Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
The VHD C:\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	29	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:23:18 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The VHD C:\iSCSIVHDLocation\volume-5e60c315-5abf-476e-880c-12afbe54aac6.VHDX has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	28	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:23:07 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The VHD \Device\HarddiskVolumeShadowCopy2\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	27	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:21:08 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The VHD C:\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	26	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4340	hv-osbrick-7679	S-1-5-18	12/18/2020 6:20:56 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Expand VHD C:\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX.	51	0		4	0	0	-9223372036854775808	25	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	3376	hv-osbrick-7679	S-1-5-18	12/18/2020 6:16:49 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Expand VHD for C:\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX (target '').	50	0		4	0	0	-9223372036854775808	24	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4352	3700	hv-osbrick-7679	S-1-5-18	12/18/2020 6:16:49 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX.	51	0		4	0	0	-9223372036854775808	23	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	1464	hv-osbrick-7679	S-1-5-18	12/18/2020 6:16:49 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX (target '').	50	0		4	0	0	-9223372036854775808	22	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4352	4408	hv-osbrick-7679	S-1-5-18	12/18/2020 6:16:48 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX.	51	0		4	0	0	-9223372036854775808	21	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	5108	hv-osbrick-7679	S-1-5-18	12/18/2020 6:16:46 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\iSCSIVHDLocation\volume-2b6cd914-5689-46a1-a4b1-52553905587c.VHDX (target '').	50	0		4	0	0	-9223372036854775808	20	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:16:46 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The VHD C:\iSCSIVHDLocation\volume-15c0e266-9e9d-4d7a-b692-ae2467525c57.VHDX has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	19	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:16:32 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Expand VHD C:\iSCSIVHDLocation\volume-15c0e266-9e9d-4d7a-b692-ae2467525c57.VHDX.	51	0		4	0	0	-9223372036854775808	18	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	3312	hv-osbrick-7679	S-1-5-18	12/18/2020 6:15:14 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Expand VHD for C:\iSCSIVHDLocation\volume-15c0e266-9e9d-4d7a-b692-ae2467525c57.VHDX (target '').	50	0		4	0	0	-9223372036854775808	17	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4352	4472	hv-osbrick-7679	S-1-5-18	12/18/2020 6:15:14 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\iSCSIVHDLocation\volume-15c0e266-9e9d-4d7a-b692-ae2467525c57.VHDX.	51	0		4	0	0	-9223372036854775808	16	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	2924	hv-osbrick-7679	S-1-5-18	12/18/2020 6:15:14 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\iSCSIVHDLocation\volume-15c0e266-9e9d-4d7a-b692-ae2467525c57.VHDX (target '').	50	0		4	0	0	-9223372036854775808	15	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4352	1872	hv-osbrick-7679	S-1-5-18	12/18/2020 6:15:13 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\iSCSIVHDLocation\volume-15c0e266-9e9d-4d7a-b692-ae2467525c57.VHDX.	51	0		4	0	0	-9223372036854775808	14	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	4976	hv-osbrick-7679	S-1-5-18	12/18/2020 6:15:11 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\iSCSIVHDLocation\volume-15c0e266-9e9d-4d7a-b692-ae2467525c57.VHDX (target '').	50	0		4	0	0	-9223372036854775808	13	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:15:11 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The VHD C:\iSCSIVHDLocation\volume-83fc10af-4b8a-44cc-ad27-8bf9ef675666.VHDX has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	12	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:14:56 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The VHD \Device\HarddiskVolumeShadowCopy1\iSCSIVHDLocation\volume-3060a389-88a0-4bd2-81f8-b42b33856f2c.VHDX has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	11	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:13:39 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Expand VHD C:\iSCSIVHDLocation\volume-3060a389-88a0-4bd2-81f8-b42b33856f2c.VHDX.	51	0		4	0	0	-9223372036854775808	10	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	2024	hv-osbrick-7679	S-1-5-18	12/18/2020 6:13:22 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Expand VHD for C:\iSCSIVHDLocation\volume-3060a389-88a0-4bd2-81f8-b42b33856f2c.VHDX (target '').	50	0		4	0	0	-9223372036854775808	9	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4352	1380	hv-osbrick-7679	S-1-5-18	12/18/2020 6:13:22 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\iSCSIVHDLocation\volume-3060a389-88a0-4bd2-81f8-b42b33856f2c.VHDX.	51	0		4	0	0	-9223372036854775808	8	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	4868	hv-osbrick-7679	S-1-5-18	12/18/2020 6:13:22 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\iSCSIVHDLocation\volume-3060a389-88a0-4bd2-81f8-b42b33856f2c.VHDX (target '').	50	0		4	0	0	-9223372036854775808	7	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4352	1872	hv-osbrick-7679	S-1-5-18	12/18/2020 6:13:21 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\iSCSIVHDLocation\volume-3060a389-88a0-4bd2-81f8-b42b33856f2c.VHDX.	51	0		4	0	0	-9223372036854775808	6	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	4996	hv-osbrick-7679	S-1-5-18	12/18/2020 6:13:19 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\iSCSIVHDLocation\volume-3060a389-88a0-4bd2-81f8-b42b33856f2c.VHDX (target '').	50	0		4	0	0	-9223372036854775808	5	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	1280	4584	hv-osbrick-7679	S-1-5-18	12/18/2020 6:13:19 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Expand VHD C:\openstack\instances\instance-00000001\root.vhdx.	51	0		4	0	0	-9223372036854775808	4	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	772	hv-osbrick-7679	S-1-5-18	12/18/2020 6:12:57 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Expand VHD for C:\openstack\instances\instance-00000001\root.vhdx (target '').	50	0		4	0	0	-9223372036854775808	3	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4684	4808	hv-osbrick-7679	S-1-5-18	12/18/2020 6:12:57 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\openstack\instances\instance-00000001\root.vhdx.	51	0		4	0	0	-9223372036854775808	2	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	3352	hv-osbrick-7679	S-1-5-18	12/18/2020 6:12:57 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\openstack\instances\instance-00000001\root.vhdx (target '').	50	0		4	0	0	-9223372036854775808	1	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4684	4580	hv-osbrick-7679	S-1-5-18	12/18/2020 6:12:57 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]