Microsoft-Windows-Hyper-V-DynMem

64 events across 3 channels

Event	Title	Channel	Sample
1500	[Virtual machine VmId]	Operational	N
1500	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
1510	[Virtual machine VmId]	Operational	N
1510	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
1520	[Virtual machine VmId]	Operational	N
1520	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
1530	[Virtual machine VmId]	Operational	N
1530	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
12540	'VmName' device Device experienced a protocol error indicative of a deep system …	Operational	N
12540	'VmName' device Device experienced a protocol error indicative of a deep system …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12541	Device Device experienced a protocol error indicative of a deep system problem	Operational	N
12541	Device Device experienced a protocol error indicative of a deep system problem.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12542	VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM …	Operational	N
12542	VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12543	VM 'VmName' (Virtual machine ID VmId) is misconfigured	Operational	N
12543	VM 'VmName' (Virtual machine ID VmId) is misconfigured.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12544	'VmName' device Device found bad data on restoring	Operational	N
12544	'VmName' device Device found bad data on restoring.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12545	Device Device found bad data on restoring	Operational	N
12545	Device Device found bad data on restoring.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12546	VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest …	Operational	N
12546	VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12547	VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest …	Operational	N
12547	VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest …	Microsoft-Windows-Hyper-V-Worker-Admin	N
25001	Started reserving memory	Operational	N
25001	Started reserving memory.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25002	Operation reserve memory completed, Parameter0 pages were reserved, time Time s	Operational	N
25002	Operation reserve memory completed, Parameter0 pages were reserved, time Time s.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25003	Started committing memory	Operational	N
25003	Started committing memory.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25004	Operation committing memory completed, Parameter0 pages were committed, time …	Operational	N
25004	Operation committing memory completed, Parameter0 pages were committed, time …	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25005	Started de-committing memory	Operational	N
25005	Started de-committing memory.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25006	Operation de-committing memory completed, Parameter0 pages were de-committed, …	Operational	N
25006	Operation de-committing memory completed, Parameter0 pages were de-committed, …	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25007	Started hot adding memory (GUEST)	Operational	N
25007	Started hot adding memory (GUEST).	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25008	Operation hot adding memory completed (GUEST), Parameter0 pages were hot added, …	Operational	N
25008	Operation hot adding memory completed (GUEST), Parameter0 pages were hot added, …	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25009	Started un-ballooning memory (GUEST)	Operational	N
25009	Started un-ballooning memory (GUEST).	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25010	Operation un-ballooning memory completed (GUEST), Parameter0 pages were …	Operational	N
25010	Operation un-ballooning memory completed (GUEST), Parameter0 pages were …	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25011	Started ballooning memory (GUEST)	Operational	N
25011	Started ballooning memory (GUEST).	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25012	Operation ballooning memory completed (GUEST), Parameter0 pages were ballooned, …	Operational	N
25012	Operation ballooning memory completed (GUEST), Parameter0 pages were ballooned, …	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25013	Started hot add undo memory	Operational	N
25013	Started hot add undo memory.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25014	Operation hot add undo memory completed, Parameter0 pages were processed, time …	Operational	N
25014	Operation hot add undo memory completed, Parameter0 pages were processed, time …	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25015	Started releasing memory	Operational	N
25015	Started releasing memory.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25016	Operation release memory completed, Parameter0 pages were released, time Time s	Operational	N
25016	Operation release memory completed, Parameter0 pages were released, time Time s.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25017	Started backing pages	Operational	N
25017	Started backing pages.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25018	Operation backing pages completed, Parameter0 pages were backed, time Time s	Operational	N
25018	Operation backing pages completed, Parameter0 pages were backed, time Time s.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25019	Started greedy ballooning memory (GUEST)	Operational	N
25019	Started greedy ballooning memory (GUEST).	Microsoft-Windows-Hyper-V-Worker-Analytic	N
25020	Operation greedy ballooning memory completed (GUEST), Parameter0 pages were …	Operational	N
25020	Operation greedy ballooning memory completed (GUEST), Parameter0 pages were …	Microsoft-Windows-Hyper-V-Worker-Analytic	N

