detection.wiki

Microsoft-Windows-Hyper-V-VmSwitch

529 events across 5 channels

Event IDTitleChannel
0Microsoft-Windows-Hyper-V-VmSwitch-Operational
1Operational
1Failed to open handle to configuration store root due to error Status.System
2Operational
2Failed to restore switch.System
3Operational
3Failed to register the control device object for the switch due to error Status.System
4Operational
4Failed to initialize VMSwitch driver due to error Status.System
5Operational
5Miniport NIC NicName (Friendly Name: NicFName) successfully enabled.System
6Operational
6Failed to enable miniport NIC NicName (Friendly Name: NicFName), status = …System
7Operational
7Miniport NIC NicName (Friendly Name: NicFName) successfully initialized.System
8Operational
8Failed to initialize miniport NIC NicName (Friendly Name: NicFName), status = …System
9Operational
9Switch SwitchName (Friendly Name: SwitchFName) successfully initialized.System
10Operational
10Failed to initialize switch SwitchName (Friendly Name: SwitchFName), status = …System
11Operational
11Failed to update configuration for switch SwitchName (Friendly Name: …System
12Operational
12Failed to update configuration for port PortName (Friendly Name: PortFName) on …System
13Operational
13Failed to update configuration for NIC NicName (Friendly Name: NicFName), status …System
14Operational
14Failed to restore configuration for switch SwitchName (Friendly Name: …System
15Operational
15Failed to restore configuration for port PortName (Friendly Name: PortFName) on …System
16Operational
16Failed to restore configuration for NIC NicName (Friendly Name: NicFName), …System
17Operational
17Protocol NIC NicName (Friendly Name: NicFName) successfully bound to port …System
18Operational
18Failed to bind protocol NIC NicName (Friendly Name: NicFName) to port PortName …System
19Operational
19Protocol NIC NicName (Friendly Name: NicFName) successfully unbound.System
20Operational
20Failed to unbind protocol NIC NicName (Friendly Name: NicFName), status = …System
21Operational
21Media connected on NIC NicName (Friendly Name: NicFName).System
22Operational
22Media disconnected on NIC NicName (Friendly Name: NicFName).System
23Operational
23NIC NicName (Friendly Name: NicFName) is now operational.System
24Operational
24NIC NicName (Friendly Name: NicFName) is no longer operational.System
25Operational
25The MAC address MacAddress has moved from port Port1Name (Friendly Name: …System
26Operational
26Cannot load networking driver in VMName because there is no mutually supported …System
28Operational
28Port Port2Name (Friendly Name: Port2FName) was prevented from using MAC address …System
29Operational
29Invalid mac address MacAddress configured for NIC NicName (Friendly Name: …System
30Operational
30NIC NicName (Friendly Name: NicFName) was prevented from using MAC address …System
31Operational
31The mac address for NIC NicName (Friendly Name: NicFName) has been overridden by …System
32Operational
32Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName …System
33Operational
33One or more packets were dropped on port PortName (Friendly Name: PortFName) on …System
34Operational
34Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName …System
35Operational
35Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName …System
36A packet was dropped on port PortName (Friendly Name: PortFName) on switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
36Operational
37An IPsec offload inbound packet with destination IP SwitchName and SPI …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
37Operational
38An IPsec offload inbound packet failed crypto on the NIC.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
38Operational
39An IPsec offload outbound packet was dropped.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
39Operational
40An IPsec offload attempt failed.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
40Operational
41Operational
41Failed to query for switch extensions.System
42Operational
42A forwarding extension is enabled on switch SwitchName (Friendly Name: …System
43Operational
43A forwarding extension was disabled on switch SwitchName (Friendly Name: …System
44VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was moved from …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
44Operational
45An IPsec offload packet was dropped because it going to be delivered to multiple …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
45Operational
46Operational
46The connected NIC does not support VLAN trunk mode on switch SwitchName …System
47CurrentTime= CurrentTime BytesSent= BytesSent BytesDropped= BytesDropped …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
47Operational
48NetLuid= NetLuid CurrentTime= CurrentTime ActiveFlows= ActiveFlows ActiveWeight= …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
48Operational
49FlowConformanceEventId= FlowConformanceEvent CurrentTime= CurrentTime …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
49Operational
50FlowSendQueueEventId= FlowSendQueueEvent CurrentTime= CurrentTime IdleTime= …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
50Operational
51TimerId= TimerEvent EventId= TimerId CurrentTime= CurrentTime SetTime= SetTime …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
51Operational
52NetLuid= NetLuid CurrentTime= CurrentTime BytesRequested= BytesRequested …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
52Operational
53Qos Packet dropped, reason=DropReason.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
53Operational
54NBL originating from Nic NicName (Friendly Name: NicFName) was dropped in switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
54Operational
55NBL destined to Nic NicName (Friendly Name: NicFName) was dropped in switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
55Operational
56NBL BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
56Operational
57NBL BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
57Operational
58NBL BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
58Operational
59Switch extension ExtensionName has vetoed delivery of NBL from Nic SrcNicName …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
59Operational
60NBLs were dropped by extension ExtensionGuid (Friendly Name: …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
60Operational
61Operational
61Saved state restored for NIC NicName (Friendly Name: NicFName) on Virtual …System
62Operational
62Switch SwitchName (Friendly Name: SwitchFName) successfully deleted.System
63Operational
63Failed to delete switch SwitchName (Friendly Name: SwitchFName), status = …System
64Switch SwitchName (Friendly Name: SwitchFName) info successfully set.Operational
65Operational
65Failed to set switch info for switch SwitchName (Friendly Name: SwitchFName), …System
66Delete complete for Switch SwitchName (Friendly Name: SwitchFName).Operational
67Port PortName (Friendly Name: PortFName) successfully created on switch …Operational
67Port PortName (Friendly Name: PortFName) successfully created on switch …System
68Operational
68Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName …System
69Port PortName (Friendly Name: PortFName) successfully deleted - switch …Operational
69Port PortName (Friendly Name: PortFName) successfully deleted - switch …System
70Operational
70Failed to delete port PortName (Friendly Name: PortFName) on switch SwitchName …System
71Delete complete for port PortName (Friendly Name: PortFName).Operational
71Delete complete for port PortName (Friendly Name: PortFName).System
72Operational
72Failed to set monitor mode on port PortName (Friendly Name: PortFName) on switch …System
73Operational
73Failed to set VLAN info on port PortName (Friendly Name: PortFName) on switch …System
74Operational
74Failed to set IP spoofing info on port PortName (Friendly Name: PortFName) on …System
75Operational
75The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on …System
76Operational
76The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), …System
77Operational
77Failed to disconnect NIC NicName (Friendly Name: NicFName), status = Status.System
78Operational
78Failed to complete operation 'Operation' on port PortName (Friendly Name: …System
79Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
79Operational
80Operational
80Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: …System
81Completed operation 'Operation' on switch SwitchName (Friendly Name: …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
81Operational
82Operational
82Failed to complete bandwidth policy operation 'Operation' on port PortName …System
83Completed bandwidth policy operation 'Operation' on port PortName (Friendly …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
83Operational
84Operational
84Failed to create default flow on switch SwitchName (Friendly Name: SwitchFName) …System
85Successfully created default flow on switch SwitchName (Friendly Name: …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
85Operational
86Failed to complete operation 'Operation' on port PortName (Friendly Name: …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
86Operational
87Operational
87The connected Nic NicName (Friendly Name: NicFName) does not support VLAN …System
88Operational
88Failed to complete security policy operation on port PortName (Friendly Name: …System
89Completed security policy operation on port PortName (Friendly Name: PortFName) …Operational
90Operational
90Failed to complete Port ACL policy operation on port PortName (Friendly Name: …System
91Completed Port ACL policy operation on port PortName (Friendly Name: PortFName) …Operational
92Operational
92A switch extension blocked the operation 'Operation' on port PortName (Friendly …System
93Operational
93A switch extension blocked the operation 'Operation' on switch SwitchName …System
94Operational
94Failed to complete offload policy operation on port PortName (Friendly Name: …System
95Operational
95The VLAN configuration being set on port PortName (Friendly Name: PortFName) on …System
96Operational
96VLAN tagging is configured on port PortName (Friendly Name: PortFName), …System
97Operational
97Failed to retrieve the active extension list from switch SwitchName (Friendly …System
98Operational
98Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port …System
99Operational
99Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port …System
100Operational
100Failed to complete bandwidth policy operation 'Operation' on switch SwitchName …System
101Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
101Operational
102Operational
102Networking driver in VMName is loaded and the protocol version is negotiated to …System
103Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
103Operational
104The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
104Operational
105The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
105Operational
106Operational
106Available processor sets of the underlying physical NICs belonging to the LBFO …System
107DataOidTarget.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
107Operational
108DataOidTarget.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
108Operational
109DataOidTarget.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
109Operational
110DataOidTarget.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
110Operational
111StatusTarget.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
111Operational
112StatusTarget.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
112Operational
113Operational
113Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch …System
114Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
114Operational
115Completed VMQ allocation for NIC NicName (Friendly Name: NicFName) on switch …Operational
116Switch Team member connected.Operational
117Switch Team member disconnected.Operational
118The external NIC NicName (Friendly Name: NicFName) on switch SwitchName …Operational
119Operational
119Port PortName (Friendly Name: PortFName) has MAC address spoofing enabled.System
120Operational
120The configured bandwidth reservation might not be applied on switch SwitchName …System
121Operational
121An extension is attempting to revoke the VF allocated for Port PortName …System
122Operational
122VMQ group creation failed with NIC NicName (Friendly Name: NicFName) on switch …System
123VMQ capabilities received from NIC NicName (Friendly Name: NicFName): …Operational
124NIC NicName (Friendly Name: NicFName) restarted.Operational
125Media connected on NIC NicName (Friendly Name: NicFName).Operational
126Media disconnected on NIC NicName (Friendly Name: NicFName).Operational
127Operational
127The Isolation configuration could not be deleted from port PortName (Friendly …System
128Operational
128The Isolation configuration set on port PortName (Friendly Name: PortFName) on …System
129Operational
129The Routing Domain configuration (Routing Domain: RoutingDomainName, GUID: …System
130Operational
130Failed to complete Extended Port ACL policy operation on port PortName (Friendly …System
131A packet was dropped on port PortName (Friendly Name: PortFName) on switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
131Operational
132Operational
132The extension stack for Switch SwitchName (Friendly Name: SwitchFName) failed to …System
133RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
133Operational
134VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
134Operational
135Processor ProcIndex is over ProcUtil percent.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
135Operational
136Adjusted load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
136Operational
137Perspective load of RSS queue RssQueueIndex from VMQ VmqIndex of switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
137Operational
138Adjusted load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
138Operational
139Perspective load of VMQ VmqIndex on switch SwitchName (Friendly Name: …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
139Operational
140Assigned processor of RSS queue RssQueueIndex of VMQ VmqIndex on switch …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
140Operational
141The RSS queue group of VMQ VmqIndex from switch SwitchName (Friendly Name: …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
141Operational
142Virtual RSS configuration update failed on NIC NicName (Friendly Name: NicFName) …Operational
143Virtual RSS configuration update succeeded on NIC NicName (Friendly Name: …Operational
144Driver Verifier failure in vmswitch.Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
144Operational
145Policy configuration failed.Operational
146Operational
146Ndk adapter failed to open on behalf of virtual NIC NicName (Friendly Name: …System
147Operational
147Ndk adapter failed to close on behalf of virtual NIC NicName (Friendly Name: …System
148Ndk Oid NdisOid for external NIC PtNicName (Friendly Name: PtNicFName) on behalf …Operational
149Operational
149Ndk PnP event NetEvent successfully sent for virtual NIC NicName (Friendly Name: …System
150Operational
150Request RDMA failed for host virtual NIC NicName (Friendly Name: NicFName) on …System
151Operational
151Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC NicName …System
152Replacing Member OldMember with new Member NewMember for load balancing.Operational
153Excluding Member Member from load balancing.Operational
154Using Member Member for load balancing.Operational
155Starting ConnectTimer for Member Member.Operational
156Stopping to use Member Member for load balancing.Operational
157Priming Switch for TeamNic TeamNic using Member Member.Operational
158Failing NBL send on Member Member.Operational
159Failing NBL send on TeamNic TeamNic.Operational
160Dropping NBLs on Member Member.Operational
161DriverEntry exiting, Status = Status.Operational
162Member Member created.Operational
163Aggregator Aggregator created.Operational
164Member Member placed in Team TeamNic, Status = Status.Operational
165Indicating new link state for TeamNic TeamNic.Operational
166Default Aggregator for TeamNic TeamNic changed to Receiver.Operational
167BroadcastReceiver for TeamNic TeamNic changed to Receiver.Operational
168Initializing TeamNic TeamNic, Status = Status.Operational
169Removing Aggregator Aggregator from TeamNic TeamNic.Operational
170Removed Member Member from TeamNic TeamNic.Operational
171Removing TeamNic TeamNic.Operational
172MsLbfoProvider driver is unloading.Operational
173Changing Aggregator for Member Member from OldAggregator to NewAggregator.Operational
174LACP Initializing for Member Member, Status = Status.Operational
175LACP de-initialized for Member Member.Operational
176Received LACPDU on Member Member.Operational
177LBFO LACP Member Member; ReceiveMachine: OldState->NewState.Operational
178LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.Operational
179LBFO LACP Member Member; Mux Machine: OldState->NewState.Operational
180Sending LACPDU on Member Member.Operational
181LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.Operational
182LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: …Operational
183LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.Operational
184Operational
184Member Nic Member Connected.System
185Operational
185Member Nic Member Disconnected.System
186Operational
186Connection Timer Started for Member Nic Member.System
187Operational
187LACP Churn detected on Member Nic Member.System
188Operational
188Use of Vlan detected on non-default Team Nic Member.System
189Operational
189MAC conflict: A port on the virtual switch has the same MAC as one of the …System
190Operational
190Failed to update NIC NDIS QoS with miniport NIC NicName (Friendly Name: …System
191Operational
191Successfully updated NIC NDIS QoS with Miniport NIC NicName (Friendly Name: …System
192Operational
192Team NIC NicName (Friendly Name: NicFName) has inconsistent consolidated NDIS …System
193Operational
193Team NIC NicName (Friendly Name: NicFName) has consistent consolidated NDIS QoS …System
194Operation operation failed for NIC NicName (Friendly Name: NicFName).Operational
195Switch Extension Operation operation failed for NIC NicName (Friendly Name: …Operational
196Switch Extension Operation operation succeeded for NIC NicName (Friendly Name: …Operational
197Operational
197Failed to set filter for VLAN Id VlanID on NIC NicNameLen (Friendly Name: …System
198VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).Operational
199VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).Operational
200Neither VMQ nor RSS are supported on the external NIC NicName (Friendly Name: …Operational
201VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
201Operational
202Operational
202Team NIC NicName (Friendly Name: NicFName) failed to indicate status for new …System
203Operational
203Team NIC NicName (Friendly Name: NicFName) successfully indicate status for new …System
204Operational
204Failed to set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN …System
205Operational
205Failed to move filter FilterId from vPort SrcVPortId to vPort DstVPortId.System
206Operational
206Initialization of switch embedded team succeeded.System
207Operational
207Initialization of switch embedded team failed.System
208Operational
208Pause of switch embedded team succeeded.System
209Operational
209Initialization of switch embedded team failed.System
210Operational
210Switch embedded team is pre-detached.System
211Operational
211Switch embedded team is completely detached.System
212Operational
212NIC was successfully added to the switch embedded team.System
213Operational
213NIC failed to be addeded to the switch embedded team.System
214Operational
214NIC was removed from the switch embedded team.System
215Operational
215Failed to clear filter FilterId on vPort vPortId.System
216Operational
216Request RDMA failed for virtual machine NIC NicName (Friendly Name: NicFName) on …System
217External NIC sent NDK PnP event but it failed to reach all miniports.Operational
218NIC NicName (Friendly Name: NicFName) queried isolation information on port …Operational
219NIC NicName (Friendly Name: NicFName) queried isolation information on port …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
219Operational
220Status change (NicStatus) sent to Nic NicName (Friendly Name: NicFName) on port …Operational
221Data path usage blocked for Nic NicName (Friendly Name: NicFName) on port …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
221Operational
222Control path usage blocked for Nic NicName (Friendly Name: NicFName) on port …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
222Operational
223Rundown: Switch SwitchName (Friendly Name: SwitchFName).Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
223Operational
224Rundown: Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
224Operational
225Virtual RSS configuration initialization failed on NIC NicName (Friendly Name: …Operational
226Virtual RSS configuration initialization succeeded on NIC NicName (Friendly …Operational
227Operational
227Failed to complete offload policy operation 'Operation' on switch SwitchName …System
228Completed offload policy operation 'Operation' on switch SwitchName (Friendly …Operational
229Operational
229Syncing TCP offloads for switch embedded teaming failed.System
230Operational
230Syncing TCP offloads for switch embedded teaming succeeded.System
231A potentially looped back packet with MAC MacAddress was indicated to physical …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
231Operational
232Operational
232NIC NicName (Friendly Name: NicFName) successfully connected to port PortName …System
233Operational
233The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), …System
234Operational
234NIC NicName successfully disconnected from port PortName.System
235Operational
235NIC NicName disconnect from port PortName failed.System
236Operational
236Failed to allocate virtual function for NIC NicName (Friendly Name: NicFName), …System
237Operational
237Failed to enable Packet Direct for switch SwitchFName.System
238Operational
238Failed to setup Packet Direct access for virtual NIC NicName (Friendly Name: …System
239Operational
239Failed to setup Packet Direct data path on switch SwitchName (Friendly Name: …System
240PD Buffer BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
240Operational
241PD Buffer BufferAddress received from Nic NicName (Friendly Name: NicFName) in …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
241Operational
242PD Buffer BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) …Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
242Operational
243Operational
243Insufficient number of available MAC address filters for configuring …System
244Operational
244Insufficient number of available MAC address filters for configuring …System
245Successfully set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN …Operational
246Successfully moved filter FilterId from vPort SrcVPortId to vPort DstVPortId.Operational
247Successfully cleared filter FilterId on vPort vPortId.Operational
248Send spreading was successfully enabled on NIC NicName (Friendly Name: …Operational
249The system is not ready to enable send spreading on NIC NicName (Friendly Name: …Operational
250Send spreading on NIC NicName (Friendly Name: NicFName) is not supported.Operational
251Failed to enable send spreading on NIC NicName (Friendly Name: NicFName).Operational
252Memory allocated for packets in a vRss queue (on CPU ProcessorIndex) on switch …System
253Memory allocated for packets in a vRss queue (on CPU ProcessorIndex) on switch …System
254Operational
254Sending Ndk PnP event NetEvent failed for virtual NIC NicName (Friendly Name: …System
255Setting Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) …Operational
256Operational
256Failed to set Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) …System
257Operational
257Failed to retrieve Rdma weight on port PortName (Friendly Name PortFName) …System
258Operational
258Failed to get stored VlanID for Physical NIC NicName.System
259Operational
259Underlying network adapter failed to execute critical OID request.System
260Operational
260Failed to move RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName …System
261Operational
261Failed to complete performance policy operation 'Operation' on switch SwitchName …System
262Completed performance policy operation 'Operation' on switch SwitchName …Operational
263Operational
263Miniport NIC NicName (Friendly Name: NicFName) is operating in sub-optimal RSC …System
264Operational
264Internal or External Port PortName (Friendly Name: PortFName) successfully …System
265Operational
265Traffic flow has been paused on external NIC NicFName of switch SwitchFName.System
266Operational
266Traffic flow has been restarted on external NIC NicFName of switch SwitchFName.System
267Operational
267IOCTL Operation IoctlCode completed with status Status in ElapsedTime ms.System
268Operational
268Connectivity state changed to ConnectivityState.System
269Operational
269Failed to get Device VlanID Regkey for Physical NIC NicName.System
270Operational
270Traffic flow is pausing on external NIC NicFName of switch SwitchFName.System
275Failed to handle status from extension stack sent to Nic NicName (Friendly Name: …Operational
276Operational
276Could not allocate virtual function for NIC NicName (Friendly Name: NicFName).System
277Operational
277vmswitch.System
278Operational
278NDK request for virtual NIC NicName (Friendly Name: NicFName) was disabled …System
279Operational
279NDK request for virtual NIC NicName (Friendly Name: NicFName) was re-enabled …System
280Operational
280VMS Utilization Plan Vport QueuePairs adjusted from requested number …System
281Operational
281VMS Utilization Plan Vport QueuePairs failure.System
282Operational
282Failed to find a VMBus Channel in servicing state for VM Nic (Name: NicName).System
283Operational
283Failed to complete extension policy operation 'FailReason' on switch SwitchName …System
284Completed extension policy operation 'RequiredExtensionCount' on switch …Operational
285V-Switch operation OperationName (OperationId) took too long to complete.Microsoft-Windows-Hyper-V-VmSwitch-Operational
286Operational
286Temporarily disable logging for event(s) LogRateLimitEventId of NIC NicName …System
287Operational
287Extending disable logging for event(s) LogRateLimitEventId of NIC NicName …System
288Operational
288Virtual function for NIC NicName (Friendly Name: NicFName) successfully …System
289Operational
289Switch VF data path for NIC NicName (Friendly Name: NicFName) failed with status …System
290Operational
290Switch VF data path for NIC NicName (Friendly Name: NicFName) succeeded.System
291Operational
291RSC offload modified for NIC NicName (Friendly Name: NicFName) Previous IPv4: …System
292Operational
292RSC offload modified for Port PortName (Friendly Name: PortFName) Previous: …System
293Operational
293VF assignment ChangeStateTo for Port PortName (Friendly Name: PortFName).System
294Operational
294Found L1VH VM NIC that has matched MacAddress MacAddress, connected to port …System
295Operational
295No L1VH VM NIC found that has matched MacAddress MacAddress on switch SwitchName …System
296Operational
296NIC Switch creation failed on the first member adapter SwitchName (Friendly …System
297Operational
297NIC Switch creation failed on the member adapter SwitchName (Friendly Name: …System
298Operational
298NIC Switch appears to be not supported on the first member adapter SwitchName …System
299Operational
299NIC Switch appears to be not supported on this member adapter SwitchName …System
300Operational
300Nic Switch assymetric capabilities or configuration detected between the first …System
301Operational
301Processing NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES status indication: new …System
302Operational
302Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: …System
303Operational
303Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch …System
304Operational
304Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = …System
305Operational
305Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: OldSriovSupport, …System
306Operational
306WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: SwitchFriendlyName, …System

Event ID 0 —

#
Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Operational
Level
Informational

Fields #

NameDescription
Name—
netPnpEvent—
switchName_Length—
switchName—
switchFriendlyName_Length—
switchFriendlyName—
delta (100 ns)—
Status— NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 0,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 0,
    "time_created": "2023-11-06T06:25:41.500585+00:00",
    "event_record_id": 31,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 228
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ExtProtocol NetPnpEvent End",
    "netPnpEvent": "NetEventBindsComplete",
    "switchName_Length": 0,
    "switchName": "",
    "switchFriendlyName_Length": 0,
    "switchFriendlyName": "",
    "delta (100 ns)": 40,
    "Status": 0
  },
  "message": ""
}

References #

Event ID 1 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
ConfigStoreInitialize

Description

Failed to open handle to configuration store root due to error.

Fields #

NameDescription
Status UInt32— NTSTATUS reference

Event ID 1 — Failed to open handle to configuration store root due to error Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
ConfigStoreInitialize

Description

Failed to open handle to configuration store root due to error Status.

Message #

Failed to open handle to configuration store root due to error %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference

Event ID 2 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
ConfigStoreInitialize

Description

Failed to restore switch. The switch name in the configuration store is corrupted.

Fields #

NameDescription
Status UInt32— NTSTATUS reference

Event ID 2 — Failed to restore switch.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
ConfigStoreInitialize

Description

Failed to restore switch. The switch name in the configuration store is corrupted.

Message #

Failed to restore switch. The switch name in the configuration store is corrupted.

Fields #

NameDescription
Status UInt32— NTSTATUS reference

Event ID 3 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
DriverInit

Description

Failed to register the control device object for the switch due to error .

Fields #

NameDescription
Status UInt32— NTSTATUS reference

Event ID 3 — Failed to register the control device object for the switch due to error Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
DriverInit

Description

Failed to register the control device object for the switch due to error Status.

Message #

Failed to register the control device object for the switch due to error %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference

Event ID 4 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
DriverInit

Description

Failed to initialize VMSwitch driver due to error .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
UniqueEvent UInt32—

Event ID 4 — Failed to initialize VMSwitch driver due to error Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
DriverInit

Description

Failed to initialize VMSwitch driver due to error Status.

Message #

Failed to initialize VMSwitch driver due to error %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
UniqueEvent UInt32—

Event ID 5 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
EnableNIC

Description

Miniport NIC (Friendly Name: ) successfully enabled.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 5 — Miniport NIC NicName (Friendly Name: NicFName) successfully enabled.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Task
EnableNIC

Description

Miniport NIC NicName (Friendly Name: NicFName) successfully enabled.

Message #

Miniport NIC %2 (Friendly Name: %4) successfully enabled

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 1003,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-13T20:24:29.667692+00:00",
    "event_record_id": 2176,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 408
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "NicFNameLen": 1,
    "NicFName": ""
  },
  "message": ""
}

Event ID 6 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
EnableNIC

Description

Failed to enable miniport NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 6 — Failed to enable miniport NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
EnableNIC

Description

Failed to enable miniport NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to enable miniport NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 7 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializeNIC

Description

Miniport NIC (Friendly Name: ) successfully initialized.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 7 — Miniport NIC NicName (Friendly Name: NicFName) successfully initialized.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Task
InitializeNIC

Description

Miniport NIC NicName (Friendly Name: NicFName) successfully initialized.

Message #

Miniport NIC %2 (Friendly Name: %4) successfully initialized.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 7,
    "version": 0,
    "level": 4,
    "task": 1004,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.198098+00:00",
    "event_record_id": 2813,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "NicFNameLen": 3,
    "NicFName": "WSL"
  },
  "message": ""
}

Event ID 8 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializeNIC

Description

Failed to initialize miniport NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 8 — Failed to initialize miniport NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
InitializeNIC

Description

Failed to initialize miniport NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to initialize miniport NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 9 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializeSwitch

Description

Switch (Friendly Name: ) successfully initialized.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 9 — Switch SwitchName (Friendly Name: SwitchFName) successfully initialized.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Task
InitializeSwitch

Description

Switch SwitchName (Friendly Name: SwitchFName) successfully initialized.

Message #

Switch %2 (Friendly Name: %4) successfully initialized.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 4,
    "task": 1005,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:01.748463+00:00",
    "event_record_id": 2810,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "Flags": 32,
    "OwnerService": 1
  },
  "message": ""
}

Event ID 10 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializeSwitch

Description

Failed to initialize switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 10 — Failed to initialize switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Error
Task
InitializeSwitch

Description

Failed to initialize switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to initialize switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 2,
    "task": 1005,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-14T01:40:09.154839+00:00",
    "event_record_id": 2491,
    "correlation": {},
    "execution": {
      "process_id": 2476,
      "thread_id": 2776
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Status": 3221225525,
    "SwitchNameLen": 36,
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "SwitchFNameLen": 14,
    "SwitchFName": "Default Switch",
    "UniqueEvent": 50
  },
  "message": ""
}

Event ID 11 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
StoreSwitch

Description

Failed to update configuration for switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 11 — Failed to update configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
StoreSwitch

Description

Failed to update configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to update configuration for switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 12 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
StorePort

Description

Failed to update configuration for port (Friendly Name: ) on switch (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 12 — Failed to update configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
StorePort

Description

Failed to update configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to update configuration for port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9), status = %1. UniqueEvent = %10.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 13 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
StoreNic

Description

Failed to update configuration for NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 13 — Failed to update configuration for NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
StoreNic

Description

Failed to update configuration for NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to update configuration for NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 14 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
RestoreSwitch

Description

Failed to restore configuration for switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 14 — Failed to restore configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
RestoreSwitch

Description

Failed to restore configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to restore configuration for switch %3 (Friendly Name: %5),  status = %1, UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 15 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
RestorePort

Description

Failed to restore configuration for port (Friendly Name: ) on switch (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 15 — Failed to restore configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
RestorePort

Description

Failed to restore configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to restore configuration for port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9), status = %1. UniqueEvent = %10.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 16 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
RestoreNic

Description

Failed to restore configuration for NIC (Friendly Name: ), status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 16 — Failed to restore configuration for NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
RestoreNic

Description

Failed to restore configuration for NIC NicName (Friendly Name: NicFName), status = Status.

Message #

Failed to restore configuration for NIC %3 (Friendly Name: %5), status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 17 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
BindProtocolNic

Description

Protocol NIC (Friendly Name: ) successfully bound to port (Friendly Name: ) on switch (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 17 — Protocol NIC NicName (Friendly Name: NicFName) successfully bound to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
BindProtocolNic

Description

Protocol NIC NicName (Friendly Name: NicFName) successfully bound to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Message #

Protocol NIC %2 (Friendly Name: %4) successfully bound to port %6 (Friendly Name: %8) on switch %10(Friendly Name: %12).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 18 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
BindProtocolNic

Description

Failed to bind protocol NIC (Friendly Name: ) to port (Friendly Name: ) on switch (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 18 — Failed to bind protocol NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
BindProtocolNic

Description

Failed to bind protocol NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to bind protocol NIC %3 (Friendly Name: %5) to port %7 (Friendly Name: %9) on switch %11 (Friendly Name: %13), status = %1. UniqueEvent = %14.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 19 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
UnbindProtocolNic

Description

Protocol NIC (Friendly Name: ) successfully unbound.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 19 — Protocol NIC NicName (Friendly Name: NicFName) successfully unbound.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
UnbindProtocolNic

Description

Protocol NIC NicName (Friendly Name: NicFName) successfully unbound.

Message #

Protocol NIC %2 (Friendly Name: %4) successfully unbound.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 20 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
UnbindProtocolNic

Description

Failed to unbind protocol NIC (Friendly Name: ), status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 20 — Failed to unbind protocol NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
UnbindProtocolNic

Description

Failed to unbind protocol NIC NicName (Friendly Name: NicFName), status = Status.

Message #

Failed to unbind protocol NIC %3 (Friendly Name: %5), status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 21 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
ConnectMedia

Description

Media connected on NIC (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 21 — Media connected on NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
ConnectMedia

Description

Media connected on NIC NicName (Friendly Name: NicFName).

Message #

Media connected on NIC %2 (Friendly Name: %4).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 22 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
DisconnectMedia

Description

Media disconnected on NIC (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 22 — Media disconnected on NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
DisconnectMedia

Description

Media disconnected on NIC NicName (Friendly Name: NicFName).

Message #

Media disconnected on NIC %2 (Friendly Name: %4).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 23 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
NicOperational

Description

NIC (Friendly Name: ) is now operational.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 23 — NIC NicName (Friendly Name: NicFName) is now operational.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
NicOperational

Description

NIC NicName (Friendly Name: NicFName) is now operational.

Message #

NIC %2 (Friendly Name: %4) is now operational.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 24 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
NicNonOperational

Description

NIC (Friendly Name: ) is no longer operational.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 24 — NIC NicName (Friendly Name: NicFName) is no longer operational.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
NicNonOperational

Description

NIC NicName (Friendly Name: NicFName) is no longer operational.

Message #

NIC %2 (Friendly Name: %4) is no longer operational.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 25 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
MacChange

Description

The MAC address has moved from port (Friendly Name: ) to port (Friendly Name: ).

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
Port1NameLen UInt32—
Port1Name UnicodeString—
Port1FNameLen UInt32—
Port1FName UnicodeString—
Port2NameLen UInt32—
Port2Name UnicodeString—
Port2FNameLen UInt32—
Port2FName UnicodeString—

Event ID 25 — The MAC address MacAddress has moved from port Port1Name (Friendly Name: Port1FName) to port Port2Name (Friendly Name: Port2FName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
MacChange

Description

The MAC address MacAddress has moved from port Port1Name (Friendly Name: Port1FName) to port Port2Name (Friendly Name: Port2FName).

Message #

The MAC address %2 has moved from port %4 (Friendly Name: %6) to port %8 (Friendly Name: %10).

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
Port1NameLen UInt32—
Port1Name UnicodeString—
Port1FNameLen UInt32—
Port1FName UnicodeString—
Port2NameLen UInt32—
Port2Name UnicodeString—
Port2FNameLen UInt32—
Port2FName UnicodeString—

Event ID 26 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
ProtocolVersionNegotiate

Description

Cannot load networking driver in because there is no mutually supported protocol. Server version Client version (Virtual machine ID ).

Fields #

NameDescription
VMNameLen UInt32—
VMName UnicodeString—
VMIdLen UInt32—
VMId UnicodeString—
ServerVersionLen UInt32—
ServerVersion UnicodeString—
ClientVersionLen UInt32—
ClientVersion UnicodeString—

Event ID 26 — Cannot load networking driver in VMName because there is no mutually supported protocol.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
ProtocolVersionNegotiate

Description

Cannot load networking driver in VMName because there is no mutually supported protocol. Server version ServerVersion Client version ClientVersion (Virtual machine ID VMId).

Message #

Cannot load networking driver in %2 because there is no mutually supported protocol.  Server version %6  Client version %8 (Virtual machine ID %4).

Fields #

NameDescription
VMNameLen UInt32—
VMName UnicodeString—
VMIdLen UInt32—
VMId UnicodeString—
ServerVersionLen UInt32—
ServerVersion UnicodeString—
ClientVersionLen UInt32—
ClientVersion UnicodeString—

Event ID 28 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
MacRelearn

Description

Port (Friendly Name: ) was prevented from using MAC address because it is pinned to port (Friendly Name: ).

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
Port1NameLen UInt32—
Port1Name UnicodeString—
Port1FNameLen UInt32—
Port1FName UnicodeString—
Port2NameLen UInt32—
Port2Name UnicodeString—
Port2FNameLen UInt32—
Port2FName UnicodeString—

Event ID 28 — Port Port2Name (Friendly Name: Port2FName) was prevented from using MAC address MacAddress because it is pinned to port Port1Name (Friendly Name: Port1FName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
MacRelearn

Description

Port Port2Name (Friendly Name: Port2FName) was prevented from using MAC address MacAddress because it is pinned to port Port1Name (Friendly Name: Port1FName).

Message #

Port %8 (Friendly Name: %10) was prevented from using MAC address %2 because it is pinned to port %4 (Friendly Name: %6).

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
Port1NameLen UInt32—
Port1Name UnicodeString—
Port1FNameLen UInt32—
Port1FName UnicodeString—
Port2NameLen UInt32—
Port2Name UnicodeString—
Port2FNameLen UInt32—
Port2FName UnicodeString—

Event ID 29 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
MacConfig

Description

Invalid mac address configured for NIC (Friendly Name: ).

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 29 — Invalid mac address MacAddress configured for NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
MacConfig

Description

Invalid mac address MacAddress configured for NIC NicName (Friendly Name: NicFName).

Message #

Invalid mac address %2 configured for NIC %4 (Friendly Name: %6).

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 30 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
MacConfig

Description

NIC (Friendly Name: ) was prevented from using MAC address because it is connected to a port that does not allow mac spoofing.

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 30 — NIC NicName (Friendly Name: NicFName) was prevented from using MAC address MacAddress because it is connected to a port that does not allow mac spoofing.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
MacConfig

Description

NIC NicName (Friendly Name: NicFName) was prevented from using MAC address MacAddress because it is connected to a port that does not allow mac spoofing.

Message #

NIC %4 (Friendly Name: %6) was prevented from using MAC address %2 because it is connected to a port that does not allow mac spoofing.

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 31 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
MacConfig

Description

The mac address for NIC (Friendly Name: ) has been overridden by the VM to .

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 31 — The mac address for NIC NicName (Friendly Name: NicFName) has been overridden by the VM to MacAddress.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
MacConfig

Description

The mac address for NIC NicName (Friendly Name: NicFName) has been overridden by the VM to MacAddress.

Message #

The mac address for NIC %4 (Friendly Name: %6) has been overridden by the VM to %2.

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 32 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
NicConnect

Description

Failed to connect NIC (Friendly Name: ) to port (Friendly Name: ) on switch (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 32 — Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
NicConnect

Description

Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to connect NIC %3 (Friendly Name: %5) to port %7 (Friendly Name: %9) on switch %11 (Friendly Name: %13), status = %1. UniqueEvent = %14.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 33 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Description

One or more packets were dropped on port (Friendly Name: ) on switch (Friendly Name: ) because the packet contained spoofed IP address. Connected NIC is (Friendly Name: )on VM .

Fields #

NameDescription
VMNameLen UInt32—
VMName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 33 — One or more packets were dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet contained spoofed IP address.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
PktDrop

Description

One or more packets were dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet contained spoofed IP address. Connected NIC is NicName (Friendly Name: NicFName)on VM VMName.

Message #

One or more packets were dropped on port %8 (Friendly Name: %10) on switch %12 (Friendly Name: %14) because the packet contained spoofed IP address. Connected NIC is %4  (Friendly Name: %6)on VM %2.

Fields #

NameDescription
VMNameLen UInt32—
VMName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 34 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
CreatePort

Description

Failed to create port (Friendly Name: ) on switch (Friendly Name: ). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 34 — Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
CreatePort

Description

Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to create port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = %1. UniqueEvent = %10.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 35 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
NicConnect

Description

Failed to connect NIC (Friendly Name: ) to port (Friendly Name: ) on switch (Friendly Name: ). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 35 — Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
NicConnect

Description

Failed to connect NIC (Friendly Name: ) to port (Friendly Name: ) on switch (Friendly Name: ). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = .

Message #

Failed to connect NIC %3 (Friendly Name: %5) to port %7 (Friendly Name: %9) on switch %11 (Friendly Name: %13). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 36 — A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Port ACL entry AclName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Description

A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Port ACL entry AclName.

Message #

A packet was dropped on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) because the packet is filtered by Port ACL entry %10.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
AclNameLen UInt32—
AclName UnicodeString—

Event ID 36 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Description

A packet was dropped on port (Friendly Name: ) on switch (Friendly Name: ) because the packet is filtered by Port ACL entry .

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
AclNameLen UInt32—
AclName UnicodeString—

Event ID 37 — An IPsec offload inbound packet with destination IP SwitchName and SPI SwitchFNameLen destined to port PortName (Friendly Name: PortFName);on switch PortFName (Friendly Name: SwitchName) was drop...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Description

An IPsec offload inbound packet with destination IP SwitchName and SPI SwitchFNameLen destined to port PortName (Friendly Name: PortFName);on switch PortFName (Friendly Name: SwitchName) was dropped. Reason: IpsecOffloadInboundDropReason.

Message #

An IPsec offload inbound packet with destination IP %7 and SPI %8 destined to port %3 (Friendly Name: %5);on switch %5 (Friendly Name: %7) was dropped. Reason: %1

Fields #

NameDescription
IpsecOffloadInboundDropReason UInt32—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DestAddressLen UInt32—
DestAddress UnicodeString—
SPI UInt32—

Event ID 37 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Description

An IPsec offload inbound packet with destination IP and SPI destined to port (Friendly Name: );on switch (Friendly Name: ) was dropped. Reason.

Fields #

NameDescription
IpsecOffloadInboundDropReason UInt32—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DestAddressLen UInt32—
DestAddress UnicodeString—
SPI UInt32—

Event ID 38 — An IPsec offload inbound packet failed crypto on the NIC.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Message #

An IPsec offload inbound packet failed crypto on the NIC. Destination IP address: %10, SPI: %11, port %2 (Friendly Name: %4), switch %6 (Friendly Name: %8) This may be a DoS attack since the IP and SPI switch lookup succeeded but the SA packet port did not match. Ignoring the crypto failure and letting the packet through.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DestAddressLen UInt32—
DestAddress UnicodeString—
SPI UInt32—

Event ID 38 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DestAddressLen UInt32—
DestAddress UnicodeString—
SPI UInt32—

Event ID 39 — An IPsec offload outbound packet was dropped.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Message #

An IPsec offload outbound packet was dropped. Offload handle: %9, from port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8)  The packet did not match any existing offload handle on that port. This may be network attack.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
OffloadHandle UInt64—

Event ID 39 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
OffloadHandle UInt64—

Event ID 40 — An IPsec offload attempt failed.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Description

An IPsec offload attempt failed. Originating from port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Reason: IpsecSaOffloadFailureReason. NDIS Status: Status.

Message #

An IPsec offload attempt failed. Originating from port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Reason: %1. NDIS Status: %10

Fields #

NameDescription
IpsecSaOffloadFailureReason UInt32—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 40 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Description

An IPsec offload attempt failed. Originating from port (Friendly Name: ) on switch (Friendly Name: ). Reason: . NDIS Status.

Fields #

NameDescription
IpsecSaOffloadFailureReason UInt32—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 41 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializeSwitch

Description

Failed to query for switch extensions. The switch data path cannot start. Switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 41 — Failed to query for switch extensions.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
InitializeSwitch

Description

Failed to query for switch extensions. The switch data path cannot start. Switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to query for switch extensions. The switch data path cannot start. Switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 42 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializeSwitch

Description

A forwarding extension is enabled on switch (Friendly Name: ). Built-in forwarding capability is disabled.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 42 — A forwarding extension is enabled on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
InitializeSwitch

Description

A forwarding extension is enabled on switch SwitchName (Friendly Name: SwitchFName). Built-in forwarding capability is disabled.

Message #

A forwarding extension is enabled on switch %2 (Friendly Name: %4). Built-in forwarding capability is disabled

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 43 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializeSwitch

Description

A forwarding extension was disabled on switch (Friendly Name: ). Built-in forwarding capability is enabled.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 43 — A forwarding extension was disabled on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
InitializeSwitch

Description

A forwarding extension was disabled on switch SwitchName (Friendly Name: SwitchFName). Built-in forwarding capability is enabled.

Message #

A forwarding extension was disabled on switch %2 (Friendly Name: %4). Built-in forwarding capability is enabled

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 44 — VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was moved from Processor SourceProcIndex to Processor DestinationProcIndex.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was moved from Processor SourceProcIndex to Processor DestinationProcIndex.

Message #

VMQ %5 on switch %2 (Friendly Name: %4) was moved from Processor %6 to Processor %7.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
SourceProcIndex UInt32—
DestinationProcIndex UInt32—

Event ID 44 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

VMQ on switch (Friendly Name: ) was moved from Processor to Processor .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
SourceProcIndex UInt32—
DestinationProcIndex UInt32—

Event ID 45 — An IPsec offload packet was dropped because it going to be delivered to multiple destinations.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Message #

An IPsec offload packet was dropped because it going to be delivered to multiple destinations. From port %2 (Friendly Name: %4) on switch %6  (Friendly Name: %8). The multiple destinations could be because of Port monitoring, Layer 2 Multicast or switch flooding.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 45 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 46 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
TrunkModeNotSupported

Description

The connected NIC does not support VLAN trunk mode on switch (Friendly Name: ) port (Friendly Name: ).

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—

Event ID 46 — The connected NIC does not support VLAN trunk mode on switch SwitchName (Friendly Name: SwitchFName) port PortName (Friendly Name: PortFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
TrunkModeNotSupported

Description

The connected NIC does not support VLAN trunk mode on switch SwitchName (Friendly Name: SwitchFName) port PortName (Friendly Name: PortFName).

Message #

The connected NIC does not support VLAN trunk mode on switch %2 (Friendly Name: %4) port %6 (Friendly Name: %8).

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—

Event ID 47 — CurrentTime= CurrentTime BytesSent= BytesSent BytesDropped= BytesDropped NewSendWindow= NewSendWindow MinSendWindow= MinSendWindow.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

CurrentTime= CurrentTime BytesSent= BytesSent BytesDropped= BytesDropped NewSendWindow= NewSendWindow MinSendWindow= MinSendWindow.

Message #

CurrentTime= %1 BytesSent= %2 BytesDropped= %3 NewSendWindow= %4 MinSendWindow= %5

Fields #

NameDescription
CurrentTime UInt64—
BytesSent UInt32—
BytesDropped UInt32—
NewSendWindow UInt32—
MinSendWindow UInt32—
Weight UInt32—
SBytesRequested Int64—
DropRate UInt32—
IdleIntervals UInt64—
RcSendWindow UInt32—
RcEpisodeLength UInt32—
RcStatMuxFactor UInt32—
RcExitThreshold UInt32—
AverageMaxBytesRequested UInt32—

Event ID 47 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

CurrentTime= BytesSent= BytesDropped= NewSendWindow= MinSendWindow=.

Fields #

NameDescription
CurrentTime UInt64—
BytesSent UInt32—
BytesDropped UInt32—
NewSendWindow UInt32—
MinSendWindow UInt32—
Weight UInt32—
SBytesRequested Int64—
DropRate UInt32—
IdleIntervals UInt64—
RcSendWindow UInt32—
RcEpisodeLength UInt32—
RcStatMuxFactor UInt32—
RcExitThreshold UInt32—
AverageMaxBytesRequested UInt32—

Event ID 48 — NetLuid= NetLuid CurrentTime= CurrentTime ActiveFlows= ActiveFlows ActiveWeight= ActiveWeight NewSendWindow= NewSendWindow.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

NetLuid= NetLuid CurrentTime= CurrentTime ActiveFlows= ActiveFlows ActiveWeight= ActiveWeight NewSendWindow= NewSendWindow.

Message #

NetLuid= %1 CurrentTime= %2 ActiveFlows= %3 ActiveWeight= %4 NewSendWindow= %5

Fields #

NameDescription
NetLuid Binary—
CurrentTime UInt64—
ActiveFlows UInt32—
ActiveWeight UInt32—
NewSendWindow UInt32—

Event ID 48 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NetLuid= CurrentTime= ActiveFlows= ActiveWeight= NewSendWindow=.

Fields #

NameDescription
NetLuid Binary—
CurrentTime UInt64—
ActiveFlows UInt32—
ActiveWeight UInt32—
NewSendWindow UInt32—

Event ID 49 — FlowConformanceEventId= FlowConformanceEvent CurrentTime= CurrentTime LastConformanceTime= LastConformanceTime PeakConformanceTime= PeakConformanceTime Tokens= Tokens MaxTokens= MaxTokens Rate= Rat...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

FlowConformanceEventId= FlowConformanceEvent CurrentTime= CurrentTime LastConformanceTime= LastConformanceTime PeakConformanceTime= PeakConformanceTime Tokens= Tokens MaxTokens= MaxTokens Rate= Rate LastConformanceCredits= LastConformanceCredits.

Message #

FlowConformanceEventId= %1 CurrentTime= %2 LastConformanceTime= %3 PeakConformanceTime= %4 Tokens= %5 MaxTokens= %6 Rate= %7 LastConformanceCredits= %8

Fields #

NameDescription
FlowConformanceEvent UInt32—
CurrentTime UInt64—
LastConformanceTime UInt64—
PeakConformanceTime UInt64—
Tokens UInt64—
MaxTokens UInt64—
Rate UInt64—
LastConformanceCredits UInt32—

Event ID 49 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

FlowConformanceEventId= CurrentTime= LastConformanceTime= PeakConformanceTime= Tokens= MaxTokens= Rate= LastConformanceCredits=.

Fields #

NameDescription
FlowConformanceEvent UInt32—
CurrentTime UInt64—
LastConformanceTime UInt64—
PeakConformanceTime UInt64—
Tokens UInt64—
MaxTokens UInt64—
Rate UInt64—
LastConformanceCredits UInt32—

Event ID 50 — FlowSendQueueEventId= FlowSendQueueEvent CurrentTime= CurrentTime IdleTime= IdleTime DelayTime= DelayTime BytesRequested= BytesRequested BytesSent= BytesSent BytesQueued= BytesQueued.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

FlowSendQueueEventId= FlowSendQueueEvent CurrentTime= CurrentTime IdleTime= IdleTime DelayTime= DelayTime BytesRequested= BytesRequested BytesSent= BytesSent BytesQueued= BytesQueued.

Message #

FlowSendQueueEventId= %1 CurrentTime= %2 IdleTime= %3 DelayTime= %4 BytesRequested= %5 BytesSent= %6 BytesQueued= %7

Fields #

NameDescription
FlowSendQueueEvent UInt32—
CurrentTime UInt64—
IdleTime UInt64—
DelayTime UInt64—
BytesRequested UInt32—
BytesSent UInt32—
BytesQueued UInt32—

Event ID 50 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

FlowSendQueueEventId= CurrentTime= IdleTime= DelayTime= BytesRequested= BytesSent= BytesQueued=.

Fields #

NameDescription
FlowSendQueueEvent UInt32—
CurrentTime UInt64—
IdleTime UInt64—
DelayTime UInt64—
BytesRequested UInt32—
BytesSent UInt32—
BytesQueued UInt32—

Event ID 51 — TimerId= TimerEvent EventId= TimerId CurrentTime= CurrentTime SetTime= SetTime RunTime= RunTime FlowsProcessed= FlowsProcessed NblsSent= NblsSent NblsDropped= NblsDropped Flags= Flags.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

TimerId= TimerEvent EventId= TimerId CurrentTime= CurrentTime SetTime= SetTime RunTime= RunTime FlowsProcessed= FlowsProcessed NblsSent= NblsSent NblsDropped= NblsDropped Flags= Flags.

Message #

TimerId= %1 EventId= %2 CurrentTime= %3 SetTime= %4 RunTime= %5 FlowsProcessed= %6 NblsSent= %7 NblsDropped= %8 Flags= %9

Fields #

NameDescription
TimerEvent UInt32—
TimerId UInt32—
CurrentTime UInt64—
SetTime UInt64—
RunTime UInt64—
FlowsProcessed UInt32—
NblsSent UInt32—
NblsDropped UInt32—
Flags UInt32—

Event ID 51 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

TimerId= EventId= CurrentTime= SetTime= RunTime= FlowsProcessed= NblsSent= NblsDropped= Flags=.

Fields #

NameDescription
TimerEvent UInt32—
TimerId UInt32—
CurrentTime UInt64—
SetTime UInt64—
RunTime UInt64—
FlowsProcessed UInt32—
NblsSent UInt32—
NblsDropped UInt32—
Flags UInt32—

Event ID 52 — NetLuid= NetLuid CurrentTime= CurrentTime BytesRequested= BytesRequested BytesCompleted= BytesCompleted BytesInQueue= BytesInQueue BufferAvailable= BufferAvailable AlphaTerm= AlphaTerm BetaTerm= Be...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

NetLuid= NetLuid CurrentTime= CurrentTime BytesRequested= BytesRequested BytesCompleted= BytesCompleted BytesInQueue= BytesInQueue BufferAvailable= BufferAvailable AlphaTerm= AlphaTerm BetaTerm= BetaTerm DeltaSendWindow= DeltaSendWindow NewSendWindow= NewSendWindow.

Message #

NetLuid= %1 CurrentTime= %2 BytesRequested= %3 BytesCompleted= %4 BytesInQueue= %5 BufferAvailable= %6 AlphaTerm= %8 BetaTerm= %7 DeltaSendWindow= %9 NewSendWindow= %10

Fields #

NameDescription
NetLuid Binary—
CurrentTime UInt64—
BytesRequested UInt32—
BytesCompleted UInt32—
BytesInQueue UInt32—
BufferAvailable Int64—
BetaTerm Int64—
AlphaTerm Int64—
DeltaSendWindow Int64—
NewSendWindow Int64—

Event ID 52 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NetLuid= CurrentTime= BytesRequested= BytesCompleted= BytesInQueue= BufferAvailable= AlphaTerm= BetaTerm= DeltaSendWindow= NewSendWindow=.

Fields #

NameDescription
NetLuid Binary—
CurrentTime UInt64—
BytesRequested UInt32—
BytesCompleted UInt32—
BytesInQueue UInt32—
BufferAvailable Int64—
BetaTerm Int64—
AlphaTerm Int64—
DeltaSendWindow Int64—
NewSendWindow Int64—

Event ID 53 — Qos Packet dropped, reason=DropReason.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

Qos Packet dropped, reason=DropReason.

Message #

Qos Packet dropped, reason=%1

Fields #

NameDescription
DropReason UInt32—

Event ID 53 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Qos Packet dropped, reason=.

Fields #

NameDescription
DropReason UInt32—

Event ID 54 — NBL originating from Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Description

NBL originating from Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status).

Message #

NBL originating from Nic %2 (Friendly Name: %4) was dropped in switch %6 (Friendly Name: %8), Reason %9 (Status:%10)

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DropReason UInt32—
Status UInt32— NTSTATUS reference

Event ID 54 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Description

NBL originating from Nic (Friendly Name: ) was dropped in switch (Friendly Name: ), Reason (Status:).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DropReason UInt32—
Status UInt32— NTSTATUS reference

Event ID 55 — NBL destined to Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Description

NBL destined to Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status).

Message #

NBL destined to Nic %2 (Friendly Name: %4) was dropped in switch %6 (Friendly Name: %8), Reason %9 (Status:%10)

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DropReason UInt32—
Status UInt32— NTSTATUS reference

Event ID 55 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Description

NBL destined to Nic (Friendly Name: ) was dropped in switch (Friendly Name: ), Reason (Status:).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DropReason UInt32—
Status UInt32— NTSTATUS reference

Event ID 56 — NBL BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

NBL BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Message #

NBL %9 received from Nic %2 (Friendly Name: %4) in switch %6 (Friendly Name: %8)

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 56 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NBL received from Nic (Friendly Name: ) in switch (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 57 — NBL BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

NBL BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

NBL %13 routed from Nic %2 (Friendly Name: %4) to Nic %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12)

Fields #

NameDescription
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
DestNicNameLen UInt32—
DestNicName UnicodeString—
DestNicFNameLen UInt32—
DestNicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 57 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NBL routed from Nic (Friendly Name: ) to Nic (Friendly Name: ) on switch (Friendly Name: ).

Fields #

NameDescription
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
DestNicNameLen UInt32—
DestNicName UnicodeString—
DestNicFNameLen UInt32—
DestNicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 58 — NBL BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

NBL BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Message #

NBL %9 delivered to Nic %2 (Friendly Name: %4) in switch %6 (Friendly Name: %8)

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 58 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NBL delivered to Nic (Friendly Name: ) in switch (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 59 — Switch extension ExtensionName has vetoed delivery of NBL from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: Swit...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

Switch extension ExtensionName has vetoed delivery of NBL from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

Switch extension %2 has vetoed delivery of NBL from Nic %4 (Friendly Name: %6) to Nic %8 (Friendly Name: %10) on switch %12 (Friendly Name: %14)

Fields #

NameDescription
ExtensionNameLen UInt32—
ExtensionName UnicodeString—
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
DestNicNameLen UInt32—
DestNicName UnicodeString—
DestNicFNameLen UInt32—
DestNicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 59 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch extension has vetoed delivery of NBL from Nic (Friendly Name: ) to Nic (Friendly Name: ) on switch (Friendly Name: ).

Fields #

NameDescription
ExtensionNameLen UInt32—
ExtensionName UnicodeString—
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
DestNicNameLen UInt32—
DestNicName UnicodeString—
DestNicFNameLen UInt32—
DestNicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 60 — NBLs were dropped by extension ExtensionGuid (Friendly Name: ExtensionFriendlyName) in switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

NBLs were dropped by extension ExtensionGuid (Friendly Name: ExtensionFriendlyName) in switch SwitchName (Friendly Name: SwitchFName). Source Nic SrcNicName (Friendly Name: SrcNicFName), Reason Reason.

Message #

NBLs were dropped by extension %10 (Friendly Name: %12) in switch %6 (Friendly Name: %8). Source Nic %2 (Friendly Name: %4), Reason %14

Fields #

NameDescription
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ExtensionGuidLen UInt32—
ExtensionGuid UnicodeString—
ExtensionFriendlyNameLen UInt32—
ExtensionFriendlyName UnicodeString—
ReasonLen UInt32—
Reason UnicodeString—

Event ID 60 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NBLs were dropped by extension (Friendly Name: ) in switch (Friendly Name: ). Source Nic (Friendly Name: ), Reason.

Fields #

NameDescription
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ExtensionGuidLen UInt32—
ExtensionGuid UnicodeString—
ExtensionFriendlyNameLen UInt32—
ExtensionFriendlyName UnicodeString—
ReasonLen UInt32—
Reason UnicodeString—

Event ID 61 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
NicRestore

Description

Saved state restored for NIC (Friendly Name: ) on Virtual Machine ID (Friendly Name: ) was not processed. The state was originally saved by Extension (Friendly Name: ). Restore will continue.

Fields #

NameDescription
ExtensionNameLength UInt32—
ExtensionName UnicodeString—
ExtensionId GUID—
FeatureClassId GUID—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
VMNameLen UInt32—
VMName UnicodeString—
VMIdLen UInt32—
VMId UnicodeString—

Event ID 61 — Saved state restored for NIC NicName (Friendly Name: NicFName) on Virtual Machine ID VMId (Friendly Name: VMName) was not processed.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
NicRestore

Description

Saved state restored for NIC (Friendly Name: ) on Virtual Machine ID (Friendly Name: ) was not processed. The state was originally saved by Extension (Friendly Name: ). Restore will continue.

Message #

Saved state restored for NIC %6 (Friendly Name: %8) on Virtual Machine ID %12 (Friendly Name: %10) was not processed. The state %4 was originally saved by Extension %3 (Friendly Name: %2). Restore will continue.

Fields #

NameDescription
ExtensionNameLength UInt32—
ExtensionName UnicodeString—
ExtensionId GUID—
FeatureClassId GUID—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
VMNameLen UInt32—
VMName UnicodeString—
VMIdLen UInt32—
VMId UnicodeString—

Event ID 62 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch (Friendly Name: ) successfully deleted.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 62 — Switch SwitchName (Friendly Name: SwitchFName) successfully deleted.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Opcode
Info

Description

Switch SwitchName (Friendly Name: SwitchFName) successfully deleted.

Message #

Switch %2 (Friendly Name: %4) successfully deleted.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 62,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775937,
    "time_created": "2026-03-13T20:26:51.622353+00:00",
    "event_record_id": 2209,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 4820
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 9,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 63 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to delete switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 63 — Failed to delete switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to delete switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to delete switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 64 — Switch SwitchName (Friendly Name: SwitchFName) info successfully set.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

Switch SwitchName (Friendly Name: SwitchFName) info successfully set.

Message #

Switch %2 (Friendly Name: %4) info successfully set.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 64,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:24:28.297213+00:00",
    "event_record_id": 53,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 7796
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 10,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 65 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to set switch info for switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 65 — Failed to set switch info for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to set switch info for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to set switch info for switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 66 — Delete complete for Switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

Delete complete for Switch SwitchName (Friendly Name: SwitchFName).

Message #

Delete complete for Switch %2 (Friendly Name: %4).

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 66,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:26:51.623598+00:00",
    "event_record_id": 342,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 4820
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 9,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 67 — Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Message #

Port %2 (Friendly Name: %4) successfully created on switch %6 (Friendly Name: %8).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 67,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-11T06:32:02.414624+00:00",
    "event_record_id": 22,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 2384
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "PortFNameLen": 36,
    "PortFName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "Flags": 0,
    "OwnerService": 1
  },
  "message": ""
}

Event ID 67 — Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Message #

Port %2 (Friendly Name: %4) successfully created on switch %6 (Friendly Name: %8).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 68 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to create port (Friendly Name: ) on switch (Friendly Name: ). Status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 68 — Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to create port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1. UniqueEvent = %10.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 69 — Port PortName (Friendly Name: PortFName) successfully deleted - switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

Port PortName (Friendly Name: PortFName) successfully deleted - switch SwitchName (Friendly Name: SwitchFName).

Message #

Port %2 (Friendly Name: %4) successfully deleted - switch %6 (Friendly Name: %8).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 69,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:25:06.632116+00:00",
    "event_record_id": 79,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 10904
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "7BAE5890-FC5D-4166-B557-FEF82659BCD4",
    "PortFNameLen": 0,
    "PortFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 0,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 69 — Port PortName (Friendly Name: PortFName) successfully deleted - switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Port PortName (Friendly Name: PortFName) successfully deleted - switch SwitchName (Friendly Name: SwitchFName).

Message #

Port %2 (Friendly Name: %4) successfully deleted - switch %6 (Friendly Name: %8).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 70 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to delete port (Friendly Name: ) on switch (Friendly Name: ). Status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 70 — Failed to delete port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to delete port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Failed to delete port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 71 — Delete complete for port PortName (Friendly Name: PortFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

Delete complete for port PortName (Friendly Name: PortFName).

Message #

Delete complete for port %2 (Friendly Name: %4).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 71,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:25:06.633725+00:00",
    "event_record_id": 80,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 10904
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "7BAE5890-FC5D-4166-B557-FEF82659BCD4",
    "PortFNameLen": 0,
    "PortFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 0,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 71 — Delete complete for port PortName (Friendly Name: PortFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Delete complete for port PortName (Friendly Name: PortFName).

Message #

Delete complete for port %2 (Friendly Name: %4).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 72 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to set monitor mode on port (Friendly Name: ) on switch (Friendly Name: ). Status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 72 — Failed to set monitor mode on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to set monitor mode on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Failed to set monitor mode on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 73 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to set VLAN info on port (Friendly Name: ) on switch (Friendly Name: ). Status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 73 — Failed to set VLAN info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to set VLAN info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Failed to set VLAN info on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 74 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to set IP spoofing info on port (Friendly Name: ) on switch (Friendly Name: ). Status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 74 — Failed to set IP spoofing info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to set IP spoofing info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to set IP spoofing info on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1. UniqueEvent = %10.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 75 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 75 — The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Message #

The operation '%11' failed on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1. UniqueEvent = %10.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 76 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
UniqueEvent UInt32—
NicInstanceId GUID—

Event ID 76 — The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

The operation '%6' failed on nic %3 (Friendly Name: %5), Instance Id %8. Status = %1. UniqueEvent = %7.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
UniqueEvent UInt32—
NicInstanceId GUID—

Event ID 77 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to disconnect NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 77 — Failed to disconnect NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to disconnect NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to disconnect NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 78 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 78 — Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to complete operation '%13' on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9) Property Id %10 Instance Id %11. Status = %1. UniqueEvent = %12.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 79 — Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Message #

Completed operation '%11' on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) Property Id %9 Instance Id %10.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 79 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 80 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 80 — Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to complete operation '%9' on switch %3 (Friendly Name: %5) Property Id %6 Instance Id %7. Status = %1. UniqueEvent = %8.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 81 — Completed operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Completed operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Message #

Completed operation '%7' on switch %2 (Friendly Name: %4) Property Id %5 Instance Id %6.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 81 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Completed operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 82 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to complete bandwidth policy operation '' on port (Friendly Name: ) on switch (Friendly Name: ) Reservation - , Weight - , Limit - , BurstLimit - , BurstSize - , Reason - , Status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reservation Int64—
Weight Int64—
Limit Int64—
BurstLimit Int64—
BurstSize Int64—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 82 — Failed to complete bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to complete bandwidth policy operation '' on port (Friendly Name: ) on switch (Friendly Name: ) Reservation - , Weight - , Limit - , BurstLimit - , BurstSize - , Reason - , Status = .

Message #

Failed to complete bandwidth policy operation '%16' on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9) Reservation - %10, Weight - %11, Limit - %12, BurstLimit - %13, BurstSize - %14, Reason - %15, Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reservation Int64—
Weight Int64—
Limit Int64—
BurstLimit Int64—
BurstSize Int64—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 83 — Completed bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Limit - ...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Completed bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Limit - Limit, BurstLimit - BurstLimit, BurstSize - BurstSize.

Message #

Completed bandwidth policy operation '%14' on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) Reservation - %9, Weight - %10, Limit - %11, BurstLimit - %12, BurstSize - %13.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reservation Int64—
Weight Int64—
Limit Int64—
BurstLimit Int64—
BurstSize Int64—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 83 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Completed bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Limit - Limit, BurstLimit - BurstLimit, BurstSize - BurstSize.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reservation Int64—
Weight Int64—
Limit Int64—
BurstLimit Int64—
BurstSize Int64—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 84 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to create default flow on switch (Friendly Name: ) Reservation - , Weight - ,Status = .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Status UInt32— NTSTATUS reference
Reservation Int64—
Weight Int64—

Event ID 84 — Failed to create default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight ,Status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to create default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight ,Status = Status.

Message #

Failed to create default flow on switch %2 (Friendly Name: %4) Reservation - %6, Weight - %7 ,Status = %5.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Status UInt32— NTSTATUS reference
Reservation Int64—
Weight Int64—

Event ID 85 — Successfully created default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Successfully created default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Message #

Successfully created default flow on switch %2 (Friendly Name: %4) Reservation - %6, Weight - %7.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Status UInt32— NTSTATUS reference
Reservation Int64—
Weight Int64—

Event ID 85 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Successfully created default flow on switch (Friendly Name: ) Reservation - , Weight - .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Status UInt32— NTSTATUS reference
Reservation Int64—
Weight Int64—

Event ID 86 — Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to complete operation '%13' on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9) Property Id %10 Instance Id %11. Status = %1. UniqueEvent = %12.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 86 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 87 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VlanPtNicNotSupported

Description

The connected Nic (Friendly Name: ) does not support VLAN configuration as it is external. The VLAN configuration on port (Friendly Name: ) will be ignored.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 87 — The connected Nic NicName (Friendly Name: NicFName) does not support VLAN configuration as it is external.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
VlanPtNicNotSupported

Description

The connected Nic NicName (Friendly Name: NicFName) does not support VLAN configuration as it is external. The VLAN configuration on port PortName (Friendly Name: PortFName) will be ignored.

Message #

The connected Nic %6 (Friendly Name: %8) does not support VLAN configuration as it is external. The VLAN configuration on port %2 (Friendly Name: %4) will be ignored.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 88 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
AllowMacSpoofing Boolean—
EnableDhcpGuard Boolean—
EnableRouterGuard Boolean—
MonitorMode UInt32—
MonitorSession UInt32—
AllowIeeePriorityTag Boolean—
VirtualSubnetId UInt32—
AllowTeaming Boolean—
StormLimit UInt32—
DynamicIPAddressLimit UInt32—
EnableFixSpeed10G Boolean—
FailReason UInt32—

Event ID 88 — Failed to complete security policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - AllowMacSpoofing: AllowMacSpoofing, EnableDhcpGuar...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Failed to complete security policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - AllowMacSpoofing: %9, EnableDhcpGuard: %10, EnableRouterGuard: %11, MonitorMode: %12, AllowIeeePriorityTag: %14, VirtualSubnetId: %15, AllowTeaming: %16, StormLimit: %17, DynamicIPAddressLimit: %18, EnableFixSpeed10G: %19, Reason: %20.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
AllowMacSpoofing Boolean—
EnableDhcpGuard Boolean—
EnableRouterGuard Boolean—
MonitorMode UInt32—
MonitorSession UInt32—
AllowIeeePriorityTag Boolean—
VirtualSubnetId UInt32—
AllowTeaming Boolean—
StormLimit UInt32—
DynamicIPAddressLimit UInt32—
EnableFixSpeed10G Boolean—
FailReason UInt32—

Event ID 89 — Completed security policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - AllowMacSpoofing: AllowMacSpoofing, EnableDhcpGuard: EnableDhcpGu...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Message #

Completed security policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - AllowMacSpoofing: %9, EnableDhcpGuard: %10, EnableRouterGuard: %11, MonitorMode: %12, AllowIeeePriorityTag: %14, VirtualSubnetId: %15, AllowTeaming %16, StormLimit: %17, DynamicIPAddressLimit: %18, EnableFixSpeed10G: %19.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
AllowMacSpoofing Boolean—
EnableDhcpGuard Boolean—
EnableRouterGuard Boolean—
MonitorMode UInt32—
MonitorSession UInt32—
AllowIeeePriorityTag Boolean—
VirtualSubnetId UInt32—
AllowTeaming Boolean—
StormLimit UInt32—
DynamicIPAddressLimit UInt32—
EnableFixSpeed10G Boolean—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 89,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:26:32.435528+00:00",
    "event_record_id": 233,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 7796
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "E6BB997F-D0DA-483C-8647-FE1681B7D63D",
    "PortFNameLen": 0,
    "PortFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "AllowMacSpoofing": true,
    "EnableDhcpGuard": false,
    "EnableRouterGuard": false,
    "MonitorMode": 0,
    "MonitorSession": 0,
    "AllowIeeePriorityTag": false,
    "VirtualSubnetId": 0,
    "AllowTeaming": false,
    "StormLimit": 0,
    "DynamicIPAddressLimit": 0,
    "EnableFixSpeed10G": false
  },
  "message": ""
}

Event ID 90 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Direction UInt32—
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
Applicability UInt32—
Type UInt32—
Action UInt32—
LocalAddrLen UInt32—
LocalAddr UnicodeString—
LocalPrefix UInt32—
RemoteAddrLen UInt32—
RemoteAddr UnicodeString—
RemotePrefix UInt32—
FailReason UInt32—

Event ID 90 — Failed to complete Port ACL policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - Direction: Direction, Applicability: Applicability, A...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Failed to complete Port ACL policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - Direction: %9, Applicability: %10, AclType: %11, Action: %12, LocalAddress: '%14', LocalPrefixLength: %15, RemoteAddress: '%17', RemotePrefixLength: %18. Reason: %19

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Direction UInt32—
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
Applicability UInt32—
Type UInt32—
Action UInt32—
LocalAddrLen UInt32—
LocalAddr UnicodeString—
LocalPrefix UInt32—
RemoteAddrLen UInt32—
RemoteAddr UnicodeString—
RemotePrefix UInt32—
FailReason UInt32—

Event ID 91 — Completed Port ACL policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - Direction: Direction, Applicability: Applicability, AclType: %...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Message #

Completed Port ACL policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - Direction: %9, Applicability: %10, AclType: %11, Action: %12, LocalAddress: '%14', LocalPrefixLength: %15, RemoteAddress: '%17', RemotePrefixLength: %18.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Direction UInt32—
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
Applicability UInt32—
Type UInt32—
Action UInt32—
LocalAddrLen UInt32—
LocalAddr UnicodeString—
LocalPrefix UInt32—
RemoteAddrLen UInt32—
RemoteAddr UnicodeString—
RemotePrefix UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 91,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:26:28.669856+00:00",
    "event_record_id": 219,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 10904
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "AB7BE073-914D-47D9-8244-65F75F65968B",
    "PortFNameLen": 0,
    "PortFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Direction": 2,
    "Applicability": 2,
    "Type": 3,
    "Action": 3,
    "LocalAddrLen": 1,
    "LocalAddr": "",
    "LocalPrefix": 0,
    "RemoteAddrLen": 1,
    "RemoteAddr": "",
    "RemotePrefix": 0
  },
  "message": ""
}

Event ID 92 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

A switch extension blocked the operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 92 — A switch extension blocked the operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

A switch extension blocked the operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Message #

A switch extension blocked the operation '%11' on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) Property Id %9 Instance Id %10.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 93 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

A switch extension blocked the operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 93 — A switch extension blocked the operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

A switch extension blocked the operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Message #

A switch extension blocked the operation '%7' on switch %2 (Friendly Name: %4) Property Id %5 Instance Id %6.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 94 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
IPSecOffloadLimit UInt32—
VMQOffloadWeight UInt32—
IovOffloadWeight UInt32—
QueuePairs UInt32—
InterruptModeration UInt32—
FailReason UInt32—

Event ID 94 — Failed to complete offload policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - IPSecOffloadLimit: IPSecOffloadLimit, VMQOffloadWeig...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Failed to complete offload policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - IPSecOffloadLimit: %9, VMQOffloadWeight: %10, IovOffloadWeight: %11, QueuePairs: %12, InterruptModeration: %13. Reason: %14

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
IPSecOffloadLimit UInt32—
VMQOffloadWeight UInt32—
IovOffloadWeight UInt32—
QueuePairs UInt32—
InterruptModeration UInt32—
FailReason UInt32—

Event ID 95 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The VLAN configuration being set on port (Friendly Name: ) on switch (Friendly Name: ) is invalid. Reason.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 95 — The VLAN configuration being set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

The VLAN configuration being set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid. Reason: FailReason.

Message #

The VLAN configuration being set on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) is invalid. Reason: %9

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 96 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 96 — VLAN tagging is configured on port PortName (Friendly Name: PortFName), connected Nic NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

VLAN tagging is configured on port %2 (Friendly Name: %4), connected Nic %6 (Friendly Name: %8). However, the external NIC connected to this switch does not support VLAN or VLAN is disabled. This might lead to external network connectivity issues.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 97 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to retrieve the active extension list from switch (Friendly Name: ), status = , Reason = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 97 — Failed to retrieve the active extension list from switch SwitchName (Friendly Name: SwitchFName), status = Status, Reason = FailReason.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to retrieve the active extension list from switch SwitchName (Friendly Name: SwitchFName), status = Status, Reason = FailReason.

Message #

Failed to retrieve the active extension list from switch %3 (Friendly Name: %5), status = %1, Reason = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 98 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Connectivity has been blocked for NIC (Friendly Name: ) on port (Friendly Name: ). Extension is required on the port, but it is not active on switch (Friendly Name: ).

Fields #

NameDescription
ExtensionId GUID—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 98 — Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName). Extension ExtensionId is required on the port, but it is not active on switch SwitchName (Friendly Name: SwitchFName).

Message #

Connectivity has been blocked for NIC %3 (Friendly Name: %5) on port %7 (Friendly Name: %9). Extension %1 is required on the port, but it is not active on switch %11 (Friendly Name: %13).

Fields #

NameDescription
ExtensionId GUID—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 99 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Connectivity has been blocked for NIC (Friendly Name: ) on port (Friendly Name: ) on switch (Friendly Name: ). An extension feature is required on the port, but it is not registered on the system.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 99 — Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Connectivity has been blocked for NIC (Friendly Name: ) on port (Friendly Name: ) on switch (Friendly Name: ). An extension feature is required on the port, but it is not registered on the system.

Message #

Connectivity has been blocked for NIC %2 (Friendly Name: %4) on port %6 (Friendly Name: %8) on switch %10(Friendly Name: %12). An extension feature is required on the port, but it is not registered on the system.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 100 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to complete bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Reason - FailReason, Status = Status.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reservation Int64—
Weight Int64—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 100 — Failed to complete bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Reason - FailReason, Status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to complete bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Reason - FailReason, Status = Status.

Message #

Failed to complete bandwidth policy operation '%9' on switch %3 (Friendly Name: %5) Reservation - %6, Weight - %7, Reason - %8, Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reservation Int64—
Weight Int64—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 101 — Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Message #

Completed bandwidth policy operation '%7' on switch %2 (Friendly Name: %4) Reservation - %5, Weight - %6.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reservation Int64—
Weight Int64—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 101 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reservation Int64—
Weight Int64—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 102 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
ProtocolVersionNegotiate

Description

Networking driver in is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID ).

Fields #

NameDescription
VMNameLen UInt32—
VMName UnicodeString—
VMIdLen UInt32—
VMId UnicodeString—

Event ID 102 — Networking driver in VMName is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID VMId).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Task
ProtocolVersionNegotiate

Description

Networking driver in VMName is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID VMId).

Message #

Networking driver in %2 is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID %4).

Fields #

NameDescription
VMNameLen UInt32—
VMName UnicodeString—
VMIdLen UInt32—
VMId UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 1019,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.483803+00:00",
    "event_record_id": 2817,
    "correlation": {},
    "execution": {
      "process_id": 9472,
      "thread_id": 9664
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-83-1-698845485-1245677379-4261864325-3027728797"
    }
  },
  "event_data": {
    "VMNameLen": 36,
    "VMName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4",
    "VMIdLen": 36,
    "VMId": "29A7892D-8743-4A3F-85E3-06FE9D7977B4"
  },
  "message": ""
}

Event ID 103 — Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to complete operation '%9' on switch %3 (Friendly Name: %5) Property Id %6 Instance Id %7. Status = %1. UniqueEvent = %8.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 103 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
PropertyId GUID—
InstanceId GUID—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 104 — The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

The operation '%6' failed on nic %3 (Friendly Name: %5), Instance Id %8. Status = %1. UniqueEvent = %7.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
UniqueEvent UInt32—
NicInstanceId GUID—

Event ID 104 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
UniqueEvent UInt32—
NicInstanceId GUID—

Event ID 105 — The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Message #

The operation '%11' failed on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1. UniqueEvent = %10.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 105 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 106 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Available processor sets of the underlying physical NICs belonging to the LBFO team NIC (Friendly Name: ) on switch (Friendly Name: ) are not configured correctly. Reason.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
QueueMode UInt32—

Event ID 106 — Available processor sets of the underlying physical NICs belonging to the LBFO team NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) are...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Available processor sets of the underlying physical NICs belonging to the LBFO team NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) are not configured correctly. Reason: QueueMode.

Message #

Available processor sets of the underlying physical NICs belonging to the LBFO team NIC %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) are not configured correctly. Reason: %9

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
QueueMode UInt32—

Event ID 107 — DataOidTarget.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

DataOidTarget. OID (Oid) on switch SwitchName (Friendly Name: SwitchFName).

Message #

%1. OID (%2) on switch %4 (Friendly Name: %6).

Fields #

NameDescription
DataOidTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 107 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

. OID () on switch (Friendly Name: ).

Fields #

NameDescription
DataOidTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 108 — DataOidTarget.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

DataOidTarget. OID (Oid) on switch SwitchName (Friendly Name: SwitchFName), Result: Status.

Message #

%1. OID (%2) on switch %4 (Friendly Name: %6), Result: %7.

Fields #

NameDescription
DataOidTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 108 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

. OID () on switch (Friendly Name: ), Result: .

Fields #

NameDescription
DataOidTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 109 — DataOidTarget.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

DataOidTarget. NIC_REQUEST OID (Oid) on switch SwitchName (Friendly Name: SwitchFName) on behalf of NIC SrcNicName (Friendly Name: SrcNicFName) (Index: SrcNicIndex) to NIC DstNicName (Friendly Name: DstNicFName) (Index: DstNicIndex).

Message #

%1. NIC_REQUEST OID (%2) on switch %4 (Friendly Name: %6) on behalf of NIC %8 (Friendly Name: %10) (Index: %11) to  NIC %13 (Friendly Name: %15) (Index: %16)

Fields #

NameDescription
DataOidTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
SrcNicIndex UInt32—
DstNicNameLen UInt32—
DstNicName UnicodeString—
DstNicFNameLen UInt32—
DstNicFName UnicodeString—
DstNicIndex UInt32—

Event ID 109 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

. NIC_REQUEST OID () on switch (Friendly Name: ) on behalf of NIC (Friendly Name: ) (Index: ) to NIC (Friendly Name: ) (Index: ).

Fields #

NameDescription
DataOidTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
SrcNicIndex UInt32—
DstNicNameLen UInt32—
DstNicName UnicodeString—
DstNicFNameLen UInt32—
DstNicFName UnicodeString—
DstNicIndex UInt32—

Event ID 110 — DataOidTarget.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

DataOidTarget. NIC_REQUEST OID (Oid) on switch SwitchName (Friendly Name: SwitchFName) on behalf of NIC SrcNicName (Friendly Name: SrcNicFName) (Index: SrcNicIndex) to NIC DstNicName (Friendly Name: DstNicFName) (Index: DstNicIndex), Result: Status.

Message #

%1. NIC_REQUEST OID (%2) on switch %4 (Friendly Name: %6) on behalf of NIC %8 (Friendly Name: %10) (Index: %11) to  NIC %13 (Friendly Name: %15) (Index: %16), Result: %17

Fields #

NameDescription
DataOidTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
SrcNicIndex UInt32—
DstNicNameLen UInt32—
DstNicName UnicodeString—
DstNicFNameLen UInt32—
DstNicFName UnicodeString—
DstNicIndex UInt32—
Status UInt32— NTSTATUS reference

Event ID 110 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

. NIC_REQUEST OID () on switch (Friendly Name: ) on behalf of NIC (Friendly Name: ) (Index: ) to NIC (Friendly Name: ) (Index: ), Result.

Fields #

NameDescription
DataOidTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
SrcNicIndex UInt32—
DstNicNameLen UInt32—
DstNicName UnicodeString—
DstNicFNameLen UInt32—
DstNicFName UnicodeString—
DstNicIndex UInt32—
Status UInt32— NTSTATUS reference

Event ID 111 — StatusTarget.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

StatusTarget. Status (Oid) on switch SwitchName (Friendly Name: SwitchFName).

Message #

%1. Status (%2) on switch %4 (Friendly Name: %6).

Fields #

NameDescription
StatusTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 111 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

. Status () on switch (Friendly Name: ).

Fields #

NameDescription
StatusTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 112 — StatusTarget.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

StatusTarget. NIC_STATUS Status (Oid) on switch SwitchName (Friendly Name: SwitchFName) on behalf of NIC SrcNicName (Friendly Name: SrcNicFName) (Index: SrcNicIndex) to NIC DstNicName (Friendly Name: DstNicFName) (Index: DstNicIndex).

Message #

%1. NIC_STATUS Status (%2) on switch %4 (Friendly Name: %6) on behalf of NIC %8 (Friendly Name: %10) (Index: %11) to  NIC %13 (Friendly Name: %15) (Index: %16)

Fields #

NameDescription
StatusTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
SrcNicIndex UInt32—
DstNicNameLen UInt32—
DstNicName UnicodeString—
DstNicFNameLen UInt32—
DstNicFName UnicodeString—
DstNicIndex UInt32—

Event ID 112 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

. NIC_STATUS Status () on switch (Friendly Name: ) on behalf of NIC (Friendly Name: ) (Index: ) to NIC (Friendly Name: ) (Index: ).

Fields #

NameDescription
StatusTarget UInt32—
Oid UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
SrcNicIndex UInt32—
DstNicNameLen UInt32—
DstNicName UnicodeString—
DstNicFNameLen UInt32—
DstNicFName UnicodeString—
DstNicIndex UInt32—

Event ID 113 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to allocate VMQ for NIC (Friendly Name: ) on switch (Friendly Name: ). Reason - . Status =.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 113 — Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName). Reason - FailReason. Status = Status.

Message #

Failed to allocate VMQ for NIC %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Reason - %10. Status = %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 114 — Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName). Reason - FailReason. Status = Status.

Message #

Failed to allocate VMQ for NIC %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Reason - %10. Status = %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 114 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to allocate VMQ for NIC (Friendly Name: ) on switch (Friendly Name: ). Reason - . Status =.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 115 — Completed VMQ allocation for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Completed VMQ allocation for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

Completed VMQ allocation for NIC %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 116 — Switch Team member connected.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch Team member connected. NIC NicName (Friendly Name: NicFName) with NicIndex NicIndex (NetCfgInstanceId: NetCfgInstanceId) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Switch Team member connected. NIC %6 (Friendly Name: %8) with NicIndex %9 (NetCfgInstanceId: %10) on switch %2 (Friendly Name: %4). Status = %11

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
NicIndex UInt32—
NetCfgInstanceId GUID—
Status UInt32— NTSTATUS reference

Event ID 117 — Switch Team member disconnected.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch Team member disconnected. NIC NicName (Friendly Name: NicFName) with NicIndex NicIndex (NetCfgInstanceId: NetCfgInstanceId) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Switch Team member disconnected. NIC %6 (Friendly Name: %8) with NicIndex %9 (NetCfgInstanceId: %10) on switch %2 (Friendly Name: %4). Status = %11

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
NicIndex UInt32—
NetCfgInstanceId GUID—
Status UInt32— NTSTATUS reference

Event ID 118 — The external NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) is connected to ConfigurationType.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The external NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) is connected to ConfigurationType.

Message #

The external NIC %6 (Friendly Name: %8) on switch %2 (Friendly Name: %4) is connected to %9.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
ConfigurationType UInt32—

Event ID 119 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
SecurityConflict UInt32—

Event ID 119 — Port PortName (Friendly Name: PortFName) has MAC address spoofing enabled.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Port %2 (Friendly Name: %4) has MAC address spoofing enabled. This is not supported on the associated switch %6 (Friendly Name: %8) because IOV is enabled. Traffic with a spoofed MAC address will not function properly.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
SecurityConflict UInt32—

Event ID 120 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The configured bandwidth reservation might not be applied on switch (Friendly Name: ) as the external NIC (Friendly Name: )'s link speed is less than the total reservation configured.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 120 — The configured bandwidth reservation might not be applied on switch SwitchName (Friendly Name: SwitchFName) as the external NIC NicName (Friendly Name: NicFName)'s link speed ...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

The configured bandwidth reservation might not be applied on switch SwitchName (Friendly Name: SwitchFName) as the external NIC NicName (Friendly Name: NicFName)'s link speed is less than the total reservation configured.

Message #

The configured bandwidth reservation might not be applied on switch %2 (Friendly Name: %4) as the external NIC %6 (Friendly Name: %8)'s link speed is less than the total reservation configured.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 121 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

An extension is attempting to revoke the VF allocated for Port (Friendly Name: ) on switch (Friendly Name: ).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 121 — An extension is attempting to revoke the VF allocated for Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

An extension is attempting to revoke the VF allocated for Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

An extension is attempting to revoke the VF allocated for Port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 122 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

VMQ group creation failed with NIC (Friendly Name: ) on switch (Friendly Name: ) with status = . Reason: .

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
QueueMode UInt32—
Status UInt32— NTSTATUS reference
FailReason UInt32—

Event ID 122 — VMQ group creation failed with NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) with status = QueueMode.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

VMQ group creation failed with NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) with status = QueueMode. Reason: Status.

Message #

VMQ group creation failed with NIC %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) with status = %9. Reason: %10.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
QueueMode UInt32—
Status UInt32— NTSTATUS reference
FailReason UInt32—

Event ID 123 — VMQ capabilities received from NIC NicName (Friendly Name: NicFName): VmqSupported - VmqSupported, DynamicVmqSupported - dynamicVmqSupported.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

VMQ capabilities received from NIC NicName (Friendly Name: NicFName): VmqSupported - VmqSupported, DynamicVmqSupported - dynamicVmqSupported.

Message #

VMQ capabilities received from NIC %2 (Friendly Name: %4): VmqSupported - %6, DynamicVmqSupported - %7.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
LinkSpeed UInt64—
VmqSupported Boolean—
dynamicVmqSupported Boolean—
QueueMode UInt32—
EnabledFilterTypes UInt32—
EnabledQueueTypes UInt32—
SupportedQueueProperties UInt32—
SupportedFilterTests UInt32—
SupportedHeaders UInt32—
SupportedMacHeaderFields UInt32—

Event ID 124 — NIC NicName (Friendly Name: NicFName) restarted.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

NIC NicName (Friendly Name: NicFName) restarted.

Message #

NIC %2 (Friendly Name: %4) restarted.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 124,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-11T06:32:02.210346+00:00",
    "event_record_id": 14,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 3728
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "NicFNameLen": 3,
    "NicFName": "WSL"
  },
  "message": ""
}

Event ID 125 — Media connected on NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

Media connected on NIC NicName (Friendly Name: NicFName).

Message #

Media connected on NIC %2 (Friendly Name: %4).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 125,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-11T06:32:02.266923+00:00",
    "event_record_id": 17,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "NicFNameLen": 3,
    "NicFName": "WSL"
  },
  "message": ""
}

Event ID 126 — Media disconnected on NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

Media disconnected on NIC NicName (Friendly Name: NicFName).

Message #

Media disconnected on NIC %2 (Friendly Name: %4).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 126,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:26:50.947776+00:00",
    "event_record_id": 329,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 4820
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "95F9FAC4-A05B-4500-8332-94A3FFD233C2",
    "NicFNameLen": 12,
    "NicFName": "TestInternal"
  },
  "message": ""
}

Event ID 127 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The Isolation configuration could not be deleted from port (Friendly Name: ) on switch (Friendly Name: ). Reason.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 127 — The Isolation configuration could not be deleted from port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

The Isolation configuration could not be deleted from port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Reason: FailReason.

Message #

The Isolation configuration could not be deleted from port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8). Reason: %9

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—

Event ID 128 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The Isolation configuration set on port (Friendly Name: ) on switch (Friendly Name: ) is invalid. Reason: , Ext1: , Ext2.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—
Ext1 UInt32—
Ext2 UInt32—

Event ID 128 — The Isolation configuration set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

The Isolation configuration set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid. Reason: FailReason, Ext1: Ext1, Ext2: Ext2.

Message #

The Isolation configuration set on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) is invalid. Reason: %9, Ext1: %10, Ext2: %11

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—
Ext1 UInt32—
Ext2 UInt32—

Event ID 129 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The Routing Domain configuration (Routing Domain: , GUID: ) set on port (Friendly Name: ) on switch (Friendly Name: ) is invalid. Reason: , Ext1: , Ext2.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—
RoutingDomainGuidLen UInt32—
RoutingDomainGuid UnicodeString—
RoutingDomainNameLen UInt32—
RoutingDomainName UnicodeString—
Ext1 UInt32—
Ext2 UInt32—

Event ID 129 — The Routing Domain configuration (Routing Domain: RoutingDomainName, GUID: RoutingDomainGuid) set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is in...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

The Routing Domain configuration (Routing Domain: RoutingDomainName, GUID: RoutingDomainGuid) set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid. Reason: FailReason, Ext1: Ext1, Ext2: Ext2.

Message #

The Routing Domain configuration (Routing Domain: %13, GUID: %11) set on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) is invalid. Reason: %9, Ext1: %14, Ext2: %15

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—
RoutingDomainGuidLen UInt32—
RoutingDomainGuid UnicodeString—
RoutingDomainNameLen UInt32—
RoutingDomainName UnicodeString—
Ext1 UInt32—
Ext2 UInt32—

Event ID 130 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Direction UInt32—
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
Action UInt32—
LocalIPAddrLen UInt32—
LocalIPAddr UnicodeString—
RemoteIPAddrLen UInt32—
RemoteIPAddr UnicodeString—
LocalPortLen UInt32—
LocalPort UnicodeString—
RemotePortLen UInt32—
RemotePort UnicodeString—
Protocol UInt32—
Known values
0
HOPOPT
1
ICMP
2
IGMP
6
TCP
17
UDP
41
IPv6
43
IPv6-Route
44
IPv6-Frag
47
GRE
50
ESP
51
AH
58
ICMPv6
89
OSPF
103
PIM
132
SCTP
Weight UInt32—
Stateful Boolean—
IdleSessionTimeout UInt32—
VirtualSubnetId UInt32—
FailReason UInt32—

Event ID 130 — Failed to complete Extended Port ACL policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - Direction: Direction, Action: Action,...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Failed to complete Extended Port ACL policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - Direction: %9, Action: %10, LocalIPAddress: '%12', RemoteIPAddress: '%14', LocalPort: '%16', RemotePort: '%18', Protocol: %19, Weight: %20, Stateful: %21, IdleSessionTimeout: %22, VirtualSubnetId: %23. Reason: %24

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Direction UInt32—
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
Action UInt32—
LocalIPAddrLen UInt32—
LocalIPAddr UnicodeString—
RemoteIPAddrLen UInt32—
RemoteIPAddr UnicodeString—
LocalPortLen UInt32—
LocalPort UnicodeString—
RemotePortLen UInt32—
RemotePort UnicodeString—
Protocol UInt32—
Known values
0
HOPOPT
1
ICMP
2
IGMP
6
TCP
17
UDP
41
IPv6
43
IPv6-Route
44
IPv6-Frag
47
GRE
50
ESP
51
AH
58
ICMPv6
89
OSPF
103
PIM
132
SCTP
Weight UInt32—
Stateful Boolean—
IdleSessionTimeout UInt32—
VirtualSubnetId UInt32—
FailReason UInt32—

Event ID 131 — A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Direction extended port ACL entry w...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task
PktDrop

Description

A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Direction extended port ACL entry with weight Weight.

Message #

A packet was dropped on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) because the packet is filtered by %9 extended port ACL entry with weight %10.

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Direction UInt32—
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
Weight UInt32—

Event ID 131 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
PktDrop

Description

A packet was dropped on port (Friendly Name: ) on switch (Friendly Name: ) because the packet is filtered by extended port ACL entry with weight .

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Direction UInt32—
Known values
%%14592
Inbound
%%14593
Outbound
%%14594
Forward
%%14595
Bidirectional
Weight UInt32—

Event ID 132 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The extension stack for Switch (Friendly Name: ) failed to start because an extension failed to Activate.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 132 — The extension stack for Switch SwitchName (Friendly Name: SwitchFName) failed to start because an extension failed to Activate.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

The extension stack for Switch SwitchName (Friendly Name: SwitchFName) failed to start because an extension failed to Activate.

Message #

The extension stack for Switch %3 (Friendly Name: %5) failed to start because an extension failed to Activate.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 133 — RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor ProcIndex.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor ProcIndex.

Message #

RSS queue %7 from VMQ %6 of switch %2 (Friendly Name: %4) is marked as a moving candidate of processor %5.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ProcIndex UInt32—
VmqIndex UInt32—
RssQueueIndex UInt32—

Event ID 133 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

RSS queue from VMQ of switch (Friendly Name: ) is marked as a moving candidate of processor .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ProcIndex UInt32—
VmqIndex UInt32—
RssQueueIndex UInt32—

Event ID 134 — VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor ProcIndex.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor ProcIndex.

Message #

VMQ %6 of switch %2 (Friendly Name: %4) is marked as a moving candidate of processor %5.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ProcIndex UInt32—
VmqIndex UInt32—

Event ID 134 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

VMQ of switch (Friendly Name: ) is marked as a moving candidate of processor .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ProcIndex UInt32—
VmqIndex UInt32—

Event ID 135 — Processor ProcIndex is over ProcUtil percent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

Processor ProcIndex is over ProcUtil percent.

Message #

Processor %1 is over %2 percent.

Fields #

NameDescription
ProcIndex UInt32—
ProcUtil UInt32—

Event ID 135 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

Processor is over percent.

Fields #

NameDescription
ProcIndex UInt32—
ProcUtil UInt32—

Event ID 136 — Adjusted load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

Adjusted load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Message #

Adjusted load of RSS queue %6 from VMQ %5 of switch %2 (Friendly Name: %4) on processor %7 is %8 percent.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
RssQueueIndex UInt32—
ProcIndex UInt32—
QueueLoad UInt32—

Event ID 136 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

Adjusted load of RSS queue from VMQ of switch (Friendly Name: ) on processor is percent.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
RssQueueIndex UInt32—
ProcIndex UInt32—
QueueLoad UInt32—

Event ID 137 — Perspective load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

Perspective load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Message #

Perspective load of RSS queue %6 from VMQ %5 of switch %2 (Friendly Name: %4) on processor %7 is %8 percent.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
RssQueueIndex UInt32—
ProcIndex UInt32—
QueueLoad UInt32—
SafeThreshold UInt32—

Event ID 137 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

Perspective load of RSS queue from VMQ of switch (Friendly Name: ) on processor is percent.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
RssQueueIndex UInt32—
ProcIndex UInt32—
QueueLoad UInt32—
SafeThreshold UInt32—

Event ID 138 — Adjusted load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

Adjusted load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Message #

Adjusted load of VMQ %5 on switch %2 (Friendly Name: %4) on processor %6 is %7 percent.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
ProcIndex UInt32—
QueueLoad UInt32—

Event ID 138 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

Adjusted load of VMQ on switch (Friendly Name: ) on processor is percent.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
ProcIndex UInt32—
QueueLoad UInt32—

Event ID 139 — Perspective load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

Perspective load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Message #

Perspective load of VMQ %5 on switch %2 (Friendly Name: %4) on processor %6 is %7 percent.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
ProcIndex UInt32—
QueueLoad UInt32—
SafeThreshold UInt32—

Event ID 139 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

Perspective load of VMQ on switch (Friendly Name: ) on processor is percent.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
ProcIndex UInt32—
QueueLoad UInt32—
SafeThreshold UInt32—

Event ID 140 — Assigned processor of RSS queue RssQueueIndex of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was updated.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

Assigned processor of RSS queue RssQueueIndex of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was updated. The assigned processor for receives was ReceiveProcIndex, now DestinationReceiveProcIndex. The assigned channel for sends was SendProcIndex, now DestinationSendProcIndex.

Message #

Assigned processor of RSS queue %6 of VMQ %5 on switch %2 (Friendly Name: %4) was updated. The assigned processor for receives was %7, now %9. The assigned channel for sends was %8, now %10.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
RssQueueIndex UInt32—
ReceiveProcIndex UInt32—
SendProcIndex UInt32—
DestinationReceiveProcIndex UInt32—
DestinationSendProcIndex UInt32—

Event ID 140 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

Assigned processor of RSS queue of VMQ on switch (Friendly Name: ) was updated. The assigned processor for receives was , now . The assigned channel for sends was , now .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
RssQueueIndex UInt32—
ReceiveProcIndex UInt32—
SendProcIndex UInt32—
DestinationReceiveProcIndex UInt32—
DestinationSendProcIndex UInt32—

Event ID 141 — The RSS queue group of VMQ VmqIndex from switch SwitchName (Friendly Name: SwitchFName) has been IsActivate on processor ProcIndex.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task
VmqMove

Description

The RSS queue group of VMQ VmqIndex from switch SwitchName (Friendly Name: SwitchFName) has been IsActivate on processor ProcIndex.

Message #

The RSS queue group of VMQ %6 from switch %2 (Friendly Name: %4) has been %5 on processor %7.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
IsActivate UInt32—
VmqIndex UInt32—
ProcIndex UInt32—

Event ID 141 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

The RSS queue group of VMQ from switch (Friendly Name: ) has been on processor .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
IsActivate UInt32—
VmqIndex UInt32—
ProcIndex UInt32—

Event ID 142 — Virtual RSS configuration update failed on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName) with status Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Virtual RSS configuration update failed on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName) with status Status. Reason: FailReason.

Message #

Virtual RSS configuration update failed on NIC %2 (Friendly Name: %4) of switch %6 (Friendly Name: %8) with status %10. Reason: %9.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—
Status UInt32— NTSTATUS reference
Flags UInt32—
BaseCpuNumber UInt32—
HashInformation UInt32—
IndirectionTableSize UInt32—
IndirectionTableOffset UInt32—
HashSecretKeySize UInt32—
HashSecretKeyOffset UInt32—

Event ID 143 — Virtual RSS configuration update succeeded on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Verbose
Opcode
Info

Description

Virtual RSS configuration update succeeded on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName).

Message #

Virtual RSS configuration update succeeded on NIC %2 (Friendly Name: %4) of switch %6 (Friendly Name: %8).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
BaseCpuNumber UInt32—
HashInformation UInt32—
IndirectionTableSize UInt32—
IndirectionTableOffset UInt32—
HashSecretKeySize UInt32—
HashSecretKeyOffset UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 143,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388064,
    "time_created": "2026-03-11T06:32:02.612643+00:00",
    "event_record_id": 41,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1672
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NicFNameLen": 0,
    "NicFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "Flags": 0,
    "BaseCpuNumber": 0,
    "HashInformation": 5889,
    "IndirectionTableSize": 512,
    "IndirectionTableOffset": 40,
    "HashSecretKeySize": 40,
    "HashSecretKeyOffset": 552
  },
  "message": ""
}

Event ID 144 — Driver Verifier failure in vmswitch.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Driver Verifier failure in vmswitch. Reason: FailReason.

Message #

Driver Verifier failure in vmswitch. Reason: %1.

Fields #

NameDescription
FailReason UInt32—

Event ID 144 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Driver Verifier failure in vmswitch. Reason: .

Fields #

NameDescription
FailReason UInt32—

Event ID 145 — Policy configuration failed.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Policy configuration failed. Reason: FailReason.

Message #

Policy configuration failed. Reason: %1

Fields #

NameDescription
FailReason UInt32—

Event ID 146 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Ndk adapter failed to open on behalf of virtual NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 146 — Ndk adapter failed to open on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Ndk adapter failed to open on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Ndk adapter failed to open on behalf of virtual NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 147 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Ndk adapter failed to close on behalf of virtual NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 147 — Ndk adapter failed to close on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Ndk adapter failed to close on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Ndk adapter failed to close on behalf of virtual NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 148 — Ndk Oid NdisOid for external NIC PtNicName (Friendly Name: PtNicFName) on behalf of virtual NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Warning
Opcode
Info

Description

Ndk Oid NdisOid for external NIC PtNicName (Friendly Name: PtNicFName) on behalf of virtual NIC NicName (Friendly Name: NicFName). Status: Status. Reason: FailReason.

Message #

Ndk Oid %2 for external NIC %9 (Friendly Name: %11) on behalf of virtual NIC %5 (Friendly Name: %7). Status: %3. Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NdisOid UInt32—
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 148,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388032,
    "time_created": "2026-03-12T00:55:57.772989+00:00",
    "event_record_id": 718,
    "correlation": {},
    "execution": {
      "process_id": 10544,
      "thread_id": 11416
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FailReason": 2,
    "NdisOid": 4228121090,
    "Status": 3221225485,
    "NicNameLen": 36,
    "NicName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "NicFNameLen": 3,
    "NicFName": "WSL",
    "PtNicNameLen": 1,
    "PtNicName": "",
    "PtNicFNameLen": 1,
    "PtNicFName": ""
  },
  "message": ""
}

Event ID 149 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Ndk PnP event successfully sent for virtual NIC (Friendly Name: ).

Fields #

NameDescription
FailReason UInt32—
NetEvent UInt32—
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 149 — Ndk PnP event NetEvent successfully sent for virtual NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Ndk PnP event NetEvent successfully sent for virtual NIC NicName (Friendly Name: NicFName).

Message #

Ndk PnP event %2 successfully sent for virtual NIC %5 (Friendly Name: %7).

Fields #

NameDescription
FailReason UInt32—
NetEvent UInt32—
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 150 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Request RDMA failed for host virtual NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 150 — Request RDMA failed for host virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Request RDMA failed for host virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Request RDMA failed for host virtual NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 151 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 151 — Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 152 — Replacing Member OldMember with new Member NewMember for load balancing.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Replacing Member OldMember with new Member NewMember for load balancing.

Message #

Replacing Member %1 with new Member %2 for load balancing

Fields #

NameDescription
OldMember GUID—
NewMember GUID—

Event ID 153 — Excluding Member Member from load balancing.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Excluding Member Member from load balancing.

Message #

Excluding Member %1 from load balancing

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 154 — Using Member Member for load balancing.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Using Member Member for load balancing.

Message #

Using Member %1 for load balancing

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 155 — Starting ConnectTimer for Member Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Starting ConnectTimer for Member Member.

Message #

Starting ConnectTimer for Member %1

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 156 — Stopping to use Member Member for load balancing.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Stopping to use Member Member for load balancing.

Message #

Stopping to use Member %1 for load balancing

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 157 — Priming Switch for TeamNic TeamNic using Member Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Priming Switch for TeamNic TeamNic using Member Member.

Message #

Priming Switch for TeamNic %1 using Member %2

Fields #

NameDescription
TeamNic Pointer—
Member GUID—

Event ID 158 — Failing NBL send on Member Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failing NBL send on Member Member.

Message #

Failing NBL send on Member %1

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 159 — Failing NBL send on TeamNic TeamNic.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failing NBL send on TeamNic TeamNic.

Message #

Failing NBL send on TeamNic %1

Fields #

NameDescription
TeamNic Pointer—
Status Int32— NTSTATUS reference

Event ID 160 — Dropping NBLs on Member Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Dropping NBLs on Member Member.

Message #

Dropping NBLs on Member %1

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 161 — DriverEntry exiting, Status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

DriverEntry exiting, Status = Status.

Message #

DriverEntry exiting, Status = %1

Fields #

NameDescription
Status Int32— NTSTATUS reference

Event ID 162 — Member Member created.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Member Member created.

Message #

Member %1 created.

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 163 — Aggregator Aggregator created.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Aggregator Aggregator created.

Message #

Aggregator %1 created.

Fields #

NameDescription
Aggregator Pointer—

Event ID 164 — Member Member placed in Team TeamNic, Status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Member Member placed in Team TeamNic, Status = Status.

Message #

Member %2 placed in Team %1, Status = %3.

Fields #

NameDescription
TeamNic Pointer—
Member GUID—
Status Int32— NTSTATUS reference

Event ID 165 — Indicating new link state for TeamNic TeamNic.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Indicating new link state for TeamNic TeamNic. StatusBuffer = StatusBuffer.

Message #

Indicating new link state for TeamNic %1. StatusBuffer = %3.

Fields #

NameDescription
TeamNic Pointer—
StatusBufferLen UInt32—
StatusBuffer Binary—

Event ID 166 — Default Aggregator for TeamNic TeamNic changed to Receiver.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Default Aggregator for TeamNic TeamNic changed to Receiver.

Message #

Default Aggregator for TeamNic %1 changed to %2.

Fields #

NameDescription
TeamNic Pointer—
Receiver Pointer—

Event ID 167 — BroadcastReceiver for TeamNic TeamNic changed to Receiver.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

BroadcastReceiver for TeamNic TeamNic changed to Receiver.

Message #

BroadcastReceiver for TeamNic %1 changed to %2.

Fields #

NameDescription
TeamNic Pointer—
Receiver Pointer—

Event ID 168 — Initializing TeamNic TeamNic, Status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Initializing TeamNic TeamNic, Status = Status.

Message #

Initializing TeamNic %1, Status = %2.

Fields #

NameDescription
TeamNic Pointer—
Status Int32— NTSTATUS reference

Event ID 169 — Removing Aggregator Aggregator from TeamNic TeamNic.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Removing Aggregator Aggregator from TeamNic TeamNic.

Message #

Removing Aggregator %2 from TeamNic %1.

Fields #

NameDescription
TeamNic Pointer—
Aggregator Pointer—

Event ID 170 — Removed Member Member from TeamNic TeamNic.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Removed Member Member from TeamNic TeamNic.

Message #

Removed Member %2 from TeamNic %1.

Fields #

NameDescription
TeamNic Pointer—
Member GUID—
Status Int32— NTSTATUS reference

Event ID 171 — Removing TeamNic TeamNic.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Removing TeamNic TeamNic.

Message #

Removing TeamNic %1.

Fields #

NameDescription
TeamNic Pointer—
Status Int32— NTSTATUS reference

Event ID 172 — MsLbfoProvider driver is unloading.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

MsLbfoProvider driver is unloading.

Message #

MsLbfoProvider driver is unloading.

Event ID 173 — Changing Aggregator for Member Member from OldAggregator to NewAggregator.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Changing Aggregator for Member Member from OldAggregator to NewAggregator.

Message #

Changing Aggregator for Member %1 from %2 to %3.

Fields #

NameDescription
Member GUID—
OldAggregator Pointer—
NewAggregator Pointer—

Event ID 174 — LACP Initializing for Member Member, Status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LACP Initializing for Member Member, Status = Status.

Message #

LACP Initializing for Member %1, Status = %2.

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 175 — LACP de-initialized for Member Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LACP de-initialized for Member Member.

Message #

LACP de-initialized for Member %1.

Fields #

NameDescription
Member GUID—
Status Int32— NTSTATUS reference

Event ID 176 — Received LACPDU on Member Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Received LACPDU on Member Member. Buffer= Buffer.

Message #

Received LACPDU on Member %1. Buffer= %3.

Fields #

NameDescription
Member GUID—
BufferLen UInt32—
Buffer Binary—

Event ID 177 — LBFO LACP Member Member; ReceiveMachine: OldState->NewState.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LBFO LACP Member Member; ReceiveMachine: OldState->NewState.

Message #

LBFO LACP Member %1; ReceiveMachine: %2->%3.

Fields #

NameDescription
Member GUID—
OldState HexInt32—
NewState HexInt32—

Event ID 178 — LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.

Message #

LBFO LACP Member %1; Periodic Transmission Machine: %2->%3.

Fields #

NameDescription
Member GUID—
OldState HexInt32—
NewState HexInt32—

Event ID 179 — LBFO LACP Member Member; Mux Machine: OldState->NewState.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LBFO LACP Member Member; Mux Machine: OldState->NewState.

Message #

LBFO LACP Member %1; Mux Machine: %2->%3.

Fields #

NameDescription
Member GUID—
OldState HexInt32—
NewState HexInt32—

Event ID 180 — Sending LACPDU on Member Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Sending LACPDU on Member Member. Buffer= Buffer.

Message #

Sending LACPDU on Member %1. Buffer= %3.

Fields #

NameDescription
Member GUID—
BufferLen UInt32—
Buffer Binary—

Event ID 181 — LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.

Message #

LBFO LACP Member %1; Selected NewAgg: %3, Ready:%4.

Fields #

NameDescription
Member GUID—
OldAggregator Pointer—
NewAggregator Pointer—
Ready Boolean—

Event ID 182 — LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: NewAggregator.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: NewAggregator.

Message #

LBFO LACP Member %1; UnSelected, OldAgg: %2 NewAgg: %3.

Fields #

NameDescription
Member GUID—
OldAggregator Pointer—
NewAggregator Pointer—
Ready Boolean—

Event ID 183 — LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.

Message #

LBFO LACP Member %1; Churn Type (%2): %3->%4.

Fields #

NameDescription
Member GUID—
ChurnType Int32—
OldState Int32—
NewState Int32—

Event ID 184 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Member Nic Connected.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 184 — Member Nic Member Connected.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Member Nic Member Connected.

Message #

Member Nic %2 Connected.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 185 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Member Nic Disconnected.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 185 — Member Nic Member Disconnected.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Member Nic Member Disconnected.

Message #

Member Nic %2 Disconnected.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 186 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Connection Timer Started for Member Nic . It will be in use shortly.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 186 — Connection Timer Started for Member Nic Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Connection Timer Started for Member Nic Member. It will be in use shortly.

Message #

Connection Timer Started for Member Nic %2. It will be in use shortly.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 187 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

LACP Churn detected on Member Nic .

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 187 — LACP Churn detected on Member Nic Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

LACP Churn detected on Member Nic Member.

Message #

LACP Churn detected on Member Nic %2.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 188 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Use of Vlan detected on non-default Team Nic.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 188 — Use of Vlan detected on non-default Team Nic Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Use of Vlan detected on non-default Team Nic Member.

Message #

Use of Vlan detected on non-default Team Nic %2

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 189 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic.

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 189 — MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic Member.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic Member.

Message #

MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic %2

Fields #

NameDescription
DriverObject UnicodeString—
Member UnicodeString—

Event ID 190 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to update NIC NDIS QoS with miniport NIC (Friendly Name: ), status = . UniqueEvent =.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 190 — Failed to update NIC NDIS QoS with miniport NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to update NIC NDIS QoS with miniport NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to update NIC NDIS QoS with miniport NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 191 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Successfully updated NIC NDIS QoS with Miniport NIC (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 191 — Successfully updated NIC NDIS QoS with Miniport NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Successfully updated NIC NDIS QoS with Miniport NIC NicName (Friendly Name: NicFName).

