Microsoft Hyper-V Alarms

This section describes predefined alarms for Microsoft Hyper-V infrastructure components.

Alarm Name	Event/Condition	Severity	Resolve Action	Description
Bad Hyper-V username logon attempt	Based on event 4625 Microsoft-Windows-Security-Auditing.	Error	Manual	This event records a failed user logon attempt. The combination of username, password and permissions is the mechanism by which Hyper-V server authenticate a user for access and authorize the user to perform activities.
Cluster communication session failed	Based on event 1570 Microsoft-Windows-FailoverClustering.	Error	Manual	Host mode failed to establish a communication session while joining the cluster.
Cluster host node network connectivity error	Based on event 1554 Microsoft-Windows-FailoverClustering.	Error	Manual	This cluster node has no network connectivity. It cannot participate in the cluster until connectivity is restored.
Cluster hosts update version mismatch	Based on event 1548 Microsoft-Windows-FailoverClustering.	Error	Manual	Host node has established a communication session with another node and detected that it is running a different but compatible version of the cluster service software.
Cluster network failure	Based on event 1127 Microsoft-Windows-FailoverClustering.	Warning	Manual	Cluster network interface for cluster node has failed.
Cluster witness resource failure	Based on event 1558 Microsoft-Windows-FailoverClustering.	Error	Manual	The cluster service detected a problem with the witness resource. The witness resource will be failed over to another node within the cluster in an attempt to reestablish access to cluster configuration data.
Cluster witness resource update failure	Based on event 1557 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster service failed to update the cluster configuration data on the witness resource.
Host available memory	Average Hyper-V Services memory usage for 15 minutes is above 80%.	Warning	Automatic	This host is low on available memory.
Host available memory	Average Hyper-V Services memory usage for 15 minutes is above 90%.	Error	Automatic	This host is low on available memory.
Host average disk queue length	Average disk queue length for 15 minutes is above 1.	Warning	Automatic	Average disk queue length on the host may report on too many I/O requests. This means that not all requests are queued. Some requests are completed and are on their way back to where the performance data is being collected.
Host average disk queue length	Average disk queue length for 15 minutes is above 2.	Error	Automatic
Host average memory pressure	Average pressure for 15 minutes is above 90%.	Warning	Automatic	This host has exceeded the threshold for memory pressure.
Host average memory pressure	Average pressure for 15 minutes is above 100%.	Error	Automatic	This host has exceeded the threshold for memory pressure.
Host cluster membership	Based on event 1093 Microsoft-Windows-FailoverClustering.	Error	Manual	The Cluster service cannot identify host node as a member of failover cluster.
Host connection failure	State not equals Connected for 5 minutes or more.	Error	Automatic	This alarm monitors Hyper-V host connection state.
Host CPU time per dispatch	Average host CPU wait time for 15 minutes is 60 microseconds.	Warning	Automatic	The counter shows the average time Virtual Machines running on the host spent waiting for a virtual processor to be dispatched onto a logical processor. More vCPUs on host means more things the dispatcher has to schedule thus wait time raises.
Host CPU time per dispatch	Average host CPU wait time for 15 minutes is 100 microseconds.	Error	Automatic
Host CPU usage	Average Total Run Time value for 15 minutes is above 75%.	Warning	Automatic	This host has exceeded the threshold for CPU usage.
Host CPU usage	Average Total Run Time value for 15 minutes is above 85%.	Error	Automatic	This host has exceeded the threshold for CPU usage.
Host failed to form a cluster	Based on event 1546 Microsoft-Windows-FailoverClustering.	Error	Manual	Host node failed to form a failover cluster.
Host Image Management service is not running	Hyper-V Image Management service is not running for 5 minutes or more.	Error	Automatic	The service required to manage virtual storage is not running. No virtual storage management operations can be performed.
Host Memory Pages Usage	Average pages/sec value for 15 minutes is above 500.	Warning	Automatic	The counter shows the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the types of faults that cause system-wide delays.
Host Memory Pages Usage	Average pages/sec value for 15 minutes is above 1500.	Error	Automatic
Host network average output queue length	Average network output queue length for 15 minutes is above 1.	Warning	Automatic	This host has exceeded the threshold for the length of the queue in packets. This counter should be 0 at all times.
Host network average output queue length	Average network output queue length for 15 minutes is above 2.	Error	Automatic
Host network outbound errors number	Average network outbound errors number for 15 minutes is above 1.	Warning	Automatic	This host has exceeded the threshold for the outbound packets that couldn't be transmitted because of errors.
Host network outbound errors number	Average network outbound errors number for 15 minutes is above 2.	Error	Automatic
Host Networking Management service is not running	Hyper-V Networking Management service is not running for 5 minutes or more.	Error	Automatic	The Hyper-V Networking Management Service is not configured to start automatically. Virtual networks cannot be managed until the service is started.
Host node failed to form a cluster	Based on event 1573 Microsoft-Windows-FailoverClustering.	Error	Manual	Host node failed to form a cluster.
Host node failed to join cluster	Based on event 1572 Microsoft-Windows-FailoverClustering.	Error	Manual	Host node failed to join the cluster because it could not send and receive failure detection network messages with other cluster nodes.
Host node was evicted from cluster	Based on event 1011 Microsoft-Windows-FailoverClustering.	Warning	Manual	Cluster host node has been evicted from the failover cluster.
Host node was removed from cluster	Based on event 1135 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster node was removed from the active failover cluster membership. If the Cluster service fails to start on a failover cluster node, the node cannot function as part of the cluster.
Host restart	Based on event 1074 User32.	Information	Automatic	Host operation system has been restarted or shut down.
Missing latest cluster configuration data	Based on event 1561 Microsoft-Windows-FailoverClustering.	Error	Manual	The cluster service has determined that this node does not have the latest copy of cluster configuration data. Therefore, the cluster service has prevented itself from starting on this node.
Network communication failure	Based on event 1592 Microsoft-Windows-FailoverClustering.	Warning	Manual	Cluster node lost communication with another cluster node. Network communication was reestablished.
Unreachable cluster network interface	Based on event 1126 Microsoft-Windows-FailoverClustering.	Warning	Manual	Cluster network interface for cluster node is unreachable by at least one other cluster node attached to the network.
Virtual Machine Management service is not running	Hyper-V Virtual Machine Management service is not running.	Error	Automatic	The service required to manage virtual machines is not running. No virtual machine management operations can be performed.

Virtual Machine

Alarm Name	Event/Condition	Severity	Resolve Action	Description
Background disk merge failed	Based on event 19100 Microsoft-Windows-Hyper-V-VMMS.	Warning	Manual	The parent virtual hard disks associated with this virtual machine may be in an inconsistent state.
Background disk merge interruption	Based on event 19090 Microsoft-Windows-Hyper-V-VMMS.	Warning	Manual	The snapshot merge operation was interrupted.
Checkpoint configuration is not accessible	Based on event 16420 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	The configuration of checkpoint is no longer accessible.
Current memory pressure	Average memory pressure for 15 minutes is above 110%.	Warning	Automatic	This VM has exceeded the threshold for memory pressure.
Current memory pressure	Average memory pressure for 15 minutes is above 125%.	Error	Automatic	This VM has exceeded the threshold for memory pressure.
Failed to assign dynamic MAC address	Based on event 12572 Microsoft-Windows-Hyper-V-SynthNic.	Error	Manual	Dynamic MAC address for VM network adapter was not assigned.
Failed to create memory contents file	Based on event 3320 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	Failed to create memory contents file.
Failed to create VM saved state file	Based on event 3080 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	Failed to create or access VM saved state file.
Failed to delete VM directory	Based on event 16150 Microsoft-Windows-Hyper-V-VMMS.	Warning	Manual	Cannot delete VM directory.
Failed to initialize VM memory	Based on event 3050 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	Failed to initialize VM memory.
Failed to merge virtual disk	Based on event 16210 Microsoft-Windows-Hyper-V-VMMS.	Warning	Manual	Cannot merge disk file on deletion. As a result, this disk may be in an inconsistent state.
Failed to power on VM	Based on event 12010 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	Failed to power on VM.
	Based on event 12030 Microsoft-Windows-Hyper-V-Worker.
	Based on event 12040 Microsoft-Windows-Hyper-V-Worker.
	Based on event 12050 Microsoft-Windows-Hyper-V-Worker.
Failed to restore VM	Based on event 12080 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	Failed to restore a VM.
Failed to save VM	Based on event 12054 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	Failed to save state for a VM.
Guest disk space	Guest disk free space is below 10%.	Warning	Automatic	Guest OS volume is low on available guest disk space.
Guest disk space	Guest disk free space is below 5%.	Error	Automatic	Guest OS volume is low on available guest disk space.
Incompatible version of integration services	Based on event 4010 Microsoft-Windows-Hyper-V-Integration.	Warning	Manual	The version of a component of integration services is incompatible with another version.
Insufficient disk space	Based on event 16050 Microsoft-Windows-Hyper-V-VMMS.	Warning	Manual	Hyper-V disk space is low on available free space.
Invalid static MAC address	Based on event 12560 Microsoft-Windows-Hyper-V-SynthNic.	Error	Manual	By default, new virtual machines in Hyper-V are created with NICs that are assigned dynamic MAC addresses.
	Based on event 12560 Microsoft-Windows-Hyper-V-Worker.
	Based on event 12560 Microsoft-Windows-Hyper-V-VMMS.
Latest checkpoint age	VM checkpoint age is 48 hours or more.	Warning	Automatic	The age of the latest checkpoint for this VM has exceeded the configured threshold.
Latest checkpoint size	Hyper-V VM checkpoint size is above 10% of the VM size.	Warning	Automatic	The size of the latest checkpoint file for this VM has exceeded the configured threshold.
Latest checkpoint size	Hyper-V VM checkpoint size is above 20% of the VM size.	Error	Automatic
Machine remoting system failure	Based on event 12480 Microsoft-Windows-Hyper-V-Worker.	Warning	Manual	Failure in machine remoting system has been detected.
No disk space to run this VM	Based on event 16060 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	VM has been paused because it has run out of disk space.
Not enough memory to start a VM	Based on event 3122 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	Hyper-V was unable to allocate RAM resources to start this VM.
Not enough memory to start a VM	Based on event 3030 Microsoft-Windows-Hyper-V-Worker.	Error	Manual
Possible ransomware activity	Total Run Time is above 70% and Virtual Storage Write is above 40 MB/s or Virtual Network Bytes Sent/sec is above 40 MB/s for 5 minutes.	Warning	Automatic	Veeam ONE detected suspicious activity on this VM.
Possible ransomware activity	Total Run Time is above 80% and Virtual Storage Write is above 60 MB/s or Virtual Network Bytes Sent/sec is above 60 MB/s for 5 minutes.	Error	Automatic	Veeam ONE detected suspicious activity on this VM.
Static MAC address conflict	Based on event 12562 Microsoft-Windows-Hyper-V-SynthNic.	Warning	Manual	By default, new virtual machines in Hyper-V are created with NICs that are assigned dynamic MAC addresses.
Static MAC address conflict	Based on event 12562 Microsoft-Windows-Hyper-V-Worker.	Warning	Manual
Unexpected VM error	Based on event 16020 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	This VM has encountered an unexpected error.
VM configuration is not accessible	Based on event 16410 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	The configuration of virtual machine is no longer accessible.
VM configuration is not accessible	Based on event 16400 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual
VM configuration module error	Based on event 4096 Microsoft-Windows-Hyper-V-Config.	Error	Manual	The VM configuration is no longer accessible.
VM CPU usage	Average guest run time for 15 minutes is above 75%.	Warning	Automatic	This VM has exceeded the threshold for CPU usage.
VM CPU usage	Average guest run time for 15 minutes is above 85%.	Error	Automatic	This VM has exceeded the threshold for CPU usage.
VM disk errors	Average number of errors/min for 15 minutes is above 4.	Warning	Automatic	This VM has logged one or more errors that have occurred on its virtual device.
VM disk errors	Average number of errors/min for 15 minutes is above 8.	Error	Automatic
VM guest OS reboot	Based on event 18514 Microsoft-Windows-Hyper-V-Worker.	Information	Warning	Virtual Machine was rebooted. This warning is applied only to Windows Server 2012 and Windows Server 2012 R2.
VM initialization error	Based on event 3040 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	VM initialization has failed.
VM power status	State not equals Running for 5 minutes or more.	Error	Automatic	VM power state has been changed.
VM invalid switch port reference	Based on event 12570 Microsoft-Windows-Hyper-V-SynthNic.	Error	Manual	The virtual machine cannot be started.
VM restart	Based on event 18512 Microsoft-Windows-Hyper-V-Worker.	Information	Automatic	Virtual Machine was rebooted. This warning is applied only to Windows Server 2012 and Windows Server 2012 R2.
VM shutdown by guest	Based on event 18508 Microsoft-Windows-Hyper-V-Worker.	Information	Automatic	Virtual Machine was shut down. This warning is applied only to Windows Server 2012 and newer Windows server versions.
VM shutdown by host	Based on event 18504 Microsoft-Windows-Hyper-V-Worker.	Information	Automatic	Virtual Machine was shut down. This warning is applied only to Windows Server 2012 and newer Windows server versions.
VM vCPU time per dispatch	Average CPU wait time for 15 minutes is above 60 microseconds.	Warning	Automatic	The counter shows the average time spent waiting for a virtual processor to be dispatched onto a logical processor.
VM vCPU time per dispatch	Average CPU wait time for 15 minutes is above 100 microseconds.	Error	Automatic
VM with no backups	No backup restore points for the past 24 hours.	Warning	Automatic	This VM has not been backed up within the defined RPO (Recovery Point Objective) interval.
VM with no replica	No replica restore points for the past 24 hours.	Warning	Automatic	This VM has not been replicated within the defined RPO (Recovery Point Objective) interval.
VSS checkpoint failure	Based on event 10102 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	Failed to create the backup of virtual machine.
VSS checkpoint failure	Based on event 15252 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	Failed to create the backup of virtual machine.

