Microsoft-Windows-VHDMP

84 events across 2 channels

Event ID	Title	Channel
1	The VHD %1 has come online (surfaced) as disk number %2.	Microsoft-Windows-VHDMP-Operational
2	The VHD %1 has been removed (unsurfaced) as disk number %2.	Microsoft-Windows-VHDMP-Operational
3	Failed to surface VHD %1.	Microsoft-Windows-VHDMP-Operational
4	Failed to surface VHD %1.	Microsoft-Windows-VHDMP-Operational
5	Failed to %1 VHD %2.	Microsoft-Windows-VHDMP-Operational
6	Operation failed on VHD %2.	Microsoft-Windows-VHDMP-Operational
7	The Vhd Chain for VHD %4 is corrupted.	Microsoft-Windows-VHDMP-Operational
8	The change tracking file for VHD %1 is corrupted and cannot be read.	Microsoft-Windows-VHDMP-Operational
9	The VHD file %1 has been modified without updating its associated change …	Microsoft-Windows-VHDMP-Operational
10	Error %2 occured when attempting to update the change tracking file for VHD %1.	Microsoft-Windows-VHDMP-Operational
11	Surface for VHD %2 is invalidated and will be removed (unsurfaced) because of a …	Microsoft-Windows-VHDMP-Operational
12	Handle for virtual disk '.	Microsoft-Windows-VHDMP-Operational
13	Failed to create handle for virtual disk '.	Microsoft-Windows-VHDMP-Operational
14	Virtual disk handle closed: HandleContext = %1, VirtualDisk = %2.	Microsoft-Windows-VHDMP-Operational
15	Virtual disk object created.	Microsoft-Windows-VHDMP-Operational
16	Virtual disk object destroyed.	Microsoft-Windows-VHDMP-Operational
17	Virtual disk '.	Microsoft-Windows-VHDMP-Operational
18	Virtual disk '.	Microsoft-Windows-VHDMP-Operational
19	The VHD %1 has come online (surfaced) as disk number %2.	Microsoft-Windows-VHDMP-Operational
20	The VHD %1 has been removed (unsurfaced) as disk number %2.	Microsoft-Windows-VHDMP-Operational
21	Starting to open handle for virtual disk.	Microsoft-Windows-VHDMP-Operational
22	Starting to create the handle for the file backing virtual disk '.	Microsoft-Windows-VHDMP-Operational
23	Handle for the file backing virtual disk '.	Microsoft-Windows-VHDMP-Operational
24	Failed to create handle for the file backing virtual disk '.	Microsoft-Windows-VHDMP-Operational
25	Beginning to bring the VHD %1 online (surface).	Microsoft-Windows-VHDMP-Operational
26	Beginning to remove the VHD %1 (unsurface).	Microsoft-Windows-VHDMP-Operational
27	Starting to close the handle for the file backing virtual disk '.	Microsoft-Windows-VHDMP-Operational
28	Handle for the file backing virtual disk '.	Microsoft-Windows-VHDMP-Operational
29	Operation failed on VHD %2.	Microsoft-Windows-VHDMP-Operational
30	Starting to close virtual disk handle: HandleContext = %1, VirtualDisk = %2.	Microsoft-Windows-VHDMP-Operational
31	Starting to cleanup the backing store for virtual disk '.	Microsoft-Windows-VHDMP-Operational
32	Finished cleaning up the backing store for virtual disk '.	Microsoft-Windows-VHDMP-Operational
33	Starting to flush the backing store footer for virtual disk '.	Microsoft-Windows-VHDMP-Operational
34	Finished flushing the backing store footer for virtual disk '.	Microsoft-Windows-VHDMP-Operational
35	Virtual disk '.	Microsoft-Windows-VHDMP-Operational
36	I/O cancellation (FastClose) started for file '.	Microsoft-Windows-VHDMP-Operational
50	Performing %1 VHD for %2 (target '%3').	Microsoft-Windows-VHDMP-Operational
51	Successfully performed %1 VHD %2.	Microsoft-Windows-VHDMP-Operational
100	Vhd resiliency initiated for %1 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
101	Vhd resiliency successfully recovered %1 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
102	Vhd resiliency failed to recover %1 (VM ID: %2) with error %3.	Microsoft-Windows-VHDMP-Operational
110	Recovery initiated for %1 (VM ID: %2) due to an IO failure with error %3.	Microsoft-Windows-VHDMP-Operational
111	Recovery succeeded for %1 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
112	Recovery failed for %1 (VM ID: %2) with error %3.	Microsoft-Windows-VHDMP-Operational
113	File %1 is invalidated (VM ID: %2) from current mode %3 with error %4.	Microsoft-Windows-VHDMP-Operational
114	Waiting on file (%4) recovery for %1 (VM ID: %2) due to an IO failure with error …	Microsoft-Windows-VHDMP-Operational
115	Waiting on file (%4) recovery for %1 (VM ID: %2) completed with status %3.	Microsoft-Windows-VHDMP-Operational
116	File (%3) recovery succeeded for %1 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
117	File (%4) recovery failed for %1 (VM ID: %2) with error %3.	Microsoft-Windows-VHDMP-Operational
118	Failed to open file %1 with error %3.	Microsoft-Windows-VHDMP-Operational
119	File %1 has been closed before initiating a recovery attempt.	Microsoft-Windows-VHDMP-Operational
120	Recovery attempt initiated for virtual disk %1 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
121	Recovery attempt completed successfully for virtual disk %1 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
122	Recovery attempt for virtual disk %1 failed with status %3 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
123	Reopening handles to file %1 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
124	Waiting for handles to file %1 to be reactivated (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
125	Recovery attempt completed for file %1 with status %3 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
126	I/O failed with status %3 on file %1 (VM ID: %2).	Microsoft-Windows-VHDMP-Operational
208	Change Tracking has been enabled for the VHD %1 (%2) with log file %3.	Microsoft-Windows-VHDMP-Operational
209	Change Tracking has been disabled for the VHD %1 (%2).	Microsoft-Windows-VHDMP-Operational
210	Change Tracking for the VHD %1 to the log file %2 has been stopped due to the …	Microsoft-Windows-VHDMP-Operational
211	Flushing of the header of the log file %1 has failed due to error %2.	Microsoft-Windows-VHDMP-Operational
212	Flushing of the buffers to the log file %1 has failed due to error %2.	Microsoft-Windows-VHDMP-Operational
213	Opening the log file %1 for tracking has failed due to error %2.	Microsoft-Windows-VHDMP-Operational
214	Offline changes are detected for VHD %2.	Microsoft-Windows-VHDMP-Operational
215	No configurations were found for CtLogPerfOpts; Using default [.	Microsoft-Windows-VHDMP-Operational
216	CtLogPerfOpts is set to CtLogPerfOptNoChange [.	Microsoft-Windows-VHDMP-Operational
217	CtLogPerfOpts is set to CtLogPerfOptDisableWriteThrough [.	Microsoft-Windows-VHDMP-Operational
218	CtLogPerfOpts is set to [.	Microsoft-Windows-VHDMP-Operational
219	CtLogPerfOpts is set to [.	Microsoft-Windows-VHDMP-Operational
220	Expected conf value for CtMinMasterBufferSize not found using default [.	Microsoft-Windows-VHDMP-Operational
221	Expected conf value for CtMaxDirtyMemThresholdPercent not found using default [.	Microsoft-Windows-VHDMP-Operational
222	Expected conf value for CtMaxFlushBufferSize not found using default [.	Microsoft-Windows-VHDMP-Operational
223	Using following values [.	Microsoft-Windows-VHDMP-Operational
224	CtLogPerfOpts is set to [.	Microsoft-Windows-VHDMP-Operational
300	IO latency summary: Virtual disk: %1 IO type: %2 Interval duration: %3 Max …	Microsoft-Windows-VHDMP-Operational
301	IO latency summary: Virtual disk: %1 IO type: %2 Interval duration: %3 Max …	Microsoft-Windows-VHDMP-Operational
302	An IO took more than %2 ms to complete: Virtual disk: %1 IO Type: %4 IO Size: %5 …	Microsoft-Windows-VHDMP-Operational
303	An IO took more than %2 ms to complete: Virtual disk: %1 IO Type: %4 Latency: %5 …	Microsoft-Windows-VHDMP-Operational
304	A persistent reservation IO took more than %2 ms to complete: Virtual disk: %1 …	Microsoft-Windows-VHDMP-Operational
1001	Starting an IO.	Microsoft-Windows-VHDMP-Analytic
1002	Completing an IO.	Microsoft-Windows-VHDMP-Analytic
1010	A %4 %3 IO to %1 (VM ID: %2) failed with error %7.	Microsoft-Windows-VHDMP-Analytic
1011	A %4 %3 IO to %1 (VM ID: %2) failed with error %7.	Microsoft-Windows-VHDMP-Analytic

Event ID 1 — The VHD %1 has come online (surfaced) as disk number %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

The VHD %1 has come online (surfaced) as disk number %2.

Fields

Name	Description
`VhdFileName`	—
`VhdDiskNumber`	—
`VirtualDisk`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 1
  version: 0
  level: 4
  task: 1205
  opcode: 2
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:49:36.935694+00:00'
  event_record_id: 43
  correlation: {}
  execution:
    process_id: 4
    thread_id: 252
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-18
event_data:
  VhdFileName: C:\Users\Administrator\windows.iso
  VhdDiskNumber: 2
  VirtualDisk: '0xffffb5031d1c0040'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2 — The VHD %1 has been removed (unsurfaced) as disk number %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

The VHD %1 has been removed (unsurfaced) as disk number %2.

Fields

Name	Description
`VhdFileName`	—
`VhdDiskNumber`	—
`VirtualDisk`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 2
  version: 0
  level: 4
  task: 1206
  opcode: 2
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:06.004748+00:00'
  event_record_id: 104
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VhdFileName: C:\Users\Administrator\windows.iso
  VhdDiskNumber: 2
  VirtualDisk: '0xffffb5031d1c0040'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3 — Failed to surface VHD %1.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Failed to surface VHD %1. Error status %2.

Fields

Name	Description
`VhdFileName`	—
`Status`	—
`VirtualDisk`	—

Event ID 4 — Failed to surface VHD %1.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Failed to surface VHD %1. Surface attempt was cancelled.

Fields

Name	Description
`VhdFileName`	—
`VirtualDisk`	—

Event ID 5 — Failed to %1 VHD %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Failed to %1 VHD %2. Error status %3.

Fields

Name	Description
`VhdMetaOps`	—
`VhdFileName`	—
`Status`	—

Event ID 6 — Operation failed on VHD %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Operation failed on VHD %2. Operation type %1. Error status %3.

Fields

Name	Description
`VhdIoType`	—
`VhdFileName`	—
`Status`	—

Event ID 7 — The Vhd Chain for VHD %4 is corrupted.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

The Vhd Chain for VHD %4 is corrupted. The expected LastWriteGUID %2 (%3) did not match the parent's actual LastWriteGUID (%1).

Fields

Name	Description
`ParentLastWriteGUID`	—
`ExpectedParentLastWriteGUID1`	—
`ExpectedParentLastWriteGUID2`	—
`VhdFileName`	—

Event ID 8 — The change tracking file for VHD %1 is corrupted and cannot be read.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

The change tracking file for VHD %1 is corrupted and cannot be read. No change tracking information will be available for this VHD, and change tracking will need to be enabled again before changed are tracked.

Fields

Name	Description
`VhdFileName`	—
`CorruptionReason`	—

Event ID 9 — The VHD file %1 has been modified without updating its associated change tracking file.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

The VHD file %1 has been modified without updating its associated change tracking file. Because the consistency of the change tracking information cannot be ensured, the change tracking data has been reset. No change tracking information will be available for this VHD, and change tracking will need to be enabled again before changed are tracked.

Fields

Name	Description
`VhdFileName`	—

Event ID 10 — Error %2 occured when attempting to update the change tracking file for VHD %1.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Error %2 occured when attempting to update the change tracking file for VHD %1. This will invalidate the file's change tracking information. Change tracking will not be available for this VHD until change tracking is enabled again.

Fields

Name	Description
`VhdFileName`	—
`Status`	—

Event ID 11 — Surface for VHD %2 is invalidated and will be removed (unsurfaced) because of a %1 operation failure with status %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Surface for VHD %2 is invalidated and will be removed (unsurfaced) because of a %1 operation failure with status %3.

Fields

Name	Description
`VhdIoType`	—
`VhdFileName`	—
`Status`	—

Event ID 12 — Handle for virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Handle for virtual disk '%2' created successfully. VM ID = %3, Type = %4, Version = %5, Flags = %6, AccessMask = %7, WriteDepth = %8, GetInfoOnly = %9, ReadOnly = %10, HandleContext = %11, VirtualDisk = %12.

Fields

Name	Description
`Status`	—
`VhdFile`	—
`VmId`	—
`VhdType`	—
`Version`	—
`Flags`	—
`AccessMask`	—
`WriteDepth`	—
`GetInfoOnly`	—
`ReadOnly`	—
`HandleContext`	—
`VirtualDisk`	—
`FileObject`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 12
  version: 0
  level: 4
  task: 1201
  opcode: 2
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:06.006379+00:00'
  event_record_id: 118
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  Status: 0
  VhdFile: \\?\C:\Users\Administrator\windows.iso
  VmId: 00000000-0000-0000-0000-000000000000
  VhdType: 3
  Version: 1
  Flags: 0
  AccessMask: 851968
  WriteDepth: 1
  GetInfoOnly: false
  ReadOnly: false
  HandleContext: '0xffffb5031dcd2880'
  VirtualDisk: '0xffffb5031808f040'
  FileObject: '0xffffb5031dc4d5f0'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 13 — Failed to create handle for virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Failed to create handle for virtual disk '%2'. Status = %1, VM ID = %3, Type = %4, Version = %5, Flags = %6, AccessMask = %7, WriteDepth = %8, GetInfoOnly = %9, ReadOnly = %10, HandleContext = %11, VirtualDisk = %12.