Message #

Successfully updated NIC NDIS QoS with Miniport NIC %2 (Friendly Name: %4)

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 192 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 192 — Team NIC NicName (Friendly Name: NicFName) has inconsistent consolidated NDIS QoS settings.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Team NIC %2 (Friendly Name: %4) has inconsistent consolidated NDIS QoS settings. This is normally be due to a transient state where the member adapters are updating their settings. This message can safely ignored if it is soon followed by a message specifying that the team now has consistent consolidated NDIS QoS settings.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 193 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Team NIC (Friendly Name: ) has consistent consolidated NDIS QoS settings.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 193 — Team NIC NicName (Friendly Name: NicFName) has consistent consolidated NDIS QoS settings.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Team NIC NicName (Friendly Name: NicFName) has consistent consolidated NDIS QoS settings.

Message #

Team NIC %2 (Friendly Name: %4) has consistent consolidated NDIS QoS settings.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 194 — Operation operation failed for NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Operation operation failed for NIC NicName (Friendly Name: NicFName). Reason: FailureReason, Error Code: FailureCode.

Message #

%5 operation failed for NIC %2 (Friendly Name: %4). Reason: %7, Error Code: %6

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
FailureCode UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
Ext1 UInt32—
Ext2 UInt32—

Event ID 195 — Switch Extension Operation operation failed for NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch Extension Operation operation failed for NIC NicName (Friendly Name: NicFName). Reason: FailureReason, Error Code: FailureCode.

Message #

Switch Extension %5 operation failed for NIC %2 (Friendly Name: %4). Reason: %7, Error Code: %6

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
FailureCode UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
Ext1 UInt32—
HeaderType UInt32—
HeaderRevision UInt32—
HeaderSize UInt32—
ExtensionId GUID—
FeatureId GUID—
SaveDataSize UInt32—
SaveDataSizeOverflow UInt32—

Event ID 196 — Switch Extension Operation operation succeeded for NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch Extension Operation operation succeeded for NIC NicName (Friendly Name: NicFName).

Message #

Switch Extension %5 operation succeeded for NIC %2 (Friendly Name: %4).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
FailureCode UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
Ext1 UInt32—
HeaderType UInt32—
HeaderRevision UInt32—
HeaderSize UInt32—
ExtensionId GUID—
FeatureId GUID—
SaveDataSize UInt32—
SaveDataSizeOverflow UInt32—

Event ID 197 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to set filter for VLAN Id on NIC (Friendly Name: ). Reason -.

Fields #

NameDescription
VlanID UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
FailReason UInt32—

Event ID 197 — Failed to set filter for VLAN Id VlanID on NIC NicNameLen (Friendly Name: NicName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to set filter for VLAN Id VlanID on NIC NicNameLen (Friendly Name: NicName). Reason - NicFNameLen.

Message #

Failed to set filter for VLAN Id %1 on NIC %2 (Friendly Name: %3). Reason - %4

Fields #

NameDescription
VlanID UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
FailReason UInt32—

Event ID 198 — VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

VMQ is disabled on the external NIC NicName (Friendly Name: NicFName). RSS was succesfully enabled.

Message #

VMQ is disabled on the external NIC %2 (Friendly Name: %4). RSS was succesfully enabled.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 199 — VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

VMQ is disabled on the external NIC NicName (Friendly Name: NicFName). RSS could not be enabled. Reason: FailureReason, Error Code: Status.

Message #

VMQ is disabled on the external NIC %2 (Friendly Name: %4). RSS could not be enabled. Reason: %6, Error Code: %5

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 200 — Neither VMQ nor RSS are supported on the external NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Neither VMQ nor RSS are supported on the external NIC NicName (Friendly Name: NicFName).

Message #

Neither VMQ nor RSS are supported on the external NIC %2 (Friendly Name: %4).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 201 — VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

VMQ is disabled on the external NIC NicName (Friendly Name: NicFName). The RSS could not be updated to be synchronized with the host. Reason: FailureReason, Error Code: Status.

Message #

VMQ is disabled on the external NIC %2 (Friendly Name: %4). The RSS could not be updated to be synchronized with the host. Reason: %6, Error Code: %5

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 201 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

VMQ is disabled on the external NIC (Friendly Name: ). The RSS could not be updated to be synchronized with the host. Reason: , Error Code.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 202 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Team NIC (Friendly Name: ) failed to indicate status for new NDIS QoS settings.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 202 — Team NIC NicName (Friendly Name: NicFName) failed to indicate status for new NDIS QoS settings.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Team NIC NicName (Friendly Name: NicFName) failed to indicate status for new NDIS QoS settings.

Message #

Team NIC %2 (Friendly Name: %4) failed to indicate status for new NDIS QoS settings

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 203 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Team NIC (Friendly Name: ) successfully indicate status for new NDIS QoS settings.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 203 — Team NIC NicName (Friendly Name: NicFName) successfully indicate status for new NDIS QoS settings.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Team NIC NicName (Friendly Name: NicFName) successfully indicate status for new NDIS QoS settings.

Message #

Team NIC %2 (Friendly Name: %4) successfully indicate status for new NDIS QoS settings

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 204 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to set filter on vPort (MAC address=, VLAN Id=). Status=. Parameters: VportsEnabled=, team=, NicIndex=.

Fields #

NameDescription
FilterId UInt32—
vPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—
DstVPortId UInt32—
VlanId UInt32—
MacLength UInt32—
MacAddress UnicodeString—

Event ID 204 — Failed to set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId). Status=Status. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Failed to set filter %1 on vPort %2 (MAC address=%10, VLAN Id=%8). Status=%3. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

NameDescription
FilterId UInt32—
vPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—
DstVPortId UInt32—
VlanId UInt32—
MacLength UInt32—
MacAddress UnicodeString—

Event ID 205 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to move filter from vPort to vPort . Status=. Parameters: VportsEnabled=, team=, NicIndex=.

Fields #

NameDescription
FilterId UInt32—
SrcVPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—
DstVPortId UInt32—

Event ID 205 — Failed to move filter FilterId from vPort SrcVPortId to vPort DstVPortId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to move filter FilterId from vPort SrcVPortId to vPort DstVPortId. Status=Status. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Failed to move filter %1 from vPort %2 to vPort %7. Status=%3. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

NameDescription
FilterId UInt32—
SrcVPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—
DstVPortId UInt32—

Event ID 206 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Initialization of switch embedded team succeeded. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 206 — Initialization of switch embedded team succeeded.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Initialization of switch embedded team succeeded. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues.

Message #

Initialization of switch embedded team succeeded. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 207 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Initialization of switch embedded team failed. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues: . Status.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 207 — Initialization of switch embedded team failed.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Initialization of switch embedded team failed. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues. Status: Status.

Message #

Initialization of switch embedded team failed. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8. Status: %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 208 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Pause of switch embedded team succeeded. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 208 — Pause of switch embedded team succeeded.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Pause of switch embedded team succeeded. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues.

Message #

Pause of switch embedded team succeeded. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 209 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Initialization of switch embedded team failed. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues: . Status.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 209 — Initialization of switch embedded team failed.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Initialization of switch embedded team failed. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues. Status: Status.

Message #

Initialization of switch embedded team failed. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8. Status: %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 210 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch embedded team is pre-detached. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 210 — Switch embedded team is pre-detached.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Switch embedded team is pre-detached. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues.

Message #

Switch embedded team is pre-detached. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 211 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch embedded team is completely detached. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 211 — Switch embedded team is completely detached.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Switch embedded team is completely detached. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues.

Message #

Switch embedded team is completely detached. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
TeamingMode UInt32—
LoadBalancingAlgorithm UInt32—
VmqSumOfQueues Boolean—

Event ID 212 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NIC was successfully added to the switch embedded team. SwitchName (Friendly Name: ). NIC Name: (Friendly Name: ). NicIndex.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFriendlyNameLen UInt32—
NicFriendlyName UnicodeString—
NicIndex UInt32—

Event ID 212 — NIC was successfully added to the switch embedded team.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

NIC was successfully added to the switch embedded team. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). NIC Name: NicName (Friendly Name: NicFriendlyName). NicIndex: NicIndex.

Message #

NIC was successfully added to the switch embedded team. SwitchName %3 (Friendly Name: %5). NIC Name: %7 (Friendly Name: %9). NicIndex: %10

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFriendlyNameLen UInt32—
NicFriendlyName UnicodeString—
NicIndex UInt32—

Event ID 213 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NIC failed to be addeded to the switch embedded team. SwitchName (Friendly Name: ). NIC Name: (Friendly Name: ). NicIndex: . Status.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFriendlyNameLen UInt32—
NicFriendlyName UnicodeString—
NicIndex UInt32—

Event ID 213 — NIC failed to be addeded to the switch embedded team.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

NIC failed to be addeded to the switch embedded team. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). NIC Name: NicName (Friendly Name: NicFriendlyName). NicIndex: NicIndex. Status: Status.

Message #

NIC failed to be addeded to the switch embedded team. SwitchName %3 (Friendly Name: %5). NIC Name: %7 (Friendly Name: %9). NicIndex: %10. Status: %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFriendlyNameLen UInt32—
NicFriendlyName UnicodeString—
NicIndex UInt32—

Event ID 214 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NIC was removed from the switch embedded team. SwitchName (Friendly Name: ). NIC Name: (Friendly Name: ). NicIndex.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFriendlyNameLen UInt32—
NicFriendlyName UnicodeString—
NicIndex UInt32—

Event ID 214 — NIC was removed from the switch embedded team.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

NIC was removed from the switch embedded team. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). NIC Name: NicName (Friendly Name: NicFriendlyName). NicIndex: NicIndex.

Message #

NIC was removed from the switch embedded team. SwitchName %3 (Friendly Name: %5). NIC Name: %7 (Friendly Name: %9). NicIndex: %10

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFriendlyNameLen UInt32—
NicFriendlyName UnicodeString—
NicIndex UInt32—

Event ID 215 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to clear filter on vPort . Status=. Parameters: VportsEnabled=, team=, NicIndex=.

Fields #

NameDescription
FilterId UInt32—
vPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—

Event ID 215 — Failed to clear filter FilterId on vPort vPortId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to clear filter FilterId on vPort vPortId. Status=Status. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Failed to clear filter %1 on vPort %2. Status=%3. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

NameDescription
FilterId UInt32—
vPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—

Event ID 216 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Request RDMA failed for virtual machine NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 216 — Request RDMA failed for virtual machine NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Request RDMA failed for virtual machine NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Request RDMA failed for virtual machine NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicNameLen UInt32—
PtNicName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 217 — External NIC sent NDK PnP event but it failed to reach all miniports.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

External NIC sent NDK PnP event but it failed to reach all miniports. Ndk PnP event NetEvent from physical NIC NicNameLen (Friendly Name: NicFNameLen). Status: Status. Reason: FailReason.

Message #

External NIC sent NDK PnP event but it failed to reach all miniports. Ndk PnP event %2 from physical NIC %4 (Friendly Name: %6). Status: %3. Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NetEvent UInt32—
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 218 — NIC NicName (Friendly Name: NicFName) queried isolation information on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NIC (Friendly Name: ) queried isolation information on port (Friendly Name: ) on switch (Friendly Name: ). RoutingDomainCount: , MultiTenantStackEnabled: , Status: , Ext1: , Ext2.

Message #

NIC %2 (Friendly Name: %4) queried isolation information on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). RoutingDomainCount: %13, MultiTenantStackEnabled: %14, Status: %15, Ext1: %16, Ext2: %17

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
RoutingDomainCount UInt32—
MultiTenantStackEnabled Boolean—
Status UInt32— NTSTATUS reference
Ext1 UInt32—
Ext2 UInt32—

Event ID 219 — NIC NicName (Friendly Name: NicFName) queried isolation information on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

NIC (Friendly Name: ) queried isolation information on port (Friendly Name: ) on switch (Friendly Name: ). RoutingDomainCount: , MultiTenantStackEnabled: , Status: , Ext1: , Ext2.

Message #

NIC %2 (Friendly Name: %4) queried isolation information on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). RoutingDomainCount: %13, MultiTenantStackEnabled: %14, Status: %15, Ext1: %16, Ext2: %17

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
RoutingDomainCount UInt32—
MultiTenantStackEnabled Boolean—
Status UInt32— NTSTATUS reference
Ext1 UInt32—
Ext2 UInt32—

Event ID 219 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NIC (Friendly Name: ) queried isolation information on port (Friendly Name: ) on switch (Friendly Name: ). RoutingDomainCount: , MultiTenantStackEnabled: , Status: , Ext1: , Ext2.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
RoutingDomainCount UInt32—
MultiTenantStackEnabled Boolean—
Status UInt32— NTSTATUS reference
Ext1 UInt32—
Ext2 UInt32—

Event ID 220 — Status change (NicStatus) sent to Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Level
Informational
Opcode
Info

Description

Status change (NicStatus) sent to Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). NicStatus: NicStatus, Status: Status.

Message #

Status change (%13) sent to Nic %2 (Friendly Name: %4) on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). NicStatus: %13, Status: %14

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicStatus UInt32—
Status UInt32— NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 220,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388032,
    "time_created": "2026-03-11T06:32:02.568678+00:00",
    "event_record_id": 39,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1672
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NicFNameLen": 0,
    "NicFName": "",
    "PortNameLen": 36,
    "PortName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "PortFNameLen": 36,
    "PortFName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "NicStatus": 8,
    "Status": 0
  },
  "message": ""
}

Event ID 221 — Data path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

Data path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). ObjectState: ObjectState, NicState: NicState, NicPaused: NicPaused, BuffersNotReady: BuffersNotReady.

Message #

Data path usage blocked for Nic %2 (Friendly Name: %4) on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). ObjectState: %13, NicState: %14, NicPaused: %15, BuffersNotReady: %16

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ObjectState UInt32—
NicState UInt32—
NicPaused Boolean—
BuffersNotReady Boolean—

Event ID 221 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Data path usage blocked for Nic (Friendly Name: ) on port (Friendly Name: ) on switch (Friendly Name: ). ObjectState: , NicState: , NicPaused: , BuffersNotReady.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ObjectState UInt32—
NicState UInt32—
NicPaused Boolean—
BuffersNotReady Boolean—

Event ID 222 — Control path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Control path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). ObjectState: ObjectState, NicState: NicState, NicPaused: NicPaused, BuffersNotReady: BuffersNotReady.

Message #

Control path usage blocked for Nic %2 (Friendly Name: %4) on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). ObjectState: %13, NicState: %14, NicPaused: %15, BuffersNotReady: %16

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ObjectState UInt32—
NicState UInt32—
NicPaused Boolean—
BuffersNotReady Boolean—

Event ID 222 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Control path usage blocked for Nic (Friendly Name: ) on port (Friendly Name: ) on switch (Friendly Name: ). ObjectState: , NicState: , NicPaused: , BuffersNotReady.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ObjectState UInt32—
NicState UInt32—
NicPaused Boolean—
BuffersNotReady Boolean—

Event ID 223 — Rundown: Switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Rundown: Switch SwitchName (Friendly Name: SwitchFName).

Message #

Rundown: Switch %2 (Friendly Name: %4).

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 223 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Rundown: Switch (Friendly Name: ).

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 224 — Rundown: Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode
Info

Description

Rundown: Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

Rundown: Port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 224 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Rundown: Port (Friendly Name: ) on switch (Friendly Name: ).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 225 — Virtual RSS configuration initialization failed on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName) with status Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Virtual RSS configuration initialization failed on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName) with status Status. Reason: FailReason.

Message #

Virtual RSS configuration initialization failed on NIC %2 (Friendly Name: %4) of switch %6 (Friendly Name: %8) with status %10. Reason: %9.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
FailReason UInt32—
Status UInt32— NTSTATUS reference
Flags UInt32—
BaseCpuNumber UInt32—
HashInformation UInt32—
IndirectionTableSize UInt32—
IndirectionTableOffset UInt32—
HashSecretKeySize UInt32—
HashSecretKeyOffset UInt32—

Event ID 226 — Virtual RSS configuration initialization succeeded on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Virtual RSS configuration initialization succeeded on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName).

Message #

Virtual RSS configuration initialization succeeded on NIC %2 (Friendly Name: %4) of switch %6 (Friendly Name: %8).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
BaseCpuNumber UInt32—
HashInformation UInt32—
IndirectionTableSize UInt32—
IndirectionTableOffset UInt32—
HashSecretKeySize UInt32—
HashSecretKeyOffset UInt32—

Event ID 227 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DefaultQueueVrssEnabled Boolean—
DefaultQueueVmmqEnabled Boolean—
DefaultQueueVrssMaxQueuePairs Int32—
DefaultQueueVrssMinQueuePairs Int32—
DefaultQueueVrssQueueSchedulingMode UInt32—
DefaultQueueVrssExcludePrimaryProcessor Boolean—
DefaultQueueVrssIndependentHostSpreading Boolean—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 227 — Failed to complete offload policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DefaultQueueVrssEnabledRequested - DefaultQueueVrssEnabled, DefaultQueueVmmqEnabledRe...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Failed to complete offload policy operation '%14' on switch %3 (Friendly Name: %5) DefaultQueueVrssEnabledRequested - %6, DefaultQueueVmmqEnabledRequested - %7, DefaultQueueVrssMaxQueuePairsRequested - %8, DefaultQueueVrssMinQueuePairs - %9, DefaultQueueVrssQueueSchedulingMode - %10, DefaultQueueVrssExcludePrimaryProcessor - %11, DefaultQueueVrssIndependentHostSpreading - %12 Reason - %13, Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DefaultQueueVrssEnabled Boolean—
DefaultQueueVmmqEnabled Boolean—
DefaultQueueVrssMaxQueuePairs Int32—
DefaultQueueVrssMinQueuePairs Int32—
DefaultQueueVrssQueueSchedulingMode UInt32—
DefaultQueueVrssExcludePrimaryProcessor Boolean—
DefaultQueueVrssIndependentHostSpreading Boolean—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 228 — Completed offload policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DefaultQueueVrssEnabledRequested - DefaultQueueVrssEnabled, DefaultQueueVmmqEnabledRequested -...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Message #

Completed offload policy operation '%12' on switch %2 (Friendly Name: %4) DefaultQueueVrssEnabledRequested - %5, DefaultQueueVmmqEnabledRequested - %6, DefaultQueueVrssMaxQueuePairsRequested - %7, DefaultQueueVrssMinQueuePairs - %8, DefaultQueueVrssQueueSchedulingMode - %9, DefaultQueueVrssExcludePrimaryProcessor - %10, DefaultQueueVrssIndependentHostSpreading %11

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DefaultQueueVrssEnabled Boolean—
DefaultQueueVmmqEnabled Boolean—
DefaultQueueVrssMaxQueuePairs Int32—
DefaultQueueVrssMinQueuePairs Int32—
DefaultQueueVrssQueueSchedulingMode UInt32—
DefaultQueueVrssExcludePrimaryProcessor Boolean—
DefaultQueueVrssIndependentHostSpreading Boolean—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 229 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Syncing TCP offloads for switch embedded teaming failed. HNV might not work correctly. SwitchName (Friendly Name: ), Physical Adapter (Friendly Name: ), NicIndex , Failure reason: .

Fields #

NameDescription
FailReason UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
MemberAdapterNameLen UInt32—
MemberAdapterName UnicodeString—
MemberAdapterFriendlyNameLen UInt32—
MemberAdapterFriendlyName UnicodeString—
NicIndex UInt32—

Event ID 229 — Syncing TCP offloads for switch embedded teaming failed.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Syncing TCP offloads for switch embedded teaming failed. HNV might not work correctly. SwitchName SwitchName (Friendly Name: SwitchFriendlyName), Physical Adapter MemberAdapterName (Friendly Name: MemberAdapterFriendlyName), NicIndex NicIndex, Failure reason: FailReason.

Message #

Syncing TCP offloads for switch embedded teaming failed. HNV might not work correctly. SwitchName %3 (Friendly Name: %5), Physical Adapter %7 (Friendly Name: %9), NicIndex %10, Failure reason: %1.

Fields #

NameDescription
FailReason UInt32—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
MemberAdapterNameLen UInt32—
MemberAdapterName UnicodeString—
MemberAdapterFriendlyNameLen UInt32—
MemberAdapterFriendlyName UnicodeString—
NicIndex UInt32—

Event ID 230 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Syncing TCP offloads for switch embedded teaming succeeded. SwitchName (Friendly Name: ) NvgreEnabled - VxLanEnabled - .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
NvgreEnabled Boolean—
VxLanEnabled Boolean—

Event ID 230 — Syncing TCP offloads for switch embedded teaming succeeded.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Syncing TCP offloads for switch embedded teaming succeeded. SwitchName SwitchName (Friendly Name: SwitchFriendlyName) NvgreEnabled - NvgreEnabled VxLanEnabled - VxLanEnabled.

Message #

Syncing TCP offloads for switch embedded teaming succeeded. SwitchName %2 (Friendly Name: %4) NvgreEnabled - %5 VxLanEnabled - %6.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFriendlyNameLen UInt32—
SwitchFriendlyName UnicodeString—
NvgreEnabled Boolean—
VxLanEnabled Boolean—

Event ID 231 — A potentially looped back packet with MAC MacAddress was indicated to physical adapter MemberAdapterName (Friendly Name: MemberAdapterFriendlyName) since TimeDiff ms passed since it was last seen a...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

A potentially looped back packet with MAC was indicated to physical adapter (Friendly Name: ) since ms passed since it was last seen as the source MAC for a virtual NIC connected to the vSwitch.

Message #

A potentially looped back packet with MAC %2 was indicated to physical adapter %4 (Friendly Name: %6) since %7 ms passed since it was last seen as the source MAC for a virtual NIC connected to the vSwitch.

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
MemberAdapterNameLen UInt32—
MemberAdapterName UnicodeString—
MemberAdapterFriendlyNameLen UInt32—
MemberAdapterFriendlyName UnicodeString—
TimeDiff Int64—

Event ID 231 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

A potentially looped back packet with MAC was indicated to physical adapter (Friendly Name: ) since ms passed since it was last seen as the source MAC for a virtual NIC connected to the vSwitch.