Event ID 1500: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1500: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1510: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1510: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1520: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1520: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1530: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1530: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 12540: 'VmName' device Device experienced a protocol error indicative of a deep system problem

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

'VmName' device Device experienced a protocol error indicative of a deep system problem. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 12540: 'VmName' device Device experienced a protocol error indicative of a deep system problem.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device experienced a protocol error indicative of a deep system problem. (Virtual machine ID VmId).

Message #

'%1' device %3 experienced a protocol error indicative of a deep system problem. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 12541: Device Device experienced a protocol error indicative of a deep system problem

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

Device experienced a protocol error indicative of a deep system problem.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 12541: Device Device experienced a protocol error indicative of a deep system problem.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device Device experienced a protocol error indicative of a deep system problem.

Message #

Device %3 experienced a protocol error indicative of a deep system problem.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 12542: VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM pages than it can access

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM pages than it can access. Numer of inaccessible pages: InaccessiblePages.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`InaccessiblePages` UInt64

Event ID 12542: VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM pages than it can access.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM pages than it can access. Numer of inaccessible pages: InaccessiblePages.

Message #

VM '%1' (Virtual machine ID %2) is misconfigured with more physical RAM pages than it can access. Numer of inaccessible pages: %3.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`InaccessiblePages` UInt64

Event ID 12543: VM 'VmName' (Virtual machine ID VmId) is misconfigured

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`InaccessiblePages` UInt64

Event ID 12543: VM 'VmName' (Virtual machine ID VmId) is misconfigured.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured.

Message #

VM '%1' (Virtual machine ID %2) is misconfigured.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`InaccessiblePages` UInt64

Event ID 12544: 'VmName' device Device found bad data on restoring

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

'VmName' device Device found bad data on restoring. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 12544: 'VmName' device Device found bad data on restoring.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device found bad data on restoring. (Virtual machine ID VmId).

Message #

'%1' device %3 found bad data on restoring. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 12545: Device Device found bad data on restoring

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

Device found bad data on restoring.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 12545: Device Device found bad data on restoring.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device Device found bad data on restoring.

Message #

Device %3 found bad data on restoring.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString

Event ID 12546: VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString

Event ID 12546: VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory.

Message #

VM '%1' (Virtual machine ID %2) is misconfigured to allow guest hibernation along with dynamic memory.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString

Event ID 12547: VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString

Event ID 12547: VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory.

Message #

VM '%1' (Virtual machine ID %2) is misconfigured to allow guest hibernation along with dynamic memory.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString

Event ID 25001: Started reserving memory

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_reservememory
Opcode: Start

Description

Started reserving memory. Reserving pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25001: Started reserving memory.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_reservememory
Opcode: Start

Description

Started reserving memory. Reserving Parameter0 pages. (Virtual machine ID VmId).

Message #

Started reserving memory. Reserving %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25002: Operation reserve memory completed, Parameter0 pages were reserved, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_reservememory
Opcode: Stop

Description

Operation reserve memory completed, pages were reserved, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25002: Operation reserve memory completed, Parameter0 pages were reserved, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_reservememory
Opcode: Stop

Description

Operation reserve memory completed, Parameter0 pages were reserved, time Time s. (Virtual machine ID VmId).

Message #

Operation reserve memory completed, %3 pages were reserved, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25003: Started committing memory

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_commitmemory
Opcode: Start

Description

Started committing memory. Committing pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25003: Started committing memory.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_commitmemory
Opcode: Start

Description

Started committing memory. Committing Parameter0 pages. (Virtual machine ID VmId).

Message #

Started committing memory. Committing %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25004: Operation committing memory completed, Parameter0 pages were committed, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_commitmemory
Opcode: Stop

Description

Operation committing memory completed, pages were committed, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25004: Operation committing memory completed, Parameter0 pages were committed, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_commitmemory
Opcode: Stop

Description

Operation committing memory completed, Parameter0 pages were committed, time Time s. (Virtual machine ID VmId).

Message #

Operation committing memory completed, %3 pages were committed, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25005: Started de-committing memory

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_de_commitmemory
Opcode: Start

Description

Started de-committing memory. De-committing pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25005: Started de-committing memory.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_de_commitmemory
Opcode: Start

Description

Started de-committing memory. De-committing Parameter0 pages. (Virtual machine ID VmId).

Message #

Started de-committing memory. De-committing %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25006: Operation de-committing memory completed, Parameter0 pages were de-committed, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_de_commitmemory
Opcode: Stop

Description

Operation de-committing memory completed, pages were de-committed, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25006: Operation de-committing memory completed, Parameter0 pages were de-committed, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_de_commitmemory
Opcode: Stop

Description

Operation de-committing memory completed, Parameter0 pages were de-committed, time Time s. (Virtual machine ID VmId).

Message #

Operation de-committing memory completed, %3 pages were de-committed, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25007: Started hot adding memory (GUEST)

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_hotadd
Opcode: Start

Description

Started hot adding memory (GUEST). Hot adding pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25007: Started hot adding memory (GUEST).

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_hotadd
Opcode: Start

Description

Started hot adding memory (GUEST). Hot adding Parameter0 pages. (Virtual machine ID VmId).

Message #

Started hot adding memory (GUEST). Hot adding %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25008: Operation hot adding memory completed (GUEST), Parameter0 pages were hot added, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_hotadd
Opcode: Stop

Description

Operation hot adding memory completed (GUEST), pages were hot added, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25008: Operation hot adding memory completed (GUEST), Parameter0 pages were hot added, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_hotadd
Opcode: Stop

Description

Operation hot adding memory completed (GUEST), Parameter0 pages were hot added, time Time s. (Virtual machine ID VmId).

Message #

Operation hot adding memory completed (GUEST), %3 pages were hot added, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25009: Started un-ballooning memory (GUEST)

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_un_balloon
Opcode: Start

Description

Started un-ballooning memory (GUEST). Un-ballooning pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25009: Started un-ballooning memory (GUEST).

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_un_balloon
Opcode: Start

Description

Started un-ballooning memory (GUEST). Un-ballooning Parameter0 pages. (Virtual machine ID VmId).

Message #

Started un-ballooning memory (GUEST). Un-ballooning %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25010: Operation un-ballooning memory completed (GUEST), Parameter0 pages were un-ballooned, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_un_balloon
Opcode: Stop

Description

Operation un-ballooning memory completed (GUEST), pages were un-ballooned, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25010: Operation un-ballooning memory completed (GUEST), Parameter0 pages were un-ballooned, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_un_balloon
Opcode: Stop

Description

Operation un-ballooning memory completed (GUEST), Parameter0 pages were un-ballooned, time Time s. (Virtual machine ID VmId).

Message #

Operation un-ballooning memory completed (GUEST), %3 pages were un-ballooned, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25011: Started ballooning memory (GUEST)

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_balloon
Opcode: Start

Description

Started ballooning memory (GUEST). Ballooning pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25011: Started ballooning memory (GUEST).

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_balloon
Opcode: Start

Description

Started ballooning memory (GUEST). Ballooning Parameter0 pages. (Virtual machine ID VmId).

Message #

Started ballooning memory (GUEST). Ballooning %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25012: Operation ballooning memory completed (GUEST), Parameter0 pages were ballooned, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_balloon
Opcode: Stop

Description

Operation ballooning memory completed (GUEST), pages were ballooned, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25012: Operation ballooning memory completed (GUEST), Parameter0 pages were ballooned, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_balloon
Opcode: Stop

Description

Operation ballooning memory completed (GUEST), Parameter0 pages were ballooned, time Time s. (Virtual machine ID VmId).

