Microsoft-Windows-Hyper-V-StorageVSP

32 events across 3 channels

Event	Title	Channel	Sample
3	Cannot load storage device in 'AdapterName' because the version is incompatible …	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
3	Cannot load storage device in 'AdapterName' because the version is incompatible …	Operational	N
4	Storage device 'DeviceName' received a recovery status notification.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
4	Storage device 'DeviceName' received a recovery status notification	Operational	N
5	Storage device 'DeviceName' changed recovery state.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
5	Storage device 'DeviceName' changed recovery state	Operational	N
6	Storage device 'DeviceName' received an IO failure with error = Status.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
6	Storage device 'DeviceName' received an IO failure with error =	Operational	N
7	Failed to map guest I/O buffer for read access with status Status.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
7	Failed to map guest I/O buffer for read access with status	Operational	N
8	Failed to map guest I/O buffer for write access with status Status.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
8	Failed to map guest I/O buffer for write access with status	Operational	N
9	An I/O request for device 'DeviceName' took Duration milliseconds to complete.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
9	An I/O request for device 'DeviceName' took Duration milliseconds to complete	Operational	N
300	IO latency summary.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	Y
300	IO latency summary:	Operational	N
301	IO latency summary.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	Y
301	IO latency summary:	Operational	N
302	An IO took more than MaxLatencyMs ms to complete.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
302	An IO took more than MaxLatencyMs ms to complete:	Operational	N
303	An IO took more than MaxLatencyMs ms to complete.	Microsoft-Windows-Hyper-V-StorageVSP-Admin	N
303	An IO took more than MaxLatencyMs ms to complete:	Operational	N
1001	Completing a SCSI operation.	Microsoft-Windows-Hyper-V-StorageVSP-Analytic	N
1001	Completing a SCSI operation	Operational	N
1002	QoS limit reached while initiating a SCSI operation.	Microsoft-Windows-Hyper-V-StorageVSP-Analytic	N
1002	QoS limit reached while initiating a SCSI operation	Operational	N
1010	[.	Microsoft-Windows-Hyper-V-StorageVSP-Analytic	N
1010	[Source:Line]	Operational	N
1011	[.	Microsoft-Windows-Hyper-V-StorageVSP-Analytic	N
1011	[Source:Line]	Operational	N
1012	[.	Microsoft-Windows-Hyper-V-StorageVSP-Analytic	N
1012	[Source:Line]	Operational	N

Event ID 3: Cannot load storage device in 'AdapterName' because the version is incompatible with the version expected by the server.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Message #

Cannot load storage device in '%1' because the version is incompatible with the version expected by the server.  Server version %3 Client version %4 (Virtual machine ID %2). To fix this problem, you must upgrade the integration services.

Fields #

Name	Description
`AdapterName` UnicodeString
`AdapterId` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 3: Cannot load storage device in 'AdapterName' because the version is incompatible with the version expected by the server

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Fields #

Name	Description
`AdapterName` UnicodeString
`AdapterId` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 4: Storage device 'DeviceName' received a recovery status notification.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Description

Storage device 'DeviceName' received a recovery status notification. Current device state = DeviceState, Last status = LastStatus, New status = NewStatus.

Message #

Storage device '%1' received a recovery status notification. Current device state = %2, Last status = %3, New status = %4.

Fields #

Name	Description
`DeviceName` UnicodeString
`DeviceState` UInt32
`LastStatus` UInt32
`NewStatus` UInt32

Event ID 4: Storage device 'DeviceName' received a recovery status notification

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

Storage device 'DeviceName' received a recovery status notification. Current device state = DeviceState, Last status = LastStatus, New status = NewStatus.

Fields #

Name	Description
`DeviceName` UnicodeString
`DeviceState` UInt32
`LastStatus` UInt32
`NewStatus` UInt32

Event ID 5: Storage device 'DeviceName' changed recovery state.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Description

Storage device 'DeviceName' changed recovery state. Previous state = CurrentState, New state = NewState.

Message #

Storage device '%1' changed recovery state. Previous state = %2, New state = %3.

Fields #

Name	Description
`DeviceName` UnicodeString
`CurrentState` UInt32
`NewState` UInt32

Event ID 5: Storage device 'DeviceName' changed recovery state

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

Storage device 'DeviceName' changed recovery state. Previous state = CurrentState, New state = NewState.

