Hyper-V-VmSwitch Event 25 Continuously RRS feed

  • Question

  • I  am running Windows 2012 Datacenter Version 6.2.9200, running 13 Virtual Machines.  4 of these Virtual Machines uses NLB within the Guest Operating system (Guests are Windows 2008 R2).

    The NLB seems to be functioning correctly from the guest point of view, and all network interfaces are converged, but the System Event Log on the Host is filling up with informational messages similar to the following:

    Source: Hyper-V-VmSwitch
    Event ID: 25
    Task Category: (1018)
    Level: Information

    The MAC address 02-01-0A-6E-B0-97 has moved from port 62DFF413-9522-421A-83A4-B0D7A8814EB0 (Friendly Name: Dynamic Ethernet Switch Port) to port 4CE77E13-2813-4745-8191-931C11A71B05 (Friendly Name: Microsoft Network Adapter Multiplexor Driver - Virtual Switch_External).

    This event occurs approximately 12 times a second.  The message isn't always the same, the MAC address changes slightly, as does the port GUIDs.  I have traced the MAC addresses down to being the ones used in the NLB clusters.

    I can confirm that all the virtual machines which have NLB do have "Enable MAC address spoofing" enabled.

    Out of the 28,093 events I currently have, 28,042 of them are this event.

    How do I stop my system event log from receiving all this spam?

    • Edited by LesterClayton Tuesday, August 21, 2012 1:52 PM Minor Correction
    Tuesday, August 21, 2012 1:51 PM


  • Hi,

    I checked with the product team and was told that the combination of LBFO teaming and enabling MAC Spoofing on the VM’s is causing these entries in the event log. There is no way to disable the events without changing the configuration.


    Wednesday, August 22, 2012 10:17 PM

All replies

  • Hi,

    From what I'm able to research about this, it looks like a problem having to do either with MAC address collisions or the switch. Is it possible for you to configure the four NLB VMs with static MAC addresses rather than dynamic, making sure they are all unique?



    Tuesday, August 21, 2012 4:00 PM
  • Hi Lester,

    I ran in to a similar problem when testing Hyper-V on a host that only had one NIC installed.  I couldn't stop the events being logged, the only way I solved it was to install an extra NIC; 1 for management and 1 in trunk mode dedicated to the lab network (not shared with the operating system).

    Do you have multiple NICs in the host? If so, are the VMs using NIC that is shared with the host?


    Tuesday, August 21, 2012 7:18 PM
  • All 4 virtual machines have static mac addresses already, but thanks for posting :)
    Wednesday, August 22, 2012 6:31 AM
  • The server in question has 4 NIC's.  1 dedicated for the host, not used by Hyper-V, 1 disconnected (reserved for iSCSI), and the other 2 in a Switch Independent, Address Hash all adapters Active Team.

    There is only one vSwitch on the Hyper-V Virtual Networks, and this is bound to the Team (Microsoft Network Adapter Multiplexor Driver), but I have checked "Allow management operating system to share this network adapter".  This is done so that my cluster has two cluster networks rather than 1.

    As this is a production server, I'm not keen to change any networking configuration right now (we all know how well that went in the old days!), but I do have another server I can play around with.  I'll see if I can reproduce the issue, and then un-share my virtual Switch with the operating system to see if that makes a difference.  Will report back.

    Wednesday, August 22, 2012 6:36 AM
  • Hi,

    I checked with the product team and was told that the combination of LBFO teaming and enabling MAC Spoofing on the VM’s is causing these entries in the event log. There is no way to disable the events without changing the configuration.


    Wednesday, August 22, 2012 10:17 PM
  • I have this exact same problem with some hosts in my Fail over Cluster. I have the same configuration with teamed Broadcom NICs configured for LBFO and 2 Guests in 1 NLB. The guests are running on different hosts, but the errors only show up for one guest on one host. All of the hosts are configured exactly the same (as far as I can see).

    If I live migrate the problem VM to another Host the error doesn't show up on the new host. When I migrate it back it starts back up again. So it cant JUST be a problem with teaming, since it should show up on all hosts.

    Any more suggestions?



    Friday, August 24, 2012 10:21 PM
  • Hi Greg

    Thanks for your answer.  It's a bit of a pity I now have to dedicated another Ethernet port just so I can support NLB (which has the requirement of using MAC Address Spoofing), but hey, they're cheap so not a problem! :)

    JayDubU: The issue I had seemed to move to whichever host was hosting the VM at the time. Not sure what's different in your environment :/

    Tuesday, September 11, 2012 12:23 PM
  • I'm having a similar issue using only one virtual switch with only one uplink. So my eventvwr messages always refer to the same MAC address switching back and forth.

    Using Server 2016 with up-to-date Intel NIC drivers.

    Any ideas?

    Tuesday, January 17, 2017 5:56 AM
  • I have the same issue and I DON'T have MAC address spoofing on (in the one VM I have on the host).
    Tuesday, July 11, 2017 1:59 PM
  • I also have this issue and I don't have a fix for it but more of a work around.  I created a schedule task that looks for event 25 messages.  When that occurs I run a powershell script that resets my network adapters

    restart-netadapter -name "<Ethernet adapter name 1>"

    restart-netadapter -name "<Ethernet adapter name 2>"

    restart-netadapter -name "<Ethernet adapter name ...>"

    What I found was that resetting the network adapter associated with the event 25 ID will temporarily stop the logging until it is triggered again (could be hours or even weeks).  I also log all of these events by basically outputting some messages when the script runs.  Since implementing this workaround I only see logs every 4-5 days.  But as you know, once they start they continue at a rapid pace filling your event log.  It isn't ideal to reset the adapter, but until Microsoft addresses this, there aren't any other options I'm aware of.

    Just for the record, have multiple physical adapters (Intel x520, X540 and i350).  We never experienced these issues until upgrading to 2016 server with 2016 VMM.  But I see people posting with this problem back with 2012R2.  So it would be interesting if someone could figure out the root cause.  Obviously HYPER-V networking is quite complicated and there are a million variables. 

    Tuesday, June 19, 2018 2:41 PM
  • Anybody ever find a fix for this?  Ever since I started seeing all these Hyper V VmSwitch 25 events, the server has been crashing at least every 12 hours

    Monday, November 5, 2018 11:49 PM
  • @baedrik did you every find a fix? I am having the same exact problem. MAC spoofing isn't enabled, I am getting these errors in the event log and my server is crashing around every 12 hours too.

    I've tried upgrading my network drivers, and recreating the network team to no luck.

    • Edited by Joenathane Sunday, March 3, 2019 3:36 AM
    Sunday, March 3, 2019 3:35 AM
  • @baedrik and @Joenathane what errors did you get in your event viewer after event 25? 

    I had a similar issue last weekend - hundreds of event 25, followed by a sting of other Warnings and Errors - Event 16949 (Member NIC disconnected), Event  4 (Network Link down on my Broadcom physical adaptors), Event 22 (Media disconnected on my NIC Team adaptor), Event 24 (NIC no longer operational on my NIC Team adaptor), (Event 4367 (Link failure on my Broadcom physical adaptors)

    So far mine has been a one off incident, but I'm desperately trying to find the root cause so I can prevent it happening again.

    Friday, May 24, 2019 8:27 AM