Microsoft-Windows-Hyper-V-Serial

Event	Title	Channel	Sample	Rule
1500	[Virtual machine VmId]	Operational	N	N
1500	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
1510	[Virtual machine VmId]	Operational	N	N
1510	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
1520	[Virtual machine VmId]	Operational	N	N
1520	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
1530	[Virtual machine VmId]	Operational	N	N
1530	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
10500	[Virtual machine VmId]	Operational	N	N
10500	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
10510	[Virtual machine VmId]	Operational	N	N
10510	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
10520	[Virtual machine VmId]	Operational	N	N
10520	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
10530	[Virtual machine VmId]	Operational	N	N
10530	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
12320	'VmName' error 'ErrorCodeString' (ErrorCode) while opening file 'String' during …	Operational, Microsoft-Windows-Hyper-V-Worker-Admin	N	N
12321	Error 'ErrorCodeString' (ErrorCode) while opening file 'String' during serial …	Operational, Microsoft-Windows-Hyper-V-Worker-Admin	N	N
12322	The virtual machine VmName cannot load device Device because there are no …	Operational, Microsoft-Windows-Hyper-V-Worker-Admin	N	N
12323	The device Device cannot be loaded because there are no mutually support …	Operational, Microsoft-Windows-Hyper-V-Worker-Admin	N	N

Event ID 1500: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1500: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1510: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1510: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1520: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1520: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1530: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1530: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 10500: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 10500: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 10510: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 10510: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 10520: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 10520: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 10530: [Virtual machine VmId]

Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 10530: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 12320: 'VmName' error 'ErrorCodeString' (ErrorCode) while opening file 'String' during serial device startup

Channel: Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' error 'ErrorCodeString' (ErrorCode) while opening file 'String' during serial device startup. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12321: Error 'ErrorCodeString' (ErrorCode) while opening file 'String' during serial device startup

Channel: Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12322: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions

Channel: Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 12323: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client

Channel: Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Provenance

ETW provider GUID 8f9df503-1d12-49ec-bb28-f6ec42d361d4

Defined in vmserial.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB