Forum Discussion
List every possible Windows Event ID
Hi, there isn’t a single official “master list of every possible Windows Event ID” because Event IDs are defined per event provider (publisher) and depend on what roles/features/agents are installed (Hyper-V, Failover Clustering, specific Azure agents, etc.). A practical way is to enumerate providers and export the provider metadata on a machine that has those roles enabled.
Option 1 (built-in): wevtutil
List all publishers and filter by keywords (Hyper-V / Failover / Clustering / Network):
wevtutil ep | findstr /i "Hyper-V Failover Cluster Clustering Network"
For each relevant provider, export event metadata (this includes the event IDs that provider can raise):
wevtutil gp "Microsoft-Windows-Eventlog" /ge:true /f:xml
(Replace the provider name with the ones you found; you can also add /gm:true to show resolved messages where available.)
Microsoft docs for wevtutil (including ep and gp /ge:true) are here:
Microsoft Learn
Option 2 (PowerShell): Get-WinEvent provider metadata
You can also pull provider event IDs via:
Get-WinEvent -ListProvider "<ProviderName>" and read the .Events list (Id + Description) for each provider.
Note on “Azure”: “Azure” event IDs vary a lot depending on what you mean (Azure Arc, Azure Monitor Agent, Azure Stack HCI/Azure Local, etc.). If you share which Azure component/agent you’re using, you can narrow the exact providers/log channels.
The original question here mentions Hyper-V / replication / Failover Cluster / Network, so I’d start by exporting all Microsoft-Windows-Hyper-V-* and Microsoft-Windows-FailoverClustering* providers from a host where those roles are installed.
— H. John | https://www.hadsiz.com/ — a community/forum project I’m building