Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
'instance-00000001' was shut down using the Shutdown Integration Component with parameters: Force = false, Reason = 'Soft shutdown requested by OpenStack Nova.' (Virtual machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	18504	0		4	0	0	-9223372036854775808	25	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1112	744	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:15:38 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' 77bdaf7f-1b5a-45e1-aabd-63b76455fd4c (a4b42571-9e6d-4ed1-8ef4-f521db42e59f--f902df98-2c85-448b-97ce-d9621c7530c3) Disconnected from virtual network. (Virtual Machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	12598	0		4	0	0	-9223372036854775808	24	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1112	744	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:15:37 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' was reset. (Virtual machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	18512	0		4	0	0	-9223372036854775808	23	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1112	744	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:14:29 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' 77bdaf7f-1b5a-45e1-aabd-63b76455fd4c (a4b42571-9e6d-4ed1-8ef4-f521db42e59f--f902df98-2c85-448b-97ce-d9621c7530c3) Connected to virtual network. (Virtual Machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	12597	0		4	0	0	-9223372036854775808	22	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1112	744	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:14:29 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' 77bdaf7f-1b5a-45e1-aabd-63b76455fd4c (a4b42571-9e6d-4ed1-8ef4-f521db42e59f--f902df98-2c85-448b-97ce-d9621c7530c3) Disconnected from virtual network. (Virtual Machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	12598	0		4	0	0	-9223372036854775808	21	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1112	744	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:14:29 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000002' was turned off. (Virtual machine ID 1ECB4C49-7494-43E1-8A69-22252C98D573)	18502	0		4	0	0	-9223372036854775808	20	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1288	1388	hv-neutron-7864	S-1-5-83-1-516639817-1138848916-623012234-1943377964	2/17/2022 6:13:59 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000002' 42c8815a-d092-4f26-a426-b22f39e5d6bf (1ecb4c49-7494-43e1-8a69-22252c98d573--8d86ee59-ff19-4abb-a942-4e164922c6b4) Disconnected from virtual network. (Virtual Machine ID 1ECB4C49-7494-43E1-8A69-22252C98D573)	12598	0		4	0	0	-9223372036854775808	19	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1288	1388	hv-neutron-7864	S-1-5-83-1-516639817-1138848916-623012234-1943377964	2/17/2022 6:13:59 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000003' was turned off. (Virtual machine ID B3BE90A1-2556-4493-A1C4-516FAEBD6E0D)	18502	0		4	0	0	-9223372036854775808	18	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1576	2200	hv-neutron-7864	S-1-5-83-1-3015610529-1150494038-1867629729-225361326	2/17/2022 6:13:58 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000003' 7346cb3f-961f-4a0e-b22f-d8da2f9e7014 (b3be90a1-2556-4493-a1c4-516faebd6e0d--5166b8e1-8f23-40d1-9a57-6f8b4303cff6) Disconnected from virtual network. (Virtual Machine ID B3BE90A1-2556-4493-A1C4-516FAEBD6E0D)	12598	0		4	0	0	-9223372036854775808	17	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1576	2200	hv-neutron-7864	S-1-5-83-1-3015610529-1150494038-1867629729-225361326	2/17/2022 6:13:58 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' was resumed. (Virtual machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	18518	0		4	0	0	-9223372036854775808	16	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1112	3384	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:13:15 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' was paused. (Virtual machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	18516	0		4	0	0	-9223372036854775808	15	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1112	140	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:13:12 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' started successfully. (Virtual machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	18500	0		4	0	0	-9223372036854775808	14	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1112	140	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:13:08 PM	1f19486f-2424-0002-f794-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' 77bdaf7f-1b5a-45e1-aabd-63b76455fd4c (F902DF98-2C85-448B-97CE-D9621C7530C3) started successfully. (Virtual Machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	12582	0		4	0	0	-9223372036854775808	13	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1112	140	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:13:08 PM	1f19486f-2424-0002-f794-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' 77bdaf7f-1b5a-45e1-aabd-63b76455fd4c (a4b42571-9e6d-4ed1-8ef4-f521db42e59f--f902df98-2c85-448b-97ce-d9621c7530c3) Connected to virtual network. (Virtual Machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	12597	0		4	0	0	-9223372036854775808	12	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1112	140	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:13:08 PM	1f19486f-2424-0002-f794-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' was shut down using the Shutdown Integration Component with parameters: Force = false, Reason = 'Soft shutdown requested by OpenStack Nova.' (Virtual machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	18504	0		4	0	0	-9223372036854775808	11	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	4576	2176	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:13:02 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' 77bdaf7f-1b5a-45e1-aabd-63b76455fd4c (a4b42571-9e6d-4ed1-8ef4-f521db42e59f--f902df98-2c85-448b-97ce-d9621c7530c3) Disconnected from virtual network. (Virtual Machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	12598	0		4	0	0	-9223372036854775808	10	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	4576	2176	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:13:02 PM			microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000002' started successfully. (Virtual machine ID 1ECB4C49-7494-43E1-8A69-22252C98D573)	18500	0		4	0	0	-9223372036854775808	9	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1288	4200	hv-neutron-7864	S-1-5-83-1-516639817-1138848916-623012234-1943377964	2/17/2022 6:12:34 PM	1f19486f-2424-0004-4f9c-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000002' 42c8815a-d092-4f26-a426-b22f39e5d6bf (8D86EE59-FF19-4ABB-A942-4E164922C6B4) started successfully. (Virtual Machine ID 1ECB4C49-7494-43E1-8A69-22252C98D573)	12582	0		4	0	0	-9223372036854775808	8	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1288	4200	hv-neutron-7864	S-1-5-83-1-516639817-1138848916-623012234-1943377964	2/17/2022 6:12:34 PM	1f19486f-2424-0004-4f9c-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000002' 42c8815a-d092-4f26-a426-b22f39e5d6bf (1ecb4c49-7494-43e1-8a69-22252c98d573--8d86ee59-ff19-4abb-a942-4e164922c6b4) Connected to virtual network. (Virtual Machine ID 1ECB4C49-7494-43E1-8A69-22252C98D573)	12597	0		4	0	0	-9223372036854775808	7	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1288	4200	hv-neutron-7864	S-1-5-83-1-516639817-1138848916-623012234-1943377964	2/17/2022 6:12:34 PM	1f19486f-2424-0004-4f9c-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000003' started successfully. (Virtual machine ID B3BE90A1-2556-4493-A1C4-516FAEBD6E0D)	18500	0		4	0	0	-9223372036854775808	6	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	1576	3688	hv-neutron-7864	S-1-5-83-1-3015610529-1150494038-1867629729-225361326	2/17/2022 6:12:31 PM	1f19486f-2424-0004-4c9c-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000003' 7346cb3f-961f-4a0e-b22f-d8da2f9e7014 (5166B8E1-8F23-40D1-9A57-6F8B4303CFF6) started successfully. (Virtual Machine ID B3BE90A1-2556-4493-A1C4-516FAEBD6E0D)	12582	0		4	0	0	-9223372036854775808	5	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1576	3688	hv-neutron-7864	S-1-5-83-1-3015610529-1150494038-1867629729-225361326	2/17/2022 6:12:31 PM	1f19486f-2424-0004-4c9c-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000003' 7346cb3f-961f-4a0e-b22f-d8da2f9e7014 (b3be90a1-2556-4493-a1c4-516faebd6e0d--5166b8e1-8f23-40d1-9a57-6f8b4303cff6) Connected to virtual network. (Virtual Machine ID B3BE90A1-2556-4493-A1C4-516FAEBD6E0D)	12597	0		4	0	0	-9223372036854775808	4	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	1576	3688	hv-neutron-7864	S-1-5-83-1-3015610529-1150494038-1867629729-225361326	2/17/2022 6:12:31 PM	1f19486f-2424-0004-4c9c-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' started successfully. (Virtual machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	18500	0		4	0	0	-9223372036854775808	3	Microsoft-Windows-Hyper-V-Worker	51ddfa29-d5c8-4803-be4b-2ecb715570fe	Microsoft-Windows-Hyper-V-Worker-Admin	4576	2176	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:12:30 PM	1f19486f-2424-0003-215f-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' 77bdaf7f-1b5a-45e1-aabd-63b76455fd4c (F902DF98-2C85-448B-97CE-D9621C7530C3) started successfully. (Virtual Machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	12582	0		4	0	0	-9223372036854775808	2	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	4576	2176	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:12:30 PM	1f19486f-2424-0003-215f-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
'instance-00000001' 77bdaf7f-1b5a-45e1-aabd-63b76455fd4c (a4b42571-9e6d-4ed1-8ef4-f521db42e59f--f902df98-2c85-448b-97ce-d9621c7530c3) Connected to virtual network. (Virtual Machine ID A4B42571-9E6D-4ED1-8EF4-F521DB42E59F)	12597	0		4	0	0	-9223372036854775808	1	Microsoft-Windows-Hyper-V-SynthNic	c29c4fb7-b60e-4fff-9af9-cf21f9b09a34	Microsoft-Windows-Hyper-V-Worker-Admin	4576	2176	hv-neutron-7864	S-1-5-83-1-2763269489-1322360429-569767054-2682602203	2/17/2022 6:12:30 PM	1f19486f-2424-0003-215f-191f2424d801		microsoft-windows-hyper-v-worker-admin	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]