Hyper-V Event Logs Explained

Hyper-V-Config

This log contains entries that pertain to the configuration files that describe individual virtual machines. These are the XML files whose names are globally unique identifiers. They can be found under C:\ProgramData\Microsoft\Windows\Hyper-V\Virtual Machines or under VM-specific folders on a Cluster Shared Volume. The most common error is 4096, which indicates that Hyper-V is unable to locate an expected configuration file. It isn’t entirely unusual to encounter this error in normal operations, as utilities and operations may move the XML files in a fashion that isn’t entirely in sync with the Hyper-V services. It normally doesn’t require attention unless it is a persistent error.

Hyper-V-High-Availability

This section contains events related to the interaction of Failover Clustering with Hyper-V.  Most of the events here will be informational recording of actions that the Cluster service took on individual VMs. Errors should be very rare and are generally related to the same sort of synchronization issues that cause the Hyper-V-Config 4096 errors.

Hyper-V-Hypervisor

As the name implies, these events are related to the hypervisor itself. Most of the events will be related to the creation and destruction of partitions, which are the temporary container that hold running virtual machines. If there is any sort of problem with Hyper-V itself, especially issues that prevent the service from starting, this is where you’ll find out about it.

Hyper-V-Image-Management-Service

The related service is devoted to the handling of VHD files. If any operation involving a virtual hard drive fails, details are logged here.

Hyper-V-Integration

This log tracks events associated with the Integration Services that are installed into virtual machines. Most of the problems reported here can be corrected by re-installing or upgrading the Integration Services components.

Hyper-V-Network

The virtual switch(es) in your deployment will record events here. The first events will be the creation of the virtual networks themselves, as well as pairing of external networks to physical network cards. When a virtual network adapter is created or destroyed in a virtual machine, a matching virtual port is created on the virtual switch; the creation/destruction of those ports will be registered here.

Hyper-V-SynthNic

The synthetic network cards in virtual machines will log an event when they start (12582). Look here for clues as to why a network card won’t function, such as MAC collisions.

Hyper-V-SynthStor

Virtual storage controller drivers use this log for their events. The most common event is logged by virtual SCSI controllers as they start. The virtual IDE driver is emulated and not synthetic, so it initializes before the VM loads and will not log a matching event. If a drive cannot be attached to the virtual controller port as expected, it will be logged here.

Hyper-V-VMMs

The Virtual Machine Management Service generates these events. Problems with import and export actions will be logged here, as will AVHD merge operations. Host shutdown events will also be tracked in this log. It will also report when it cannot locate the files for a VM. As in other logs, these are likely to be cleaned up once a VM is completely removed.

Hyper-V-Worker

Hyper-V’s worker threads log these events. Normally, this is the busiest of all the logs, but most of them are trivial. If you’re curious how long that last Live Migration took, this is where you’ll find it. Emulated network and storage drivers (as opposed to the synthetic drivers) will create events here.