Cluster

Alarm Name	Event/Condition	Severity	Resolve Action	Description
Cluster configuration data is missing or corrupt	Based on event 1575 Microsoft-Windows-FailoverClustering.	Error	Manual	An attempt to forcibly start the cluster service has failed because the cluster configuration data on host node is either missing or corrupt.
Cluster configuration database cannot be unloaded	Based on event 1593 Microsoft-Windows-FailoverClustering.	Error	Manual	The failover cluster database could not be unloaded and any potentially incorrect changes in memory could not be discarded. The cluster service will attempt to repair the database by retrieving it from another cluster node.
Cluster database could not be loaded	Based on event 1057 Microsoft-Windows-FailoverClustering.	Error	Manual	The cluster database could not be loaded. Ensure that a good copy of the cluster configuration is available to the node.
Cluster memory overcommitment	Based on event VeeamHvClusterReserveStateOkEvent.	Resolve	Automatic	When placing a virtual machine in a failover cluster, the placement process calculates whether the new virtual machine will over-commit the cluster. If the action will over-commit the cluster, the alarm will trigger.
Cluster memory overcommitment	Based on event VeeamHvClusterReserveStateErrorEvent.	Error	Automatic
Cluster network is down	Based on event 1130 Microsoft-Windows-FailoverClustering.	Warning	Manual	Cluster network is down.
Cluster resource cannot be brought online	Based on event 1207 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster network name resource cannot be brought online. The computer object associated with the resource could not be updated in domain.
Cluster resource failure	Based on event 1069 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster resource in clustered service or application has failed.
Cluster service cannot be started	Based on event 1090 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster service cannot be started. An attempt to read configuration data from the Windows registry failed.
Cluster service failed to start	Based on event 1105 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster service failed to start because it was unable to register interfaces with the RPC service.
Cluster service failed to write data to a file	Based on event 1080 Microsoft-Windows-FailoverClustering.	Warning	Manual	Cluster service could not write to a file. In a failover cluster, most clustered services or applications use at least one disk, also called a disk resource, that you assign when you configure the clustered service or application. Clients can use the clustered service or application only when the disk is functioning correctly.
Cluster service fatal error	Based on event 1000 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster service suffered an unexpected fatal error.
Cluster service interruption	Based on event 1006 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster service was halted due to incomplete connectivity with other cluster nodes.
Cluster service shut down	Based on event 1177 Microsoft-Windows-FailoverClustering.	Error	Manual	The Cluster service is shutting down because quorum was lost.
Cluster Shared Volume is not available	Based on event 5120 Microsoft-Windows-FailoverClustering.	Warning	Automatic	Cluster Shared Volume is no longer available on this node. All I/O will temporarily be queued until a path to the volume is reestablished.
Cluster Shared Volume is not available	Based on event 5122 Microsoft-Windows-FailoverClustering.	Resolve	Automatic
Cluster Shared Volume is not directly accessible	Based on event 5121 Microsoft-Windows-FailoverClustering.	Warning	Automatic	Cluster Shared Volume is no longer directly accessible from this cluster node. I/O access will be redirected to the storage device over the network through the node that owns the volume. This may result in degraded performance.
Cluster Shared Volume is not directly accessible	Based on event 5122 Microsoft-Windows-FailoverClustering.	Resolve	Automatic
Failed to bring cluster resource online	Based on event 1049 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster IP address resource cannot be brought online.
Failed to copy cluster configuration data file	Based on event 1581 Microsoft-Windows-FailoverClustering.	Warning	Manual	The restore request for the cluster configuration data failed to make a copy of the existing cluster configuration data file (ClusDB).
Failed to create cluster resource name in domain	Based on event 1193 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster network name resource failed to create its associated computer object in domain.
Failed to migrate virtual machine	Based on event 22506 Microsoft-Windows-Hyper-V-High-Availability.	Error	Manual	Live migration for this VM did not succeed.
	Based on event 22505 Microsoft-Windows-Hyper-V-High-Availability.
	Based on event 21100 Microsoft-Windows-Hyper-V-High-Availability.
Failed to unload failover cluster database	Based on event 1574 Microsoft-Windows-FailoverClustering.	Error	Manual	The failover cluster database could not be unloaded.
Inconsistency within the failover cluster	Based on event 1073 Microsoft-Windows-FailoverClustering.	Error	Manual	The Cluster service was halted to prevent an inconsistency within the failover cluster.
Invalid IP address detected	Based on event 1047 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster IP address resource cannot be brought online because the address value is invalid.
Invalid IP address for cluster resource	Based on event 1360 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster IP address resource failed to come online.
Invalid subnet mask detected	Based on event 1046 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster IP address resource cannot be brought online because the subnet mask value is invalid.
Unexpected cluster service problem	Based on event 1556 Microsoft-Windows-FailoverClustering.	Error	Manual	The cluster service encountered an unexpected problem and will be shut down.

Cluster Shared Volume

Alarm Name	Event/Condition	Severity	Resolve Action	Description
Active filter drivers detected	Based on event 5125 Microsoft-Windows-FailoverClustering.	Warning	Manual	Cluster Shared Volume has identified one or more active filter drivers on this device stack that could interfere with CSV operations. I/O access will be redirected to the storage device over the network through another Cluster node. This may result in degraded performance.
Active filter drivers detected	Based on event 5126 Microsoft-Windows-FailoverClustering.	Warning	Manual
Cluster Shared Volume read latency	Average read latency for 15 minutes is above 40 milliseconds.	Warning	Automatic	Cluster Shared Volume has exceeded the configured threshold of total read latency.
Cluster Shared Volume read latency	Average read latency for 15 minutes is above 80 milliseconds.	Error	Automatic
Cluster Shared Volume write latency	Average write latency for 15 minutes is above 40 milliseconds.	Warning	Automatic	Cluster Shared Volume has exceeded the configured threshold of total write latency.
Cluster Shared Volume write latency	Average write latency for 15 minutes is above 80 milliseconds.	Error	Automatic
Cluster Shared Volume free space	Free space is below 10%.	Warning	Automatic	Cluster Shared Volume is low on available free space.
Cluster Shared Volume free space	Free space is below 5%.	Error	Automatic	Cluster Shared Volume is low on available free space.
Redirected access was turned on	Based on event 5136 Microsoft-Windows-FailoverClustering.	Warning	Manual	Cluster Shared Volume redirected access was turned on. Access to the storage device will be redirected over the network from all cluster nodes that are accessing this volume. This may result in degraded performance.
Volume snapshot preparation error	Based on event 1584 Microsoft-Windows-FailoverClustering.	Error	Manual	A backup application initiated a VSS snapshot on Cluster Shared Volume without properly preparing the volume for snapshot. This snapshot may be invalid and the backup may not be usable for restore operations.

