Search Hyper-V VM management services log for events

Hyper-V virtual machines logging may seem complicated, but virtualization expert Rick Vanover shows that it's actually rather simple to search the Hyper-V-VMMS log for VM events.

When it comes to determining what is going on with a Hyper-V virtual machine (VM), identifying a VM log repository isn't exactly intuitive. Further, there is no text file log kept with the VM as in other platforms.

Hyper-V logs for both the Hyper-V services and individual VMs are kept in Windows logging mechanisms. For standalone Hyper-V hosts accessed via Hyper-V Manager, there are a number of categories that aggregate logging information. When the standalone Hyper-V Server is used (that is, not as a role within Windows Server 2008 R2), remote management can be enabled to view these logs from another system. Hosts connected to System Center Virtual Machine Manager (SCVMM) use a different area of Windows logging; I'll cover this topic in a future TechRepublic post.

They Hyper-V logging events are kept in the Applications And Services Logs | Microsoft | Windows section of the Event Viewer logs (Figure A). Figure A

Click the image to enlarge.

A number of Hyper-V categories are logged. A generic logging section is the Hyper-V-VMMS section, which tracks management services for the hypervisor. The Hyper-V-VMMS logging contains server and VM log events. My one gripe with the interface is that there is not a column in this filter view to sort by VM name; this makes it somewhat unconventional for Windows platforms, where using a filter is a standard way of viewing events in management console snap-ins.

To search for events by an individual VM, the Find button will allow a guest VM name to be used as a search term (Figure B). Figure B

Click the image to enlarge.

Searching for events for an individual Hyper-V VM is possible with the Event Viewer and is different than other virtualization platforms.

How do you troubleshoot historical events with Hyper-V? Let us know in the discussion.