Microsoft-Windows-Hyper-V-VID

123 events across 3 channels

Event	Title	Channel	Sample
1101	Failed to reserve Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1102	Failed to reserve Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1103	Failed to allocate Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1104	Failed to release Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1105	Failed to withdraw pages from bucket: Parameter1.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1106	Failed to balloon Parameter1 page ranges: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1107	Failed to un-balloon Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1108	Failed to hot add Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1109	Failed to hot add undo Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1110	Failed to create mem block with Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
1111	Failed to create DAX file backed mem block with Parameter1 pages: Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
3000	Created partition with ID Parameter0 and name PartitionId.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5001	Started reserving Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5002	Finished reserving pages with status = Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5003	Started reserving bucket pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5004	Finished reserving bucket pages with status = Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5005	Started allocating Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5006	Finished allocating pages with status = Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5007	Started depositing pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5008	Finished depositing pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5009	Started releasing Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5010	Finished releasing Parameter1 pages with status = Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5011	Started releasing bucket Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5012	Finished releasing bucket Parameter1 pages with status = Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5013	Started withdrawing pages from bucket.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5014	Finished withdrawing pages from bucket with status = Parameter1.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5017	Started depositing pages to bucket from page list.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5018	Finished depositing pages to bucket from page list.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5019	Started ballooning Parameter1 page ranges.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5020	Finished ballooning Parameter1 page ranges with status Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5021	Started de-committing GPAs - Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5022	Finished de-committing GPAs - Parameter1 pages with status Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5023	Started un-ballooning Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5024	Finished un-ballooning Parameter1 pages with status Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5025	Started committing Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5026	Finished committing Parameter1 pages with status Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5029	Started hot adding Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5030	Finished hot adding Parameter1 pages with status Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5031	Started hot add undoing Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5032	Finished hot add undoing Parameter1 pages with status Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5033	Started creating memory block with Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5034	Finished creating memory block with Parameter1 pages with status Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5035	Started un-ballooning Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5036	Finished un-ballooning Parameter1 pages with status Parameter2.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5037	An uncorrected memory error occurred at physical address PhysicalAddress.	Microsoft-Windows-Hyper-V-VID-Admin	N
5038	'PhysicalAddress' was reset because an uncorrected memory error occured at …	Microsoft-Windows-Hyper-V-VID-Admin	N
5039	An uncorrected memory error occurred at physical address Platform_Directed which …	Microsoft-Windows-Hyper-V-VID-Admin	N
5040	An uncorrected memory error occurred at physical address PhysicalAddress.	Microsoft-Windows-Hyper-V-VID-Admin	N
5041	One or more corrected memory error occurred at physical address PhysicalAddress.	Microsoft-Windows-Hyper-V-VID-Admin	N
5042	One or more corrected memory error occurred at physical address …	Microsoft-Windows-Hyper-V-VID-Admin	N
5043	One or more corrected memory error occurred at physical address …	Microsoft-Windows-Hyper-V-VID-Admin	N
5044	Failed to retrieve memory from the kernel with error Parameter0 during a fast …	Microsoft-Windows-Hyper-V-VID-Admin	N
5045	Failed to persist memory with the kernel with error Parameter0 during a fast …	Microsoft-Windows-Hyper-V-VID-Admin	N
5046	VMT_VID_ALLOCATE_PARTITION_NODE_PAGESStart	Operational	N
5047	VMT_VID_ALLOCATE_PARTITION_NODE_PAGESStop	Operational	N
5048	VMT_VID_MEMORY_BLOCK_PERSISTStart	Operational	N
5049	VMT_VID_MEMORY_BLOCK_PERSISTStop	Operational	N
5050	VMT_VID_MEMORY_BLOCK_RESTOREStart	Operational	N
5051	VMT_VID_MEMORY_BLOCK_RESTOREStop	Operational	N
5052	VMT_KSR_MEMORY_BLOCK_PERSISTStart	Operational	N
5053	VMT_KSR_MEMORY_BLOCK_PERSISTStop	Operational	N
5054	VMT_VID_MEMORY_BLOCK_PHU_TEARDOWNStart	Operational	N
5055	VMT_VID_MEMORY_BLOCK_PHU_TEARDOWNStop	Operational	N
5056	VMT_VID_PARTITION_PERSISTStart	Operational	N
5057	VMT_VID_PARTITION_PERSISTStop	Operational	N
5058	VMT_VID_PARTITION_UNPERSISTStart	Operational	N
5059	VMT_VID_PARTITION_UNPERSISTStop	Operational	N
5060	VMT_VID_PARTITION_WITHDRAW_MEMORYStart	Operational	N
5061	VMT_VID_PARTITION_WITHDRAW_MEMORYStop	Operational	N
5062	VMT_VID_GPA_MAPStart	Operational	N
5063	VMT_VID_GPA_MAPStop	Operational	N
5064	VMT_VID_GPA_UNMAPStart	Operational	N
5065	VMT_VID_GPA_UNMAPStop	Operational	N
5066	VMT_VID_MDL_PAGE_FREEStart	Operational	N
5067	VMT_VID_MDL_PAGE_FREEStop	Operational	N
5068	Started creating DAX file backed memory block with Parameter1 pages.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5069	Finished creating DAX file backed memory block with Parameter1 pages with status …	Microsoft-Windows-Hyper-V-VID-Analytic	N
5070	VMT_VID_EPFStart	Microsoft-Windows-Hyper-V-VID-Analytic	N
5071	VMT_VID_EPFStop	Microsoft-Windows-Hyper-V-VID-Analytic	N
5072	One or more uncorrected persistent memory errors (TotalPages pages) occurred.	Microsoft-Windows-Hyper-V-VID-Admin	N
5073	'PhysicalAddress' was reset because an uncorrected persistent memory error …	Microsoft-Windows-Hyper-V-VID-Admin	N
5074	'PhysicalAddress' was reset because one or more uncorrected persistent memory …	Microsoft-Windows-Hyper-V-VID-Admin	N
5075	An uncorrected persistent memory error occurred at physical address …	Microsoft-Windows-Hyper-V-VID-Admin	N
5076	An uncorrected persistent memory error occurred at physical address …	Microsoft-Windows-Hyper-V-VID-Admin	N
5077	One or more uncorrected persistent memory errors (Platform_Directed pages) …	Microsoft-Windows-Hyper-V-VID-Admin	N
5078	task_05078	Microsoft-Windows-Hyper-V-VID-Analytic	N
5079	task_05079	Microsoft-Windows-Hyper-V-VID-Analytic	N
5080	task_05080	Microsoft-Windows-Hyper-V-VID-Analytic	N
5081	task_05081	Microsoft-Windows-Hyper-V-VID-Analytic	N
5082	task_05082	Microsoft-Windows-Hyper-V-VID-Analytic	N
5083	Memory partition: Both Percentage(Parameter2) and SizeInMB(Parameter1) are …	Microsoft-Windows-Hyper-V-VID-Admin	N
5084	Memory partition: Both Percentage and SizeInMB are specified on the host.	Microsoft-Windows-Hyper-V-VID-Admin	N
5085	Memory partition: Both NUMA node settings and host settings are specified.	Microsoft-Windows-Hyper-V-VID-Admin	N
5086	Memory partition: Primary settings are different than the legacy settings.	Microsoft-Windows-Hyper-V-VID-Admin	N
5087	Memory partition: Legacy memory reserve percentage setting was used.	Microsoft-Windows-Hyper-V-VID-Admin	N
5088	Memory partition not created due to 0 partition size.	Microsoft-Windows-Hyper-V-VID-Admin	N
5089	Memory partition creation failed (Parameter1 MB) with status = Parameter0.	Microsoft-Windows-Hyper-V-VID-Admin	N
5090	Memory partition host percentage(Parameter0) is invalid.	Microsoft-Windows-Hyper-V-VID-Admin	N
5091	Memory partition (Parameter0) target could not be read from the registry.	Microsoft-Windows-Hyper-V-VID-Admin	N
5092	Memory partition (Parameter0) target could not be written to the registry.	Microsoft-Windows-Hyper-V-VID-Admin	N
5093	A non-zero memory partition (Parameter1) target size was associated with a …	Microsoft-Windows-Hyper-V-VID-Admin	N
5094	Memory partition (Parameter2) target number of nodes (Parameter0) did not match …	Microsoft-Windows-Hyper-V-VID-Admin	N
5095	task_05095	Microsoft-Windows-Hyper-V-VID-Analytic	N
5096	Memory partition per NUMA node (Parameter0) IO space size (Parameter1) …	Microsoft-Windows-Hyper-V-VID-Admin	N
5097	Memory partition per NUMA node (Parameter0) IO space size (Parameter1) is bigger …	Microsoft-Windows-Hyper-V-VID-Admin	N
5098	Memory partition host IO space size (Parameter0) unaligned.	Microsoft-Windows-Hyper-V-VID-Admin	N
5099	Memory partition host IO space size (Parameter0) is too big for size …	Microsoft-Windows-Hyper-V-VID-Admin	N
5100	Memory partition per NUMA node (Parameter0) size (Parameter1) unaligned.	Microsoft-Windows-Hyper-V-VID-Admin	N
5101	Memory partition host size (Parameter0) unaligned.	Microsoft-Windows-Hyper-V-VID-Admin	N
5102	Memory partition per NUMA node (Parameter0) percentage(Parameter1) is invalid.	Microsoft-Windows-Hyper-V-VID-Admin	N
5103	Memory partition legacy percentage(Parameter0) is invalid.	Microsoft-Windows-Hyper-V-VID-Admin	N
5104	Failed to retrieve memory block from the kernel with error Parameter0 during a …	Microsoft-Windows-Hyper-V-VID-Admin	N
5105	Failed to persist memory block with the kernel with error Parameter0 during a …	Microsoft-Windows-Hyper-V-VID-Admin	N
5106	VMT_VID_ALLOCATE_PARTITION_NODE_IOSPACE_PAGESStart	Operational	N
5107	VMT_VID_ALLOCATE_PARTITION_NODE_IOSPACE_PAGESStop	Operational	N
5108	Hypervisor metadata memory partition has hot added Parameter1 pages to NUMA node …	Microsoft-Windows-Hyper-V-VID-Admin	N
5109	Partition PartitionGuid VP VpIndex encountered ExceptionInfo with syndrome: …	Microsoft-Windows-Hyper-V-VID-Admin	N
5110	An uncorrected memory error occurred at physical address Platform_Directed, …	Microsoft-Windows-Hyper-V-VID-Admin	N
5111	An uncorrected memory error occurred at physical address Platform_Directed, …	Microsoft-Windows-Hyper-V-VID-Admin	N
5112	A memory error was reported to VID at physical address PhysicalAddress but …	Microsoft-Windows-Hyper-V-VID-Admin	N
5113	Hypervisor metadata memory partition has been referenced with status:Parameter0 …	Microsoft-Windows-Hyper-V-VID-Admin	N
5114	Started auto demote IO space on physical NUMA node Parameter0.	Microsoft-Windows-Hyper-V-VID-Analytic	N
5115	Finished auto demote IO space physical NUMA node Parameter0 with status …	Microsoft-Windows-Hyper-V-VID-Analytic	N

Event ID 1101: Failed to reserve Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to reserve Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to reserve %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1102: Failed to reserve Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to reserve Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to reserve %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1103: Failed to allocate Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to allocate Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to allocate %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1104: Failed to release Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to release Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to release %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1105: Failed to withdraw pages from bucket: Parameter1.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to withdraw pages from bucket: Parameter1. (Partition ID Parameter0).

Message #

Failed to withdraw pages from bucket: %2. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 1106: Failed to balloon Parameter1 page ranges: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to balloon Parameter1 page ranges: Parameter2. (Partition ID Parameter0).

Message #

Failed to balloon %2 page ranges: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1107: Failed to un-balloon Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to un-balloon Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to un-balloon %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1108: Failed to hot add Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to hot add Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to hot add %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1109: Failed to hot add undo Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to hot add undo Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to hot add undo %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1110: Failed to create mem block with Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to create mem block with Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to create mem block with %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 1111: Failed to create DAX file backed mem block with Parameter1 pages: Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Failed to create DAX file backed mem block with Parameter1 pages: Parameter2. (Partition ID Parameter0).

Message #

Failed to create DAX file backed mem block with %2 pages: %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 3000: Created partition with ID Parameter0 and name PartitionId.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Description

Created partition with ID Parameter0 and name PartitionId.

Message #

Created partition with ID %2 and name %1.

Fields #

Name	Description
`PartitionId` UnicodeString
`Parameter0` Int64

Event ID 5001: Started reserving Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_reservepages
Opcode: Start

Description

Started reserving Parameter1 pages. (Partition ID Parameter0).

Message #

Started reserving %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5002: Finished reserving pages with status = Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_reservepages
Opcode: Stop

Description

Finished reserving pages with status = Parameter2. Parameter1 pages reserved. Parameter3 HugeLocal, Parameter4 LargeLocal, Parameter5 SmallLocal, Parameter6 HugeRemote, Parameter7 LargeRemote, Parameter8 SmallRemote. (Partition ID Parameter0).

Message #

Finished reserving pages with status = %3. %2 pages reserved. %4 HugeLocal, %5 LargeLocal, %6 SmallLocal, %7 HugeRemote, %8 LargeRemote, %9 SmallRemote. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64
`Parameter3` Int64
`Parameter4` Int64
`Parameter5` Int64
`Parameter6` Int64
`Parameter7` Int64
`Parameter8` Int64

Event ID 5003: Started reserving bucket pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_reservepages
Opcode: Start

Description

Started reserving bucket pages. Reserving Parameter1 pages. (Partition ID Parameter0).

Message #

Started reserving bucket pages. Reserving %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5004: Finished reserving bucket pages with status = Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_reservepages
Opcode: Stop

Description

Finished reserving bucket pages with status = Parameter2. Parameter1 pages reserved. (Partition ID Parameter0).

Message #

Finished reserving bucket pages with status = %3. %2 pages reserved. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5005: Started allocating Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_reservepages
Opcode: Start

Description

Started allocating Parameter1 pages. (Partition ID Parameter0).

Message #

Started allocating %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5006: Finished allocating pages with status = Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_reservepages
Opcode: Stop

Description

Finished allocating pages with status = Parameter2. Parameter1 pages allocated. (Partition ID Parameter0).

Message #

Finished allocating pages with status = %3. %2 pages allocated. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5007: Started depositing pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_reservepages
Opcode: Start

Description

Started depositing pages. (Partition ID Parameter0).

Message #

Started depositing pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64

Event ID 5008: Finished depositing pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_reservepages
Opcode: Stop

Description

Finished depositing pages. (Partition ID Parameter0).

Message #

Finished depositing pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64

Event ID 5009: Started releasing Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_releasepages
Opcode: Start

Description

Started releasing Parameter1 pages. (Partition ID Parameter0).

Message #

Started releasing %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5010: Finished releasing Parameter1 pages with status = Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_releasepages
Opcode: Stop

Description

Finished releasing Parameter1 pages with status = Parameter2. (Partition ID Parameter0).

Message #

Finished releasing %2 pages with status = %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5011: Started releasing bucket Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_releasepages
Opcode: Start

Description

Started releasing bucket Parameter1 pages. (Partition ID Parameter0).

Message #

Started releasing bucket %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5012: Finished releasing bucket Parameter1 pages with status = Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_releasepages
Opcode: Stop

Description

Finished releasing bucket Parameter1 pages with status = Parameter2. (Partition ID Parameter0).

Message #

Finished releasing bucket %2 pages with status = %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5013: Started withdrawing pages from bucket.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Opcode: Start

Description

Started withdrawing pages from bucket. (Partition ID Parameter0).

Message #

Started withdrawing pages from bucket. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64

Event ID 5014: Finished withdrawing pages from bucket with status = Parameter1.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Opcode: Stop

Description

Finished withdrawing pages from bucket with status = Parameter1. (Partition ID Parameter0).

Message #

Finished withdrawing pages from bucket with status = %2. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5017: Started depositing pages to bucket from page list.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Opcode: Start

Description

Started depositing pages to bucket from page list. (Partition ID Parameter0).

Message #

Started depositing pages to bucket from page list. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64

Event ID 5018: Finished depositing pages to bucket from page list.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Opcode: Stop

Description

Finished depositing pages to bucket from page list. (Partition ID Parameter0).

Message #

Finished depositing pages to bucket from page list. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64

Event ID 5019: Started ballooning Parameter1 page ranges.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_balloonpages
Opcode: Start

Description

Started ballooning Parameter1 page ranges. (Partition ID Parameter0).

Message #

Started ballooning %2 page ranges. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5020: Finished ballooning Parameter1 page ranges with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_balloonpages
Opcode: Stop

Description

Finished ballooning Parameter1 page ranges with status Parameter2. (Partition ID Parameter0).

Message #

Finished ballooning %2 page ranges with status %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5021: Started de-committing GPAs - Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_balloonpages
Opcode: Start

Description

Started de-committing GPAs - Parameter1 pages. (Partition ID Parameter0).

Message #

Started de-committing GPAs - %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5022: Finished de-committing GPAs - Parameter1 pages with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_balloonpages
Opcode: Stop

Description

Finished de-committing GPAs - Parameter1 pages with status Parameter2. (Partition ID Parameter0).

Message #

Finished de-committing GPAs - %2 pages with status %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5023: Started un-ballooning Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_unballoonpages
Opcode: Start

Description

Started un-ballooning Parameter1 pages. (Partition ID Parameter0).

Message #

Started un-ballooning %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5024: Finished un-ballooning Parameter1 pages with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_unballoonpages
Opcode: Stop

Description

Finished un-ballooning Parameter1 pages with status Parameter2. (Partition ID Parameter0).

Message #

Finished un-ballooning %2 pages with status %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5025: Started committing Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Opcode: Start

Description

Started committing Parameter1 pages. (Partition ID Parameter0).

Message #

Started committing %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5026: Finished committing Parameter1 pages with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Opcode: Stop

Description

Finished committing Parameter1 pages with status Parameter2. (Partition ID Parameter0).

Message #

Finished committing %2 pages with status %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5029: Started hot adding Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_hotadd
Opcode: Start

Description

Started hot adding Parameter1 pages. (Partition ID Parameter0).

Message #

Started hot adding %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5030: Finished hot adding Parameter1 pages with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_hotadd
Opcode: Stop

Description

Finished hot adding Parameter1 pages with status Parameter2. (Partition ID Parameter0).

Message #

Finished hot adding %2 pages with status %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5031: Started hot add undoing Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_hotaddundo
Opcode: Start

Description

Started hot add undoing Parameter1 pages. (Partition ID Parameter0).

Message #

Started hot add undoing %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5032: Finished hot add undoing Parameter1 pages with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_hotaddundo
Opcode: Stop

Description

Finished hot add undoing Parameter1 pages with status Parameter2. (Partition ID Parameter0).

Message #

Finished hot add undoing %2 pages with status %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5033: Started creating memory block with Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_creatememoryblock
Opcode: Start

Description

Started creating memory block with Parameter1 pages. (Partition ID Parameter0).

Message #

Started creating memory block with %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5034: Finished creating memory block with Parameter1 pages with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_creatememoryblock
Opcode: Stop

Description

Finished creating memory block with Parameter1 pages with status Parameter2. (Partition ID Parameter0).

Message #

Finished creating memory block with %2 pages with status %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5034
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5034

Event ID 5035: Started un-ballooning Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_unballoonpages
Opcode: Start

Description

Started un-ballooning Parameter1 pages. Contiguous = Parameter2. (Partition ID Parameter0).

Message #

Started un-ballooning %2 pages. Contiguous = %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5036: Finished un-ballooning Parameter1 pages with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_unballoonpages
Opcode: Stop

Description

Finished un-ballooning Parameter1 pages with status Parameter2. Contiguous = Parameter3. (Partition ID Parameter0).

Message #

Finished un-ballooning %2 pages with status %3. Contiguous = %4. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64
`Parameter3` Int64

Event ID 5037: An uncorrected memory error occurred at physical address PhysicalAddress.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

An uncorrected memory error occurred at physical address PhysicalAddress. This page was not found in a virtual machine. No action was taken. (Platform Directed: Flags).

Message #

An uncorrected memory error occurred at physical address %1. This page was not found in a virtual machine. No action was taken. (Platform Directed: %2)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8

Event ID 5038: 'PhysicalAddress' was reset because an uncorrected memory error occured at physical address Platform_Directed, which was used by this virtual machine.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

'PhysicalAddress' was reset because an uncorrected memory error occured at physical address Platform_Directed, which was used by this virtual machine. (Virtual Machine: Flags, Platform Directed: Consumed, Consumed: PartitionFriendlyName).

Message #

'%3' was reset because an uncorrected memory error occured at physical address %1, which was used by this virtual machine. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5039: An uncorrected memory error occurred at physical address Platform_Directed which is used by virtual machine 'PhysicalAddress'.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

An uncorrected memory error occurred at physical address PhysicalAddress which is used by virtual machine 'PartitionFriendlyName'. The affected page has been released. A machine check event correpsonding to this memory error was injected into the virtual machine for handling by the virtual machine's operating system. (Virtual Machine: PartitionName, Platform Directed: Flags, Consumed: Consumed)

Message #

An uncorrected memory error occurred at physical address %1 which is used by virtual machine '%3'. The affected page has been released. A machine check event correpsonding to this memory error was injected into the virtual machine for handling by the virtual machine's operating system. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5039
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5039

Event ID 5040: An uncorrected memory error occurred at physical address PhysicalAddress.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

An uncorrected memory error occurred at physical address PhysicalAddress. The virtual machine that was using the page is no longer valid. No action was taken. (Platform Directed: Flags).

Message #

An uncorrected memory error occurred at physical address %1. The virtual machine that was using the page is no longer valid. No action was taken. (Platform Directed: %2)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5040
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5040

Event ID 5041: One or more corrected memory error occurred at physical address PhysicalAddress.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

One or more corrected memory error occurred at physical address PhysicalAddress. This page was not found in a virtual machine. No action was taken. (Platform Directed: Flags).

Message #

One or more corrected memory error occurred at physical address %1. This page was not found in a virtual machine. No action was taken. (Platform Directed: %2)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8

Event ID 5042: One or more corrected memory error occurred at physical address Platform_Directed, which is used by virtual machine 'PhysicalAddress'.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

One or more corrected memory error occurred at physical address PhysicalAddress, which is used by virtual machine 'PartitionFriendlyName'. The page could not be replaced. No action was taken. The virtual machine will continue operating normally. (Virtual Machine: PartitionName, Platform Directed: Flags, Consumed: Consumed)

Message #

One or more corrected memory error occurred at physical address %1, which is used by virtual machine '%3'. The page could not be replaced. No action was taken. The virtual machine will continue operating normally. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5043: One or more corrected memory error occurred at physical address Platform_Directed, which is used by virtual machine 'PhysicalAddress'.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

One or more corrected memory error occurred at physical address PhysicalAddress, which is used by virtual machine 'PartitionFriendlyName'. The page has been replaced. The virtual machine will continue operating normally. (Virtual Machine: PartitionName, Platform Directed: Flags, Consumed: Consumed)

Message #

One or more corrected memory error occurred at physical address %1, which is used by virtual machine '%3'. The page has been replaced. The virtual machine will continue operating normally. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5044: Failed to retrieve memory from the kernel with error Parameter0 during a fast restore operation.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Failed to retrieve memory from the kernel with error Parameter0 during a fast restore operation. (Virtual Machine PartitionId).

Message #

Failed to retrieve memory from the kernel with error %2 during a fast restore operation. (Virtual Machine %1)

Fields #

Name	Description
`PartitionId` UnicodeString
`Parameter0` Int64

Event ID 5045: Failed to persist memory with the kernel with error Parameter0 during a fast save operation.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Failed to persist memory with the kernel with error Parameter0 during a fast save operation. (Virtual Machine PartitionId).

Message #

Failed to persist memory with the kernel with error %2 during a fast save operation. (Virtual Machine %1)

Fields #

Name	Description
`PartitionId` UnicodeString
`Parameter0` Int64

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5045
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5045

Event ID 5046: VMT_VID_ALLOCATE_PARTITION_NODE_PAGESStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_ALLOCATE_PARTITION_NODE_PAGES
Opcode: Start

Fields #

Name	Description
`LowAddress` UInt64
`HighAddress` UInt64
`SkipBytes` UInt64
`TotalBytes` UInt64
`CacheType` UInt32
`NodeIndex` UInt8
`Flags` UInt32
`MemoryPartition` Pointer
`PartitionGuid` GUID

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5046
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5046

Event ID 5047: VMT_VID_ALLOCATE_PARTITION_NODE_PAGESStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_ALLOCATE_PARTITION_NODE_PAGES
Opcode: Stop

Fields #

Name	Description
`Mdl` Pointer
`TotalBytes` UInt64

Event ID 5048: VMT_VID_MEMORY_BLOCK_PERSISTStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_MEMORY_BLOCK_PERSIST
Opcode: Start

Fields #

Name	Description
`MbpArraySize` UInt64
`PartitionGuid` GUID

Event ID 5049: VMT_VID_MEMORY_BLOCK_PERSISTStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_MEMORY_BLOCK_PERSIST
Opcode: Stop

Fields #

Name	Description
`Status` UInt64	NTSTATUS reference

Event ID 5050: VMT_VID_MEMORY_BLOCK_RESTOREStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_MEMORY_BLOCK_RESTORE
Opcode: Start

Fields #

Name	Description
`PageCountToBack` HexInt64
`KsrBlockId` UInt64
`PartitionGuid` GUID

Event ID 5051: VMT_VID_MEMORY_BLOCK_RESTOREStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_MEMORY_BLOCK_RESTORE
Opcode: Stop

Fields #

Name	Description
`MbpArraySize` UInt64
`Status` UInt64	NTSTATUS reference

Event ID 5052: VMT_KSR_MEMORY_BLOCK_PERSISTStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_KSR_MEMORY_BLOCK_PERSIST
Opcode: Start

Fields #

Name	Description
`KsrMemoryRunCount` UInt32
`PartitionGuid` GUID

Event ID 5053: VMT_KSR_MEMORY_BLOCK_PERSISTStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_KSR_MEMORY_BLOCK_PERSIST
Opcode: Stop

Fields #

Name	Description
`Status` UInt64	NTSTATUS reference

Event ID 5054: VMT_VID_MEMORY_BLOCK_PHU_TEARDOWNStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_MEMORY_BLOCK_PHU_TEARDOWN
Opcode: Start

Fields #

Name	Description
`MbpArraySize` UInt64
`PartitionGuid` GUID

Event ID 5055: VMT_VID_MEMORY_BLOCK_PHU_TEARDOWNStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_MEMORY_BLOCK_PHU_TEARDOWN
Opcode: Stop

Event ID 5056: VMT_VID_PARTITION_PERSISTStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_PARTITION_PERSIST
Opcode: Start

Fields #

Name	Description
`PartitionGuid` GUID

Event ID 5057: VMT_VID_PARTITION_PERSISTStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_PARTITION_PERSIST
Opcode: Stop

Fields #

Name	Description
`Status` UInt64	NTSTATUS reference

Event ID 5058: VMT_VID_PARTITION_UNPERSISTStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_PARTITION_UNPERSIST
Opcode: Start

Fields #

Name	Description
`KsrPersisted` Int8
`PartitionGuid` GUID

Event ID 5059: VMT_VID_PARTITION_UNPERSISTStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_PARTITION_UNPERSIST
Opcode: Stop

Fields #

Name	Description
`Status` UInt64	NTSTATUS reference

Event ID 5060: VMT_VID_PARTITION_WITHDRAW_MEMORYStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_PARTITION_WITHDRAW_MEMORY
Opcode: Start

Fields #

Name	Description
`KsrPersisted` Int8
`PartitionGuid` GUID

Event ID 5061: VMT_VID_PARTITION_WITHDRAW_MEMORYStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_PARTITION_WITHDRAW_MEMORY
Opcode: Stop

Fields #

Name	Description
`Status` UInt64	NTSTATUS reference

Event ID 5062: VMT_VID_GPA_MAPStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_GPA_MAP
Opcode: Start

Fields #

Name	Description
`StartGpaPage` UInt64
`StartMbp` UInt64
`MbpCount` UInt64
`InterceptOverrideFlags` UInt32
`PartitionGuid` GUID

Event ID 5063: VMT_VID_GPA_MAPStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_GPA_MAP
Opcode: Stop

Fields #

Name	Description
`Status` UInt64	NTSTATUS reference

Event ID 5064: VMT_VID_GPA_UNMAPStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_GPA_UNMAP
Opcode: Start

Fields #

Name	Description
`FirstPage` UInt64
`LastPage` UInt64
`PartitionGuid` GUID

Event ID 5065: VMT_VID_GPA_UNMAPStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_GPA_UNMAP
Opcode: Stop

Fields #

Name	Description
`Status` UInt64	NTSTATUS reference

Event ID 5066: VMT_VID_MDL_PAGE_FREEStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_MDL_PAGE_FREE
Opcode: Start

Fields #

Name	Description
`PartitionGuid` GUID

Event ID 5067: VMT_VID_MDL_PAGE_FREEStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_MDL_PAGE_FREE
Opcode: Stop

Event ID 5068: Started creating DAX file backed memory block with Parameter1 pages.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_createDAXfilebackedmemoryblock
Opcode: Start

Description

Started creating DAX file backed memory block with Parameter1 pages. (Partition ID Parameter0).

Message #

Started creating DAX file backed memory block with %2 pages. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5069: Finished creating DAX file backed memory block with Parameter1 pages with status Parameter2.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_createDAXfilebackedmemoryblock
Opcode: Stop

Description

Finished creating DAX file backed memory block with Parameter1 pages with status Parameter2. (Partition ID Parameter0).

Message #

Finished creating DAX file backed memory block with %2 pages with status %3. (Partition ID %1)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5070: VMT_VID_EPFStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VMT_VID_EPF
Opcode: Start

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5071: VMT_VID_EPFStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VMT_VID_EPF
Opcode: Stop

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5072: One or more uncorrected persistent memory errors (TotalPages pages) occurred.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

One or more uncorrected persistent memory errors (TotalPages pages) occurred. These pages were not found in a virtual machine. No action was taken. (Platform Directed: Flags).

Message #

One or more uncorrected persistent memory errors (%1 pages) occurred. These pages were not found in a virtual machine. No action was taken. (Platform Directed: %2)

Fields #

Name	Description
`TotalPages` HexInt64
`Flags` UInt8

Event ID 5073: 'PhysicalAddress' was reset because an uncorrected persistent memory error occured at physical address Platform_Directed, which was used by this virtual machine.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

'PhysicalAddress' was reset because an uncorrected persistent memory error occured at physical address Platform_Directed, which was used by this virtual machine. (Virtual Machine: Flags, Platform Directed: Consumed, Consumed: PartitionFriendlyName).

Message #

'%3' was reset because an uncorrected persistent memory error occured at physical address %1, which was used by this virtual machine. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5074: 'PhysicalAddress' was reset because one or more uncorrected persistent memory errors (Platform_Directed pages) occured, which were used by this virtual machine.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

'PhysicalAddress' was reset because one or more uncorrected persistent memory errors (Platform_Directed pages) occured, which were used by this virtual machine. (Virtual Machine: Flags, Platform Directed: Consumed, Consumed: PartitionFriendlyName).

Message #

'%3' was reset because one or more uncorrected persistent memory errors (%1 pages) occured, which were used by this virtual machine. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5075: An uncorrected persistent memory error occurred at physical address Platform_Directed which is used by virtual machine 'PhysicalAddress'.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

An uncorrected persistent memory error occurred at physical address PhysicalAddress which is used by virtual machine 'PartitionFriendlyName'. The affected page has been released. A machine check event correpsonding to this persistent memory error was injected into the virtual machine for handling by the virtual machine's operating system. (Virtual Machine: PartitionName, Platform Directed: Flags, Consumed: Consumed)

Message #

An uncorrected persistent memory error occurred at physical address %1 which is used by virtual machine '%3'. The affected page has been released. A machine check event correpsonding to this persistent memory error was injected into the virtual machine for handling by the virtual machine's operating system. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5076: An uncorrected persistent memory error occurred at physical address PhysicalAddress.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

An uncorrected persistent memory error occurred at physical address PhysicalAddress. The virtual machine that was using the page is no longer valid. No action was taken. (Platform Directed: Flags).

Message #

An uncorrected persistent memory error occurred at physical address %1. The virtual machine that was using the page is no longer valid. No action was taken. (Platform Directed: %2)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8

Event ID 5077: One or more uncorrected persistent memory errors (Platform_Directed pages) occurred, which were used by virtual machine 'TotalPages'.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

One or more uncorrected persistent memory errors (Platform_Directed pages) occurred, which were used by virtual machine 'TotalPages'. ARS notification generated. (Virtual Machine: Flags, Platform Directed: Consumed, Consumed: PartitionFriendlyName).

Message #

One or more uncorrected persistent memory errors (%1 pages) occurred, which were used by virtual machine '%3'. ARS notification generated. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`TotalPages` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5078: task_05078

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Fields #

Name	Description
`PartitionGuid` GUID
`Parameter1` UInt64

Event ID 5079: task_05079

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Fields #

Name	Description
`PartitionGuid` GUID
`Parameter1` UnicodeString

Event ID 5080: task_05080

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Fields #

Name	Description
`PartitionGuid` GUID
`Parameter1` UInt32

Event ID 5081: task_05081

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Fields #

Name	Description
`PartitionGuid` GUID
`Parameter1` UInt64
`Parameter2` UInt32

Event ID 5082: task_05082

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Fields #

Name	Description
`PartitionGuid` GUID
`PartitionName` UnicodeString
`ProcessId` UInt64
`VpCount` UInt32
`ThreadId` UInt64

Event ID 5083: Memory partition: Both Percentage(Parameter2) and SizeInMB(Parameter1) are specified for NUMA node Parameter0.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition: Both Percentage(Parameter2) and SizeInMB(Parameter1) are specified for NUMA node Parameter0. Percentage(Parameter2) is ignored.

Message #

Memory partition: Both Percentage(%3) and SizeInMB(%2) are specified for NUMA node %1. Percentage(%3) is ignored.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5084: Memory partition: Both Percentage and SizeInMB are specified on the host.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition: Both Percentage and SizeInMB are specified on the host. Percentage is ignored.

Message #

Memory partition: Both Percentage and SizeInMB are specified on the host. Percentage is ignored.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5085: Memory partition: Both NUMA node settings and host settings are specified.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition: Both NUMA node settings and host settings are specified. The host settings are ignored.

Message #

Memory partition: Both NUMA node settings and host settings are specified. The host settings are ignored.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5086: Memory partition: Primary settings are different than the legacy settings.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition: Primary settings are different than the legacy settings. The legacy settings are ignored.

Message #

Memory partition: Primary settings are different than the legacy settings. The legacy settings are ignored.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5087: Memory partition: Legacy memory reserve percentage setting was used.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition: Legacy memory reserve percentage setting was used.

Message #

Memory partition: Legacy memory reserve percentage setting was used.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5088: Memory partition not created due to 0 partition size.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition not created due to 0 partition size. This maybe caused by invalid percentage or unaligned size.

Message #

Memory partition not created due to 0 partition size. This maybe caused by invalid percentage or unaligned size.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5089: Memory partition creation failed (Parameter1 MB) with status = Parameter0.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition creation failed (Parameter1 MB) with status = Parameter0.

Message #

Memory partition creation failed (%2 MB) with status = %1.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5090: Memory partition host percentage(Parameter0) is invalid.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition host percentage(Parameter0) is invalid.

Message #

Memory partition host percentage(%1) is invalid.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5091: Memory partition (Parameter0) target could not be read from the registry.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition (Parameter0) target could not be read from the registry.

Message #

Memory partition (%1) target could not be read from the registry.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5092: Memory partition (Parameter0) target could not be written to the registry.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition (Parameter0) target could not be written to the registry.

Message #

Memory partition (%1) target could not be written to the registry.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5093: A non-zero memory partition (Parameter1) target size was associated with a memoryless and processorless NUMA node.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

A non-zero memory partition (Parameter1) target size was associated with a memoryless and processorless NUMA node. Node Number Parameter0.

Message #

A non-zero memory partition (%2) target size was associated with a memoryless and processorless NUMA node. Node Number %1.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5094: Memory partition (Parameter2) target number of nodes (Parameter0) did not match the number of NUMA nodes on the system (Parameter1).

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition (Parameter2) target number of nodes (Parameter0) did not match the number of NUMA nodes on the system (Parameter1).

Message #

Memory partition (%3) target number of nodes (%1) did not match the number of NUMA nodes on the system (%2).

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5095: task_05095

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic

Fields #

Name	Description
`PartitionGuid` GUID
`PartitionName` UnicodeString
`PinBackingPages` UInt8
`DeferredCommit` UInt8
`PrivateCompressionStore` UInt8
`HotHints` UInt8
`ColdHints` UInt8
`ColdDiscardHints` UInt8
`EnlightenedPageFaults` UInt8
`BackingPageSizeType` UInt8
`FaultClusterSizeInPages` UInt64
`DirectMapFaultClusterSizeInPages` UInt64

Event ID 5096: Memory partition per NUMA node (Parameter0) IO space size (Parameter1) unaligned.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition per NUMA node (Parameter0) IO space size (Parameter1) unaligned.

Message #

Memory partition per NUMA node (%1) IO space size (%2) unaligned.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5097: Memory partition per NUMA node (Parameter0) IO space size (Parameter1) is bigger than size (Parameter2).

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition per NUMA node (Parameter0) IO space size (Parameter1) is bigger than size (Parameter2).

Message #

Memory partition per NUMA node (%1) IO space size (%2) is bigger than size (%3).

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5098: Memory partition host IO space size (Parameter0) unaligned.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition host IO space size (Parameter0) unaligned.

Message #

Memory partition host IO space size (%1) unaligned.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5099: Memory partition host IO space size (Parameter0) is too big for size (Parameter1).

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition host IO space size (Parameter0) is too big for size (Parameter1).

Message #

Memory partition host IO space size (%1) is too big for size (%2).

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5100: Memory partition per NUMA node (Parameter0) size (Parameter1) unaligned.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition per NUMA node (Parameter0) size (Parameter1) unaligned.

Message #

Memory partition per NUMA node (%1) size (%2) unaligned.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5101: Memory partition host size (Parameter0) unaligned.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition host size (Parameter0) unaligned.

Message #

Memory partition host size (%1) unaligned.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5102: Memory partition per NUMA node (Parameter0) percentage(Parameter1) is invalid.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition per NUMA node (Parameter0) percentage(Parameter1) is invalid.

Message #

Memory partition per NUMA node (%1) percentage(%2) is invalid.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5103: Memory partition legacy percentage(Parameter0) is invalid.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Memory partition legacy percentage(Parameter0) is invalid.

Message #

Memory partition legacy percentage(%1) is invalid.

Fields #

Name	Description
`Parameter0` Int64

Event ID 5104: Failed to retrieve memory block from the kernel with error Parameter0 during a fast restore operation.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Failed to retrieve memory block from the kernel with error Parameter0 during a fast restore operation. (Virtual Machine PartitionId).

Message #

Failed to retrieve memory block from the kernel with error %2 during a fast restore operation. (Virtual Machine %1)

Fields #

Name	Description
`PartitionId` UnicodeString
`Parameter0` Int64

Event ID 5105: Failed to persist memory block with the kernel with error Parameter0 during a fast save operation.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Failed to persist memory block with the kernel with error Parameter0 during a fast save operation. (Virtual Machine PartitionId).

