Windows storage event channels
Disk, volume, filesystem, Storage Spaces and storage-housekeeping channels, bound as one feed: the storage port and class drivers, NTFS and its health-check arm, partitions and volumes, the Storage Spaces provider family, and the disk-cleanup and storage-settings services. Light curation: every event keeps the severity the provider stated, capped at Warning, and one measured flood is dropped by event id. No reasons yet; the fleet data this feed produces is what the curated storage rules will be written from.
Feed id: win.eventlog.storage.
Channels
This feed binds 22 Windows Event Log channels as one reporting axis. A channel that a given Windows edition, role or OEM does not provide is absent on that endpoint; the rest still collect.
The ticket class is the subject area an event on the channel is evidence for, and it is what fleet-wide questions group by.
| Channel | Ticket class |
|---|---|
Microsoft-Windows-Cleanmgr/Diagnostic | storage |
Microsoft-Windows-DataIntegrityScan/Admin | storage |
Microsoft-Windows-EnhancedStorage-EhStorClass/Operational | storage |
Microsoft-Windows-Ntfs/Operational | storage |
Microsoft-Windows-Ntfs/WHC | storage |
Microsoft-Windows-Partition/Diagnostic | storage |
Microsoft-Windows-ReadyBoost/Operational | storage |
Microsoft-Windows-Storage-ClassPnP/Operational | storage |
Microsoft-Windows-Storage-Storport/Health | storage |
Microsoft-Windows-Storage-Storport/Operational | storage |
Microsoft-Windows-StorageManagement-PartUtil/Operational | storage |
Microsoft-Windows-StorageSettings/Diagnostic | storage |
Microsoft-Windows-StorageSpaces-Api/Operational | storage |
Microsoft-Windows-StorageSpaces-Driver/Diagnostic | storage |
Microsoft-Windows-StorageSpaces-Driver/Operational | storage |
Microsoft-Windows-StorageSpaces-ManagementAgent/WHC | storage |
Microsoft-Windows-StorageSpaces-Parser/Diagnostic | storage |
Microsoft-Windows-StorageSpaces-Parser/Operational | storage |
Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic | storage |
Microsoft-Windows-StorageSpaces-SpaceManager/Operational | storage |
Microsoft-Windows-StorageVolume/Operational | storage |
Microsoft-Windows-Storsvc/Diagnostic | storage |
Severity
This feed is bound for collection but is not yet curated per event. Every event keeps the severity its own provider stated, capped at Warning.
Ask this feed a question
Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.