VM (W2k3sp1) on (ESX 2.5) bluescreened and rebooted

[tange1]

A VM (windows 2003 sp1) running on an ESX Server 2.5.2, 16390 appears to have bluescreened and rebooted unexpectedly on Friday. I was wondering if someone could help me track down the cause of the issue as I don’t have much info. Please let me know what info I can supply to help figure out what happened.

Thanks!

Event Type: Warning

Event Source: USER32

Event Category: None

Event ID: 1076

Date: 1/28/2008

Time: 8:30:58 AM

User: PPL\e04719

Computer: APP-DOBL-1

Description:

The reason supplied by user PPL\e04719 for the last unexpected shutdown of this computer is: System Failure: Stop error

Reason Code: 0x805000f

Bug ID:

Bugcheck String: 0x00000050 (0x9a6624e4, 0x00000000, 0x9a6624e4, 0x00000000)

Comment: 0x00000050 (0x9a6624e4, 0x00000000, x9a6624e4, 0x00000000)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 0f 00 05 08 ....

Event Type: Error

Event Source: EventLog

Event Category: None

Event ID: 6008

Date: 1/25/2008

Time: 3:55:57 PM

User: N/A

Computer: APP-DOBL-1

Description:

The previous system shutdown at 3:53:30 PM on 1/25/2008 was unexpected.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: d8 07 01 00 05 00 19 00 Ø.......

0008: 0f 00 35 00 1e 00 7c 00 ..5...|.

0010: d8 07 01 00 05 00 19 00 Ø.......

0018: 14 00 35 00 1e 00 7c 00 ..5...|.

[RParker]

Unless other VM's on that same ESX host rebooted also, it's strictly a Windows problem. The Windows OS had a problem, so it's not ESX that caused the reboot.

[tange1]

I agree with you that it might be specific to a vm host but the stop code appears to be releated to a device driver. Since this is a standard VM built off our own image (and no other VM's are having issues) I was hoping to get some help narrowing down why a device driver would have caused this.

[sonofploppy]

From looking at the error it does look like a Windows not a VMware issue. Has the VM had the latest Windows patches?

[tange1]

It's got SP1 but not SP2 (we aren't deploying that in mass). It's up to date on all patches since early May. Initial research points to this being a device driver related crash.

[wila]

Why do you think this is due to a device driver? It is the most likely cause i agree, but it isn't sure from what i'm reading here.

http://www.eventid.net/display.asp?eventid=1076&eventno=3664&source=USER32&phase=1

You could try checking the virtual disk for faults, this could BSOD any windows machine if it has issues. Just attach it to another VM and run disk check.

Another reason could be some application running and eating up every resource in your VM and it doesn't stop there, there's lots of possible reasons.

[tange1]

Upon boot I submited the error and it returned a generic microsoft page that said this error is related to device driver.

[wila]

OK, that makes sense, are you still able to boot the VM or does it crash all the time?

[tange1]

Its actually up and stable but the customer isn't going to let me get out of not giving a decent explanation and we all know that interpreting stop codes is a bit like reading ancient Egyptian. I fully agree that its mostly in windows but since its related to a device driver (and its devices are all virtual) I was hoping someone else had run into a similar error or had some path I could go down to get more info about the problem.

[wila]

Oh why do these clients always demand an explanation? Another thing you can check is the vmware.log file that is stored with the VM (well it is with vi3.x, my 2.x experience was brief, but i believe it is stored there also?)