Local Storage

Alarm Name	Event/Condition	Severity	Resolve Action	Description
Datastore read latency	Avg Disk sec/Read value for 15 minutes is 40 milliseconds.	Warning	Automatic	This host local disk has exceeded the threshold for total read latency. This performance monitor counter measures the amount of time that read operations take to respond to the operating system.
Datastore read latency	Avg Disk sec/Read value for 15 minutes is 80 milliseconds.	Error	Automatic
Datastore write latency	Avg Disk sec/Write value for 15 minutes is 40 milliseconds.	Warning	Automatic	This host disk has exceeded the threshold for total write latency. This performance monitor counter measures the amount of time that write operations take to respond to the operating system.
Datastore write latency	Avg Disk sec/Write value for 15 minutes is 80 milliseconds.	Error	Automatic
Local volume free space	Free space is below 10%.	Warning	Automatic	Local volume is low on available free space.
Local volume free space	Free space is below 5%.	Error	Automatic	Local volume is low on available free space.

Any Hyper-V Object

Alarm Name	Event/Condition	Severity	Resolve Action	Description
Cluster Shared Volume is no longer accessible	Based on event 5142 Microsoft-Windows-FailoverClustering.	Error	Manual	Cluster Shared Volume is no longer accessible from this cluster node because of error.
Failed to load VM configuration	Based on event 16300 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	Cannot load a virtual machine configuration
Failed to open VM attachment	Based on event 12290 Microsoft-Windows-Hyper-V-Worker.	Error	Manual	Cannot open VM attachment.
	Based on event 12290 Microsoft-Windows-Hyper-V-SynthStor.
	Based on event 12290 Microsoft-Windows-Hyper-V-VMMS.
	Based on event 12140 Microsoft-Windows-Hyper-V-VMMS.
	Based on event 12140 Microsoft-Windows-Hyper-V-Worker.
	Based on event 12140 Microsoft-Windows-Hyper-V-SynthStor.
	Based on event 12240 Microsoft-Windows-Hyper-V-VMMS.
	Based on event 12240 Microsoft-Windows-Hyper-V-Worker.
	Based on event 12240 Microsoft-Windows-Hyper-V-SynthStor.
Failed to register VM configuration file	Based on event 20100 Microsoft-Windows-Hyper-V-VMMS.	Warning	Manual	The Hyper-V Virtual Machine Management service failed to register the configuration for the virtual machine.
Failed to revert to VSS snapshot	Based on event 10104 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	Failed to revert to VSS snapshot on one or more virtual hard disks of the virtual machine.
Failed to unregister VM configuration file	Based on event 20102 Microsoft-Windows-Hyper-V-VMMS.	Warning	Manual	The Hyper-V Virtual Machine Management service failed to unregister the configuration for the virtual machine.
Failed to verify VM configuration file	Based on event 20104 Microsoft-Windows-Hyper-V-VMMS.	Warning	Manual	The Hyper-V Virtual Machine Management service failed to verify that the configuration is registered for the virtual machine.
VM configuration file is corrupt	Based on event 16310 Microsoft-Windows-Hyper-V-VMMS.	Error	Manual	Cannot load the virtual machine because the configuration is corrupt.