Fields #

NameDescription
MacAddressLen UInt32—
MacAddress UnicodeString—
MemberAdapterNameLen UInt32—
MemberAdapterName UnicodeString—
MemberAdapterFriendlyNameLen UInt32—
MemberAdapterFriendlyName UnicodeString—
TimeDiff Int64—

Event ID 232 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NIC (Friendly Name: ) successfully connected to port (Friendly Name: ) on switch (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Event ID 232 — NIC NicName (Friendly Name: NicFName) successfully connected to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Opcode
Info

Description

NIC NicName (Friendly Name: NicFName) successfully connected to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Message #

NIC %2 (Friendly Name: %4) successfully connected to port %6 (Friendly Name: %8) on switch %10(Friendly Name: %12).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 232,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.479516+00:00",
    "event_record_id": 2816,
    "correlation": {},
    "execution": {
      "process_id": 9436,
      "thread_id": 10020
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-83-1-698845485-1245677379-4261864325-3027728797"
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NicFNameLen": 0,
    "NicFName": "",
    "PortNameLen": 36,
    "PortName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "PortFNameLen": 36,
    "PortFName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL"
  },
  "message": ""
}

Event ID 233 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
NicInstanceId GUID—

Event ID 233 — The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Opcode
Info

Description

The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Message #

The operation '%5' succeeded on nic %2 (Friendly Name: %4), Instance Id %6.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
NicInstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 233,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.465348+00:00",
    "event_record_id": 2815,
    "correlation": {},
    "execution": {
      "process_id": 9436,
      "thread_id": 10020
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-83-1-698845485-1245677379-4261864325-3027728797"
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NicFNameLen": 1,
    "NicFName": "",
    "Operation": 7,
    "NicInstanceId": "00000000-0000-0000-0000-000000000000"
  },
  "message": ""
}

Event ID 234 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NIC successfully disconnected from port .

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—

Event ID 234 — NIC NicName successfully disconnected from port PortName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Opcode
Info

Description

NIC NicName successfully disconnected from port PortName.

Message #

NIC %2 successfully disconnected from port %4.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 234,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-13T20:25:35.577231+00:00",
    "event_record_id": 2195,
    "correlation": {},
    "execution": {
      "process_id": 8576,
      "thread_id": 3724
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-83-1-3597615443-1292995037-3776533383-3983578047"
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "D66F4153-89DD-4D11-8753-19E1BF9370ED--EA01A73B-3017-44F0-9B2D-E0B5034E70BF",
    "PortNameLen": 1,
    "PortName": ""
  },
  "message": ""
}

Event ID 235 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NIC disconnect from port failed. Status = , UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
UniqueEvent UInt32—

Event ID 235 — NIC NicName disconnect from port PortName failed.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

NIC NicName disconnect from port PortName failed. Status = Status, UniqueEvent = UniqueEvent.

Message #

NIC %3 disconnect from port %5 failed. Status = %1, UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
UniqueEvent UInt32—

Event ID 236 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to allocate virtual function for NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 236 — Failed to allocate virtual function for NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to allocate virtual function for NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to allocate virtual function for NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 237 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializePD

Description

Failed to enable Packet Direct for switch .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reason UInt32—

Event ID 237 — Failed to enable Packet Direct for switch SwitchFName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
InitializePD

Description

Failed to enable Packet Direct for switch SwitchFName. Reason.

Message #

Failed to enable Packet Direct for switch %4. %5

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Reason UInt32—

Event ID 238 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializePD

Description

Failed to setup Packet Direct access for virtual NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 238 — Failed to setup Packet Direct access for virtual NIC NicName (Friendly Name: NicFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
InitializePD

Description

Failed to setup Packet Direct access for virtual NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to setup Packet Direct access for virtual NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 239 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializePD

Description

Failed to setup Packet Direct data path on switch (Friendly Name: ), status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 239 — Failed to setup Packet Direct data path on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
InitializePD

Description

Failed to setup Packet Direct data path on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Message #

Failed to setup Packet Direct data path on switch %3 (Friendly Name: %5), status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 240 — PD Buffer BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

PD Buffer BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Message #

PD Buffer %9 delivered to Nic %2 (Friendly Name: %4) in switch %6 (Friendly Name: %8)

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 240 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

PD Buffer delivered to Nic (Friendly Name: ) in switch (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 241 — PD Buffer BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

PD Buffer BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Message #

PD Buffer %9 received from Nic %2 (Friendly Name: %4) in switch %6 (Friendly Name: %8)

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 241 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

PD Buffer received from Nic (Friendly Name: ) in switch (Friendly Name: ).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 242 — PD Buffer BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode
Info

Description

PD Buffer BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

PD Buffer %13 routed from Nic %2 (Friendly Name: %4) to Nic %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12)

Fields #

NameDescription
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
DestNicNameLen UInt32—
DestNicName UnicodeString—
DestNicFNameLen UInt32—
DestNicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 242 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

PD Buffer routed from Nic (Friendly Name: ) to Nic (Friendly Name: ) on switch (Friendly Name: ).

Fields #

NameDescription
SrcNicNameLen UInt32—
SrcNicName UnicodeString—
SrcNicFNameLen UInt32—
SrcNicFName UnicodeString—
DestNicNameLen UInt32—
DestNicName UnicodeString—
DestNicFNameLen UInt32—
DestNicFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
BufferAddress Pointer—

Event ID 243 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Insufficient number of available MAC address filters for configuring Trunk VLAN IDs on IOV switch , NIC .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
AvailableAddressFilters UInt32—
RequestedVlanIDs UInt32—

Event ID 243 — Insufficient number of available MAC address filters for configuring RequestedVlanIDs Trunk VLAN IDs on IOV switch SwitchFName, NIC NicFName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Insufficient number of available MAC address filters for configuring RequestedVlanIDs Trunk VLAN IDs on IOV switch SwitchFName, NIC NicFName.

Message #

Insufficient number of available MAC address filters for configuring %10 Trunk VLAN IDs on IOV switch %4, NIC %8.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
AvailableAddressFilters UInt32—
RequestedVlanIDs UInt32—

Event ID 244 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Insufficient number of available MAC address filters for configuring Routing Domain VLANs on IOV switch , NIC .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
AvailableAddressFilters UInt32—
RequestedVlanIDs UInt32—

Event ID 244 — Insufficient number of available MAC address filters for configuring RequestedVlanIDs Routing Domain VLANs on IOV switch SwitchFName, NIC NicFName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Insufficient number of available MAC address filters for configuring RequestedVlanIDs Routing Domain VLANs on IOV switch SwitchFName, NIC NicFName.

Message #

Insufficient number of available MAC address filters for configuring %10 Routing Domain VLANs on IOV switch %4, NIC %8.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
AvailableAddressFilters UInt32—
RequestedVlanIDs UInt32—

Event ID 245 — Successfully set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Successfully set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId). Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Successfully set filter %1 on vPort %2 (MAC address=%10, VLAN Id=%8). Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

NameDescription
FilterId UInt32—
vPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—
DstVPortId UInt32—
VlanId UInt32—
MacLength UInt32—
MacAddress UnicodeString—

Event ID 246 — Successfully moved filter FilterId from vPort SrcVPortId to vPort DstVPortId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Successfully moved filter FilterId from vPort SrcVPortId to vPort DstVPortId. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Successfully moved filter %1 from vPort %2 to vPort %7. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

NameDescription
FilterId UInt32—
SrcVPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—
DstVPortId UInt32—

Event ID 247 — Successfully cleared filter FilterId on vPort vPortId.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Successfully cleared filter FilterId on vPort vPortId. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Successfully cleared filter %1 on vPort %2. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

NameDescription
FilterId UInt32—
vPortId UInt32—
Status UInt32— NTSTATUS reference
VportsSupported Boolean—
EmbeddedTeaming Boolean—
NicIndex UInt32—

Event ID 248 — Send spreading was successfully enabled on NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Send spreading was successfully enabled on NIC NicName (Friendly Name: NicFName).

Message #

Send spreading was successfully enabled on NIC %2 (Friendly Name: %4).

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 249 — The system is not ready to enable send spreading on NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

The system is not ready to enable send spreading on NIC NicName (Friendly Name: NicFName). Reason: FailureReason, Error Code: Status.

Message #

The system is not ready to enable send spreading on NIC %2 (Friendly Name: %4). Reason: %6, Error Code: %5

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 250 — Send spreading on NIC NicName (Friendly Name: NicFName) is not supported.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Send spreading on NIC NicName (Friendly Name: NicFName) is not supported. Reason: FailureReason, Error Code: Status.

Message #

Send spreading on NIC %2 (Friendly Name: %4) is not supported. Reason: %6, Error Code: %5

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 251 — Failed to enable send spreading on NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to enable send spreading on NIC NicName (Friendly Name: NicFName). Reason: FailureReason, Error Code: Status.

Message #

Failed to enable send spreading on NIC %2 (Friendly Name: %4). Reason: %6, Error Code: %5

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 252 — Memory allocated for packets in a vRss queue (on CPU ProcessorIndex) on switch SwitchName (Friendly Name: SwitchFName) due to low resource on the physical NIC has increased to ...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Memory allocated for packets in a vRss queue (on CPU %5) on switch %2 (Friendly Name: %4) due to low resource on the physical NIC has increased to %6MB. Packets will be dropped once queue size reaches %7MB.

Fields #

NameDescription
SwitchNameLen UInt32 → unsignedInt—
SwitchName UnicodeString → string—
SwitchFNameLen UInt32 → unsignedInt—
SwitchFName UnicodeString → string—
ProcessorIndex UInt32 → unsignedInt—
QueueSizeMBytes UInt32 → unsignedInt—
QueueLimitMBytes UInt32 → unsignedInt—

Event ID 253 — Memory allocated for packets in a vRss queue (on CPU ProcessorIndex) on switch SwitchName (Friendly Name: SwitchFName) due to low resource on the physical NIC has reduced to QueueSizeMBytesMB.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Message #

Memory allocated for packets in a vRss queue (on CPU %5) on switch %2 (Friendly Name: %4) due to low resource on the physical NIC has reduced to %6MB.

Fields #

NameDescription
SwitchNameLen UInt32 → unsignedInt—
SwitchName UnicodeString → string—
SwitchFNameLen UInt32 → unsignedInt—
SwitchFName UnicodeString → string—
ProcessorIndex UInt32 → unsignedInt—
QueueSizeMBytes UInt32 → unsignedInt—
QueueLimitMBytes UInt32 → unsignedInt—

Event ID 254 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Sending Ndk PnP event failed for virtual NIC (Friendly Name: ). Status: . Reason: .

Fields #

NameDescription
FailReason UInt32—
NetEvent UInt32—
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 254 — Sending Ndk PnP event NetEvent failed for virtual NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Sending Ndk PnP event NetEvent failed for virtual NIC NicName (Friendly Name: NicFName). Status: Status. Reason: FailReason.

Message #

Sending Ndk PnP event %2 failed for virtual NIC %5 (Friendly Name: %7). Status: %3. Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NetEvent UInt32—
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 255 — Setting Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName) succeeded.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Setting Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName) succeeded.

Message #

Setting Rdma weight %10 on port %3 (Friendly Name %5) connected to Nic %7 (Friendly Name %9) succeeded.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
RdmaWeight UInt32—
FailReason UInt32—

Event ID 256 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to set Rdma weight on port (Friendly Name ) connected to Nic (Friendly Name ). Status = , Failure Reason.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
RdmaWeight UInt32—
FailReason UInt32—

Event ID 256 — Failed to set Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to set Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName). Status = Status, Failure Reason : FailReason.

Message #

Failed to set Rdma weight %10 on port %3 (Friendly Name %5) connected to Nic %7 (Friendly Name %9). Status = %1, Failure Reason : %11

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
RdmaWeight UInt32—
FailReason UInt32—

Event ID 257 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to retrieve Rdma weight on port (Friendly Name ) connected to Nic (Friendly Name ). Status = , Failure Reason.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
RdmaWeight UInt32—
FailReason UInt32—

Event ID 257 — Failed to retrieve Rdma weight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to retrieve Rdma weight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName). Status = Status, Failure Reason : FailReason.

Message #

Failed to retrieve Rdma weight on port %3 (Friendly Name %5) connected to Nic %7 (Friendly Name %9). Status = %1, Failure Reason : %11

Fields #

NameDescription
Status UInt32— NTSTATUS reference
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
RdmaWeight UInt32—
FailReason UInt32—

Event ID 258 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to get stored VlanID for Physical NIC . Status =.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 258 — Failed to get stored VlanID for Physical NIC NicName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to get stored VlanID for Physical NIC NicName. Status = Status.

Message #

Failed to get stored VlanID for Physical NIC %3. Status = %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 259 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Underlying network adapter failed to execute critical OID request. Such failure may cause hang in Hyper-V Switch component. Request: , error: , adapter name: .

Fields #

NameDescription
NdisOid UInt32—
OidFailureStatus UInt32—
FailureMode UInt32—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 259 — Underlying network adapter failed to execute critical OID request.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Underlying network adapter failed to execute critical OID request. Such failure may cause hang in Hyper-V Switch component. Request: NdisOid, error: OidFailureStatus, adapter name: PtNicFName.

Message #

Underlying network adapter failed to execute critical OID request. Such failure may cause hang in Hyper-V Switch component. Request: %1, error: %2, adapter name: %11.

Fields #

NameDescription
NdisOid UInt32—
OidFailureStatus UInt32—
FailureMode UInt32—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PtNicFNameLen UInt32—
PtNicFName UnicodeString—

Event ID 260 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
VmqMove

Description

Failed to move RSS queue from VMQ of switch (Friendly Name: ), ndisStatus = .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
RssQueueIndex Int16—
NdisStatus Int32—

Event ID 260 — Failed to move RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName), ndisStatus = NdisStatus .

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
VmqMove

Description

Failed to move RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName), ndisStatus = NdisStatus .

Message #

Failed to move RSS queue %6 from VMQ %5 of switch %2 (Friendly Name: %4), ndisStatus = %7 .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
VmqIndex UInt32—
RssQueueIndex Int16—
NdisStatus Int32—

Event ID 261 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to complete performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets, Reason - FailReason, Status = Status.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DropLowResourcesPackets Boolean—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 261 — Failed to complete performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets, Reason - FailReason, Status = Status.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to complete performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets, Reason - FailReason, Status = Status.

Message #

Failed to complete performance policy operation '%8' on switch %3 (Friendly Name: %5) DropLowResourcesPackets - %6, Reason - %7, Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DropLowResourcesPackets Boolean—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 262 — Completed performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Completed performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets.

Message #

Completed performance policy operation '%6' on switch %2 (Friendly Name: %4) DropLowResourcesPackets - %5

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
DropLowResourcesPackets Boolean—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 263 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
InitializeNIC

Description

Miniport NIC (Friendly Name: ) is operating in sub-optimal RSC config. Please keep RSC IPv4 and IPv6 advanced properties in sync.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 263 — Miniport NIC NicName (Friendly Name: NicFName) is operating in sub-optimal RSC config.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
InitializeNIC

Description

Miniport NIC NicName (Friendly Name: NicFName) is operating in sub-optimal RSC config. Please keep RSC IPv4 and IPv6 advanced properties in sync.

Message #

Miniport NIC %2 (Friendly Name: %4) is operating in sub-optimal RSC config. Please keep RSC IPv4 and IPv6 advanced properties in sync.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 264 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Internal or External Port (Friendly Name: ) successfully created on switch (Friendly Name: ).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Event ID 264 — Internal or External Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Opcode
Info

Description

Internal or External Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Message #

Internal or External Port %2 (Friendly Name: %4) successfully created on switch %6 (Friendly Name: %8).

Fields #

NameDescription
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
Flags UInt32—
OwnerService UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 264,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.039872+00:00",
    "event_record_id": 2811,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "PortFNameLen": 46,
    "PortFName": "Host Vnic B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "Flags": 1,
    "OwnerService": 1
  },
  "message": ""
}

Event ID 265 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Traffic flow has been paused on external NIC of switch .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 265 — Traffic flow has been paused on external NIC NicFName of switch SwitchFName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Traffic flow has been paused on external NIC NicFName of switch SwitchFName.

Message #

Traffic flow has been paused on external NIC %8 of switch %4.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 266 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Traffic flow has been restarted on external NIC of switch .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 266 — Traffic flow has been restarted on external NIC NicFName of switch SwitchFName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Traffic flow has been restarted on external NIC NicFName of switch SwitchFName.

Message #

Traffic flow has been restarted on external NIC %8 of switch %4.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 267 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
Servicing

Description

IOCTL Operation completed with status in ms.

Fields #

NameDescription
IoctlCode UInt32—
ElapsedTime UInt64—
Status UInt32— NTSTATUS reference

Event ID 267 — IOCTL Operation IoctlCode completed with status Status in ElapsedTime ms.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
Servicing

Description

IOCTL Operation IoctlCode completed with status Status in ElapsedTime ms.

Message #

IOCTL Operation %1 completed with status %3 in %2 ms

Fields #

NameDescription
IoctlCode UInt32—
ElapsedTime UInt64—
Status UInt32— NTSTATUS reference

Event ID 268 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Task
Servicing

Description

Connectivity state changed to.

Fields #

NameDescription
ConnectivityState UInt32—

Event ID 268 — Connectivity state changed to ConnectivityState.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Task
Servicing

Description

Connectivity state changed to ConnectivityState.

Message #

Connectivity state changed to %1

Fields #

NameDescription
ConnectivityState UInt32—

Event ID 269 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to get Device VlanID Regkey for Physical NIC . vSwitch will be created on this Physical NIC without VlanID being inherited by HostVNic. Status =.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 269 — Failed to get Device VlanID Regkey for Physical NIC NicName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to get Device VlanID Regkey for Physical NIC NicName. vSwitch will be created on this Physical NIC without VlanID being inherited by HostVNic. Status = Status.

Message #

Failed to get Device VlanID Regkey for Physical NIC %3. vSwitch will be created on this Physical NIC without VlanID being inherited by HostVNic. Status = %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 270 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Traffic flow is pausing on external NIC of switch .

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 270 — Traffic flow is pausing on external NIC NicFName of switch SwitchFName.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Traffic flow is pausing on external NIC NicFName of switch SwitchFName.

Message #

Traffic flow is pausing on external NIC %8 of switch %4.

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 275 — Failed to handle status from extension stack sent to Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to handle status from extension stack sent to Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). StatusCode: UniqueEvent, Status: Status.

Message #

Failed to handle status from extension stack sent to Nic %3 (Friendly Name: %5) on port %7 (Friendly Name: %9) on switch %11 (Friendly Name: %13). StatusCode: %14, Status: %1

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
PortNameLen UInt32—
PortName UnicodeString—
PortFNameLen UInt32—
PortFName UnicodeString—
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
UniqueEvent UInt32—

Event ID 276 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Could not allocate virtual function for NIC (Friendly Name: ). Host to guest communication channel has not been established yet, status = .

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 276 — Could not allocate virtual function for NIC NicName (Friendly Name: NicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Could not allocate virtual function for NIC NicName (Friendly Name: NicFName). Host to guest communication channel has not been established yet, status = Status.

Message #

Could not allocate virtual function for NIC %3 (Friendly Name: %5). Host to guest communication channel has not been established yet, status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
UniqueEvent UInt32—

Event ID 277 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

vmswitch.sys build .., debug , official.

Fields #

NameDescription
BuildNumber UInt32—
BuildArch AnsiString—
BuildBranch AnsiString—
Debug Boolean—
Official Boolean—
Date AnsiString—
Time AnsiString—

Event ID 277 — vmswitch.

#
Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Level
Informational
Opcode
Info

Description

vmswitch.sys build BuildNumber.BuildArch.BuildBranch, debug Debug, official Official, Date Time.

Message #

vmswitch.sys build %1.%2.%3, debug %4, official %5, %6 %7

Fields #

NameDescription
BuildNumber UInt32—
BuildArch AnsiString—
BuildBranch AnsiString—
Debug Boolean—
Official Boolean—
Date AnsiString—
Time AnsiString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 277,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2023-11-06T06:25:41.472921+00:00",
    "event_record_id": 1686,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 336
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BuildNumber": 22621,
    "BuildArch": "amd64",
    "BuildBranch": "ni_release_svc_prod1",
    "Debug": false,
    "Official": true,
    "Date": "1",
    "Time": "1"
  },
  "message": ""
}

References #

Event ID 278 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NDK request for virtual NIC (Friendly Name: ) was disabled because the mapped NIC () is not the same as the requested mapped NIC (). Reason: .

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
MappedNicNameLen UInt32—
MappedNicNicName UnicodeString—
RequestedMappedNicFNameLen UInt32—
RequestedMappeNicFName UnicodeString—

Event ID 278 — NDK request for virtual NIC NicName (Friendly Name: NicFName) was disabled because the mapped NIC (MappedNicNicName) is not the same as the requested mapped NIC (RequestedMappeNicFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

NDK request for virtual NIC NicName (Friendly Name: NicFName) was disabled because the mapped NIC (MappedNicNicName) is not the same as the requested mapped NIC (RequestedMappeNicFName). Reason: FailReason.

Message #

NDK request for virtual NIC %3 (Friendly Name: %5) was disabled because the mapped NIC (%7) is not the same as the requested mapped NIC (%9). Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
MappedNicNameLen UInt32—
MappedNicNicName UnicodeString—
RequestedMappedNicFNameLen UInt32—
RequestedMappeNicFName UnicodeString—

Event ID 279 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

NDK request for virtual NIC (Friendly Name: ) was re-enabled after being disabled on failover. Reason: .

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
MappedNicNameLen UInt32—
MappedNicNicName UnicodeString—
RequestedMappedNicFNameLen UInt32—
RequestedMappeNicFName UnicodeString—

Event ID 279 — NDK request for virtual NIC NicName (Friendly Name: NicFName) was re-enabled after being disabled on failover.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

NDK request for virtual NIC NicName (Friendly Name: NicFName) was re-enabled after being disabled on failover. Reason: FailReason.

Message #

NDK request for virtual NIC %3 (Friendly Name: %5) was re-enabled after being disabled on failover. Reason: %1.

