Servicing update-failure codes and curated labels in the Error Code histogram#653
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the existing “Error Code” histogram dimension and update-triage scenarios to correctly surface real Windows servicing/update failure HRESULTs (including those stored under Servicing UserData), and improves readability via curated HRESULT symbol labels.
Changes:
- Extend Error Code histogram scans to fall back from EventData
errorCodeto curated Servicing UserDataCbs*ChangeState/ErrorCodepaths, omitting success/empty values. - Fix/update built-in update-triage scenarios (Servicing outcomes keyed by event id at Information; reboot/crash correlation scenario definitions).
- Add curated HRESULT symbol labels (CBS/WU) and expand unit coverage for the new parsing/bucketing behaviors.
Reviewed changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tests/Unit/EventLogExpert.Scenarios.Tests/BuiltInCatalogValidationTests.cs | Adds regression tests for updated built-in scenario matching and channel metadata. |
| tests/Unit/EventLogExpert.Runtime.Tests/LogTable/TestSupport/LegacyEventColumnView.cs | Updates test adapter signatures to pass curated UserData error-code paths into HResult scan APIs. |
| tests/Unit/EventLogExpert.Runtime.Tests/Histogram/HistogramBuilderTests.cs | Adds coverage ensuring Servicing UserData HRESULTs chart correctly and successes are omitted. |
| tests/Unit/EventLogExpert.Runtime.Tests/Common/Display/EventDataValueDecoderTests.cs | Adds assertions for newly-curated HRESULT labels. |
| tests/Unit/EventLogExpert.Eventing.Tests/Common/Events/EventColumnStoreReaderParityTests.cs | Extends parity corpus and scans to include Servicing UserData HRESULT fallback. |
| tests/Unit/EventLogExpert.Eventing.Tests/Common/Events/EventColumnStoreEventDataTests.cs | Adds extensive unit coverage for UserData fallback, omission rules, and sealed/pending parity. |
| tests/Shared/EventLogExpert.Eventing.TestUtils/EventDataTestFactory.cs | Adds a WithUserData helper to construct resolved events with nested UserData fields in tests. |
| tests/Shared/EventLogExpert.Eventing.TestUtils/Common/Events/LegacyEventColumnReader.cs | Mirrors store behavior in the legacy oracle by adding EventData-first/UserData-fallback HRESULT extraction. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/updates-and-policy.json | Updates Servicing scenario to key by event id at Information and adds reboot/crash correlation scenario. |
| src/EventLogExpert.Runtime/LogTable/IEventColumnView.cs | Extends view interface to accept curated UserData error-code paths for HResult bucketing/counting. |
| src/EventLogExpert.Runtime/LogTable/EventColumnView.cs | Plumbs curated UserData error-code paths through to the event column reader. |
| src/EventLogExpert.Runtime/LogTable/CombinedColumnView.cs | Propagates the new HResult scan parameter across combined views. |
| src/EventLogExpert.Runtime/Histogram/HistogramBuilder.cs | Adds curated Servicing UserData error-code paths and uses them in Error Code histogram scans. |
| src/EventLogExpert.Runtime/Common/Display/EventDataValueDecoder.cs | Adds curated labels for additional CBS/WU HRESULTs. |
| src/EventLogExpert.Eventing/Common/Events/IEventColumnReader.cs | Extends reader interface for HResult scans to accept curated UserData error-code paths. |
| src/EventLogExpert.Eventing/Common/Events/EventColumnStoreReader.cs | Plumbs curated UserData error-code paths into the store for HResult bucketing/counting. |
| src/EventLogExpert.Eventing/Common/Events/EventColumnStore.cs | Implements sealed + pending UserData fallback for curated error-code paths during HResult scans. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jschick04
marked this pull request as ready for review
July 19, 2026 08:02
jschick04
force-pushed
the
pr/update-triage-error-codes
branch
from
July 20, 2026 14:36
c6dd02c to
3021663
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First of a stacked series, on top of the merged #652 (Error Code histogram dimension for update failure HRESULTs).
Changes
Microsoft-Windows-Servicingfailure HRESULTs from theCbsPackageChangeState/ErrorCodeandCbsUpdateChangeState/ErrorCodeUserData paths, since Servicing stores its failure code in UserData rather than an EventDataerrorCodefield.Level=Information(real Servicing events, including the failure event, log at Information, so the priorLevel=Errorfilter matched nothing), plus fixes/extensions to the reboot/crash correlation view.0x800f0816 CBS_E_DPX_JOB_STATE_SAVEDrather than a bare hex value.Testing
All unit suites green (Eventing, Scenarios, Runtime, UI); builds clean (0 warnings, 0 errors).
Notes
This is the first of a stacked series splitting a larger update-triage / histogram branch; follow-up PRs (timeline default + folder launch, histogram dimensions, highlight softening) will stack after this merges.