Message #

Operation ballooning memory completed (GUEST), %3 pages were ballooned, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25013: Started hot add undo memory

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_hotaddundo
Opcode: Start

Description

Started hot add undo memory. Undoing pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25013: Started hot add undo memory.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_hotaddundo
Opcode: Start

Description

Started hot add undo memory. Undoing Parameter0 pages. (Virtual machine ID VmId).

Message #

Started hot add undo memory. Undoing %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25014: Operation hot add undo memory completed, Parameter0 pages were processed, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_hotaddundo
Opcode: Stop

Description

Operation hot add undo memory completed, pages were processed, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25014: Operation hot add undo memory completed, Parameter0 pages were processed, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_hotaddundo
Opcode: Stop

Description

Operation hot add undo memory completed, Parameter0 pages were processed, time Time s. (Virtual machine ID VmId).

Message #

Operation hot add undo memory completed, %3 pages were processed, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25015: Started releasing memory

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_release
Opcode: Start

Description

Started releasing memory. Releasing pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25015: Started releasing memory.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_release
Opcode: Start

Description

Started releasing memory. Releasing Parameter0 pages. (Virtual machine ID VmId).

Message #

Started releasing memory. Releasing %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25016: Operation release memory completed, Parameter0 pages were released, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_release
Opcode: Stop

Description

Operation release memory completed, pages were released, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25016: Operation release memory completed, Parameter0 pages were released, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_release
Opcode: Stop

Description

Operation release memory completed, Parameter0 pages were released, time Time s. (Virtual machine ID VmId).

Message #

Operation release memory completed, %3 pages were released, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25017: Started backing pages

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_backpages
Opcode: Start

Description

Started backing pages. Backing pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25017: Started backing pages.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_backpages
Opcode: Start

Description

Started backing pages. Backing Parameter0 pages. (Virtual machine ID VmId).

Message #

Started backing pages. Backing %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25018: Operation backing pages completed, Parameter0 pages were backed, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_backpages
Opcode: Stop

Description

Operation backing pages completed, pages were backed, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25018: Operation backing pages completed, Parameter0 pages were backed, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_backpages
Opcode: Stop

Description

Operation backing pages completed, Parameter0 pages were backed, time Time s. (Virtual machine ID VmId).

Message #

Operation backing pages completed, %3 pages were backed, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25019: Started greedy ballooning memory (GUEST)

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_greedyballoooning
Opcode: Start

Description

Started greedy ballooning memory (GUEST). Ballooning pages. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25019: Started greedy ballooning memory (GUEST).

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_greedyballoooning
Opcode: Start

Description

Started greedy ballooning memory (GUEST). Ballooning Parameter0 pages. (Virtual machine ID VmId).

Message #

Started greedy ballooning memory (GUEST). Ballooning %2 pages. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Parameter0` UInt64

Event ID 25020: Operation greedy ballooning memory completed (GUEST), Parameter0 pages were ballooned, time Time s

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Operational
Task: Dynamicmemory_greedyballoooning
Opcode: Stop

Description

Operation greedy ballooning memory completed (GUEST), pages were ballooned, time s. (Virtual machine ID ).

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Event ID 25020: Operation greedy ballooning memory completed (GUEST), Parameter0 pages were ballooned, time Time s.

Provider: Microsoft-Windows-Hyper-V-DynMem
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic
Task: Dynamicmemory_greedyballoooning
Opcode: Stop

Description

Operation greedy ballooning memory completed (GUEST), Parameter0 pages were ballooned, time Time s. (Virtual machine ID VmId).

Message #

Operation greedy ballooning memory completed (GUEST), %3 pages were ballooned, time %2 s. (Virtual machine ID %1)

Fields #

Name	Description
`VmId` UnicodeString
`Time` UnicodeString
`Parameter0` UInt64

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b1d080a6-f3a5-42f6-b6f1-b9fd86c088da

Defined in vmdynmem.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-Hyper-V-DynMem registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)