Fields #

NameDescription
FailReason UInt32—
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
MappedNicNameLen UInt32—
MappedNicNicName UnicodeString—
RequestedMappedNicFNameLen UInt32—
RequestedMappeNicFName UnicodeString—

Event ID 280 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

VMS Utilization Plan Vport QueuePairs adjusted from requested number () to actual (). Reason: NIC Name: (Friendly Name: ).

Fields #

NameDescription
Status UInt32— NTSTATUS reference
RequestedNumberOfQueue UInt32—
AdjustedNumberOfQueue UInt32—
Reason UInt32—
NicName UnicodeString—
NicFriendlyName UnicodeString—

Event ID 280 — VMS Utilization Plan Vport QueuePairs adjusted from requested number (RequestedNumberOfQueue) to actual (AdjustedNumberOfQueue).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

VMS Utilization Plan Vport QueuePairs adjusted from requested number (RequestedNumberOfQueue) to actual (AdjustedNumberOfQueue). Reason: Reason NIC Name: NicName (Friendly Name: NicFriendlyName).

Message #

VMS Utilization Plan Vport QueuePairs adjusted from requested number (%2) to actual (%3). Reason: %4 NIC Name: %5 (Friendly Name: %6).

Fields #

NameDescription
Status UInt32— NTSTATUS reference
RequestedNumberOfQueue UInt32—
AdjustedNumberOfQueue UInt32—
Reason UInt32—
NicName UnicodeString—
NicFriendlyName UnicodeString—

Event ID 281 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

VMS Utilization Plan Vport QueuePairs failure. Reason: Status: . NIC Name: (Friendly Name: ).

Fields #

NameDescription
Status UInt32— NTSTATUS reference
RequestedNumberOfQueue UInt32—
AdjustedNumberOfQueue UInt32—
Reason UInt32—
NicName UnicodeString—
NicFriendlyName UnicodeString—

Event ID 281 — VMS Utilization Plan Vport QueuePairs failure.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

VMS Utilization Plan Vport QueuePairs failure. Reason: Reason Status: Status. NIC Name: NicName (Friendly Name: NicFriendlyName).

Message #

VMS Utilization Plan Vport QueuePairs failure. Reason: %4 Status: %1. NIC Name: %5 (Friendly Name: %6).

Fields #

NameDescription
Status UInt32— NTSTATUS reference
RequestedNumberOfQueue UInt32—
AdjustedNumberOfQueue UInt32—
Reason UInt32—
NicName UnicodeString—
NicFriendlyName UnicodeString—

Event ID 282 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to find a VMBus Channel in servicing state for VM Nic (Name: ). VMS Servicing State: , Channel Servicing State: . A fresh channel created.

Fields #

NameDescription
NicName UnicodeString—
VMSServicingState Boolean—
ChannelServicingState Boolean—

Event ID 282 — Failed to find a VMBus Channel in servicing state for VM Nic (Name: NicName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to find a VMBus Channel in servicing state for VM Nic (Name: NicName). VMS Servicing State: VMSServicingState, Channel Servicing State: ChannelServicingState. A fresh channel created.

Message #

Failed to find a VMBus Channel in servicing state for VM Nic (Name: %1). VMS Servicing State: %2, Channel Servicing State: %3. A fresh channel created.

Fields #

NameDescription
NicName UnicodeString—
VMSServicingState Boolean—
ChannelServicingState Boolean—

Event ID 283 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Failed to complete extension policy operation 'FailReason' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack, RequiredExtensionCount - RequiredExtensionCount Reason - FailReason, Status = Status.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ByPassExtensionStack Boolean—
RequiredExtensionCount UInt64—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 283 — Failed to complete extension policy operation 'FailReason' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack, RequiredExtensionCount - RequiredExtensionC...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Failed to complete extension policy operation 'FailReason' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack, RequiredExtensionCount - RequiredExtensionCount Reason - FailReason, Status = Status.

Message #

Failed to complete extension policy operation '%8' on switch %3 (Friendly Name: %5) ByPassExtensionStack - %6,  RequiredExtensionCount - %7 Reason - %8, Status = %1.

Fields #

NameDescription
Status UInt32— NTSTATUS reference
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ByPassExtensionStack Boolean—
RequiredExtensionCount UInt64—
FailReason UInt32—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 284 — Completed extension policy operation 'RequiredExtensionCount' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack RequiredExtensionCount - RequiredExtensio...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Completed extension policy operation 'RequiredExtensionCount' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack RequiredExtensionCount - RequiredExtensionCount.

Message #

Completed extension policy operation '%6' on switch %2 (Friendly Name: %4) ByPassExtensionStack - %5 RequiredExtensionCount - %6

Fields #

NameDescription
SwitchNameLen UInt32—
SwitchName UnicodeString—
SwitchFNameLen UInt32—
SwitchFName UnicodeString—
ByPassExtensionStack Boolean—
RequiredExtensionCount UInt64—
Operation UInt32—
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.

Event ID 285 — V-Switch operation OperationName (OperationId) took too long to complete.

#
Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Microsoft-Windows-Hyper-V-VmSwitch-Operational
Level
Warning
Opcode
Info

Description

V-Switch operation () took too long to complete. Operation Type: . Execution time ms. Queued time ms. Expected execution time less than ms. . .

Message #

V-Switch operation %1 (%3) took too long to complete. Operation Type: %2. Execution time %4 ms. Queued time %5 ms. Expected execution time less than %6 ms. %7 %8. %9 %10. %11 %12

Fields #

NameDescription
OperationName UnicodeString—
OperationType UInt32—
Known values
%%1904
New registry value created
%%1905
Existing registry value modified
%%1906
Registry value deleted
%%14674
Value Added
%%14675
Value Deleted
%%14680
Value Added With Expiration Time
%%14681
Value Deleted With Expiration Time
%%14688
Value Auto Deleted With Expiration Time
OperationId UInt32—
ExecutionTimeMS UInt64—
QueuedTimeMS UInt64—
SLAThresholdMS UInt64—
ContextType1 UInt32—
ContextInfo1 UnicodeString—
ContextType2 UInt32—
ContextInfo2 UnicodeString—
ContextType3 UInt32—
ContextInfo3 UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 285,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388032,
    "time_created": "2023-11-06T06:25:41.954437+00:00",
    "event_record_id": 32,
    "correlation": {},
    "execution": {
      "process_id": 2420,
      "thread_id": 2508
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "OperationName": "IOCTL_ENUM_VMQ_PROC_COUNT",
    "OperationType": 1,
    "OperationId": 2236540,
    "ExecutionTimeMS": 0,
    "QueuedTimeMS": 0,
    "SLAThresholdMS": 0,
    "ContextType1": 0,
    "ContextInfo1": " ",
    "ContextType2": 0,
    "ContextInfo2": " ",
    "ContextType3": 0,
    "ContextInfo3": " "
  },
  "message": ""
}

References #

Event ID 286 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Temporarily disable logging for event(s) of NIC (Friendly Name: ) for the next ms due to excessive number of instances within the past ms.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
LogRateLimitEventId UInt32—
DetectionDuration UInt32—
ProtectionDuration UInt32—
SkippedLogCount UInt32—

Event ID 286 — Temporarily disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past %...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Temporarily disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past DetectionDuration ms.

Message #

Temporarily disable logging for event(s) %5 of NIC %2 (Friendly Name: %4) for the next %7 ms due to excessive number of instances within the past %6 ms.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
LogRateLimitEventId UInt32—
DetectionDuration UInt32—
ProtectionDuration UInt32—
SkippedLogCount UInt32—

Event ID 287 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Extending disable logging for event(s) of NIC (Friendly Name: ) for the next ms due to excessive number of instances within the past ms. logs skipped since protection was enabled.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
LogRateLimitEventId UInt32—
DetectionDuration UInt32—
ProtectionDuration UInt32—
SkippedLogCount UInt32—

Event ID 287 — Extending disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past Detection...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Extending disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past DetectionDuration ms. SkippedLogCount logs skipped since protection was enabled.

Message #

Extending disable logging for event(s) %5 of NIC %2 (Friendly Name: %4) for the next %7 ms due to excessive number of instances within the past %6 ms. %8 logs skipped since protection was enabled.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
LogRateLimitEventId UInt32—
DetectionDuration UInt32—
ProtectionDuration UInt32—
SkippedLogCount UInt32—

Event ID 288 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Virtual function for NIC (Friendly Name: ) successfully allocated.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 288 — Virtual function for NIC NicName (Friendly Name: NicFName) successfully allocated.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Virtual function for NIC NicName (Friendly Name: NicFName) successfully allocated.

Message #

Virtual function for NIC %2 (Friendly Name: %4) successfully allocated.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—

Event ID 289 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch VF data path for NIC (Friendly Name: ) failed with status = , UniqueEvent = . VFDataPathActive = .

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
VFDataPathActive Boolean—
Status UInt32— NTSTATUS reference
UniqueEvent UInt32—

Event ID 289 — Switch VF data path for NIC NicName (Friendly Name: NicFName) failed with status = Status, UniqueEvent = UniqueEvent.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Switch VF data path for NIC NicName (Friendly Name: NicFName) failed with status = Status, UniqueEvent = UniqueEvent. VFDataPathActive = VFDataPathActive.

Message #

Switch VF data path for NIC %2 (Friendly Name: %4) failed with status = %6, UniqueEvent = %7. VFDataPathActive = %5.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
VFDataPathActive Boolean—
Status UInt32— NTSTATUS reference
UniqueEvent UInt32—

Event ID 290 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational
Opcode
Info

Description

Switch VF data path for NIC (Friendly Name: ) succeeded. VFDataPathActive = .

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
VFDataPathActive Boolean—
Status UInt32— NTSTATUS reference
UniqueEvent UInt32—

Event ID 290 — Switch VF data path for NIC NicName (Friendly Name: NicFName) succeeded.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System
Opcode
Info

Description

Switch VF data path for NIC NicName (Friendly Name: NicFName) succeeded. VFDataPathActive = VFDataPathActive.

Message #

Switch VF data path for NIC %2 (Friendly Name: %4) succeeded. VFDataPathActive = %5.

Fields #

NameDescription
NicNameLen UInt32—
NicName UnicodeString—
NicFNameLen UInt32—
NicFName UnicodeString—
VFDataPathActive Boolean—
Status UInt32— NTSTATUS reference
UniqueEvent UInt32—

Event ID 291 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

RSC offload modified for NIC (Friendly Name: ) Previous IPv4: , Current IPv4: , Previous IPv6: , Current IPv6: . Reason.

Fields #

NameDescription
NicName UnicodeString—
NicFName UnicodeString—
OldNicIPv4RscEnabled UInt32—
OldNicIPv6RscEnabled UInt32—
NewNicIPv4RscEnabled UInt32—
NewNicIPv6RscEnabled UInt32—
RscStateModifiedReason UInt32—

Event ID 291 — RSC offload modified for NIC NicName (Friendly Name: NicFName) Previous IPv4: OldNicIPv4RscEnabled, Current IPv4: NewNicIPv4RscEnabled, Previous IPv6: OldNicIPv6RscEnabled, Current IPv6: NewNicIPv6...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

RSC offload modified for NIC NicName (Friendly Name: NicFName) Previous IPv4: OldNicIPv4RscEnabled, Current IPv4: NewNicIPv4RscEnabled, Previous IPv6: OldNicIPv6RscEnabled, Current IPv6: NewNicIPv6RscEnabled. Reason: RscStateModifiedReason.

Message #

RSC offload modified for NIC %1 (Friendly Name: %2) Previous IPv4: %3, Current IPv4: %5, Previous IPv6: %4, Current IPv6: %6. Reason: %7

Fields #

NameDescription
NicName UnicodeString—
NicFName UnicodeString—
OldNicIPv4RscEnabled UInt32—
OldNicIPv6RscEnabled UInt32—
NewNicIPv4RscEnabled UInt32—
NewNicIPv6RscEnabled UInt32—
RscStateModifiedReason UInt32—

Event ID 292 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

RSC offload modified for Port (Friendly Name: ) Previous: , Current: . Reason.

Fields #

NameDescription
PortName UnicodeString—
PortFName UnicodeString—
OldPortRscEnabled UInt32—
NewPortRscEnabled UInt32—
RscStateModifiedReason UInt32—

Event ID 292 — RSC offload modified for Port PortName (Friendly Name: PortFName) Previous: OldPortRscEnabled, Current: NewPortRscEnabled.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

RSC offload modified for Port PortName (Friendly Name: PortFName) Previous: OldPortRscEnabled, Current: NewPortRscEnabled. Reason: RscStateModifiedReason.

Message #

RSC offload modified for Port %1 (Friendly Name: %2) Previous: %3, Current: %4. Reason: %5

Fields #

NameDescription
PortName UnicodeString—
PortFName UnicodeString—
OldPortRscEnabled UInt32—
NewPortRscEnabled UInt32—
RscStateModifiedReason UInt32—

Event ID 293 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

VF assignment for Port (Friendly Name: ). Reason.

Fields #

NameDescription
PortName UnicodeString—
PortFName UnicodeString—
SwitchName UnicodeString—
SwitchFName UnicodeString—
ChangeStateTo UInt32—
Reason UInt32—

Event ID 293 — VF assignment ChangeStateTo for Port PortName (Friendly Name: PortFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

VF assignment ChangeStateTo for Port PortName (Friendly Name: PortFName). Reason: Reason.

Message #

VF assignment %5 for Port %1 (Friendly Name: %2). Reason: %6

Fields #

NameDescription
PortName UnicodeString—
PortFName UnicodeString—
SwitchName UnicodeString—
SwitchFName UnicodeString—
ChangeStateTo UInt32—
Reason UInt32—

Event ID 294 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

Found L1VH VM NIC that has matched MacAddress , connected to port (Friendly Name: ) on switch (Friendly Name: ). The VM Nic is (Friendly Name: ).

Fields #

NameDescription
SwitchName UnicodeString—
SwitchFName UnicodeString—
MacAddress UnicodeString—
PortName UnicodeString—
PortFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—

Event ID 294 — Found L1VH VM NIC that has matched MacAddress MacAddress, connected to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

Found L1VH VM NIC that has matched MacAddress MacAddress, connected to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). The VM Nic is NicName (Friendly Name: NicFName).

Message #

Found L1VH VM NIC that has matched MacAddress %3, connected to port %4 (Friendly Name: %5) on switch %1 (Friendly Name: %2). The VM Nic is %6 (Friendly Name: %7).

Fields #

NameDescription
SwitchName UnicodeString—
SwitchFName UnicodeString—
MacAddress UnicodeString—
PortName UnicodeString—
PortFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—

Event ID 295 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

No L1VH VM NIC found that has matched MacAddress on switch (Friendly Name: ).

Fields #

NameDescription
SwitchName UnicodeString—
SwitchFName UnicodeString—
MacAddress UnicodeString—
PortName UnicodeString—
PortFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—

Event ID 295 — No L1VH VM NIC found that has matched MacAddress MacAddress on switch SwitchName (Friendly Name: SwitchFName).

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

No L1VH VM NIC found that has matched MacAddress MacAddress on switch SwitchName (Friendly Name: SwitchFName).

Message #

No L1VH VM NIC found that has matched MacAddress %3 on switch %1 (Friendly Name: %2).

Fields #

NameDescription
SwitchName UnicodeString—
SwitchFName UnicodeString—
MacAddress UnicodeString—
PortName UnicodeString—
PortFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—

Event ID 296 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 296 — NIC Switch creation failed on the first member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming: EmbeddedTeaming sta...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Message #

NIC Switch creation failed on the first member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7. Consequently, NIC Switch/VMQ offloads will be entirely disabled on that Team and vSwitch. Please investigate as it can cause performance issues.

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 297 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 297 — NIC Switch creation failed on the member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming: EmbeddedTeaming status = Sta...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Message #

NIC Switch creation failed on the member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7. Consequently, this member adapter has been evicted from the Team. Please investigate as it can cause fault tolerance and performance issues.

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 298 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 298 — NIC Switch appears to be not supported on the first member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTea...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Message #

NIC Switch appears to be not supported on the first member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7. Consequently, NIC Switch/VMQ offloads will be entirely disabled on that Team and vSwitch. Please investigate as it can cause performance issues.

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 299 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 299 — NIC Switch appears to be not supported on this member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming:...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Message #

NIC Switch appears to be not supported on this member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7. Consequently, this member adapter has been evicted from the Team. Please investigate as it can cause fault tolerance and performance issues.

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 300 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 300 — Nic Switch assymetric capabilities or configuration detected between the first member adapter and that member adapter SwitchName (Friendly Name: SwitchFName) NicInd...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Message #

Nic Switch assymetric capabilities or configuration detected between the first member adapter and that member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7.

Fields #

NameDescription
EmbeddedTeaming Boolean—
NicIndex UInt32—
SwitchName UnicodeString—
SwitchFName UnicodeString—
NicName UnicodeString—
NicFName UnicodeString—
Status UInt32— NTSTATUS reference

Event ID 301 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Fields #

NameDescription
NewNumTotalMacAddresses UInt32—
OldNumTotalMacAddresses UInt32—
NewMaxNumVFs UInt32—
OldMaxNumVFs UInt32—
DefaultNicSwitchCreated Boolean—
NicObjectHeaderState UInt32—

Event ID 301 — Processing NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES status indication: new NumTotalMacAddresses = NewNumTotalMacAddresses, previous NumTotalMacAddresses = OldNumTotalMacAddresses, new Ma...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Message #

Processing NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES status indication: new NumTotalMacAddresses = %1, previous NumTotalMacAddresses = %2, new MaxNumVFs = %3, previous MaxNumVFs = %4, DefaultNicSwitchCreated = %5, NicState = %6.

Fields #

NameDescription
NewNumTotalMacAddresses UInt32—
OldNumTotalMacAddresses UInt32—
NewMaxNumVFs UInt32—
OldMaxNumVFs UInt32—
DefaultNicSwitchCreated Boolean—
NicObjectHeaderState UInt32—

Event ID 302 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: , IovUsage: , previous MaxNumVFs = , new MaxNumVFs = , FoundMatchedNic = , VFAssignedOrRevoked = .

Fields #

NameDescription
SwitchFriendlyName UnicodeString—
IovUsage Boolean—
OldMaxNumVFs Int32—
NewMaxNumVFs Int32—
FoundMatchedNic Boolean—
VFNeedToBeAssignedOrRevoked Boolean—

Event ID 302 — Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, previous MaxNumVFs = OldMaxNumVFs, new MaxNumVFs = NewMaxNumVFs, FoundM...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, previous MaxNumVFs = OldMaxNumVFs, new MaxNumVFs = NewMaxNumVFs, FoundMatchedNic = FoundMatchedNic, VFAssignedOrRevoked = VFNeedToBeAssignedOrRevoked.

Message #

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: %1, IovUsage: %2, previous MaxNumVFs = %3, new MaxNumVFs = %4, FoundMatchedNic = %5, VFAssignedOrRevoked = %6.

Fields #

NameDescription
SwitchFriendlyName UnicodeString—
IovUsage Boolean—
OldMaxNumVFs Int32—
NewMaxNumVFs Int32—
FoundMatchedNic Boolean—
VFNeedToBeAssignedOrRevoked Boolean—

Event ID 303 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = , previous MaxNumVFs = , status: .

Fields #

NameDescription
NewMaxNumVFs UInt32—
OldMaxNumVFs UInt32—
NdisStatus Int32—

Event ID 303 — Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = NewMaxNumVFs, previous MaxNumVFs = OldMaxNumVFs, status: NdisStatus.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = NewMaxNumVFs, previous MaxNumVFs = OldMaxNumVFs, status: NdisStatus.

Message #

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = %1, previous MaxNumVFs = %2, status: %3.

Fields #

NameDescription
NewMaxNumVFs UInt32—
OldMaxNumVFs UInt32—
NdisStatus Int32—

Event ID 304 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = , NewSriovSupport = , FoundMatchedNic = , DefaultNicSwitchCreated = .

Fields #

NameDescription
SwitchFriendlyName UnicodeString—
OldSriovSupport Boolean—
NewSriovSupport Boolean—
FoundMatchedNic Boolean—
DefaultNicSwitchCreated Boolean—

Event ID 304 — Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = SwitchFriendlyName, NewSriovSupport = OldSriovSupport, FoundMatchedNic = NewSriovSupport, DefaultNicSwitchCreated...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = SwitchFriendlyName, NewSriovSupport = OldSriovSupport, FoundMatchedNic = NewSriovSupport, DefaultNicSwitchCreated = FoundMatchedNic.

Message #

Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = %1, NewSriovSupport = %2, FoundMatchedNic = %3, DefaultNicSwitchCreated = %4.

Fields #

NameDescription
SwitchFriendlyName UnicodeString—
OldSriovSupport Boolean—
NewSriovSupport Boolean—
FoundMatchedNic Boolean—
DefaultNicSwitchCreated Boolean—

Event ID 305 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: , NewSriovSupport: .

Fields #

NameDescription
OldSriovSupport UInt32—
NewSriovSupport UInt32—

Event ID 305 — Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: OldSriovSupport, NewSriovSupport: NewSriovSupport.

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: OldSriovSupport, NewSriovSupport: NewSriovSupport.

Message #

Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: %1, NewSriovSupport: %2.

Fields #

NameDescription
OldSriovSupport UInt32—
NewSriovSupport UInt32—

Event ID 306 —

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
Operational

Description

WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: , IovUsage: , FoundMatchedNic = , VFDataPathReady = , VFDataPathActive = .

Fields #

NameDescription
SwitchFriendlyName UnicodeString—
IovUsage Boolean—
FoundMatchedNic Boolean—
VFDataPathReady Boolean—
VFDataPathActive Boolean—

Event ID 306 — WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, FoundMatchedNic = FoundMatchedNic, VFDataPathReady = VFDataPathReady, VFDataPathActive = VFDataPathAct...

Provider
Microsoft-Windows-Hyper-V-VmSwitch
Channel
System

Description

WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, FoundMatchedNic = FoundMatchedNic, VFDataPathReady = VFDataPathReady, VFDataPathActive = VFDataPathActive.

Message #

WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: %1, IovUsage: %2, FoundMatchedNic = %3, VFDataPathReady = %4, VFDataPathActive = %5.

Fields #

NameDescription
SwitchFriendlyName UnicodeString—
IovUsage Boolean—
FoundMatchedNic Boolean—
VFDataPathReady Boolean—
VFDataPathActive Boolean—