Microsoft-Windows-Hyper-V-Virtual-PMEM
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | [VMID VmId] | Operational | N | N |
| 1 | [VMID VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 2 | [VMID VmId] | Operational | N | N |
| 2 | [VMID VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 3 | [VMID VmId] | Operational | N | N |
| 3 | [VMID VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 4 | [VMID VmId] | Operational | N | N |
| 4 | [VMID VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 10 | 'VmName': Virtual PMEM device 'Locator' is mapped into virtual machine address … | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
| 11 | 'VmName': Virtual PMEM device 'String' failed to start | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
| 12 | 'VmName': Saving, live-migrating or creating a checkpoint of a virtual machine … | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
| 13 | 'VmName': Virtual PMEM device 'String' must be located on a DAX-enabled volume … | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
| 14 | 'VmName': This virtual machine has been configured with a virtual PMEM device | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
| 15 | 'VmName': This virtual machine has been configured with a Physically backed PMEM … | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
Event ID 1: [VMID VmId]
#Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1: [VMID VmId] TraceData.
#Event ID 2: [VMID VmId]
#Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 2: [VMID VmId] TraceData.
#Event ID 3: [VMID VmId]
#Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 3: [VMID VmId] TraceData.
#Event ID 4: [VMID VmId]
#Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 4: [VMID VmId] TraceData.
#Event ID 10: 'VmName': Virtual PMEM device 'Locator' is mapped into virtual machine address space at base address BaseAddress, size Size bytes
#Description
'VmName': Virtual PMEM device 'Locator' is mapped into virtual machine address space at base address BaseAddress, size Size bytes. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Locator UnicodeString | |
BaseAddress UInt64 | |
Size UInt64 |
Event ID 11: 'VmName': Virtual PMEM device 'String' failed to start
#Description
'VmName': Virtual PMEM device 'String' failed to start. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
String UnicodeString | |
ErrorCodeString UnicodeString | |
ErrorCode UInt32 | |
Param1 UnicodeString | |
Param2 UnicodeString |
Event ID 12: 'VmName': Saving, live-migrating or creating a checkpoint of a virtual machine with persistent memory devices is not supported
#Description
'VmName': Saving, live-migrating or creating a checkpoint of a virtual machine with persistent memory devices is not supported. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
String UnicodeString | |
ErrorCodeString UnicodeString | |
ErrorCode UInt32 | |
Param1 UnicodeString | |
Param2 UnicodeString |
Event ID 13: 'VmName': Virtual PMEM device 'String' must be located on a DAX-enabled volume to be successfully mapped into the virtual machine address space
#Description
'VmName': Virtual PMEM device 'String' must be located on a DAX-enabled volume to be successfully mapped into the virtual machine address space. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
String UnicodeString | |
ErrorCodeString UnicodeString | |
ErrorCode UInt32 | |
Param1 UnicodeString | |
Param2 UnicodeString |
Event ID 14: 'VmName': This virtual machine has been configured with a virtual PMEM device
#Description
'VmName': This virtual machine has been configured with a virtual PMEM device. Virtual PMEM is a preview feature and is not recommended for production use. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 15: 'VmName': This virtual machine has been configured with a Physically backed PMEM controller non-DAX backing store
#Description
'VmName': This virtual machine has been configured with a Physically backed PMEM controller non-DAX backing store. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Provenance
ETW provider GUID ae3f5bf8-ab9f-56d6-29c8-8c312e2faec2
Defined in vmpmem.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB