Microsoft-Windows-Hyper-V-KMCL-Child

Event	Title	Channel	Sample	Rule
1	Fetching a packet from vmbus.	Analytic	N	N
2	Sending a packet to vmbus.	Analytic	N	N
3	Finish fetching packets from vmbus.	Analytic	N	N
4	Incoming packet quota is hit.	Analytic	N	N
5	DPC cycle limit is hit.	Analytic	N	N

Event ID 1: Fetching a packet from vmbus.

Channel: Analytic
Task: Queueandpacketeventtracing.
Opcode: Fetchasinglepacketfromtheringbuffer.

Fields #

Name	Description
`VmId` GUID
`InstanceId` GUID
`TransactionId` UInt64
`IsCompletionPacket` Boolean
`Channel` UInt16

Event ID 2: Sending a packet to vmbus.

Channel: Analytic
Task: Queueandpacketeventtracing.
Opcode: Puttingapackettotheringbuffer.

Fields #

Name	Description
`VmId` GUID
`InstanceId` GUID
`TransactionId` UInt64
`IsCompletionPacket` Boolean
`Channel` UInt16

Event ID 3: Finish fetching packets from vmbus.

Channel: Analytic
Task: Queueandpacketeventtracing.
Opcode: Finishfetchingpacketsfromtheringbuffer.

Fields #

Name	Description
`VmId` GUID
`InstanceId` GUID
`PacketFetched` UInt32
`MaximumFetchAllowed` UInt32
`Channel` UInt16

Event ID 4: Incoming packet quota is hit.

Channel: Analytic
Task: Queueandpacketeventtracing.
Opcode: Nomorepacketscanbefetchedbecausethequotaismet.

Fields #

Name	Description
`VmId` GUID
`InstanceId` GUID
`Channel` UInt16

Event ID 5: DPC cycle limit is hit.

Channel: Analytic
Task: Queueandpacketeventtracing.
Opcode: DPCcyclelimitisexceeded.

Fields #

Name	Description
`VmId` GUID
`InstanceId` GUID
`Channel` UInt16

Provenance

ETW provider GUID 16d90d71-caca-5cd9-a618-8210d93015f3

Defined in vmbkmcl.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4294, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB