Hyper-V logs a lot of useful information if you need to diagnose a problem, so I thought I would put together a little post explaining where you should be looking. The first thing to know is that all Hyper-V event logs are stored in the Event Viewer under “Applications and Services Logs”, “Microsoft”, “Windows”:
There are 10 main categories to look at:
- Hyper-V-Config: This section is for anything that relates to virtual machine configuration files. If you have a missing or corrupt virtual machine configuration file – there will be entries here that tell you all about it.
- Hyper-V-High-Availability: This section tells you about actions and changes that happen because of Hyper-V clustering.
- Hyper-V-Hypervisor: This section is used for hypervisor specific events. You will usually only need to look here if the hypervisor fails to start – then you can get detailed information here.
- Hyper-V-Image-Management-Service: This section is used by the image management service to log information about virtual hard disk operations – like creating, converting and editing virtual hard disks. If you have problems creating or editing a virtual hard disk – look here.
- Hyper-V-Integration: This section is used to log events that relate specifically to integration services.
- Hyper-V-Network: This section is used for events relating to virtual networks. You will see information about the creation and configuration of virtual networks here (as opposed to virtual network adapters).
- Hyper-V-SynthNic: This is the section where information about virtual network adapters. You will see entries in here each time a virtual machine with virtual network adapters powers up. You will also see entries here if a virtual machine fails to power on because of a configuration issue with its network adapters.
- Hyper-V-SynthStor: This section is to do with virtual hard disks that are associated with running virtual machines (it is the storage equivalent of the SynthNic section).
- Hyper-V-VMMS: This section is where the virtual machine management services files its events.
- Hyper-V-Worker: This section is used by the worker process that is used for the actual running of the virtual machine.
