Windows event log ยท Microsoft-Windows-Bits-Client/Operational61 BITS transfer has stopped

  • Windows operational
  • 6 fields
  • Microsoft-Windows-Bits-Client%4Operational.evtx
  • Microsoft-Windows-Bits-Client

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • PayloadData1jobTitle: %jobTitle%
    • %jobTitle% = /Event/EventData/Data[@Name="name"]
  • PayloadData2jobId: %jobId%
    • %jobId% = /Event/EventData/Data[@Name="Id"]
  • PayloadData3URL: %url%
    • %url% = /Event/EventData/Data[@Name="url"]
  • PayloadData4Peer: %peer%
    • %peer% = /Event/EventData/Data[@Name="peer"]
  • PayloadData5Total Bytes: %bytesTotal% (Transferred: %bytesTransferred%)
    • %bytesTotal% = /Event/EventData/Data[@Name="bytesTotal"]
    • %bytesTransferred% = /Event/EventData/Data[@Name="bytesTransferred"]
  • PayloadData6Bytes Transferred from Peer: %bytesTransferredFromPeer%
    • %bytesTransferredFromPeer% = /Event/EventData/Data[@Name="bytesTransferredFromPeer"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Bits-Client" Guid="ef1dd15b-46c1-414e-bb95-e76b077bd51e"/>
    <EventID>61</EventID>
    <Version>1</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>2</Opcode>
    <Keywords>0x4000030000000000</Keywords>
    <TimeCreated SystemTime="2020-10-03 11:01:54.6903229"/>
    <EventRecordID>667991</EventRecordID>
    <Correlation ActivityID="2577e913-0e06-4ef0-944f-2c9ec57ec669"/>
    <Execution ProcessID="679" ThreadID="2648"/>
    <Channel>Microsoft-Windows-Bits-Client/Operational</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="transferId">2567a913-0e06-4ef0-944f-2c9ec57ec669</Data>
    <Data Name="name">CCM Message Upload {0D7FE3C1-810E-43BF-98F3-6BFED5837B6C}</Data>
    <Data Name="Id">f3642209-4ea2-4ea9-b502-8320d93f45f0</Data>
    <Data Name="url">http://HOSTNAME.comain.com:80/CCM_Incoming/{0D7FE3C1-810E-43BF-98F3-6BFABCDEFB6C}</Data>
    <Data Name="peer"></Data>
    <Data Name="hr">246579813</Data>
    <Data Name="fileTime">2020-08-07 01:03:05.5210175</Data>
    <Data Name="fileLength">18440244073709551615</Data>
    <Data Name="bytesTotal">189658</Data>
    <Data Name="bytesTransferred">0</Data>
    <Data Name="proxy"></Data>
    <Data Name="peerProtocolFlags">0</Data>
    <Data Name="bytesTransferredFromPeer">0</Data>
    <Data Name="AdditionalInfoHr">0</Data>
    <Data Name="PeerContextInfo">0</Data>
    <Data Name="bandwidthLimit">18446744073709551615</Data>
    <Data Name="ignoreBandwidthLimitsOnLan">False</Data>
  </EventData>
</Event>

References

7 links

Source: evtx/Maps/Microsoft-Windows-Bits-Client-Operational_Microsoft-Windows-Bits-Client_61.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)