Microsoft-Windows-VHDMP

Event	Title	Channel	Sample	Rule
1	The VHD VhdFileName has come online (surfaced) as disk number VhdDiskNumber.	Microsoft-Windows-VHDMP-Operational	Y	N
2	The VHD VhdFileName has been removed (unsurfaced) as disk number VhdDiskNumber.	Microsoft-Windows-VHDMP-Operational	Y	N
3	Failed to surface VHD VhdFileName.	Microsoft-Windows-VHDMP-Operational	N	N
4	Failed to surface VHD VhdFileName.	Microsoft-Windows-VHDMP-Operational	N	N
5	Failed to VhdMetaOps VHD VhdFileName.	Microsoft-Windows-VHDMP-Operational	N	N
6	Operation failed on VHD VhdFileName.	Microsoft-Windows-VHDMP-Operational	N	N
7	The Vhd Chain for VHD VhdFileName is corrupted.	Microsoft-Windows-VHDMP-Operational	N	N
8	The change tracking file for VHD VhdFileName is corrupted and cannot be read.	Microsoft-Windows-VHDMP-Operational	N	N
9	The VHD file VhdFileName has been modified without updating its associated …	Microsoft-Windows-VHDMP-Operational	N	N
10	Error Status occured when attempting to update the change tracking file for VHD …	Microsoft-Windows-VHDMP-Operational	N	N
11	Surface for VHD VhdFileName is invalidated and will be removed (unsurfaced) …	Microsoft-Windows-VHDMP-Operational	N	N
12	Handle for virtual disk 'VhdFile' created successfully.	Microsoft-Windows-VHDMP-Operational	Y	N
13	Failed to create handle for virtual disk 'VhdFile'.	Microsoft-Windows-VHDMP-Operational	N	N
14	Virtual disk handle closed: HandleContext = HandleContext, VirtualDisk = …	Microsoft-Windows-VHDMP-Operational	Y	N
15	Virtual disk object created: VirtualDisk.	Microsoft-Windows-VHDMP-Operational	Y	N
16	Virtual disk object destroyed: VirtualDisk.	Microsoft-Windows-VHDMP-Operational	Y	N
17	Virtual disk 'VhdFileName' (no host access) has been surfaced.	Microsoft-Windows-VHDMP-Operational	Y	N
18	Virtual disk 'VhdFileName' (no host access) has been unsurfaced.	Microsoft-Windows-VHDMP-Operational	Y	N
19	The VHD VhdFileName has come online (surfaced) as disk number VhdInstanceId.	Microsoft-Windows-VHDMP-Operational	N	N
20	The VHD VhdFileName has been removed (unsurfaced) as disk number VhdInstanceId.	Microsoft-Windows-VHDMP-Operational	N	N
21	Starting to open handle for virtual disk.	Microsoft-Windows-VHDMP-Operational	Y	N
22	Starting to create the handle for the file backing virtual disk 'VhdFileName'.	Microsoft-Windows-VHDMP-Operational	Y	N
23	Handle for the file backing virtual disk 'VhdFileName' created successfully.	Microsoft-Windows-VHDMP-Operational	Y	N
24	Failed to create handle for the file backing virtual disk 'VhdFileName'.	Microsoft-Windows-VHDMP-Operational	Y	N
25	Beginning to bring the VHD VhdFileName online (surface).	Microsoft-Windows-VHDMP-Operational	Y	N
26	Beginning to remove the VHD VirtualDisk (unsurface).	Microsoft-Windows-VHDMP-Operational	Y	N
27	Starting to close the handle for the file backing virtual disk 'VhdFileName'.	Microsoft-Windows-VHDMP-Operational	Y	N
28	Handle for the file backing virtual disk 'VhdFileName' closed successfully.	Microsoft-Windows-VHDMP-Operational	Y	N
29	Operation failed on VHD VhdFileName.	Microsoft-Windows-VHDMP-Operational	N	N
30	Starting to close virtual disk handle: HandleContext = HandleContext, …	Microsoft-Windows-VHDMP-Operational	Y	N
31	Starting to cleanup the backing store for virtual disk 'VhdFileName'.	Microsoft-Windows-VHDMP-Operational	Y	N
32	Finished cleaning up the backing store for virtual disk 'VhdFileName'.	Microsoft-Windows-VHDMP-Operational	Y	N
33	Starting to flush the backing store footer for virtual disk 'VhdFileName'.	Microsoft-Windows-VHDMP-Operational	Y	N
34	Finished flushing the backing store footer for virtual disk 'VhdFileName'.	Microsoft-Windows-VHDMP-Operational	Y	N
35	Virtual disk 'VhdFileName' (no host access) has been unsurfaced with unflushed …	Microsoft-Windows-VHDMP-Operational	N	N
36	I/O cancellation (FastClose) started for file 'VhdFile'.	Microsoft-Windows-VHDMP-Operational	N	N
50	Performing VhdMetaOps VHD for VhdFileName (target 'TargetVhdFileName').	Microsoft-Windows-VHDMP-Operational	Y	N
51	Successfully performed VhdMetaOps VHD VhdFileName.	Microsoft-Windows-VHDMP-Operational	Y	N
100	Vhd resiliency initiated for VhdFile (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
101	Vhd resiliency successfully recovered VhdFile (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
102	Vhd resiliency failed to recover VhdFile (VM ID: VmId) with error Status.	Microsoft-Windows-VHDMP-Operational	N	N
110	Recovery initiated for VhdFile (VM ID: VmId) due to an IO failure with error …	Microsoft-Windows-VHDMP-Operational	N	N
111	Recovery succeeded for VhdFile (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
112	Recovery failed for VhdFile (VM ID: VmId) with error Status.	Microsoft-Windows-VHDMP-Operational	N	N
113	File VhdFile is invalidated (VM ID: VmId) from current mode Mode with error …	Microsoft-Windows-VHDMP-Operational	N	N
114	Waiting on file (RefType) recovery for VhdFile (VM ID: VmId) due to an IO …	Microsoft-Windows-VHDMP-Operational	N	N
115	Waiting on file (RefType) recovery for VhdFile (VM ID: VmId) completed with …	Microsoft-Windows-VHDMP-Operational	N	N
116	File (RefType) recovery succeeded for VhdFile (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
117	File (RefType) recovery failed for VhdFile (VM ID: VmId) with error Status.	Microsoft-Windows-VHDMP-Operational	N	N
118	Failed to open file VhdFile with error Status.	Microsoft-Windows-VHDMP-Operational	N	N
119	File VhdFile has been closed before initiating a recovery attempt.	Microsoft-Windows-VHDMP-Operational	N	N
120	Recovery attempt initiated for virtual disk VhdFile (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
121	Recovery attempt completed successfully for virtual disk VhdFile (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
122	Recovery attempt for virtual disk VhdFile failed with status Status (VM ID: …	Microsoft-Windows-VHDMP-Operational	N	N
123	Reopening handles to file VhdFile (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
124	Waiting for handles to file VhdFile to be reactivated (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
125	Recovery attempt completed for file VhdFile with status Status (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
126	I/O failed with status Status on file VhdFile (VM ID: VmId).	Microsoft-Windows-VHDMP-Operational	N	N
208	Change Tracking has been enabled for the VHD VhdFileName (VirtualDisk) with log …	Microsoft-Windows-VHDMP-Operational	N	N
209	Change Tracking has been disabled for the VHD VhdFileName (VirtualDisk).	Microsoft-Windows-VHDMP-Operational	N	N
210	Change Tracking for the VHD VirtualDisk to the log file LogFileName has been …	Microsoft-Windows-VHDMP-Operational	N	N
211	Flushing of the header of the log file LogFileName has failed due to error …	Microsoft-Windows-VHDMP-Operational	N	N
212	Flushing of the buffers to the log file LogFileName has failed due to error …	Microsoft-Windows-VHDMP-Operational	N	N
213	Opening the log file LogFileName for tracking has failed due to error Status.	Microsoft-Windows-VHDMP-Operational	N	N
214	Offline changes are detected for VHD VhdFileName.	Microsoft-Windows-VHDMP-Operational	N	N
215	No configurations were found for CtLogPerfOpts; Using default [Value].	Microsoft-Windows-VHDMP-Operational	Y	N
216	CtLogPerfOpts is set to CtLogPerfOptNoChange [Value]; No perf changes applied.	Microsoft-Windows-VHDMP-Operational	N	N
217	CtLogPerfOpts is set to CtLogPerfOptDisableWriteThrough [Value]; Write Through …	Microsoft-Windows-VHDMP-Operational	N	N
218	CtLogPerfOpts is set to [Value]; Write Through will be disabled and Custom perf …	Microsoft-Windows-VHDMP-Operational	N	N
219	CtLogPerfOpts is set to [Value]; Custom perf conf will be used.	Microsoft-Windows-VHDMP-Operational	N	N
220	Expected conf value for CtMinMasterBufferSize not found using default [Value].	Microsoft-Windows-VHDMP-Operational	N	N
221	Expected conf value for CtMaxDirtyMemThresholdPercent not found using default …	Microsoft-Windows-VHDMP-Operational	N	N
222	Expected conf value for CtMaxFlushBufferSize not found using default [Value].	Microsoft-Windows-VHDMP-Operational	N	N
223	Using following values [CtLogPerfOpts, CtMinMasterBufferSize, …	Microsoft-Windows-VHDMP-Operational	Y	N
224	CtLogPerfOpts is set to [Value] is not a supported value.	Microsoft-Windows-VHDMP-Operational	N	N
300	IO latency summary.	Microsoft-Windows-VHDMP-Operational	Y	N
301	IO latency summary.	Microsoft-Windows-VHDMP-Operational	Y	N
302	An IO took more than MaxLatencyMs ms to complete.	Microsoft-Windows-VHDMP-Operational	N	N
303	An IO took more than MaxLatencyMs ms to complete.	Microsoft-Windows-VHDMP-Operational	N	N
304	A persistent reservation IO took more than MaxLatencyMs ms to complete.	Microsoft-Windows-VHDMP-Operational	N	N
1001	Starting an IO.	Microsoft-Windows-VHDMP-Analytic	N	N
1002	Completing an IO.	Microsoft-Windows-VHDMP-Analytic	N	N
1010	A VhdSrbType VhdIoType IO to VhdFile (VM ID: VmId) failed with error Status.	Microsoft-Windows-VHDMP-Analytic	N	N
1011	A VhdSrbType VhdIoType IO to VhdFile (VM ID: VmId) failed with error Status.	Microsoft-Windows-VHDMP-Analytic	N	N

Event ID 1: The VHD VhdFileName has come online (surfaced) as disk number VhdDiskNumber.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: SurfaceVirtualDisk
Opcode: Stop

Message #

The VHD %1 has come online (surfaced) as disk number %2.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VhdDiskNumber` UInt32
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1205,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:49:36.935694+00:00",
    "event_record_id": 43,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 252
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\Administrator\\windows.iso",
    "VhdDiskNumber": 2,
    "VirtualDisk": "0xffffb5031d1c0040"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2: The VHD VhdFileName has been removed (unsurfaced) as disk number VhdDiskNumber.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: UnsurfaceVirtualDisk
Opcode: Stop

Message #

The VHD %1 has been removed (unsurfaced) as disk number %2.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VhdDiskNumber` UInt32
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 1206,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:06.004748+00:00",
    "event_record_id": 104,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\Administrator\\windows.iso",
    "VhdDiskNumber": 2,
    "VirtualDisk": "0xffffb5031d1c0040"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3: Failed to surface VHD VhdFileName.

Channel: Microsoft-Windows-VHDMP-Operational
Task: SurfaceVirtualDisk
Opcode: Stop

Description

Failed to surface VHD VhdFileName. Error status Status.

Message #

Failed to surface VHD %1. Error status %2.

Fields #

Name	Description
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference
`VirtualDisk` Pointer

Event ID 4: Failed to surface VHD VhdFileName.

Channel: Microsoft-Windows-VHDMP-Operational
Task: SurfaceVirtualDisk
Opcode: Stop

Description

Failed to surface VHD VhdFileName. Surface attempt was cancelled.

Message #

Failed to surface VHD %1. Surface attempt was cancelled.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VirtualDisk` Pointer

Event ID 5: Failed to VhdMetaOps VHD VhdFileName.

Channel: Microsoft-Windows-VHDMP-Operational

Description

Failed to VhdMetaOps VHD VhdFileName. Error status Status.

Message #

Failed to %1 VHD %2. Error status %3.

Fields #

Name	Description
`VhdMetaOps` AnsiString
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 6: Operation failed on VHD VhdFileName.

Channel: Microsoft-Windows-VHDMP-Operational

Description

Operation failed on VHD VhdFileName. Operation type VhdIoType. Error status Status.

Message #

Operation failed on VHD %2. Operation type %1. Error status %3.

Fields #

Name	Description
`VhdIoType` UInt32
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 7: The Vhd Chain for VHD VhdFileName is corrupted.

Channel: Microsoft-Windows-VHDMP-Operational

Description

The Vhd Chain for VHD VhdFileName is corrupted. The expected LastWriteGUID ExpectedParentLastWriteGUID1 (ExpectedParentLastWriteGUID2) did not match the parent's actual LastWriteGUID (ParentLastWriteGUID).

Message #

The Vhd Chain for VHD %4 is corrupted. The expected LastWriteGUID %2 (%3) did not match the parent's actual LastWriteGUID (%1).

Fields #

Name	Description
`ParentLastWriteGUID` GUID
`ExpectedParentLastWriteGUID1` GUID
`ExpectedParentLastWriteGUID2` GUID
`VhdFileName` UnicodeString

Event ID 8: The change tracking file for VHD VhdFileName is corrupted and cannot be read.

Channel: Microsoft-Windows-VHDMP-Operational

Description

The change tracking file for VHD VhdFileName is corrupted and cannot be read. No change tracking information will be available for this VHD, and change tracking will need to be enabled again before changed are tracked.

Message #

The change tracking file for VHD %1 is corrupted and cannot be read. No change tracking information will be available for this VHD, and change tracking will need to be enabled again before changed are tracked.

Fields #

Name	Description
`VhdFileName` UnicodeString
`CorruptionReason` UInt32

Event ID 9: The VHD file VhdFileName has been modified without updating its associated change tracking file.

Channel: Microsoft-Windows-VHDMP-Operational

Description

The VHD file VhdFileName has been modified without updating its associated change tracking file. Because the consistency of the change tracking information cannot be ensured, the change tracking data has been reset. No change tracking information will be available for this VHD, and change tracking will need to be enabled again before changed are tracked.

Message #

The VHD file %1 has been modified without updating its associated change tracking file. Because the consistency of the change tracking information cannot be ensured, the change tracking data has been reset. No change tracking information will be available for this VHD, and change tracking will need to be enabled again before changed are tracked.

Fields #

Name	Description
`VhdFileName` UnicodeString

Event ID 10: Error Status occured when attempting to update the change tracking file for VHD VhdFileName.

Channel: Microsoft-Windows-VHDMP-Operational

Description

Error Status occured when attempting to update the change tracking file for VHD VhdFileName. This will invalidate the file's change tracking information. Change tracking will not be available for this VHD until change tracking is enabled again.

Message #

Error %2 occured when attempting to update the change tracking file for VHD %1. This will invalidate the file's change tracking information. Change tracking will not be available for this VHD until change tracking is enabled again.

Fields #

Name	Description
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 11: Surface for VHD VhdFileName is invalidated and will be removed (unsurfaced) because of a VhdIoType operation failure with status Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Surface for VHD %2 is invalidated and will be removed (unsurfaced) because of a %1 operation failure with status %3.

Fields #

Name	Description
`VhdIoType` UInt32
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12: Handle for virtual disk 'VhdFile' created successfully.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: VirtualDiskHandleCreate
Opcode: Stop

Description

Handle for virtual disk '' created successfully. VM ID = , Type = , Version = , Flags = , AccessMask = , WriteDepth = , GetInfoOnly = , ReadOnly = , HandleContext = , VirtualDisk = .

Message #

Handle for virtual disk '%2' created successfully. VM ID = %3, Type = %4, Version = %5, Flags = %6, AccessMask = %7, WriteDepth = %8, GetInfoOnly = %9, ReadOnly = %10, HandleContext = %11, VirtualDisk = %12.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`VhdFile` UnicodeString
`VmId` GUID
`VhdType` UInt32
`Version` UInt32
`Flags` UInt32
`AccessMask` UInt32	Access mask reference
`WriteDepth` UInt32
`GetInfoOnly` Boolean
`ReadOnly` Boolean
`HandleContext` Pointer
`VirtualDisk` Pointer
`FileObject` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 4,
    "task": 1201,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:06.006379+00:00",
    "event_record_id": 118,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "Status": 0,
    "VhdFile": "\\\\?\\C:\\Users\\Administrator\\windows.iso",
    "VmId": "00000000-0000-0000-0000-000000000000",
    "VhdType": 3,
    "Version": 1,
    "Flags": 0,
    "AccessMask": 851968,
    "WriteDepth": 1,
    "GetInfoOnly": false,
    "ReadOnly": false,
    "HandleContext": "0xffffb5031dcd2880",
    "VirtualDisk": "0xffffb5031808f040",
    "FileObject": "0xffffb5031dc4d5f0"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 13: Failed to create handle for virtual disk 'VhdFile'.

Channel: Microsoft-Windows-VHDMP-Operational
Task: VirtualDiskHandleCreate
Opcode: Stop

Description

Failed to create handle for virtual disk ''. Status = , VM ID = , Type = , Version = , Flags = , AccessMask = , WriteDepth = , GetInfoOnly = , ReadOnly = , HandleContext = , VirtualDisk = .

Message #

Failed to create handle for virtual disk '%2'. Status = %1, VM ID = %3, Type = %4, Version = %5, Flags = %6, AccessMask = %7, WriteDepth = %8, GetInfoOnly = %9, ReadOnly = %10, HandleContext = %11, VirtualDisk = %12.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`VhdFile` UnicodeString
`VmId` GUID
`VhdType` UInt32
`Version` UInt32
`Flags` UInt32
`AccessMask` UInt32	Access mask reference
`WriteDepth` UInt32
`GetInfoOnly` Boolean
`ReadOnly` Boolean
`HandleContext` Pointer
`VirtualDisk` Pointer
`FileObject` Pointer

Event ID 14: Virtual disk handle closed: HandleContext = HandleContext, VirtualDisk = VirtualDisk.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: VirtualDiskHandleClose
Opcode: Stop

Message #

Virtual disk handle closed: HandleContext = %1, VirtualDisk = %2.

Fields #

Name	Description
`HandleContext` Pointer
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 1202,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:51:06.008478+00:00",
    "event_record_id": 132,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "HandleContext": "0xffffb50315628b00",
    "VirtualDisk": "0xffffb50315a8f040"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 15: Virtual disk object created: VirtualDisk.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational

Message #

Virtual disk object created: %1.

Fields #

Name	Description
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:51:06.005216+00:00",
    "event_record_id": 111,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VirtualDisk": "0xffffb5031808f040"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 16: Virtual disk object destroyed: VirtualDisk.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational

Message #

Virtual disk object destroyed: %1.

Fields #

Name	Description
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:51:06.008477+00:00",
    "event_record_id": 131,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VirtualDisk": "0xffffb50315a8f040"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 17: Virtual disk 'VhdFileName' (no host access) has been surfaced.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: SurfaceVirtualDisk
Opcode: Stop

Message #

Virtual disk '%1' (no host access) has been surfaced.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VhdDiskNumber` UInt32
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 1205,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-11T06:32:03.664902+00:00",
    "event_record_id": 121,
    "correlation": {},
    "execution": {
      "process_id": 9436,
      "thread_id": 10012
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-83-1-698845485-1245677379-4261864325-3027728797"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\localuser\\AppData\\Local\\wsl\\{4d205ef4-e2d2-4c32-b102-f7572f1907f9}\\ext4.vhdx",
    "VhdDiskNumber": 0,
    "VirtualDisk": "0xffff820343430040"
  },
  "message": ""
}

Event ID 18: Virtual disk 'VhdFileName' (no host access) has been unsurfaced.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: UnsurfaceVirtualDisk
Opcode: Stop

Message #

Virtual disk '%1' (no host access) has been unsurfaced.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VhdDiskNumber` UInt32
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 18,
    "version": 0,
    "level": 4,
    "task": 1206,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-13T20:25:37.714656+00:00",
    "event_record_id": 1797,
    "correlation": {},
    "execution": {
      "process_id": 2520,
      "thread_id": 5096
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-83-1-2656045725-1227044221-1802231738-3450451864"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\HyperV\\TestVMs\\TestDisk2_1EB37596-3822-4C9C-A783-E652A8852152.avhdx",
    "VhdDiskNumber": 0,
    "VirtualDisk": "0xffff920b9d72c040"
  },
  "message": ""
}

Event ID 19: The VHD VhdFileName has come online (surfaced) as disk number VhdInstanceId.

Channel: Microsoft-Windows-VHDMP-Operational
Task: SurfaceVirtualDisk
Opcode: Stop

Message #

The VHD %1 has come online (surfaced) as disk number %2.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VhdInstanceId` GUID

Event ID 20: The VHD VhdFileName has been removed (unsurfaced) as disk number VhdInstanceId.

Channel: Microsoft-Windows-VHDMP-Operational
Task: UnsurfaceVirtualDisk
Opcode: Stop

Message #

The VHD %1 has been removed (unsurfaced) as disk number %2.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VhdInstanceId` GUID

Event ID 21: Starting to open handle for virtual disk.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: VirtualDiskHandleCreate
Opcode: Start

Fields #

Name	Description
`FileObject` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 21,
    "version": 0,
    "level": 4,
    "task": 1201,
    "opcode": 1,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:06.005179+00:00",
    "event_record_id": 110,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "FileObject": "0xffffb5031dc4d5f0"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 22: Starting to create the handle for the file backing virtual disk 'VhdFileName'.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: FilewrapperHandleCreate
Opcode: Start

Message #

Starting to create the handle for the file backing virtual disk '%1'.

Fields #

Name	Description
`VhdFileName` UnicodeString
`DesiredAccess` UInt32	Process access rights reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 22,
    "version": 0,
    "level": 4,
    "task": 1203,
    "opcode": 1,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:06.005478+00:00",
    "event_record_id": 116,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\Administrator\\windows.iso",
    "DesiredAccess": 2148532224
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 23: Handle for the file backing virtual disk 'VhdFileName' created successfully.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: FilewrapperHandleCreate
Opcode: Stop

Message #

Handle for the file backing virtual disk '%1' created successfully.

Fields #

Name	Description
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 23,
    "version": 0,
    "level": 4,
    "task": 1203,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:06.005539+00:00",
    "event_record_id": 117,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\Administrator\\windows.iso",
    "Status": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 24: Failed to create handle for the file backing virtual disk 'VhdFileName'.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: FilewrapperHandleCreate
Opcode: Stop

Description

Failed to create handle for the file backing virtual disk 'VhdFileName'. Status = Status.

Message #

Failed to create handle for the file backing virtual disk '%1'. Status = %2.

Fields #

Name	Description
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 24,
    "version": 0,
    "level": 4,
    "task": 1203,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-11T06:32:03.662183+00:00",
    "event_record_id": 116,
    "correlation": {},
    "execution": {
      "process_id": 9436,
      "thread_id": 10012
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-83-1-698845485-1245677379-4261864325-3027728797"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\localuser\\AppData\\Local\\wsl\\{4d205ef4-e2d2-4c32-b102-f7572f1907f9}\\ext4.vhdx.rct",
    "Status": 3221225524
  },
  "message": ""
}

Event ID 25: Beginning to bring the VHD VhdFileName online (surface).

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: SurfaceVirtualDisk
Opcode: Start

Message #

Beginning to bring the VHD %1 online (surface).

Fields #

Name	Description
`VhdFileName` UnicodeString
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 25,
    "version": 0,
    "level": 4,
    "task": 1205,
    "opcode": 1,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:49:36.912522+00:00",
    "event_record_id": 42,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6856
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\Administrator\\windows.iso",
    "VirtualDisk": "0xffffb5031d1c0040"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 26: Beginning to remove the VHD VirtualDisk (unsurface).

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: UnsurfaceVirtualDisk
Opcode: Start

Message #

Beginning to remove the VHD %1 (unsurface).

Fields #

Name	Description
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 26,
    "version": 0,
    "level": 4,
    "task": 1206,
    "opcode": 1,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:05.979830+00:00",
    "event_record_id": 103,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VirtualDisk": "0xffffb50315a8f040"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 27: Starting to close the handle for the file backing virtual disk 'VhdFileName'.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: FilewrapperHandleCreate_1204
Opcode: Start

Message #

Starting to close the handle for the file backing virtual disk '%1'.

Fields #

Name	Description
`VhdFileName` UnicodeString
`DesiredAccess` UInt32	Process access rights reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 27,
    "version": 0,
    "level": 4,
    "task": 1204,
    "opcode": 1,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:06.008290+00:00",
    "event_record_id": 129,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\Administrator\\windows.iso",
    "DesiredAccess": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 28: Handle for the file backing virtual disk 'VhdFileName' closed successfully.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: FilewrapperHandleCreate_1204
Opcode: Stop

Message #

Handle for the file backing virtual disk '%1' closed successfully.

Fields #

Name	Description
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 28,
    "version": 0,
    "level": 4,
    "task": 1204,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:06.008317+00:00",
    "event_record_id": 130,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\Users\\Administrator\\windows.iso",
    "Status": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 29: Operation failed on VHD VhdFileName.

Channel: Microsoft-Windows-VHDMP-Operational

Description

Operation failed on VHD VhdFileName. Operation type VhdIoType. Error status Status.

Message #

Operation failed on VHD %2. Operation type %1. Error status %3.

Fields #

Name	Description
`VhdIoType` UInt32
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 30: Starting to close virtual disk handle: HandleContext = HandleContext, VirtualDisk = VirtualDisk.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: VirtualDiskHandleClose
Opcode: Stop

Message #

Starting to close virtual disk handle: HandleContext = %1, VirtualDisk = %2.

Fields #

Name	Description
`HandleContext` Pointer
`VirtualDisk` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 30,
    "version": 0,
    "level": 4,
    "task": 1202,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2023-10-25T22:51:06.007100+00:00",
    "event_record_id": 126,
    "correlation": {},
    "execution": {
      "process_id": 4416,
      "thread_id": 6872
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
    }
  },
  "event_data": {
    "HandleContext": "0xffffb50315628b00",
    "VirtualDisk": "0xffffb50315a8f040"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 31: Starting to cleanup the backing store for virtual disk 'VhdFileName'.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: CleanupBackingStore
Opcode: Start

Message #

Starting to cleanup the backing store for virtual disk '%1'.

Fields #

Name	Description
`VhdFileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 31,
    "version": 0,
    "level": 4,
    "task": 1207,
    "opcode": 1,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-13T20:25:37.731437+00:00",
    "event_record_id": 1832,
    "correlation": {},
    "execution": {
      "process_id": 2520,
      "thread_id": 5096
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\HyperV\\TestVMs\\TestVM2\\Virtual Machines\\9E500A9D-357D-4923-BADF-6B6B98B7A9CD.vmgs"
  },
  "message": ""
}

Event ID 32: Finished cleaning up the backing store for virtual disk 'VhdFileName'.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: CleanupBackingStore
Opcode: Stop

Message #

Finished cleaning up the backing store for virtual disk '%1'.

Fields #

Name	Description
`VhdFileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 32,
    "version": 0,
    "level": 4,
    "task": 1207,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-13T20:25:37.733125+00:00",
    "event_record_id": 1835,
    "correlation": {},
    "execution": {
      "process_id": 2520,
      "thread_id": 5096
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\HyperV\\TestVMs\\TestVM2\\Virtual Machines\\9E500A9D-357D-4923-BADF-6B6B98B7A9CD.vmgs"
  },
  "message": ""
}

Event ID 33: Starting to flush the backing store footer for virtual disk 'VhdFileName'.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: CleanupBackingStoreFlush
Opcode: Start

Message #

Starting to flush the backing store footer for virtual disk '%1'.

Fields #

Name	Description
`VhdFileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 33,
    "version": 0,
    "level": 4,
    "task": 1208,
    "opcode": 1,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-13T20:25:37.731454+00:00",
    "event_record_id": 1833,
    "correlation": {},
    "execution": {
      "process_id": 2520,
      "thread_id": 5096
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\HyperV\\TestVMs\\TestVM2\\Virtual Machines\\9E500A9D-357D-4923-BADF-6B6B98B7A9CD.vmgs"
  },
  "message": ""
}

Event ID 34: Finished flushing the backing store footer for virtual disk 'VhdFileName'.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational
Task: CleanupBackingStoreFlush
Opcode: Stop

Message #

Finished flushing the backing store footer for virtual disk '%1'.

Fields #

Name	Description
`VhdFileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 34,
    "version": 0,
    "level": 4,
    "task": 1208,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2026-03-13T20:25:37.733110+00:00",
    "event_record_id": 1834,
    "correlation": {},
    "execution": {
      "process_id": 2520,
      "thread_id": 5096
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VhdFileName": "C:\\HyperV\\TestVMs\\TestVM2\\Virtual Machines\\9E500A9D-357D-4923-BADF-6B6B98B7A9CD.vmgs"
  },
  "message": ""
}

Event ID 35: Virtual disk 'VhdFileName' (no host access) has been unsurfaced with unflushed data.

Channel: Microsoft-Windows-VHDMP-Operational
Task: UnsurfaceVirtualDisk
Opcode: Stop

Description

Virtual disk 'VhdFileName' (no host access) has been unsurfaced with unflushed data. Data corruption is possible if the virtual disk is surfaced again.

Message #

Virtual disk '%1' (no host access) has been unsurfaced with unflushed data. Data corruption is possible if the virtual disk is surfaced again.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VhdDiskNumber` UInt32
`VirtualDisk` Pointer

Event ID 36: I/O cancellation (FastClose) started for file 'VhdFile'.

Channel: Microsoft-Windows-VHDMP-Operational

Description

I/O cancellation (FastClose) started for file 'VhdFile'. (VM ID: VmId).

Message #

I/O cancellation (FastClose) started for file '%1'. (VM ID: %2)

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 50: Performing VhdMetaOps VHD for VhdFileName (target 'TargetVhdFileName').

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational

Message #

Performing %1 VHD for %2 (target '%3').

Fields #

Name	Description
`VhdMetaOps` AnsiString
`VhdFileName` UnicodeString
`TargetVhdFileName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 50,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:00.644588+00:00",
    "event_record_id": 73,
    "correlation": {},
    "execution": {
      "process_id": 3708,
      "thread_id": 7448
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "VhdMetaOps": "Create",
    "VhdFileName": "C:\\Users\\localuser\\AppData\\Local\\Temp\\29A7892D-8743-4A3F-85E3-06FE9D7977B4\\swap.vhdx",
    "TargetVhdFileName": ""
  },
  "message": ""
}

Event ID 51: Successfully performed VhdMetaOps VHD VhdFileName.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational

Message #

Successfully performed %1 VHD %2.

Fields #

Name	Description
`VhdMetaOps` AnsiString
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 51,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:00.672841+00:00",
    "event_record_id": 76,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 10056
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "VhdMetaOps": "Create",
    "VhdFileName": "C:\\Users\\localuser\\AppData\\Local\\Temp\\29A7892D-8743-4A3F-85E3-06FE9D7977B4\\swap.vhdx",
    "Status": 0
  },
  "message": ""
}

Event ID 100: Vhd resiliency initiated for VhdFile (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Description

Vhd resiliency initiated for VhdFile (VM ID: VmId). A VhdIoType IO failed with error Status.

Message #

Vhd resiliency initiated for %1 (VM ID: %2). A %3 IO failed with error %4.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`VhdIoType` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 101: Vhd resiliency successfully recovered VhdFile (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Vhd resiliency successfully recovered %1 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID

Event ID 102: Vhd resiliency failed to recover VhdFile (VM ID: VmId) with error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Vhd resiliency failed to recover %1 (VM ID: %2) with error %3.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 110: Recovery initiated for VhdFile (VM ID: VmId) due to an IO failure with error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Recovery initiated for %1 (VM ID: %2) due to an IO failure with error %3.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 111: Recovery succeeded for VhdFile (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Recovery succeeded for %1 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID

Event ID 112: Recovery failed for VhdFile (VM ID: VmId) with error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Recovery failed for %1 (VM ID: %2) with error %3.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 113: File VhdFile is invalidated (VM ID: VmId) from current mode Mode with error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Description

File VhdFile is invalidated (VM ID: VmId) from current mode Mode with error Status. Any recovery in process will be failed and the virtual disk will be invalidated as well.

Message #

File %1 is invalidated (VM ID: %2) from current mode %3 with error %4. Any recovery in process will be failed and the virtual disk will be invalidated as well.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Mode` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 114: Waiting on file (RefType) recovery for VhdFile (VM ID: VmId) due to an IO failure with error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Waiting on file (%4) recovery for %1 (VM ID: %2) due to an IO failure with error %3.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference
`RefType` UInt32
`Mode` UInt32
`PendingRecoveryCount` UInt32

Event ID 115: Waiting on file (RefType) recovery for VhdFile (VM ID: VmId) completed with status Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Waiting on file (%4) recovery for %1 (VM ID: %2) completed with status %3.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference
`RefType` UInt32

Event ID 116: File (RefType) recovery succeeded for VhdFile (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

File (%3) recovery succeeded for %1 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`RefType` UInt32
`Mode` UInt32
`PendingRecoveryCount` UInt32

Event ID 117: File (RefType) recovery failed for VhdFile (VM ID: VmId) with error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

File (%4) recovery failed for %1 (VM ID: %2) with error %3.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference
`RefType` UInt32
`Mode` UInt32
`PendingRecoveryCount` UInt32

Event ID 118: Failed to open file VhdFile with error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Description

Failed to open file VhdFile with error Status. The file handle was previously invalidated due to a critical error. This operation will be retried periodically. (VM ID: VmId).

Message #

Failed to open file %1 with error %3. The file handle was previously invalidated due to a critical error. This operation will be retried periodically. (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 119: File VhdFile has been closed before initiating a recovery attempt.

Channel: Microsoft-Windows-VHDMP-Operational

Description

File VhdFile has been closed before initiating a recovery attempt. The file was open in mode Mode. (VM ID: VmId).

Message #

File %1 has been closed before initiating a recovery attempt. The file was open in mode %3. (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Mode` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 120: Recovery attempt initiated for virtual disk VhdFile (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Recovery attempt initiated for virtual disk %1 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 121: Recovery attempt completed successfully for virtual disk VhdFile (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Recovery attempt completed successfully for virtual disk %1 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 122: Recovery attempt for virtual disk VhdFile failed with status Status (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Recovery attempt for virtual disk %1 failed with status %3 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 123: Reopening handles to file VhdFile (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Reopening handles to file %1 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 124: Waiting for handles to file VhdFile to be reactivated (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Waiting for handles to file %1 to be reactivated (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 125: Recovery attempt completed for file VhdFile with status Status (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Recovery attempt completed for file %1 with status %3 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 126: I/O failed with status Status on file VhdFile (VM ID: VmId).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

I/O failed with status %3 on file %1 (VM ID: %2).

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 208: Change Tracking has been enabled for the VHD VhdFileName (VirtualDisk) with log file LogFileName.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Change Tracking has been enabled for the VHD %1 (%2) with log file %3.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VirtualDisk` UInt64
`LogFileName` UnicodeString

Event ID 209: Change Tracking has been disabled for the VHD VhdFileName (VirtualDisk).

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Change Tracking has been disabled for the VHD %1 (%2).

Fields #

Name	Description
`VhdFileName` UnicodeString
`VirtualDisk` UInt64

Event ID 210: Change Tracking for the VHD VirtualDisk to the log file LogFileName has been stopped due to the error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Change Tracking for the VHD %1 to the log file %2 has been stopped due to the error %3.

Fields #

Name	Description
`VirtualDisk` UInt64
`LogFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 211: Flushing of the header of the log file LogFileName has failed due to error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Flushing of the header of the log file %1 has failed due to error %2.

Fields #

Name	Description
`LogFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 212: Flushing of the buffers to the log file LogFileName has failed due to error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Flushing of the buffers to the log file %1 has failed due to error %2.

Fields #

Name	Description
`LogFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 213: Opening the log file LogFileName for tracking has failed due to error Status.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Opening the log file %1 for tracking has failed due to error %2.

Fields #

Name	Description
`LogFileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 214: Offline changes are detected for VHD VhdFileName.

Channel: Microsoft-Windows-VHDMP-Operational

Description

Offline changes are detected for VHD VhdFileName. Log file: LogFileName, VHD time: VHDFileTime, Log file time: LogFileTime.

Message #

Offline changes are detected for VHD %2. Log file: %1, VHD time: %4, Log file time: %5

Fields #

Name	Description
`LogFileName` UnicodeString
`VhdFileName` UnicodeString
`Status` UInt32	NTSTATUS reference
`VHDFileTime` UInt64
`LogFileTime` UInt64

Event ID 215: No configurations were found for CtLogPerfOpts; Using default [Value].

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational

Message #

No configurations were found for CtLogPerfOpts; Using default [%1]

Fields #

Name	Description
`Value` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "{E2816346-87F4-4F85-95C3-0C79409AA89D}",
    "event_source_name": "",
    "event_id": 215,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-30T02:22:27.4983379+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 10744
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Value": "0"
  },
  "message": "No configurations were found for CtLogPerfOpts; Using default [0x0]"
}

Event ID 216: CtLogPerfOpts is set to CtLogPerfOptNoChange [Value]; No perf changes applied.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

CtLogPerfOpts is set to CtLogPerfOptNoChange [%1]; No perf changes applied

Fields #

Name	Description
`Value` UInt64

Event ID 217: CtLogPerfOpts is set to CtLogPerfOptDisableWriteThrough [Value]; Write Through will be disabled.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

CtLogPerfOpts is set to CtLogPerfOptDisableWriteThrough [%1]; Write Through will be disabled

Fields #

Name	Description
`Value` UInt64

Event ID 218: CtLogPerfOpts is set to [Value]; Write Through will be disabled and Custom perf conf will be used.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

CtLogPerfOpts is set to [%1]; Write Through will be disabled and Custom perf conf will be used

Fields #

Name	Description
`Value` UInt64

Event ID 219: CtLogPerfOpts is set to [Value]; Custom perf conf will be used.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

CtLogPerfOpts is set to [%1]; Custom perf conf will be used

Fields #

Name	Description
`Value` UInt64

Event ID 220: Expected conf value for CtMinMasterBufferSize not found using default [Value].

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Expected conf value for CtMinMasterBufferSize not found using default [%1]

Fields #

Name	Description
`Value` UInt64

Event ID 221: Expected conf value for CtMaxDirtyMemThresholdPercent not found using default [Value].

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Expected conf value for CtMaxDirtyMemThresholdPercent not found using default [%1]

Fields #

Name	Description
`Value` UInt64

Event ID 222: Expected conf value for CtMaxFlushBufferSize not found using default [Value].

Channel: Microsoft-Windows-VHDMP-Operational

Message #

Expected conf value for CtMaxFlushBufferSize not found using default [%1]

Fields #

Name	Description
`Value` UInt64

Event ID 223: Using following values [CtLogPerfOpts, CtMinMasterBufferSize, CtMaxDirtyMemThresholdPercent, CtMaxFlushBufferSize] for CtLog.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational

Message #

Using following values [%1, %2, %3, %4] for CtLog

Fields #

Name	Description
`CtLogPerfOpts` UInt64
`CtMinMasterBufferSize` UInt64
`CtMaxDirtyMemThresholdPercent` UInt64
`CtMaxFlushBufferSize` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "{E2816346-87F4-4F85-95C3-0C79409AA89D}",
    "event_source_name": "",
    "event_id": 223,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-30T02:22:27.4983394+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 10744
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "CtLogPerfOpts": "0",
    "CtMinMasterBufferSize": "16777216",
    "CtMaxDirtyMemThresholdPercent": "50",
    "CtMaxFlushBufferSize": "8388608"
  },
  "message": "Using following values [0x0, 0x1000000, 0x32, 0x800000] for CtLog"
}

Event ID 224: CtLogPerfOpts is set to [Value] is not a supported value.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

CtLogPerfOpts is set to [%1] is not a supported value

Fields #

Name	Description
`Value` UInt64

Event ID 300: IO latency summary.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational

Message #

IO latency summary:

           Virtual disk: %1
           
           IO type: %2
           
           Interval duration: %3
           
           Max Acceptable IO Latency: %4
           High Latency IOs: %5
           
           IO count: %6
           Avg IOPS: %7
           Avg latency: %9
           
           Latency buckets: [%10]
           IO count buckets: [%11, %12, %13, %14, %15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
           Total time buckets (ns): [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40, %41, %42]

Fields #

Name	Description
`VhdFile` UnicodeString
`IoTypeStr` UnicodeString
`IntervalDurationStr` UnicodeString
`MaxLatencyMs` UInt64
`HighLatencyIoCount` UInt32
`TotalIoCount` UInt64
`AverageIops` UInt64
`AverageLatencyNs` UInt64
`AverageLatencyStr` UnicodeString
`LatencyBuckets` UnicodeString
`IoCount0` UInt64
`IoCount1` UInt64
`IoCount2` UInt64
`IoCount3` UInt64
`IoCount4` UInt64
`IoCount5` UInt64
`IoCount6` UInt64
`IoCount7` UInt64
`IoCount8` UInt64
`IoCount9` UInt64
`IoCount10` UInt64
`IoCount11` UInt64
`IoCount12` UInt64
`IoCount13` UInt64
`IoCount14` UInt64
`IoCount15` UInt64
`TotalTimeNs0` UInt64
`TotalTimeNs1` UInt64
`TotalTimeNs2` UInt64
`TotalTimeNs3` UInt64
`TotalTimeNs4` UInt64
`TotalTimeNs5` UInt64
`TotalTimeNs6` UInt64
`TotalTimeNs7` UInt64
`TotalTimeNs8` UInt64
`TotalTimeNs9` UInt64
`TotalTimeNs10` UInt64
`TotalTimeNs11` UInt64
`TotalTimeNs12` UInt64
`TotalTimeNs13` UInt64
`TotalTimeNs14` UInt64
`TotalTimeNs15` UInt64
`SnapshotId` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223653511831486468,
    "time_created": "2026-03-12T02:32:47.489264+00:00",
    "event_record_id": 159,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7740
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VhdFile": "C:\\Users\\localuser\\AppData\\Local\\wsl\\{4d205ef4-e2d2-4c32-b102-f7572f1907f9}\\ext4.vhdx",
    "IoTypeStr": "Flush",
    "IntervalDurationStr": "3600 s",
    "MaxLatencyMs": 30000,
    "HighLatencyIoCount": 0,
    "TotalIoCount": 223,
    "AverageIops": 188,
    "AverageLatencyNs": 5326333,
    "AverageLatencyStr": "5 ms",
    "LatencyBuckets": "128 µs, 256 µs, 512 µs, 1 ms, 4 ms, 16 ms, 64 ms, 128 ms, 256 ms, 512 ms, 1 s, 5 s, 10 s, 20 s, 30 s, > 30 s",
    "IoCount0": 0,
    "IoCount1": 0,
    "IoCount2": 0,
    "IoCount3": 1,
    "IoCount4": 187,
    "IoCount5": 26,
    "IoCount6": 3,
    "IoCount7": 6,
    "IoCount8": 0,
    "IoCount9": 0,
    "IoCount10": 0,
    "IoCount11": 0,
    "IoCount12": 0,
    "IoCount13": 0,
    "IoCount14": 0,
    "IoCount15": 0,
    "TotalTimeNs0": 0,
    "TotalTimeNs1": 0,
    "TotalTimeNs2": 0,
    "TotalTimeNs3": 909300,
    "TotalTimeNs4": 514097100,
    "TotalTimeNs5": 134031900,
    "TotalTimeNs6": 100298800,
    "TotalTimeNs7": 438435300,
    "TotalTimeNs8": 0,
    "TotalTimeNs9": 0,
    "TotalTimeNs10": 0,
    "TotalTimeNs11": 0,
    "TotalTimeNs12": 0,
    "TotalTimeNs13": 0,
    "TotalTimeNs14": 0,
    "TotalTimeNs15": 0,
    "SnapshotId": 471410465843
  },
  "message": ""
}

Event ID 301: IO latency summary.

Channel: Microsoft-Windows-VHDMP-Operational
Level: Informational

Message #

IO latency summary:

           Virtual disk: %1
           
           IO type: %2
           
           Interval duration: %3
           
           Max Acceptable IO Latency: %4
           High Latency IOs: %5
           
           IO count: %6
           Total bytes: %43
           Avg IOPS: %7
           Avg Bps: %44
           Avg latency: %9
           
           Latency buckets: [%10]
           IO count buckets: [%11, %12, %13, %14, %15, %16, %17, %18, %19, %20, %21, %22, %23, %24, %25, %26]
           Total time buckets (ns): [%27, %28, %29, %30, %31, %32, %33, %34, %35, %36, %37, %38, %39, %40, %41, %42]

Fields #

Name	Description
`VhdFile` UnicodeString
`IoTypeStr` UnicodeString
`IntervalDurationStr` UnicodeString
`MaxLatencyMs` UInt64
`HighLatencyIoCount` UInt32
`TotalIoCount` UInt64
`AverageIops` UInt64
`AverageLatencyNs` UInt64
`AverageLatencyStr` UnicodeString
`LatencyBuckets` UnicodeString
`IoCount0` UInt64
`IoCount1` UInt64
`IoCount2` UInt64
`IoCount3` UInt64
`IoCount4` UInt64
`IoCount5` UInt64
`IoCount6` UInt64
`IoCount7` UInt64
`IoCount8` UInt64
`IoCount9` UInt64
`IoCount10` UInt64
`IoCount11` UInt64
`IoCount12` UInt64
`IoCount13` UInt64
`IoCount14` UInt64
`IoCount15` UInt64
`TotalTimeNs0` UInt64
`TotalTimeNs1` UInt64
`TotalTimeNs2` UInt64
`TotalTimeNs3` UInt64
`TotalTimeNs4` UInt64
`TotalTimeNs5` UInt64
`TotalTimeNs6` UInt64
`TotalTimeNs7` UInt64
`TotalTimeNs8` UInt64
`TotalTimeNs9` UInt64
`TotalTimeNs10` UInt64
`TotalTimeNs11` UInt64
`TotalTimeNs12` UInt64
`TotalTimeNs13` UInt64
`TotalTimeNs14` UInt64
`TotalTimeNs15` UInt64
`TotalBytes` UInt64
`AverageBps` UInt64
`TotalBytes0` UInt64
`TotalBytes1` UInt64
`TotalBytes2` UInt64
`TotalBytes3` UInt64
`TotalBytes4` UInt64
`TotalBytes5` UInt64
`TotalBytes6` UInt64
`TotalBytes7` UInt64
`TotalBytes8` UInt64
`TotalBytes9` UInt64
`TotalBytes10` UInt64
`TotalBytes11` UInt64
`TotalBytes12` UInt64
`TotalBytes13` UInt64
`TotalBytes14` UInt64
`TotalBytes15` UInt64
`SnapshotId` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VHDMP",
    "guid": "E2816346-87F4-4F85-95C3-0C79409AA89D",
    "event_source_name": "",
    "event_id": 301,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223653511831486468,
    "time_created": "2026-03-12T02:32:47.489248+00:00",
    "event_record_id": 158,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 7740
    },
    "channel": "Microsoft-Windows-VHDMP-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VhdFile": "C:\\Users\\localuser\\AppData\\Local\\wsl\\{4d205ef4-e2d2-4c32-b102-f7572f1907f9}\\ext4.vhdx",
    "IoTypeStr": "Write",
    "IntervalDurationStr": "3600 s",
    "MaxLatencyMs": 30000,
    "HighLatencyIoCount": 0,
    "TotalIoCount": 1272,
    "AverageIops": 393,
    "AverageLatencyNs": 2542019,
    "AverageLatencyStr": "2 ms",
    "LatencyBuckets": "128 µs, 256 µs, 512 µs, 1 ms, 4 ms, 16 ms, 64 ms, 128 ms, 256 ms, 512 ms, 1 s, 5 s, 10 s, 20 s, 30 s, > 30 s",
    "IoCount0": 0,
    "IoCount1": 9,
    "IoCount2": 526,
    "IoCount3": 472,
    "IoCount4": 171,
    "IoCount5": 48,
    "IoCount6": 46,
    "IoCount7": 0,
    "IoCount8": 0,
    "IoCount9": 0,
    "IoCount10": 0,
    "IoCount11": 0,
    "IoCount12": 0,
    "IoCount13": 0,
    "IoCount14": 0,
    "IoCount15": 0,
    "TotalTimeNs0": 0,
    "TotalTimeNs1": 2157100,
    "TotalTimeNs2": 227236100,
    "TotalTimeNs3": 304852600,
    "TotalTimeNs4": 253009200,
    "TotalTimeNs5": 408639200,
    "TotalTimeNs6": 2037554800,
    "TotalTimeNs7": 0,
    "TotalTimeNs8": 0,
    "TotalTimeNs9": 0,
    "TotalTimeNs10": 0,
    "TotalTimeNs11": 0,
    "TotalTimeNs12": 0,
    "TotalTimeNs13": 0,
    "TotalTimeNs14": 0,
    "TotalTimeNs15": 0,
    "TotalBytes": 154968064,
    "AverageBps": 47926553,
    "TotalBytes0": 0,
    "TotalBytes1": 49152,
    "TotalBytes2": 3325952,
    "TotalBytes3": 15396864,
    "TotalBytes4": 48160768,
    "TotalBytes5": 39374848,
    "TotalBytes6": 48660480,
    "TotalBytes7": 0,
    "TotalBytes8": 0,
    "TotalBytes9": 0,
    "TotalBytes10": 0,
    "TotalBytes11": 0,
    "TotalBytes12": 0,
    "TotalBytes13": 0,
    "TotalBytes14": 0,
    "TotalBytes15": 0,
    "SnapshotId": 471410465843
  },
  "message": ""
}

Event ID 302: An IO took more than MaxLatencyMs ms to complete.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

An IO took more than %2 ms to complete:

           Virtual disk: %1
           IO Type: %4
           IO Size: %5 bytes
           Latency: %6 ms

Fields #

Name	Description
`VhdFile` UnicodeString
`MaxLatencyMs` UInt64
`IoType` UInt16
`IoTypeStr` UnicodeString
`IoSize` UInt32
`LatencyMs` UInt64

Event ID 303: An IO took more than MaxLatencyMs ms to complete.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

An IO took more than %2 ms to complete:

           Virtual disk: %1
           IO Type: %4
           Latency: %5 ms

Fields #

Name	Description
`VhdFile` UnicodeString
`MaxLatencyMs` UInt64
`IoType` UInt16
`IoTypeStr` UnicodeString
`LatencyMs` UInt64

Event ID 304: A persistent reservation IO took more than MaxLatencyMs ms to complete.

Channel: Microsoft-Windows-VHDMP-Operational

Message #

A persistent reservation IO took more than %2 ms to complete:

           Virtual disk: %1
           [In = 1, Out = 0]: %3
           IO Size: %4 bytes
           Latency: %5 ms

Fields #

Name	Description
`VhdFile` UnicodeString
`MaxLatencyMs` UInt64
`PersistentReserveIn` Boolean
`IoSize` UInt32
`LatencyMs` UInt64

Event ID 1001: Starting an IO.

Channel: Microsoft-Windows-VHDMP-Analytic
Task: IOrequest
Opcode: StartinganIO.

Fields #

Name	Description
`VhdId` UnicodeString
`VhdIoType` UInt32
`VhdSrbType` UInt32
`Offset` UInt64
`Length` UInt32

Event ID 1002: Completing an IO.

Channel: Microsoft-Windows-VHDMP-Analytic
Task: IOrequest
Opcode: CompletinganIO.

Fields #

Name	Description
`VhdId` UnicodeString
`VhdIoType` UInt32
`VhdSrbType` UInt32
`Offset` UInt64
`Length` UInt32

Event ID 1010: A VhdSrbType VhdIoType IO to VhdFile (VM ID: VmId) failed with error Status.

Channel: Microsoft-Windows-VHDMP-Analytic

Description

A VhdSrbType VhdIoType IO to VhdFile (VM ID: VmId) failed with error Status. Recovery of this virtual disk has been initiated. If this IO was initiated by a VM then it will be internally retried later when the virtual disk has successfully recovered.

Message #

A %4 %3 IO to %1 (VM ID: %2) failed with error %7. Recovery of this virtual disk has been initiated. If this IO was initiated by a VM then it will be internally retried later when the virtual disk has successfully recovered.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`VhdIoType` UInt32
`VhdSrbType` UInt32
`Offset` UInt64
`Length` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 1011: A VhdSrbType VhdIoType IO to VhdFile (VM ID: VmId) failed with error Status.

Channel: Microsoft-Windows-VHDMP-Analytic

Description

A VhdSrbType VhdIoType IO to VhdFile (VM ID: VmId) failed with error Status. Recovery for this virtual disk could not be initiated either because this is not a recoverable failure or recovery has failed or the virtual disk is in an invalid state.

Message #

A %4 %3 IO to %1 (VM ID: %2) failed with error %7. Recovery for this virtual disk could not be initiated either because this is not a recoverable failure or recovery has failed or the virtual disk is in an invalid state.

Fields #

Name	Description
`VhdFile` UnicodeString
`VmId` GUID
`VhdIoType` UInt32
`VhdSrbType` UInt32
`Offset` UInt64
`Length` UInt32
`Status` UInt32	NTSTATUS reference

Provenance

ETW provider GUID e2816346-87f4-4f85-95c3-0c79409aa89d

Defined in vhdmp.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1591, captured 2026-06-02 — Manifest XML pack, 2.0 MB