query: >-
message:"Guest refused to detach volume" AND
(message:"Unable to detach from guest transient domain." OR
message:"Unable to detach the device from the live config") AND
tags:"screen-n-cpu.txt"