The computer has rebooted from a bugcheck. The bugcheck was: 0x0000013c

[GeoffreySchalle]

A virtual server has begun BSOD / Rebooting for no known reason - no changes or updates have been made that we are aware of (although it is possible that something like Anti-Virus autoupdated, and is triggering this issue).  I did a search online, and found cases from a few years ago with Trend Micro possibly causing this, although we are not using this product.

The Windows Event logs show the following:

The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000013c (0xffffeeab66c3b080, 0x0000000000000002, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 111417-12796-01.

I can attach the Memory Dump file, but it's about 200 MB, zipped, and is too large to attach here.

What's the best way to break this down, and troubleshoot what's causing the BSODs?

Server is Windows 2012 R2, fully patched up.  VMware is ESXi 6.0.0, 3073146.  VMware tools are current on all VMs.

[dekoshal]

Please attached  all the vmware.log of this vm server. These log files will be located in working directory of the virtual machine.

Best Regards,

Deepak Koshal

CNE|CLA|CWMA|VCP4|VCP5|CCAH

[GeoffreySchalle]

Logs attached, thank you.

[dekoshal]

This is what i see in the vmware-1.log

2017-10-03T21:31:02.973Z| vcpu-0| I120: PIIX4: PM Soft Off.  Good-bye.

2017-10-03T21:31:02.973Z| vcpu-0| I120: Chipset: Issuing power-off request...

2017-10-03T21:31:02.973Z| vcpu-0| A115: ConfigDB: Setting softPowerOff = "TRUE"

2017-10-03T21:31:02.981Z| vmx| I120: Stopping VCPU threads...

According to vmware kb article  https://kb.vmware.com/kb/1019064   Determining why a virtual machine was powered off or restarted.

It means :

A Guest OS initiated halt generates this event within the virtual machine logs:

Mar 04 17:28:58.849: vcpu-0| PIIX4: PM Soft Off. Good-bye.

To continue troubleshooting, contact the operating system vendor to determine why the guest operating system initiated the halt. If the operating system vendor suspects that the outage was caused by VMware Tools or the virtual hardware, contact VMware support. If you determine that the operating system within your virtual machine reported a blue screen, kernel panic, or equivalent, see https://kb.vmware.com/kb/1003999

If you found this or any other answer helpful, please consider the use of the Correct or Helpful to award points.

Best Regards,

Deepak Koshal

CNE|CLA|CWMA|VCP4|VCP5|CCAH

[dekoshal]

Do you also see something like vmx-zdump file in the virtual machine working directory ? If yes please upload that too.

Best Regards,

Deepak Koshal

CNE|CLA|CWMA|VCP4|VCP5|CCAH

[GeoffreySchalle]

No dump files, no - only the two log files, and the usual disk, memory, and lock files.

Soft Off - this sounds like someone issued a Shut-Down / restart command?  Is this possible?

(We just inherited this client from someone else who left things in a ... poor state.  It's possible users have the ability to reboot the server while RDP'ed into it.  I'll check to see if they do.)

[dekoshal]

I think you mentioned BSOD as the reason for reboot.  You should check system event logs for more details and load the memory dump in WinDbg and share the Screenshot of that here.

If you found this or any other answer helpful, please consider the use of the Correct or Helpful to award points.

Best Regards,

Deepak Koshal

CNE|CLA|CWMA|VCP4|VCP5|CCAH

[dekoshal]

May be you will find this helpful.

https://support.microsoft.com/en-us/help/315263/how-to-read-the-small-memory-dump-file-that-is-creat...

If you found this or any other answer helpful, please consider the use of the Correct or Helpful to award points.

Best Regards,

Deepak Koshal

CNE|CLA|CWMA|VCP4|VCP5|CCAH

[dekoshal · Accepted solution]

So i check the log file again and found another entry

2017-10-03T21:30:49.147Z| vmx| I120: Tools: sending 'OS_Halt' (state = 1) state change request

2017-10-03T21:30:49.147Z| vmx| I120: Vix: [3006474 vmxCommands.c:534]: VMAutomation_InitiatePowerOff. Tried to soft halt. Success = 1

as per the vmware kb#1019064 this means A user or API initiated request to shutdown a virtual machine.

If you found this or any other answer helpful, please consider the use of the Correct or Helpful to award points.

Best Regards,

Deepak Koshal

CNE|CLA|CWMA|VCP4|VCP5|CCAH