Fields

Name	Description
`Status`	—
`VhdFile`	—
`VmId`	—
`VhdType`	—
`Version`	—
`Flags`	—
`AccessMask`	—
`WriteDepth`	—
`GetInfoOnly`	—
`ReadOnly`	—
`HandleContext`	—
`VirtualDisk`	—
`FileObject`	—

Event ID 14 — Virtual disk handle closed: HandleContext = %1, VirtualDisk = %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Virtual disk handle closed: HandleContext = %1, VirtualDisk = %2.

Fields

Name	Description
`HandleContext`	—
`VirtualDisk`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 14
  version: 0
  level: 4
  task: 1202
  opcode: 2
  keywords: 9223372036854775808
  time_created: '2023-10-25T22:51:06.008478+00:00'
  event_record_id: 132
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  HandleContext: '0xffffb50315628b00'
  VirtualDisk: '0xffffb50315a8f040'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 15 — Virtual disk object created.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Virtual disk object created: %1.

Fields

Name	Description
`VirtualDisk`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 15
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-10-25T22:51:06.005216+00:00'
  event_record_id: 111
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VirtualDisk: '0xffffb5031808f040'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 16 — Virtual disk object destroyed.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Virtual disk object destroyed: %1.

Fields

Name	Description
`VirtualDisk`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 16
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-10-25T22:51:06.008477+00:00'
  event_record_id: 131
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VirtualDisk: '0xffffb50315a8f040'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 17 — Virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Virtual disk '%1' (no host access) has been surfaced.

Fields

Name	Description
`VhdFileName`	—
`VhdDiskNumber`	—
`VirtualDisk`	—

Event ID 18 — Virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Virtual disk '%1' (no host access) has been unsurfaced.

Fields

Name	Description
`VhdFileName`	—
`VhdDiskNumber`	—
`VirtualDisk`	—

Event ID 19 — The VHD %1 has come online (surfaced) as disk number %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

The VHD %1 has come online (surfaced) as disk number %2.

Fields

Name	Description
`VhdFileName`	—
`VhdInstanceId`	—

Event ID 20 — The VHD %1 has been removed (unsurfaced) as disk number %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

The VHD %1 has been removed (unsurfaced) as disk number %2.

Fields

Name	Description
`VhdFileName`	—
`VhdInstanceId`	—

Event ID 21 — Starting to open handle for virtual disk.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Starting to open handle for virtual disk.

Fields

Name	Description
`FileObject`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 21
  version: 0
  level: 4
  task: 1201
  opcode: 1
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:06.005179+00:00'
  event_record_id: 110
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  FileObject: '0xffffb5031dc4d5f0'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 22 — Starting to create the handle for the file backing virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Starting to create the handle for the file backing virtual disk '%1'.

Fields

Name	Description
`VhdFileName`	—
`DesiredAccess`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 22
  version: 0
  level: 4
  task: 1203
  opcode: 1
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:06.005478+00:00'
  event_record_id: 116
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VhdFileName: C:\Users\Administrator\windows.iso
  DesiredAccess: 2148532224
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 23 — Handle for the file backing virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Handle for the file backing virtual disk '%1' created successfully.

Fields

Name	Description
`VhdFileName`	—
`Status`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 23
  version: 0
  level: 4
  task: 1203
  opcode: 2
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:06.005539+00:00'
  event_record_id: 117
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VhdFileName: C:\Users\Administrator\windows.iso
  Status: 0
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 24 — Failed to create handle for the file backing virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Failed to create handle for the file backing virtual disk '%1'. Status = %2.

Fields

Name	Description
`VhdFileName`	—
`Status`	—

Event ID 25 — Beginning to bring the VHD %1 online (surface).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Beginning to bring the VHD %1 online (surface).

Fields

Name	Description
`VhdFileName`	—
`VirtualDisk`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 25
  version: 0
  level: 4
  task: 1205
  opcode: 1
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:49:36.912522+00:00'
  event_record_id: 42
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6856
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VhdFileName: C:\Users\Administrator\windows.iso
  VirtualDisk: '0xffffb5031d1c0040'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 26 — Beginning to remove the VHD %1 (unsurface).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Beginning to remove the VHD %1 (unsurface).

Fields

Name	Description
`VirtualDisk`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 26
  version: 0
  level: 4
  task: 1206
  opcode: 1
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:05.979830+00:00'
  event_record_id: 103
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VirtualDisk: '0xffffb50315a8f040'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 27 — Starting to close the handle for the file backing virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Starting to close the handle for the file backing virtual disk '%1'.

Fields

Name	Description
`VhdFileName`	—
`DesiredAccess`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 27
  version: 0
  level: 4
  task: 1204
  opcode: 1
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:06.008290+00:00'
  event_record_id: 129
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VhdFileName: C:\Users\Administrator\windows.iso
  DesiredAccess: 0
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 28 — Handle for the file backing virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Handle for the file backing virtual disk '%1' closed successfully.

Fields

Name	Description
`VhdFileName`	—
`Status`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 28
  version: 0
  level: 4
  task: 1204
  opcode: 2
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:06.008317+00:00'
  event_record_id: 130
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  VhdFileName: C:\Users\Administrator\windows.iso
  Status: 0
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 29 — Operation failed on VHD %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Operation failed on VHD %2. Operation type %1. Error status %3.

Fields

Name	Description
`VhdIoType`	—
`VhdFileName`	—
`Status`	—

Event ID 30 — Starting to close virtual disk handle: HandleContext = %1, VirtualDisk = %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational
Level: 4
Samples: 1

Message

Starting to close virtual disk handle: HandleContext = %1, VirtualDisk = %2.

Fields

Name	Description
`HandleContext`	—
`VirtualDisk`	—

Example Event

system:
  provider: Microsoft-Windows-VHDMP
  guid: E2816346-87F4-4F85-95C3-0C79409AA89D
  event_source_name: ''
  event_id: 30
  version: 0
  level: 4
  task: 1202
  opcode: 2
  keywords: 9223372036854775809
  time_created: '2023-10-25T22:51:06.007100+00:00'
  event_record_id: 126
  correlation: {}
  execution:
    process_id: 4416
    thread_id: 6872
  channel: Microsoft-Windows-VHDMP-Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-21-2533829718-189860685-2477588761-500
event_data:
  HandleContext: '0xffffb50315628b00'
  VirtualDisk: '0xffffb50315a8f040'
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 31 — Starting to cleanup the backing store for virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Starting to cleanup the backing store for virtual disk '%1'.

Fields

Name	Description
`VhdFileName`	—

Event ID 32 — Finished cleaning up the backing store for virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Finished cleaning up the backing store for virtual disk '%1'.

Fields

Name	Description
`VhdFileName`	—

Event ID 33 — Starting to flush the backing store footer for virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Starting to flush the backing store footer for virtual disk '%1'.

Fields

Name	Description
`VhdFileName`	—

Event ID 34 — Finished flushing the backing store footer for virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Finished flushing the backing store footer for virtual disk '%1'.

Fields

Name	Description
`VhdFileName`	—

Event ID 35 — Virtual disk '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Virtual disk '%1' (no host access) has been unsurfaced with unflushed data. Data corruption is possible if the virtual disk is surfaced again.

Fields

Name	Description
`VhdFileName`	—
`VhdDiskNumber`	—
`VirtualDisk`	—

Event ID 36 — I/O cancellation (FastClose) started for file '.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

I/O cancellation (FastClose) started for file '%1'. (VM ID: %2)

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 50 — Performing %1 VHD for %2 (target '%3').

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Performing %1 VHD for %2 (target '%3').

Fields

Name	Description
`VhdMetaOps`	—
`VhdFileName`	—
`TargetVhdFileName`	—

Event ID 51 — Successfully performed %1 VHD %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Successfully performed %1 VHD %2.

Fields

Name	Description
`VhdMetaOps`	—
`VhdFileName`	—
`Status`	—

Event ID 100 — Vhd resiliency initiated for %1 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Vhd resiliency initiated for %1 (VM ID: %2). A %3 IO failed with error %4.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`VhdIoType`	—
`Status`	—

Event ID 101 — Vhd resiliency successfully recovered %1 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Vhd resiliency successfully recovered %1 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—

Event ID 102 — Vhd resiliency failed to recover %1 (VM ID: %2) with error %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Vhd resiliency failed to recover %1 (VM ID: %2) with error %3.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 110 — Recovery initiated for %1 (VM ID: %2) due to an IO failure with error %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Recovery initiated for %1 (VM ID: %2) due to an IO failure with error %3.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 111 — Recovery succeeded for %1 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Recovery succeeded for %1 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—

Event ID 112 — Recovery failed for %1 (VM ID: %2) with error %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Recovery failed for %1 (VM ID: %2) with error %3.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 113 — File %1 is invalidated (VM ID: %2) from current mode %3 with error %4.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

File %1 is invalidated (VM ID: %2) from current mode %3 with error %4. Any recovery in process will be failed and the virtual disk will be invalidated as well.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Mode`	—
`Status`	—

Event ID 114 — Waiting on file (%4) recovery for %1 (VM ID: %2) due to an IO failure with error %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Waiting on file (%4) recovery for %1 (VM ID: %2) due to an IO failure with error %3.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—
`RefType`	—
`Mode`	—
`PendingRecoveryCount`	—

Event ID 115 — Waiting on file (%4) recovery for %1 (VM ID: %2) completed with status %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Waiting on file (%4) recovery for %1 (VM ID: %2) completed with status %3.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—
`RefType`	—

Event ID 116 — File (%3) recovery succeeded for %1 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

File (%3) recovery succeeded for %1 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`RefType`	—
`Mode`	—
`PendingRecoveryCount`	—

Event ID 117 — File (%4) recovery failed for %1 (VM ID: %2) with error %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

File (%4) recovery failed for %1 (VM ID: %2) with error %3.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—
`RefType`	—
`Mode`	—
`PendingRecoveryCount`	—

Event ID 118 — Failed to open file %1 with error %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Failed to open file %1 with error %3. The file handle was previously invalidated due to a critical error. This operation will be retried periodically. (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 119 — File %1 has been closed before initiating a recovery attempt.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

File %1 has been closed before initiating a recovery attempt. The file was open in mode %3. (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Mode`	—
`Status`	—

Event ID 120 — Recovery attempt initiated for virtual disk %1 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Recovery attempt initiated for virtual disk %1 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 121 — Recovery attempt completed successfully for virtual disk %1 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Recovery attempt completed successfully for virtual disk %1 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 122 — Recovery attempt for virtual disk %1 failed with status %3 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Recovery attempt for virtual disk %1 failed with status %3 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 123 — Reopening handles to file %1 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Reopening handles to file %1 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 124 — Waiting for handles to file %1 to be reactivated (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Waiting for handles to file %1 to be reactivated (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 125 — Recovery attempt completed for file %1 with status %3 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Recovery attempt completed for file %1 with status %3 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 126 — I/O failed with status %3 on file %1 (VM ID: %2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

I/O failed with status %3 on file %1 (VM ID: %2).

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`Status`	—

Event ID 208 — Change Tracking has been enabled for the VHD %1 (%2) with log file %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Change Tracking has been enabled for the VHD %1 (%2) with log file %3.

Fields

Name	Description
`VhdFileName`	—
`VirtualDisk`	—
`LogFileName`	—

Event ID 209 — Change Tracking has been disabled for the VHD %1 (%2).

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Change Tracking has been disabled for the VHD %1 (%2).

Fields

Name	Description
`VhdFileName`	—
`VirtualDisk`	—

Event ID 210 — Change Tracking for the VHD %1 to the log file %2 has been stopped due to the error %3.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Change Tracking for the VHD %1 to the log file %2 has been stopped due to the error %3.

Fields

Name	Description
`VirtualDisk`	—
`LogFileName`	—
`Status`	—

Event ID 211 — Flushing of the header of the log file %1 has failed due to error %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Flushing of the header of the log file %1 has failed due to error %2.

Fields

Name	Description
`LogFileName`	—
`Status`	—

Event ID 212 — Flushing of the buffers to the log file %1 has failed due to error %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Flushing of the buffers to the log file %1 has failed due to error %2.

Fields

Name	Description
`LogFileName`	—
`Status`	—

Event ID 213 — Opening the log file %1 for tracking has failed due to error %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Opening the log file %1 for tracking has failed due to error %2.

Fields

Name	Description
`LogFileName`	—
`Status`	—

Event ID 214 — Offline changes are detected for VHD %2.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Offline changes are detected for VHD %2. Log file: %1, VHD time: %4, Log file time: %5

Fields

Name	Description
`LogFileName`	—
`VhdFileName`	—
`Status`	—
`VHDFileTime`	—
`LogFileTime`	—

Event ID 215 — No configurations were found for CtLogPerfOpts; Using default [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

No configurations were found for CtLogPerfOpts; Using default [%1]

Fields

Name	Description
`Value`	—

Event ID 216 — CtLogPerfOpts is set to CtLogPerfOptNoChange [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

CtLogPerfOpts is set to CtLogPerfOptNoChange [%1]; No perf changes applied

Fields

Name	Description
`Value`	—

Event ID 217 — CtLogPerfOpts is set to CtLogPerfOptDisableWriteThrough [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

CtLogPerfOpts is set to CtLogPerfOptDisableWriteThrough [%1]; Write Through will be disabled

Fields

Name	Description
`Value`	—

Event ID 218 — CtLogPerfOpts is set to [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

CtLogPerfOpts is set to [%1]; Write Through will be disabled and Custom perf conf will be used

Fields

Name	Description
`Value`	—

Event ID 219 — CtLogPerfOpts is set to [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

CtLogPerfOpts is set to [%1]; Custom perf conf will be used

Fields

Name	Description
`Value`	—

Event ID 220 — Expected conf value for CtMinMasterBufferSize not found using default [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Expected conf value for CtMinMasterBufferSize not found using default [%1]

Fields

Name	Description
`Value`	—

Event ID 221 — Expected conf value for CtMaxDirtyMemThresholdPercent not found using default [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Expected conf value for CtMaxDirtyMemThresholdPercent not found using default [%1]

Fields

Name	Description
`Value`	—

Event ID 222 — Expected conf value for CtMaxFlushBufferSize not found using default [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Expected conf value for CtMaxFlushBufferSize not found using default [%1]

Fields

Name	Description
`Value`	—

Event ID 223 — Using following values [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

Using following values [%1, %2, %3, %4] for CtLog

Fields

Name	Description
`CtLogPerfOpts`	—
`CtMinMasterBufferSize`	—
`CtMaxDirtyMemThresholdPercent`	—
`CtMaxFlushBufferSize`	—

Event ID 224 — CtLogPerfOpts is set to [.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

CtLogPerfOpts is set to [%1] is not a supported value

Fields

Name	Description
`Value`	—

Event ID 300 — IO latency summary: Virtual disk: %1 IO type: %2 Interval duration: %3 Max Acceptable IO Latency: %4 High Latency IOs: %5 IO count: %6 Avg IOPS: %7...

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

IO latency summary:

           Virtual disk: %1
           
           IO type: %2
           
           Interval duration: %3
           
           Max Acceptable IO Latency: %4
           High Latency IOs: %5
           
           IO count: %6
           Avg IOPS: %7
           Avg latency: %9
           
           Latency buckets: [%10]
           IO count buckets: [%11, %12, %13, %14, %15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
           Total time buckets (ns): [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40, %41, %42]

Fields

Name	Description
`VhdFile`	—
`IoTypeStr`	—
`IntervalDurationStr`	—
`MaxLatencyMs`	—
`HighLatencyIoCount`	—
`TotalIoCount`	—
`AverageIops`	—
`AverageLatencyNs`	—
`AverageLatencyStr`	—
`LatencyBuckets`	—
`IoCount0`	—
`IoCount1`	—
`IoCount2`	—
`IoCount3`	—
`IoCount4`	—
`IoCount5`	—
`IoCount6`	—
`IoCount7`	—
`IoCount8`	—
`IoCount9`	—
`IoCount10`	—
`IoCount11`	—
`IoCount12`	—
`IoCount13`	—
`IoCount14`	—
`IoCount15`	—
`TotalTimeNs0`	—
`TotalTimeNs1`	—
`TotalTimeNs2`	—
`TotalTimeNs3`	—
`TotalTimeNs4`	—
`TotalTimeNs5`	—
`TotalTimeNs6`	—
`TotalTimeNs7`	—
`TotalTimeNs8`	—
`TotalTimeNs9`	—
`TotalTimeNs10`	—
`TotalTimeNs11`	—
`TotalTimeNs12`	—
`TotalTimeNs13`	—
`TotalTimeNs14`	—
`TotalTimeNs15`	—
`SnapshotId`	—

Event ID 301 — IO latency summary: Virtual disk: %1 IO type: %2 Interval duration: %3 Max Acceptable IO Latency: %4 High Latency IOs: %5 IO count: %6 Total bytes:...

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

IO latency summary:

           Virtual disk: %1
           
           IO type: %2
           
           Interval duration: %3
           
           Max Acceptable IO Latency: %4
           High Latency IOs: %5
           
           IO count: %6
           Total bytes: %43
           Avg IOPS: %7
           Avg Bps: %44
           Avg latency: %9
           
           Latency buckets: [%10]
           IO count buckets: [%11, %12, %13, %14, %15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
           Total time buckets (ns): [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40, %41, %42]

Fields

Name	Description
`VhdFile`	—
`IoTypeStr`	—
`IntervalDurationStr`	—
`MaxLatencyMs`	—
`HighLatencyIoCount`	—
`TotalIoCount`	—
`AverageIops`	—
`AverageLatencyNs`	—
`AverageLatencyStr`	—
`LatencyBuckets`	—
`IoCount0`	—
`IoCount1`	—
`IoCount2`	—
`IoCount3`	—
`IoCount4`	—
`IoCount5`	—
`IoCount6`	—
`IoCount7`	—
`IoCount8`	—
`IoCount9`	—
`IoCount10`	—
`IoCount11`	—
`IoCount12`	—
`IoCount13`	—
`IoCount14`	—
`IoCount15`	—
`TotalTimeNs0`	—
`TotalTimeNs1`	—
`TotalTimeNs2`	—
`TotalTimeNs3`	—
`TotalTimeNs4`	—
`TotalTimeNs5`	—
`TotalTimeNs6`	—
`TotalTimeNs7`	—
`TotalTimeNs8`	—
`TotalTimeNs9`	—
`TotalTimeNs10`	—
`TotalTimeNs11`	—
`TotalTimeNs12`	—
`TotalTimeNs13`	—
`TotalTimeNs14`	—
`TotalTimeNs15`	—
`TotalBytes`	—
`AverageBps`	—
`TotalBytes0`	—
`TotalBytes1`	—
`TotalBytes2`	—
`TotalBytes3`	—
`TotalBytes4`	—
`TotalBytes5`	—
`TotalBytes6`	—
`TotalBytes7`	—
`TotalBytes8`	—
`TotalBytes9`	—
`TotalBytes10`	—
`TotalBytes11`	—
`TotalBytes12`	—
`TotalBytes13`	—
`TotalBytes14`	—
`TotalBytes15`	—
`SnapshotId`	—

Event ID 302 — An IO took more than %2 ms to complete: Virtual disk: %1 IO Type: %4 IO Size: %5 bytes Latency: %6 ms.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

An IO took more than %2 ms to complete:

           Virtual disk: %1
           IO Type: %4
           IO Size: %5 bytes
           Latency: %6 ms

Fields

Name	Description
`VhdFile`	—
`MaxLatencyMs`	—
`IoType`	—
`IoTypeStr`	—
`IoSize`	—
`LatencyMs`	—

Event ID 303 — An IO took more than %2 ms to complete: Virtual disk: %1 IO Type: %4 Latency: %5 ms.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

An IO took more than %2 ms to complete:

           Virtual disk: %1
           IO Type: %4
           Latency: %5 ms

Fields

Name	Description
`VhdFile`	—
`MaxLatencyMs`	—
`IoType`	—
`IoTypeStr`	—
`LatencyMs`	—

Event ID 304 — A persistent reservation IO took more than %2 ms to complete: Virtual disk: %1 [In = 1, Out = 0]: %3 IO Size: %4 bytes Latency: %5 ms.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Operational

Message

A persistent reservation IO took more than %2 ms to complete:

           Virtual disk: %1
           [In = 1, Out = 0]: %3
           IO Size: %4 bytes
           Latency: %5 ms

Fields

Name	Description
`VhdFile`	—
`MaxLatencyMs`	—
`PersistentReserveIn`	—
`IoSize`	—
`LatencyMs`	—

Event ID 1001 — Starting an IO.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Analytic

Message

Starting an IO.

Fields

Name	Description
`VhdId`	—
`VhdIoType`	—
`VhdSrbType`	—
`Offset`	—
`Length`	—

Event ID 1002 — Completing an IO.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Analytic

Message

Completing an IO.

Fields

Name	Description
`VhdId`	—
`VhdIoType`	—
`VhdSrbType`	—
`Offset`	—
`Length`	—

Event ID 1010 — A %4 %3 IO to %1 (VM ID: %2) failed with error %7.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Analytic

Message

A %4 %3 IO to %1 (VM ID: %2) failed with error %7. Recovery of this virtual disk has been initiated. If this IO was initiated by a VM then it will be internally retried later when the virtual disk has successfully recovered.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`VhdIoType`	—
`VhdSrbType`	—
`Offset`	—
`Length`	—
`Status`	—

Event ID 1011 — A %4 %3 IO to %1 (VM ID: %2) failed with error %7.

Provider: Microsoft-Windows-VHDMP
Channel: Microsoft-Windows-VHDMP-Analytic

Message

A %4 %3 IO to %1 (VM ID: %2) failed with error %7. Recovery for this virtual disk could not be initiated either because this is not a recoverable failure or recovery has failed or the virtual disk is in an invalid state.

Fields

Name	Description
`VhdFile`	—
`VmId`	—
`VhdIoType`	—
`VhdSrbType`	—
`Offset`	—
`Length`	—
`Status`	—