I would like to ask for assistance regarding a problem that I’m facing with the production environment based on ESXi 5.5 Update 3f (Build Number - 6480324).
The problem occurs on VM’s based on Windows 2000 (SP4) Server Operating systems that reboot abnormally with event (6008) being logged onto the event viewer , just a generic message that the previous shutdown was unexpected. The reboots occurs every 2-3 hours in a day and is continuous.
The Virtual machines have been newly created on the Cluster of 2 ESXi hosts and the reboot occurs for all the Win2K Virtual Machines.
I would like to know if you have any similar cases in the past and if there are any steps to resolve the problem.
Version | Release Date | Build Number | Vmware Tools Version with Patch |
ESXi 5.5 Update 3f | 9/14/2017 | 6480324 | 10.0.9 |
Guest OS - Windows 2000 (SP4) Server
Adapter Type - Flexible (had initially installed E1000 but now changed to troubleshoot)
SCSI Controller - Bus Logic Parallel
The issue above was due to a vulnerability with Microsoft Operating System and the Anti Virus installed on the system.
The issue was identified by creating a VM with no connection with Network and no additional software's. The machine did not reboot for a week, then we started installing the software in phase with monitoring. It was identified then Antivirus and joining to the network caused an issue of BSOD (Blue screen of death), due to which the systems were rebooted.
To mitigate the same below measures were taken :
1. Post installation of the VM, the following patch was installed - http://support.microsoft.com/kb/958644
2. McAffee antivirus client was reinstalled
The issue is now resolved.
Have you checked the vmware.log to find out wether the reboot was initiated by a vmware-tools function ?
Hi continuum, thank you very much for the reply.
Yes the logs mentioned below indicate somehow that VMware initiated the reboot. Have also checked the ESXi host logs which point that HA is the cause of the Virtual Machine reboot for Windows 2000 Server. Although VM Monitoring Status is disabled on the Cluster !
I am still in a fix to resolve this
vmware.log |
---|
2018-01-20T11:08:17.156Z| vmx| I120: Tools: Tools heartbeat timeout. 2018-01-20T11:08:40.266Z| vcpu-1| W110: Balloon: Start: vmmemctl reset balloon 2018-01-20T11:08:40.266Z| vcpu-1| I120: Balloon: Reset (n 11 pages 0) 2018-01-20T11:08:40.266Z| vcpu-1| I120: Balloon: Reset: nUnlocked 0 size 0 2018-01-20T11:10:05.403Z| vmx| I120: Tools: Tools heartbeat timeout. 2018-01-20T11:10:21.645Z| vcpu-3| I120: Guest: toolbox: Version: build-2827462 2018-01-20T11:10:21.645Z| vcpu-3| I120: GuestRpc: Channel 0, guest application toolbox. 2018-01-20T11:10:22.122Z| vcpu-0| I120: TOOLS soft reset detected. 2018-01-20T11:10:22.123Z| vcpu-0| I120: TOOLS autoupgrade protocol version 2 2018-01-20T11:10:22.123Z| vcpu-0| I120: Vix: [9377178 mainDispatch.c:3884]: VMAutomationReportPowerStateChange: Reporting power state change (opcode=2, err=0). 2018-01-20T11:10:22.126Z| vcpu-0| I120: TOOLS Received tools.set.version rpc call, version = 9359. 2018-01-20T11:10:22.127Z| vcpu-0| I120: ToolsSetVersionWork did nothing; new tools version (9359) matches old Tools version 2018-01-20T11:10:22.127Z| vcpu-0| I120: TOOLS Setting autoupgrade-checked FALSE. |
ESXi Host logs |
---|
2017-10-10T19:01:07.259Z| vmx| I120: Vix: [63562 guestCommands.c:1924]: Error VIX_E_TOOLS_NOT_RUNNING in VMAutomationTranslateGuestRpcError(): VMware Tools are not running in the guest 2017-10-10T19:08:07.053Z| vmx| I120: Tools: No activity for 10 minutes, resetting Tools version. 2017-10-10T19:08:07.053Z| vmx| I120: ToolsSetVersionWork did nothing; new tools version (0) matches old Tools version 2017-10-10T21:30:18.632Z| vmx| I120: Vix: [63562 vmxCommands.c:680]: VMAutomation_Reset. Trying hard reset 2017-10-10T21:30:18.632Z| vmx| W110: 2017-10-10T21:30:18.632Z| vmx| W110+ 2017-10-10T21:30:18.632Z| vmx| W110+ VMXRequestReset 2017-10-10T21:30:18.632Z| vmx| I120: Vigor_Reset: Attaching to reset. 2017-10-10T21:30:18.633Z| vmx| I120: Stopping VCPU threads.. |
I have gone through these articles but still unable to resolve - VMware Knowledge Base
Thank you for your help and time
Further to this, I even Turned Off vSphere HA on the cluster. Still the Windows 2000 machine reboot exists.
Would removing one of the ESXi host from the Cluster help to identify the issue ?
The issue above was due to a vulnerability with Microsoft Operating System and the Anti Virus installed on the system.
The issue was identified by creating a VM with no connection with Network and no additional software's. The machine did not reboot for a week, then we started installing the software in phase with monitoring. It was identified then Antivirus and joining to the network caused an issue of BSOD (Blue screen of death), due to which the systems were rebooted.
To mitigate the same below measures were taken :
1. Post installation of the VM, the following patch was installed - http://support.microsoft.com/kb/958644
2. McAffee antivirus client was reinstalled
The issue is now resolved.