Not not the moment of, it happens randomly so it takes a minute or so before I catch it and start the logging. There's no way I can anticipate the start, is that what you require? Also, I wasn't running VMware at the time, I'll have a look at the log.