Fields #

Name	Description
`DeviceName` UnicodeString
`CurrentState` UInt32
`NewState` UInt32

Event ID 6: Storage device 'DeviceName' received an IO failure with error = Status.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Description

Storage device 'DeviceName' received an IO failure with error = Status. Current device state = CurrentState, New state = NewState, Current status = CurrentStatus.

Message #

Storage device '%1' received an IO failure with error = %2. Current device state = %3, New state = %4, Current status = %5.

Fields #

Name	Description
`DeviceName` UnicodeString
`Status` UInt32	NTSTATUS reference
`CurrentState` UInt32
`NewState` UInt32
`CurrentStatus` UInt32

Event ID 6: Storage device 'DeviceName' received an IO failure with error =

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

Storage device 'DeviceName' received an IO failure with error = Status. Current device state = CurrentState, New state = NewState, Current status = CurrentStatus.

Fields #

Name	Description
`DeviceName` UnicodeString
`Status` UInt32	NTSTATUS reference
`CurrentState` UInt32
`NewState` UInt32
`CurrentStatus` UInt32

Event ID 7: Failed to map guest I/O buffer for read access with status Status.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Description

Failed to map guest I/O buffer for read access with status Status. Device name = DeviceName.

Message #

Failed to map guest I/O buffer for read access with status %2. Device name = %1

Fields #

Name	Description
`DeviceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 7: Failed to map guest I/O buffer for read access with status

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

Failed to map guest I/O buffer for read access with status . Device name =.

Fields #

Name	Description
`DeviceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 8: Failed to map guest I/O buffer for write access with status Status.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Description

Failed to map guest I/O buffer for write access with status Status. Device name = DeviceName.

Message #

Failed to map guest I/O buffer for write access with status %2. Device name = %1

Fields #

Name	Description
`DeviceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 8: Failed to map guest I/O buffer for write access with status

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

Failed to map guest I/O buffer for write access with status . Device name =.

Fields #

Name	Description
`DeviceName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 9: An I/O request for device 'DeviceName' took Duration milliseconds to complete.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Description

An I/O request for device 'DeviceName' took Duration milliseconds to complete. Operation code = Command, Data transfer length = DataTransferLength, Status = Status.

Message #

An I/O request for device '%1' took %5 milliseconds to complete. Operation code = %2, Data transfer length = %3, Status = %4.

Fields #

Name	Description
`DeviceName` UnicodeString
`Command` UInt32
`DataTransferLength` UInt32
`Status` UInt32	NTSTATUS reference
`Duration` UInt32

Event ID 9: An I/O request for device 'DeviceName' took Duration milliseconds to complete

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

An I/O request for device 'DeviceName' took Duration milliseconds to complete. Operation code = Command, Data transfer length = DataTransferLength, Status = Status.

Fields #

Name	Description
`DeviceName` UnicodeString
`Command` UInt32
`DataTransferLength` UInt32
`Status` UInt32	NTSTATUS reference
`Duration` UInt32

Event ID 300: IO latency summary.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin
Level: Informational

Description

IO latency summary.

Message #

IO latency summary:

           Device: %1
           
           IO type: %2
           
           Interval duration: %3
           
           Max Acceptable IO Latency: %4
           High Latency IOs: %5
           
           IO count: %6
           Avg IOPS: %7
           Avg latency: %9
           
           Latency buckets: [%10]
           IO count buckets: [%11, %12, %13, %14, %15, %16, %17, %17, %19, %20, %21, %22, %23, %24, %25, %26]
           Total time buckets (ns): [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40, %41, %42]