Message #

Failed to persist memory block with the kernel with error %2 during a fast save operation. (Virtual Machine %1)

Fields #

Name	Description
`PartitionId` UnicodeString
`Parameter0` Int64

Event ID 5106: VMT_VID_ALLOCATE_PARTITION_NODE_IOSPACE_PAGESStart

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_ALLOCATE_PARTITION_NODE_IOSPACE_PAGES
Opcode: Start

Fields #

Name	Description
`TotalPageCount` UInt64
`NodeIndex` UInt8
`Flags` UInt32
`MemoryPartition` Pointer
`PartitionGuid` GUID

Event ID 5107: VMT_VID_ALLOCATE_PARTITION_NODE_IOSPACE_PAGESStop

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Operational
Task: VMT_VID_ALLOCATE_PARTITION_NODE_IOSPACE_PAGES
Opcode: Stop

Fields #

Name	Description
`Status` UInt64	NTSTATUS reference
`TotalPageCount` UInt64
`TotalRemotePageCount` UInt64
`RangeList` Pointer
`RangeCount` UInt64

Event ID 5108: Hypervisor metadata memory partition has hot added Parameter1 pages to NUMA node Parameter0.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Hypervisor metadata memory partition has hot added Parameter1 pages to NUMA node Parameter0.

Message #

Hypervisor metadata memory partition has hot added %2 pages to NUMA node %1.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5109: Partition PartitionGuid VP VpIndex encountered ExceptionInfo with syndrome: ExceptionSyndrome and Vbar exception type: ExceptionType for memory GVA: Gva, GPA: Gpa, PFN: Pfn.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Partition PartitionGuid VP VpIndex encountered ExceptionInfo with syndrome: ExceptionSyndrome and Vbar exception type: ExceptionType for memory GVA: Gva, GPA: Gpa, PFN: Pfn. Handler ouptut - WheaResult: WheaResult.

Message #

Partition %1 VP %2 encountered %3 with syndrome: %4 and Vbar exception type: %5 for memory GVA: %6, GPA: %7, PFN: %8. Handler ouptut - WheaResult: %9.

Fields #

Name	Description
`PartitionGuid` GUID
`VpIndex` UInt32
`ExceptionInfo` UnicodeString
`ExceptionSyndrome` UInt32
`ExceptionType` UInt32
`Gva` UInt64
`Gpa` UInt64
`Pfn` UInt64
`WheaResult` UInt32

Event ID 5110: An uncorrected memory error occurred at physical address Platform_Directed, which is used by virtual machine 'PhysicalAddress'.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

An uncorrected memory error occurred at physical address PhysicalAddress, which is used by virtual machine 'PartitionFriendlyName'. The GPA mapped to this address was already poisoned by another instance of the handler. (Virtual Machine: PartitionName, Platform Directed: Flags, Consumed: Consumed)

Message #

An uncorrected memory error occurred at physical address %1, which is used by virtual machine '%3'. The GPA mapped to this address was already poisoned by another instance of the handler. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5111: An uncorrected memory error occurred at physical address Platform_Directed, which is used by virtual machine 'PhysicalAddress'.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

An uncorrected memory error occurred at physical address , which is used by virtual machine ''. The GPA mapped to this address was poisoned. (Virtual Machine: , Platform Directed: , Consumed: ).

Message #

An uncorrected memory error occurred at physical address %1, which is used by virtual machine '%3'. The GPA mapped to this address was poisoned. (Virtual Machine: %4, Platform Directed: %2, Consumed: %5)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8
`PartitionFriendlyName` UnicodeString
`PartitionName` UnicodeString
`Consumed` UInt8

Event ID 5112: A memory error was reported to VID at physical address PhysicalAddress but contained invalid/unsupported parameters.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

A memory error was reported to VID at physical address PhysicalAddress but contained invalid/unsupported parameters. (Platform Directed: Flags).

Message #

A memory error was reported to VID at physical address %1 but contained invalid/unsupported parameters. (Platform Directed: %2)

Fields #

Name	Description
`PhysicalAddress` HexInt64
`Flags` UInt8

Event ID 5113: Hypervisor metadata memory partition has been referenced with status:Parameter0 and state:Parameter1.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Admin

Description

Hypervisor metadata memory partition has been referenced with status:Parameter0 and state:Parameter1.

Message #

Hypervisor metadata memory partition has been referenced with status:%1 and state:%2.

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64

Event ID 5114: Started auto demote IO space on physical NUMA node Parameter0.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_AutomaticdemotionofIOspace
Opcode: Start

Description

Started auto demote IO space on physical NUMA node Parameter0. (NumaNodeIsRequired:Parameter1, MemoryPartitionId:Parameter2).

Message #

Started auto demote IO space on physical NUMA node %1. (NumaNodeIsRequired:%2, MemoryPartitionId:%3)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64

Event ID 5115: Finished auto demote IO space physical NUMA node Parameter0 with status Parameter3.

Provider: Microsoft-Windows-Hyper-V-VID
Channel: Microsoft-Windows-Hyper-V-VID-Analytic
Task: VID_AutomaticdemotionofIOspace
Opcode: Stop

Description

Finished auto demote IO space physical NUMA node Parameter0 with status Parameter3. (NumaNodeIsRequired:Parameter1, MemoryPartitionId:Parameter2).

Message #

Finished auto demote IO space physical NUMA node %1 with status %4. (NumaNodeIsRequired:%2, MemoryPartitionId:%3)

Fields #

Name	Description
`Parameter0` Int64
`Parameter1` Int64
`Parameter2` Int64
`Parameter3` Int64

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 5931d877-4860-4ee7-a95c-610a5f0d1407

Defined in vid.sys, the binary that emits these events.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02

Downloads

Microsoft-Windows-Hyper-V-VID registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)