Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
The VHD C:\openstack\instances\instance-00000007\root.vhdx has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	11	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	3336	4900	hv-osbrick-8497	S-1-5-83-1-2339645029-1291547786-1838897833-1824355404	7/13/2022 5:31:09 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The VHD C:\openstack\instances\instance-00000007\root.vhdx has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	10	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4572	4644	hv-osbrick-8497	S-1-5-83-1-2339645029-1291547786-1838897833-1824355404	7/13/2022 5:29:53 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Expand VHD C:\openstack\instances\instance-00000007\root.vhdx.	51	0		4	0	0	-9223372036854775808	9	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	4640	hv-osbrick-8497	S-1-5-18	7/13/2022 5:28:12 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Expand VHD for C:\openstack\instances\instance-00000007\root.vhdx (target '').	50	0		4	0	0	-9223372036854775808	8	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	2912	3760	hv-osbrick-8497	S-1-5-18	7/13/2022 5:28:12 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\openstack\instances\instance-00000007\root.vhdx.	51	0		4	0	0	-9223372036854775808	7	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	3392	hv-osbrick-8497	S-1-5-18	7/13/2022 5:28:12 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\openstack\instances\instance-00000007\root.vhdx (target '').	50	0		4	0	0	-9223372036854775808	6	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	2912	3760	hv-osbrick-8497	S-1-5-18	7/13/2022 5:28:11 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The VHD C:\openstack\instances\instance-00000001\root.vhdx has been removed (unsurfaced) as disk number 0.	2	0		4	0	0	-9223372036854775808	5	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4148	3224	hv-osbrick-8497	S-1-5-83-1-1467330345-1095891712-2795614126-3968454992	7/13/2022 5:27:49 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Expand VHD C:\openstack\instances\instance-00000001\root.vhdx.	51	0		4	0	0	-9223372036854775808	4	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	1868	hv-osbrick-8497	S-1-5-18	7/13/2022 5:22:47 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Expand VHD for C:\openstack\instances\instance-00000001\root.vhdx (target '').	50	0		4	0	0	-9223372036854775808	3	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	2912	3836	hv-osbrick-8497	S-1-5-18	7/13/2022 5:22:47 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Successfully performed Create VHD C:\openstack\instances\instance-00000001\root.vhdx.	51	0		4	0	0	-9223372036854775808	2	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	4	1088	hv-osbrick-8497	S-1-5-18	7/13/2022 5:22:47 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Performing Create VHD for C:\openstack\instances\instance-00000001\root.vhdx (target '').	50	0		4	0	0	-9223372036854775808	1	Microsoft-Windows-VHDMP	e2816346-87f4-4f85-95c3-0c79409aa89d	Microsoft-Windows-VHDMP-Operational	2912	3836	hv-osbrick-8497	S-1-5-18	7/13/2022 5:22:46 PM			microsoft-windows-vhdmp-operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]