RequestId;
[WmiDataId(2),pointer,read] uint32 connID;
};
[Dynamic,Description("IIS: WWW Global"),Guid("{d55d3bc9-cba9-44df-827e-132d3a4596c2}"),HttpGlobalRawEtw,locale("MS\\0x409")]
class IIS_Global_Trace : EventTrace
{
[DefineValues{"ETW_IIS_GLOBAL_STARTUP", "ETW_IIS_GLOBAL_SHUTDOWN", "ETW_IIS_GLOBAL_ALL"},Values{"IISStartup", "IISShutdown", "All"},ValueMap{"0x0001", "0x0002", "0x0003"}] uint32 Flags;
[DefineValues{"TRACE_LEVEL_FATAL", "TRACE_LEVEL_ERROR", "TRACE_LEVEL_WARNING", "TRACE_LEVEL_INFORMATION", "TRACE_LEVEL_VERBOSE"},Values{"Fatal", "Error", "Warning", "Information", "Verbose"},ValueMap{"0x1", "0x2", "0x3", "0x4", "0x5"},ValueType("index")] uint32 Level;
};
[Dynamic,Guid("{35646e78-fe59-47e9-a617-eef5fc640816}"),EventVersion(1),DisplayName("IISStartup"),locale("MS\\0x409")]
class IIS_Startup_Trans : IIS_Global_Trace
{
};
[Dynamic,EventType(10),EventLevel(4)]
class W3StartupProcessStartInfo : IIS_Startup_Trans
{
[WmiDataId(1),StringTermination("NullTerminated"),format("w"),read] string CommandLineArgs;
[WmiDataId(2),read] boolean IIS5CompatMode;
[WmiDataId(3),StringTermination("NullTerminated"),format("w"),read] string UserName;
[WmiDataId(4),format("x"),read] uint32 ProcessAffinityMask;
};
[Dynamic,EventType(11),EventLevel(4)]
class W3StartupW3serverStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(12),EventLevel(5)]
class W3StartupResourceDllStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(13),EventLevel(5)]
class W3StartupIISUtilStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(14),EventLevel(5)]
class W3StartupWinsockStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(15),EventLevel(5)]
class W3StartupMetabaseStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(16),EventLevel(5)]
class W3StartupMblistenerStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(17),EventLevel(5)]
class W3StartupW3siteStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(18),EventLevel(5)]
class W3StartupUlatqStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(19),EventLevel(5)]
class W3StartupGlobalFilterStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(20),EventLevel(5)]
class W3StartupSiteListStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(21),EventLevel(5)]
class W3StartupCacheStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(22),EventLevel(5)]
class W3StartupW3connectionStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(23),EventLevel(5)]
class W3StartupW3contextStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(24),EventLevel(5)]
class W3StartupW3requestStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(25),EventLevel(5)]
class W3StartupW3responseStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(26),EventLevel(5)]
class W3StartupServerVariableStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(27),EventLevel(5)]
class W3StartupMimeMapStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(28),EventLevel(5)]
class W3StartupLoggingStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(29),EventLevel(5)]
class W3StartupRawConnectionStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(30),EventLevel(5)]
class W3StartupCertificateStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(31),EventLevel(5)]
class W3StartupISAPIRestrictionListStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(32),EventLevel(5)]
class W3StartupCGIRestrictionListStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(33),EventLevel(5)]
class W3StartupCompressionStart : IIS_Startup_Trans
{
};
[Dynamic,EventType(34),EventLevel(4)]
class W3StartupW3serverEnd : IIS_Startup_Trans
{
};
[Dynamic,EventType(35),EventLevel(2)]
class W3StartupW3serverInitError : IIS_Startup_Trans
{
[WmiDataId(1),read] uint32 InitStatus;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(36),EventLevel(4)]
class W3StartupFilterLoadStart : IIS_Startup_Trans
{
[WmiDataId(1),StringTermination("NullTerminated"),format("w"),read] string FilterName;
};
[Dynamic,EventType(37),EventLevel(4)]
class W3StartupFilterLoadEnd : IIS_Startup_Trans
{
[WmiDataId(1),StringTermination("NullTerminated"),format("w"),read] string FilterName;
[WmiDataId(2),format("x"),read] uint32 ErrorCode;
};
[Dynamic,EventType(38),EventLevel(4)]
class W3StartupUlatqStartListening : IIS_Startup_Trans
{
};
[Dynamic,Guid("{e1af7c2a-7bbe-4bec-b5e0-ba064e1d77da}"),EventVersion(1),DisplayName("IISShutdown"),locale("MS\\0x409")]
class IIS_Shutdown_Trans : IIS_Global_Trace
{
};
[Dynamic,EventType(10),EventLevel(4)]
class W3ShutdownProcessMode : IIS_Shutdown_Trans
{
[WmiDataId(1),read] boolean ShutdownImmediate;
[WmiDataId(2),read] boolean AllCGIKilled;
};
[Dynamic,EventType(11),EventLevel(4)]
class W3ShutdownW3serverShutdownStart : IIS_Shutdown_Trans
{
};
[Dynamic,EventType(12),EventLevel(4)]
class W3ShutdownW3serverShutdownEnd : IIS_Shutdown_Trans
{
};
[Dynamic,EventType(13),EventLevel(4)]
class W3ShutdownFilterUnloadStart : IIS_Shutdown_Trans
{
[WmiDataId(1),StringTermination("NullTerminated"),format("w"),read] string FilterName;
};
[Dynamic,EventType(14),EventLevel(4)]
class W3ShutdownFilterUnloadEnd : IIS_Shutdown_Trans
{
[WmiDataId(1),StringTermination("NullTerminated"),format("w"),read] string FilterName;
};
[Dynamic,Guid("{c4ccfe5b-639e-42d9-a9af-a5dee1688f35}"),EventVersion(1),DisplayName("IISGlobalCache"),locale("MS\\0x409")]
class IISGlobalCacheEvents : IIS_Global_Trace
{
};