VM shutdown after a time running W2003k Server.

[elnegroalvarez]

Hi All:

Some days ago, I tried to run ESXI 5.1.0 (VMware-ESXi-5.1.0-Update1-1065491-HP-5.50.26) on my Server HP Proliant DL320 G5p. I've created one VM on it (a Windows 2003 Server SP2). Everything goes well, I can run windows update, install aditional software for testing purpose, but after a time, vm goes down.

I was looking for some help for fixing my issue, but nothing at this moment.

Moreover I tried a virtual machine snapshoot, and I realized that:

1) If I try starting up my virtual machine after it goes down, After log on Windows it goes down inmediately.

2) If I try start up the last snapshoot its startup well, but till a couple hours, then all start again.

Before I tested with:

4.1_U2_Jun_2012_ESXi_HD-USB-SDImgeInstlr_Z7550-00800 and VMware-ESXi-5.1.0-Update1-1065491-HP-5.50.26, But with same results.

Here I attached my last log file.

Thanks in advance

Jose R. Alvarez

[admin]

Hi,

We see the following in the logs.

2013-08-10T21:47:27.474Z| vmx| W110: ObtainHardwareID unexpected failure: 22.

2013-08-10T21:47:27.474Z| vmx| W110: Hostinfo_MachineID ObtainHardwareID failure (Invalid argument); providing default.

2013-08-10T21:47:31.707Z| vcpu-0| I120: CPU reset: hard (mode 2)     // user or API initiated request to reset a virtual machine generates this event

2013-08-10T21:47:32.573Z| vcpu-1| I120: CPU reset: soft (mode 2)     // Guest OS initiated reset generates this event

2013-08-10T21:47:32.578Z| vcpu-2| I120: CPU reset: soft (mode 2)

2013-08-10T21:47:32.581Z| vcpu-3| I120: CPU reset: soft (mode 2)

2013-08-10T21:53:25.404Z| vcpu-0| I120: PIIX4: PM Soft Off.  Good-bye.  // Guest OS initiated halt generates the following event

Seems that reset is being called by the API or user..!!

Check the windows event log for any 6008 event ID on the same time stamp to see if it was a forced shutdown.. If so try to find any event ID's that let to the possible force shutdown event ID.

[a_p_]

Only a thought. Shutdowns like these are usually seen with Windows not being activated.

André

[elnegroalvarez]

Hi:

In first, thanks for your reply.

After my vm shutdown I can't start it up again, so I'm not able to check my log events. Moreover, I saw when I tried to start up and after log on it with windows credential on my vm, appear the window "Shutdown Event Tracker" where I've to write what was the reason for that shutdown, after that, windows appear to be loading but then vm is shutting down automatically.

So to start up again my vm I've to select my current snapshoot.

If you need more details, just ask me.

Cheers

[elnegroalvarez]

Hi:

I ran "oobe/msoobe /a" command, and appear a windows and it show me that Winows is already activated.

Thansk for your reply

José

[a_p_]

After this issue occurs, are you able to boot the VM in save mode and/or is it possible to connect via RDP?

If not, are you able to open the Computer Management on another system and connect to the server to check e.g. the Event Logs?

André

[elnegroalvarez]

HI Andre:

1) I booted in save mode (with and without net support, last well know config) but its same issue, its seems startup, I saw my vm up but suddenly goes down.

2) I can't check nothing.

Im lost

The only way to start up my vm is going it back to the snapshoot. But it works a couple of hours and all happens again.

Thanks for your advice.

Cheers

Adding some screen shoot to understand better

[a_p_]

I f you cannot access the disk online (except for reverting to the snasphot) you may consider to either attach the virtual disk (ensure you attach the latest snapshot!!!, i.e. the .vmdk file which shows up in the VM's .vmx file - you need to edit the helper VM's .vmx file manually for this.) as an additional virtual disk to a helper VM or use the VMware's diskmount utility to mount the virtual disk (again, the latest snapshot) to the host system. This will at least allow you to scan the disk for viruses etc. and check registry entries (e.g. Winlogon, Run, RunOnce, ... entries).

You may also be able to do this online (after reverting). In this case I'd alos use Sysinternal's/Microsoft's AutoRuns utility to see whether this shows something unusual.

André

[microbomb]

Did you ever figure this out? I'm having the same problem. Within seconds after logging into the server I get

PIIX4: PM Soft Off.  Good-bye.

and the VM shutdown down instantly.