Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
The volume snapshot driver has completed processing for volume offline. Volume GUID: {927A77EA-0000-0000-0000-100000000000} Guidance: When a volume is taken offline, the volume snapshot driver disables any persistent snapshots that still exist for the volume (autorelease snapshots were deleted when the volume was dismounted). Snapshots of other volumes whose diff areas are on the offlining volume are destroyed, unless those volumes are in snapshot protection mode. In that case those volumes are taken offline. You should expect this event when a volume is taken offline. No user action is required.	117	0		4	0	2	4611686018427387904	38	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	512	hv-osbrick-8360	S-1-5-18	5/25/2022 9:33:02 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume offline. Volume GUID: {927A77EA-0000-0000-0000-100000000000} Guidance: When a volume is taken offline, the volume snapshot driver disables any persistent snapshots that still exist for the volume (autorelease snapshots were deleted when the volume was dismounted). Snapshots of other volumes whose diff areas are on the offlining volume are destroyed, unless those volumes are in snapshot protection mode. In that case those volumes are taken offline. You should expect this event when a volume is taken offline. No user action is required.	116	0		4	0	1	4611686018427387904	37	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	512	hv-osbrick-8360	S-1-5-18	5/25/2022 9:33:02 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {927A77EA-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	36	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	5044	hv-osbrick-8360	S-1-5-18	5/25/2022 9:33:01 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {927A77EA-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	35	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	5044	hv-osbrick-8360	S-1-5-18	5/25/2022 9:33:01 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume offline. Volume GUID: {927A77EA-0000-0000-0000-100000000000} Guidance: When a volume is taken offline, the volume snapshot driver disables any persistent snapshots that still exist for the volume (autorelease snapshots were deleted when the volume was dismounted). Snapshots of other volumes whose diff areas are on the offlining volume are destroyed, unless those volumes are in snapshot protection mode. In that case those volumes are taken offline. You should expect this event when a volume is taken offline. No user action is required.	117	0		4	0	2	4611686018427387904	34	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	4384	hv-osbrick-8360	S-1-5-18	5/25/2022 9:32:21 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume offline. Volume GUID: {927A77EA-0000-0000-0000-100000000000} Guidance: When a volume is taken offline, the volume snapshot driver disables any persistent snapshots that still exist for the volume (autorelease snapshots were deleted when the volume was dismounted). Snapshots of other volumes whose diff areas are on the offlining volume are destroyed, unless those volumes are in snapshot protection mode. In that case those volumes are taken offline. You should expect this event when a volume is taken offline. No user action is required.	116	0		4	0	1	4611686018427387904	33	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	4384	hv-osbrick-8360	S-1-5-18	5/25/2022 9:32:21 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {927A77EA-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	32	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	384	hv-osbrick-8360	S-1-5-18	5/25/2022 9:32:21 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {927A77EA-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	31	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	384	hv-osbrick-8360	S-1-5-18	5/25/2022 9:32:21 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	30	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	228	hv-osbrick-8360	S-1-5-18	5/25/2022 8:42:19 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	29	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	228	hv-osbrick-8360	S-1-5-18	5/25/2022 8:42:19 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	28	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	240	WIN-5T344G8GM1H	S-1-5-18	5/25/2022 8:40:31 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	27	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	240	WIN-5T344G8GM1H	S-1-5-18	5/25/2022 8:40:31 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	26	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	212	WIN-5T344G8GM1H	S-1-5-18	5/25/2022 8:40:31 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	25	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	212	WIN-5T344G8GM1H	S-1-5-18	5/25/2022 8:40:31 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	24	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	196	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:27 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	23	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	196	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:27 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	22	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:12 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	21	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:12 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	20	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:30 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	19	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:30 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	18	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:57 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	17	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:57 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	16	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:47 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	15	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:47 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	14	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:49:58 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	13	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:49:58 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	12	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 10:23:52 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	11	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 10:23:52 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	10	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:20 PM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	9	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:20 PM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	8	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:06 PM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	7	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:06 PM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	6	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:48 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	5	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:48 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	4	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	336	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:49 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	3	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	336	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:49 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has completed processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: The volume snapshot driver was able to scan for any persistent snapshots on this volume. You should expect this event when a volume is brought online. No user action is required.	101	0		4	0	2	4611686018427387904	2	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	200	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:49 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The volume snapshot driver has begun processing for volume online. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Guidance: When a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume. You should expect this event when a volume is brought online. No user action is required.	100	0		4	0	1	4611686018427387904	1	Microsoft-Windows-VolumeSnapshot-Driver	67fe2216-727a-40cb-94b2-c02211edb34a	Microsoft-Windows-VolumeSnapshot-Driver/Operational	4	200	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:49 AM			microsoft-windows-volumesnapshot-driver/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]