VM just locks up!

[carrothospital]

So, I realize that this may be a Windows problem and not a VMware problem, but I can't tell yet, so wanted to get some input to see if it has happened to anyone else.

We have SBS 2008 as a VM on our ESXi box ( 4.0.0, 208167 ). Last night at 11 it locked up and stopped responding. It vanished from the network and I couldn't even get it to respond from the vSphere console. Sending a CTRL ALT DEL wouldn't do anything, the console just showed the SBS login screen and never changed. I couldn't get it to shutdown because VMware tools was unresponsive. The only thing was to cut the power and restart.

Since last night it has done this twice more. I looked through some of the logs in ESXi and didn't see anything that caught my eye, but I don't know what to look for. I'll attach a snippet from the vmware.log that has something with vmware tools timing out, but that may just be a side effect.

Like I said, this may turn out to be a Windows issue, but since I've never seen a VM be completely unresponsive in the vSphere client, I figured I'd see if anyone else has ever experienced that. We have 2 other VM's running just fine and are completely responsive from the console.

A side note is that I am no longer the sole administrator of this machine, so it's possible that someone else made changes that I don't know about. I know there was an antivirus upgrade on Saturday, but that's it. I'm going to keep digging on it, but thought someone may have some advice.

Thanks!

Apr 19 13:51:09.542: vcpu-0| GuestRpc: Channel 2, conflict: guest application toolbox-dnd tried to register, but it is still registered on channel 1

Apr 19 13:51:09.542: vcpu-0| GuestRpc: Channel 2 reinitialized.

Apr 19 13:51:09.542: vcpu-0| GuestRpc: Channel 2 reinitialized.

Apr 19 13:55:57.851: vmx| GuestRpcSendTimedOut: message to toolbox timed out.

Apr 19 13:55:57.851: vmx| GuestRpcSendTimedOut: message to toolbox-dnd timed out

Apr 19 13:56:12.851: vmx| GuestRpcSendTimedOut: message to toolbox timed out.

Apr 19 13:56:12.851: vmx| GuestRpc: app toolbox's second ping timeout; assuming app is down

Apr 19 13:56:12.851: vmx| GuestRpcSendTimedOut: message to toolbox-dnd timed out.

Apr 19 13:56:12.851: vmx| GuestRpc: app toolbox-dnd's second ping timeout; assuming app is down

Apr 19 13:57:55.725: mks| SOCKET 2 (116) recv error 104: Connection reset by peer

Apr 19 13:57:55.726: mks| SOCKET 2 (116) destroying VNC backend on socket error: 1

Apr 19 13:57:55.726: mks| MKS: Base polling period is 1000000us

Apr 19 13:58:11.178: mks| MKS: Base polling period is 10000us

Apr 19 13:58:25.067: mks| VNCENCODE 3 encoding mode change: (800x600x24depth,32bpp,3200bytes/line)

Apr 19 13:58:25.140: mks| VNCENCODE 3 encoding mode change: (800x600x24depth,32bpp,3200bytes/line)

Apr 19 13:58:57.320: mks| SOCKET 3 (115) recv error 104: Connection reset by peer

Apr 19 13:58:57.320: mks| SOCKET 3 (115) destroying VNC backend on socket error: 1

[athlon_crazy]

you can start from event log may be you can get something out of it. Sometime you can see the patern / trend before the VM hanged. I'd once VM always restart problem and event log help me much to resolved the issue.

vcbMC-1.0.6 Beta

vcbMC-1.0.7 Lite

Vote Me for vExpert 2009!

[carrothospital]

Thanks for the feedback.

So far the event logs are pretty bare. I'll look closer and see if I can see a pattern where I didn't see if before. In the Windows event log there's not much there. It's all normal operation, the server was basically idle, and then it just drops off. The next entry isn't until I reboot it. The VMware logs are a little different, there may be a pattern in there, but I haven't noticed it yet. I don't know what a lot of the stuff means, so it's a little harder for me to decipher.

I'll dig a little deeper and let you know.

[athlon_crazy · Accepted solution]

We need to identify whether this is VM or OS issue. Could you please upload your last VMware.log at the time this issue occurred.

vcbMC-1.0.6 Beta

vcbMC-1.0.7 Lite

Vote Me for vExpert 2009!

[carrothospital]

Looks like this is a Windows problem with NOD32 Antivirus. It causes issues where the whole machine freezes and doesn't respond to any input. I posted here fearing it was a VMware issue, since I've never seen the machine not respond to anything but a complete power off in the vSphere console.

I guess I got ahead of myself, but since it's a production system, I wanted to get as much help as possible. Thanks again for your help. I think we've isolated the problem now.

[Jonnicholas08]

Hi,

I have been experiencing the exact same issue and have changed some NOD setting as per : http://kb.eset.com/esetkb/index?page=content&id=SOLN2144&actp=search&viewlocale=en_US&searchid=12606... which appears to have helped.

You mentioned that you may have isolated the problem, please can you advise on what the issue might have been?

Regards