Fields #

Name	Description
`DeviceName` UnicodeString
`IoTypeStr` UnicodeString
`IntervalDurationStr` UnicodeString
`MaxLatencyMs` UInt64
`HighLatencyIoCount` UInt32
`TotalIoCount` UInt64
`AverageIops` UInt64
`AverageLatencyNs` UInt64
`AverageLatencyStr` UnicodeString
`LatencyBuckets` UnicodeString
`IoCount0` UInt64
`IoCount1` UInt64
`IoCount2` UInt64
`IoCount3` UInt64
`IoCount4` UInt64
`IoCount5` UInt64
`IoCount6` UInt64
`IoCount7` UInt64
`IoCount8` UInt64
`IoCount9` UInt64
`IoCount10` UInt64
`IoCount11` UInt64
`IoCount12` UInt64
`IoCount13` UInt64
`IoCount14` UInt64
`IoCount15` UInt64
`TotalTimeNs0` UInt64
`TotalTimeNs1` UInt64
`TotalTimeNs2` UInt64
`TotalTimeNs3` UInt64
`TotalTimeNs4` UInt64
`TotalTimeNs5` UInt64
`TotalTimeNs6` UInt64
`TotalTimeNs7` UInt64
`TotalTimeNs8` UInt64
`TotalTimeNs9` UInt64
`TotalTimeNs10` UInt64
`TotalTimeNs11` UInt64
`TotalTimeNs12` UInt64
`TotalTimeNs13` UInt64
`TotalTimeNs14` UInt64
`TotalTimeNs15` UInt64
`SnapshotId` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-StorageVSP",
    "guid": "10B3D268-9782-49A4-AACC-A93C5482CB6F",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223653511831486472,
    "time_created": "2026-03-11T07:27:12.106460+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 728
    },
    "channel": "Microsoft-Windows-Hyper-V-StorageVSP-Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceName": "C:\\Users\\localuser\\AppData\\Local\\wsl\\{4d205ef4-e2d2-4c32-b102-f7572f1907f9}\\ext4.vhdx",
    "IoTypeStr": "Flush",
    "IntervalDurationStr": "3308 s",
    "MaxLatencyMs": 30000,
    "HighLatencyIoCount": 0,
    "TotalIoCount": 7965,
    "AverageIops": 578,
    "AverageLatencyNs": 1730354,
    "AverageLatencyStr": "1 ms",
    "LatencyBuckets": "128 µs, 256 µs, 512 µs, 1 ms, 4 ms, 16 ms, 64 ms, 128 ms, 256 ms, 512 ms, 1 s, 5 s, 10 s, 20 s, 30 s, > 30 s",
    "IoCount0": 2,
    "IoCount1": 0,
    "IoCount2": 8,
    "IoCount3": 4551,
    "IoCount4": 3136,
    "IoCount5": 256,
    "IoCount6": 7,
    "IoCount7": 5,
    "IoCount8": 0,
    "IoCount9": 0,
    "IoCount10": 0,
    "IoCount11": 0,
    "IoCount12": 0,
    "IoCount13": 0,
    "IoCount14": 0,
    "IoCount15": 0,
    "TotalTimeNs0": 62200,
    "TotalTimeNs1": 0,
    "TotalTimeNs2": 3271600,
    "TotalTimeNs3": 3670578700,
    "TotalTimeNs4": 8165903800,
    "TotalTimeNs5": 1301873500,
    "TotalTimeNs6": 223394400,
    "TotalTimeNs7": 417192100,
    "TotalTimeNs8": 0,
    "TotalTimeNs9": 0,
    "TotalTimeNs10": 0,
    "TotalTimeNs11": 0,
    "TotalTimeNs12": 0,
    "TotalTimeNs13": 0,
    "TotalTimeNs14": 0,
    "TotalTimeNs15": 0,
    "SnapshotId": 36066045902
  },
  "message": ""
}

Event ID 300: IO latency summary:

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

IO latency summary.

Fields #

Name	Description
`DeviceName` UnicodeString
`IoTypeStr` UnicodeString
`IntervalDurationStr` UnicodeString
`MaxLatencyMs` UInt64
`HighLatencyIoCount` UInt32
`TotalIoCount` UInt64
`AverageIops` UInt64
`AverageLatencyNs` UInt64
`AverageLatencyStr` UnicodeString
`LatencyBuckets` UnicodeString
`IoCount0` UInt64
`IoCount1` UInt64
`IoCount2` UInt64
`IoCount3` UInt64
`IoCount4` UInt64
`IoCount5` UInt64
`IoCount6` UInt64
`IoCount7` UInt64
`IoCount8` UInt64
`IoCount9` UInt64
`IoCount10` UInt64
`IoCount11` UInt64
`IoCount12` UInt64
`IoCount13` UInt64
`IoCount14` UInt64
`IoCount15` UInt64
`TotalTimeNs0` UInt64
`TotalTimeNs1` UInt64
`TotalTimeNs2` UInt64
`TotalTimeNs3` UInt64
`TotalTimeNs4` UInt64
`TotalTimeNs5` UInt64
`TotalTimeNs6` UInt64
`TotalTimeNs7` UInt64
`TotalTimeNs8` UInt64
`TotalTimeNs9` UInt64
`TotalTimeNs10` UInt64
`TotalTimeNs11` UInt64
`TotalTimeNs12` UInt64
`TotalTimeNs13` UInt64
`TotalTimeNs14` UInt64
`TotalTimeNs15` UInt64
`SnapshotId` UInt64

Event ID 301: IO latency summary.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin
Level: Informational

Description

IO latency summary.

Message #

IO latency summary:

           Device: %1
           
           IO type: %2
           
           Interval duration: %3
           
           Max Acceptable IO Latency: %4
           High Latency IOs: %5
           
           IO count: %6
           Total bytes: %43
           Avg IOPS: %7
           Avg Bps: %44
           Avg latency: %9
           
           Latency buckets: [%10]
           IO count buckets: [%11, %12, %13, %14, %15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
           Total time buckets (ns): [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40, %41, %42]

Fields #

Name	Description
`DeviceName` UnicodeString
`IoTypeStr` UnicodeString
`IntervalDurationStr` UnicodeString
`MaxLatencyMs` UInt64
`HighLatencyIoCount` UInt32
`TotalIoCount` UInt64
`AverageIops` UInt64
`AverageLatencyNs` UInt64
`AverageLatencyStr` UnicodeString
`LatencyBuckets` UnicodeString
`IoCount0` UInt64
`IoCount1` UInt64
`IoCount2` UInt64
`IoCount3` UInt64
`IoCount4` UInt64
`IoCount5` UInt64
`IoCount6` UInt64
`IoCount7` UInt64
`IoCount8` UInt64
`IoCount9` UInt64
`IoCount10` UInt64
`IoCount11` UInt64
`IoCount12` UInt64
`IoCount13` UInt64
`IoCount14` UInt64
`IoCount15` UInt64
`TotalTimeNs0` UInt64
`TotalTimeNs1` UInt64
`TotalTimeNs2` UInt64
`TotalTimeNs3` UInt64
`TotalTimeNs4` UInt64
`TotalTimeNs5` UInt64
`TotalTimeNs6` UInt64
`TotalTimeNs7` UInt64
`TotalTimeNs8` UInt64
`TotalTimeNs9` UInt64
`TotalTimeNs10` UInt64
`TotalTimeNs11` UInt64
`TotalTimeNs12` UInt64
`TotalTimeNs13` UInt64
`TotalTimeNs14` UInt64
`TotalTimeNs15` UInt64
`TotalBytes` UInt64
`AverageBps` UInt64
`TotalBytes0` UInt64
`TotalBytes1` UInt64
`TotalBytes2` UInt64
`TotalBytes3` UInt64
`TotalBytes4` UInt64
`TotalBytes5` UInt64
`TotalBytes6` UInt64
`TotalBytes7` UInt64
`TotalBytes8` UInt64
`TotalBytes9` UInt64
`TotalBytes10` UInt64
`TotalBytes11` UInt64
`TotalBytes12` UInt64
`TotalBytes13` UInt64
`TotalBytes14` UInt64
`TotalBytes15` UInt64
`SnapshotId` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-StorageVSP",
    "guid": "10B3D268-9782-49A4-AACC-A93C5482CB6F",
    "event_source_name": "",
    "event_id": 301,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223653511831486472,
    "time_created": "2026-03-12T02:28:23.061118+00:00",
    "event_record_id": 26,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7440
    },
    "channel": "Microsoft-Windows-Hyper-V-StorageVSP-Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceName": "C:\\Users\\localuser\\AppData\\Local\\wsl\\{4d205ef4-e2d2-4c32-b102-f7572f1907f9}\\ext4.vhdx",
    "IoTypeStr": "Write",
    "IntervalDurationStr": "3600 s",
    "MaxLatencyMs": 30000,
    "HighLatencyIoCount": 0,
    "TotalIoCount": 1379,
    "AverageIops": 241,
    "AverageLatencyNs": 4151339,
    "AverageLatencyStr": "4 ms",
    "LatencyBuckets": "128 µs, 256 µs, 512 µs, 1 ms, 4 ms, 16 ms, 64 ms, 128 ms, 256 ms, 512 ms, 1 s, 5 s, 10 s, 20 s, 30 s, > 30 s",
    "IoCount0": 5,
    "IoCount1": 2,
    "IoCount2": 94,
    "IoCount3": 264,
    "IoCount4": 622,
    "IoCount5": 347,
    "IoCount6": 45,
    "IoCount7": 0,
    "IoCount8": 0,
    "IoCount9": 0,
    "IoCount10": 0,
    "IoCount11": 0,
    "IoCount12": 0,
    "IoCount13": 0,
    "IoCount14": 0,
    "IoCount15": 0,
    "TotalTimeNs0": 425700,
    "TotalTimeNs1": 269300,
    "TotalTimeNs2": 40607500,
    "TotalTimeNs3": 182072200,
    "TotalTimeNs4": 1431657900,
    "TotalTimeNs5": 2014725200,
    "TotalTimeNs6": 2054939900,
    "TotalTimeNs7": 0,
    "TotalTimeNs8": 0,
    "TotalTimeNs9": 0,
    "TotalTimeNs10": 0,
    "TotalTimeNs11": 0,
    "TotalTimeNs12": 0,
    "TotalTimeNs13": 0,
    "TotalTimeNs14": 0,
    "TotalTimeNs15": 0,
    "TotalBytes": 155158520,
    "AverageBps": 27103356,
    "TotalBytes0": 120,
    "TotalBytes1": 48,
    "TotalBytes2": 152968,
    "TotalBytes3": 2249088,
    "TotalBytes4": 61644824,
    "TotalBytes5": 42459184,
    "TotalBytes6": 48652288,
    "TotalBytes7": 0,
    "TotalBytes8": 0,
    "TotalBytes9": 0,
    "TotalBytes10": 0,
    "TotalBytes11": 0,
    "TotalBytes12": 0,
    "TotalBytes13": 0,
    "TotalBytes14": 0,
    "TotalBytes15": 0,
    "SnapshotId": 468766184796
  },
  "message": ""
}

Event ID 301: IO latency summary:

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

IO latency summary.

Fields #

Name	Description
`DeviceName` UnicodeString
`IoTypeStr` UnicodeString
`IntervalDurationStr` UnicodeString
`MaxLatencyMs` UInt64
`HighLatencyIoCount` UInt32
`TotalIoCount` UInt64
`AverageIops` UInt64
`AverageLatencyNs` UInt64
`AverageLatencyStr` UnicodeString
`LatencyBuckets` UnicodeString
`IoCount0` UInt64
`IoCount1` UInt64
`IoCount2` UInt64
`IoCount3` UInt64
`IoCount4` UInt64
`IoCount5` UInt64
`IoCount6` UInt64
`IoCount7` UInt64
`IoCount8` UInt64
`IoCount9` UInt64
`IoCount10` UInt64
`IoCount11` UInt64
`IoCount12` UInt64
`IoCount13` UInt64
`IoCount14` UInt64
`IoCount15` UInt64
`TotalTimeNs0` UInt64
`TotalTimeNs1` UInt64
`TotalTimeNs2` UInt64
`TotalTimeNs3` UInt64
`TotalTimeNs4` UInt64
`TotalTimeNs5` UInt64
`TotalTimeNs6` UInt64
`TotalTimeNs7` UInt64
`TotalTimeNs8` UInt64
`TotalTimeNs9` UInt64
`TotalTimeNs10` UInt64
`TotalTimeNs11` UInt64
`TotalTimeNs12` UInt64
`TotalTimeNs13` UInt64
`TotalTimeNs14` UInt64
`TotalTimeNs15` UInt64
`TotalBytes` UInt64
`AverageBps` UInt64
`TotalBytes0` UInt64
`TotalBytes1` UInt64
`TotalBytes2` UInt64
`TotalBytes3` UInt64
`TotalBytes4` UInt64
`TotalBytes5` UInt64
`TotalBytes6` UInt64
`TotalBytes7` UInt64
`TotalBytes8` UInt64
`TotalBytes9` UInt64
`TotalBytes10` UInt64
`TotalBytes11` UInt64
`TotalBytes12` UInt64
`TotalBytes13` UInt64
`TotalBytes14` UInt64
`TotalBytes15` UInt64
`SnapshotId` UInt64

Event ID 302: An IO took more than MaxLatencyMs ms to complete.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Description

An IO took more than MaxLatencyMs ms to complete.

Message #

An IO took more than %2 ms to complete:

           Device: %1
           IO Type: %4
           IO Size: %5 bytes
           Latency: %6 ms

Fields #

Name	Description
`DeviceName` UnicodeString
`MaxLatencyMs` UInt64
`IoType` UInt16
`IoTypeStr` UnicodeString
`IoSize` UInt32
`LatencyMs` UInt64

Event ID 302: An IO took more than MaxLatencyMs ms to complete:

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

An IO took more than ms to complete.

Fields #

Name	Description
`DeviceName` UnicodeString
`MaxLatencyMs` UInt64
`IoType` UInt16
`IoTypeStr` UnicodeString
`IoSize` UInt32
`LatencyMs` UInt64

Event ID 303: An IO took more than MaxLatencyMs ms to complete.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Admin

Description

An IO took more than MaxLatencyMs ms to complete.

Message #

An IO took more than %2 ms to complete:

           Device: %1
           IO Type: %4
           Latency: %5 ms

Fields #

Name	Description
`DeviceName` UnicodeString
`MaxLatencyMs` UInt64
`IoType` UInt16
`IoTypeStr` UnicodeString
`LatencyMs` UInt64

Event ID 303: An IO took more than MaxLatencyMs ms to complete:

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Description

An IO took more than ms to complete.

Fields #

Name	Description
`DeviceName` UnicodeString
`MaxLatencyMs` UInt64
`IoType` UInt16
`IoTypeStr` UnicodeString
`LatencyMs` UInt64

Event ID 1001: Completing a SCSI operation.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Analytic
Task: StorVSPSCSIoperationtrace.
Opcode: SCSIoperationcompleted.

Description

Completing a SCSI operation.

Message #

Completing a SCSI operation.

Fields #

Name	Description
`DeviceName` UnicodeString
`Command` UInt32
`DataTransferSize` UInt32
`Status` UInt32	NTSTATUS reference
`QueueTimeUSec` UInt64
`ServiceTimeUSec` UInt64
`ChannelUniqueId` GUID
`LunSrbQueueTag` UInt32

Event ID 1001: Completing a SCSI operation

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational
Task: StorVSPSCSIoperationtrace.
Opcode: SCSIoperationcompleted.

Description

Completing a SCSI operation.

Fields #

Name	Description
`DeviceName` UnicodeString
`Command` UInt32
`DataTransferSize` UInt32
`Status` UInt32	NTSTATUS reference
`QueueTimeUSec` UInt64
`ServiceTimeUSec` UInt64
`ChannelUniqueId` GUID
`LunSrbQueueTag` UInt32

Event ID 1002: QoS limit reached while initiating a SCSI operation.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Analytic
Task: StorVSPSCSIoperationtrace.
Opcode: QoSlimithit.

Description

QoS limit reached while initiating a SCSI operation.

Message #

QoS limit reached while initiating a SCSI operation.

Fields #

Name	Description
`DeviceName` UnicodeString

Event ID 1002: QoS limit reached while initiating a SCSI operation

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational
Task: StorVSPSCSIoperationtrace.
Opcode: QoSlimithit.

Description

QoS limit reached while initiating a SCSI operation.

Fields #

Name	Description
`DeviceName` UnicodeString

Event ID 1010: [.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Analytic

Message #

[%1:%2] %3

Fields #

Name	Description
`Source` AnsiString
`Line` UInt32
`Message` AnsiString

Event ID 1010: [Source:Line]

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Fields #

Name	Description
`Source` AnsiString
`Line` UInt32
`Message` AnsiString

Event ID 1011: [.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Analytic

Message #

[%1:%2] %3

Fields #

Name	Description
`Source` AnsiString
`Line` UInt32
`Message` AnsiString

Event ID 1011: [Source:Line]

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Fields #

Name	Description
`Source` AnsiString
`Line` UInt32
`Message` AnsiString

Event ID 1012: [.

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Microsoft-Windows-Hyper-V-StorageVSP-Analytic

Message #

[%1:%2] %3

Fields #

Name	Description
`Source` AnsiString
`Line` UInt32
`Message` AnsiString

Event ID 1012: [Source:Line]

Provider: Microsoft-Windows-Hyper-V-StorageVSP
Channel: Operational

Fields #

Name	Description
`Source` AnsiString
`Line` UInt32
`Message` AnsiString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 10b3d268-9782-49a4-aacc-a93c5482cb6f

Defined in storvsp.sys, the binary that emits these events.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-Hyper-V-StorageVSP registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)