Microsoft-Windows-Hyper-V-CrashDump

Event	Title	Channel	Sample	Rule
1500	[Virtual machine VmId]	Operational	N	N
1500	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
1510	[Virtual machine VmId]	Operational	N	N
1510	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
1520	[Virtual machine VmId]	Operational	N	N
1520	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
1530	[Virtual machine VmId]	Operational	N	N
1530	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
40000	[Virtual machine VmId] 'VmName' device Device - A fatal error occured while …	Operational, Microsoft-Windows-Hyper-V-Worker-Admin	N	N
40001	[Virtual machine VmId] 'VmName' A guest crash dump was successfully written to	Operational	N	N
40001	[Virtual machine VmId] 'VmName' A guest crash dump was successfully written to …	Microsoft-Windows-Hyper-V-Worker-Admin	N	N
40002	[Virtual machine VmId] 'VmName' A guest crash dump was started but did not …	Operational, Microsoft-Windows-Hyper-V-Worker-Admin	N	N

Event ID 1500: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1500: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1510: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1510: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1520: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1520: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1530: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1530: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 40000: [Virtual machine VmId] 'VmName' device Device - A fatal error occured while processing a protocol message from the guest

Channel: Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 40001: [Virtual machine VmId] 'VmName' A guest crash dump was successfully written to

Channel: Operational

Description

[Virtual machine VmId] 'VmName' A guest crash dump was successfully written to DumpFile.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`DumpFile` UnicodeString

Event ID 40001: [Virtual machine VmId] 'VmName' A guest crash dump was successfully written to DumpFile.

Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Message #

[Virtual machine %2] '%1' A guest crash dump was successfully written to %3.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`DumpFile` UnicodeString

Event ID 40002: [Virtual machine VmId] 'VmName' A guest crash dump was started but did not complete successfully

Channel: Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString

Provenance

ETW provider GUID c7c9e4f7-c41d-5c68-f104-d72a920016c7

Defined in VmCrashDump.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB