Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Determining why a virtual machine was powered off or restarted (1019064)

Last Updated: 1/22/2021Categories: How toTotal Views: 74469Language:
Chinese (Simplified)JapaneseEnglish

37 like this article

Subscribe to get an email
newsletter with new updates

37 people found this helpful Please provide article feedback:

Learn how VMware Skyline Advisor and Skyline Health Diagnostics work together to provide proactive intelligence and self-service log analysis.

Use Skyline Advisor to avoid issues before they occur across VCF, vSphere, vSAN, NSX, vROps & Horizon. Skyline Findings are based on top KBs, VMSAs/CVEs and design best practices.

Use Skyline Health Diagnostics to root cause vSphere & vSAN logs when an issue occurs. Skyline Health Diagnostic Findings are based on top KBs and VMSA/CVEs. You can use the Skyline Health Diagnostics tool in online or offline mode.

If you require additional help from technical support, please use Skyline Advisor to initiate a Log Assist to reduce time to upload logs. TSEs can also initiate logs to reduce effort.

Symptoms

Clients connected to services running in a virtual machine are no longer accessible

Applications dependent on services running in a virtual machine are reporting errors

A virtual machine no longer responds to network connections

A virtual machine no longer responds to user interaction at the console

A virtual machine has been turned off unexpectedly

A virtual machine has been rebooted unexpectedly

In the vmware.log, you see an error similar to:

PIIX4: PM Soft Off. Good-bye

In the Windows Event Viewer, you will see the message:

User sent the guest OS shutdown

Hostd logs (hostd.log) shows below snippet:

Info hostd : State Transistion (VM_STATE_ON -> VM_STATE_SHUTTING_DOWN)

Purpose

This article provides troubleshooting steps to determine why a virtual machine was powered off or rebooted. For more information on power operations of a virtual machine, see the Configure the Virtual Machine Power States section of the vSphere Single Host Management Guide.

Resolution

To determine why the virtual machine was powered off or rebooted:

Verify the location of the virtual machine log files:

Open the vSphere Client and connect to the vCenter Server.

Provide administrative credentials when prompted.

Ensure that you are in the Hosts & Clusters view.

Select the virtual machine in the Inventory.

Click the Summary tab.

Click Edit Settings.

Click the Options tab.

Select General Options.

Record the Virtual Machine Working Location on the right side.

Open the virtual machine log file:

Open a browser and enter the URL http://<vCenter hostname>.
Where, <vCenter hostname> is the IP or fully qualified domain name for the vCenter Server.

Provide administrative credentials when prompted.

Click the Browse datastores in the VirtualCenter inventory link.

Navigate the webpages until you reach the appropriate datacenter, datastore, and folder as noted in step 1.

Click the link to the appropriate log file, and open it with your preferred editor.

Note: A new vmware-#.log file is created during a hard reset, power on, or vMotion of the virtual machine. Use the dates in the Last Modified column to determine the logs, which recorded the outage.

Record the name of the VMware ESXi host that was running the virtual machine when it abruptly rebooted or shut down. The second line of the vmware.log file contains an entry that identifies the host. For example:

Mar 04 17:27:17.648: vmx| Hostname=esx02.domain.com

Determine if the virtual machine was powered off or restarted by the guest operating system:

A Guest OS initiated reset generates this event in the virtual machine logs, i.e vmware.log

Mar 04 17:04:29.638: vcpu-0| CPU reset: soft

2017-05-02T00:54:53.800Z| vcpu-0| I125: Chipset: Issuing power-off request...

To continue troubleshooting, contact the operating system vendor to determine why the guest operating system initiated the reset. If the operating system vendor suspects that the outage was caused by VMware Tools or the virtual hardware, contact VMware support. If you determine that the operating system within your virtual machine reported a blue screen, kernel panic, or equivalent, see Identifying critical Guest OS failures within virtual machines (1003999).

A Guest OS initiated halt generates this event within the virtual machine logs(vmware.log)

Mar 04 17:28:58.849: vcpu-0| PIIX4: PM Soft Off. Good-bye.

To continue troubleshooting, contact the operating system vendor to determine why the guest operating system initiated the halt. If the operating system vendor suspects that the outage was caused by VMware Tools or the virtual hardware, contact VMware support. If you determine that the operating system within your virtual machine reported a blue screen, kernel panic, or equivalent, see Identifying critical Guest OS failures within virtual machines (1003999).

Determine if the virtual machine was powered off or restarted by a user or vSphere API call:

A user or API initiated request to reset a virtual machine generates this event in the virtual machine log files:(vmware.log)

Mar 04 17:07:38.588: vcpu-0| CPU reset: hard

A user or API initiated request to power off a virtual machine generates this event in the virtual machine log files:(vmware.log)

Mar 04 09:45:18.324: vmx| MKS local poweroff

A user or API initiated request to shutdown a virtual machine generates this event in the virtual machine log files:(vmware.log)

2015-04-09T18:13:10.244Z| vmx| I120: Tools: sending 'OS_Halt' (state = 1) state change request

and:

2015-04-09T18:13:19.897Z| vcpu-0| I120: PIIX4: PM Soft Off. Good-bye.

A user or API initiated request to restart the guest operating system in a virtual machine generates this event in the virtual machine log files:(vmware.log)

2015-04-09T18:09:12.346Z| vmx| I120: Tools: sending 'OS_Reboot' (state = 2) state change request

and:

2015-04-09T18:09:22.238Z| vcpu-0| I120: CPU reset: soft (mode 1)

Determine if the virtual machine reported a backtrace. A backtrace generates events similar to this in the virtual machine log file:(vmware.log)

Mar 04 09:42:33.315: vmx| Caught signal 6 -- tid 101087
Mar 04 09:42:33.315: vmx| SIGNAL: eip 0x1019e731 esp 0xbf5ffa9c ebp 0xbf5ffac8
Mar 04 09:42:33.315: vmx| SIGNAL: eax 0x0 ebx 0x18adf ecx 0x6 edx 0x10054a00 esi 0x18adf edi 0x6
Mar 04 09:42:33.315: vmx| SIGNAL: stack 0xbf5ffa9c : 0x10048dab 0x00018adf 0x00000006 0xbf5ffac8
Mar 04 09:42:33.315: vmx| SIGNAL: stack 0xbf5ffaac : 0x10048d63 0xbf5ffae8 0x1000b8a0 0xbf5ffac8
Mar 04 09:42:33.315: vmx| SIGNAL: stack 0xbf5ffabc : 0x10054a00 0x00000006 0x0861e1a0 0xbf5ffae8
Mar 04 09:42:33.315: vmx| SIGNAL: stack 0xbf5ffacc : 0x100492c7 0x00000400 0x00000006 0x00000001
Mar 04 09:42:33.315: vmx| SIGNAL: stack 0xbf5ffadc : 0x100492aa 0x1029e5a8 0x00000001 0xbf5ffc18
Mar 04 09:42:33.315: vmx| SIGNAL: stack 0xbf5ffaec : 0x1019fc82 0x00000006 0xbf5ffb00 0x00000000
Mar 04 09:42:33.315: vmx| SIGNAL: stack 0xbf5ffafc : 0x1019fb30 0x00000020 0x00000000 0x00000000
Mar 04 09:42:33.315: vmx| SIGNAL: stack 0xbf5ffb0c : 0x00000000 0x00000000 0x00000000 0x00000000
Mar 04 09:42:33.315: vmx| Backtrace:
Mar 04 09:42:33.315: vmx| Backtrace[0] 0xbf5ff858 eip 0x805ae40
Mar 04 09:42:33.315: vmx| Backtrace[1] 0xbf5ff928 eip 0x80f735a
Mar 04 09:42:33.315: vmx| Backtrace[2] 0xbf5ff9a8 eip 0x80f70e8
Mar 04 09:42:33.315: vmx| Backtrace[3] 0xbf5ffa28 eip 0x10048e5b
Mar 04 09:42:33.315: vmx| Backtrace[4] 0xbf5ffa94 eip 0x7d0004f
Mar 04 09:42:33.315: vmx| Backtrace[5] 0xbf5ffac8 eip 0x1019e731
Mar 04 09:42:33.315: vmx| Backtrace[6] 0xbf5ffae8 eip 0x100492c7
Mar 04 09:42:33.315: vmx| Backtrace[7] 0xbf5ffc18 eip 0x1019fc82
Mar 04 09:42:33.315: vmx| Backtrace[8] 0xbf5ffc38 eip 0x101eed95
Mar 04 09:42:33.315: vmx| Backtrace[9] 0xbf5ffc68 eip 0x101eca2d
Mar 04 09:42:33.315: vmx| Backtrace[10] 0xbf5ffc78 eip 0x818e87c
Mar 04 09:42:33.315: vmx| Backtrace[11] 0xbf5ffc98 eip 0x81895e7
Mar 04 09:42:33.315: vmx| Backtrace[12] 0xbf5ffcb8 eip 0x80cd940
Mar 04 09:42:33.315: vmx| Backtrace[13] 0xbf5ffcc8 eip 0x80c4f08
Mar 04 09:42:33.315: vmx| Backtrace[14] 0xbf5ffcf8 eip 0x80c4b15
Mar 04 09:42:33.315: vmx| Backtrace[15] 0xbf5ffd48 eip 0x804fd18
Mar 04 09:42:33.315: vmx| Backtrace[16] 0xbf5ffd68 eip 0x804ec14
Mar 04 09:42:33.315: vmx| Backtrace[17] 0xbf5ffda8 eip 0x1018c853
Mar 04 09:42:33.315: vmx| Backtrace[18] 00000000 eip 0x804de11
Mar 04 09:42:33.315: vmx| Unexpected signal: 6.

To continue troubleshooting the backtrace, see Interpreting virtual machine monitor and executable failures (1019471).

Determine if the virtual machine operating system had a system fault. The vmware.log will contain entries similar to:

svga| I120: WinBSOD: ( 1) `A problem has been detected and Windows has been shut down to prevent damage '

svga| I120: WinBSOD: ( 2) `to your computer.'

svga| I120: WinBSOD: ( 4) `If this is the first time you've seen this Stop error screen,'

svga| I120: WinBSOD: ( 5) `restart your computer. If this screen appears again, follow'

svga| I120: WinBSOD: ( 6) `these steps:'

svga| I120: WinBSOD: ( 8) `Disable or uninstall any anti-virus, disk defragmentation'

svga| I120: WinBSOD: ( 9) `or backup utilities. Check your hard drive configuration, '

svga| I120: WinBSOD: (10) `and check for any updated drivers. Run CHKDSK /F to check '

svga| I120: WinBSOD: (11) `for hard drive corruption, and then restart your computer. '

svga| I120: WinBSOD: (13) `Technical information: '

svga| I120: WinBSOD: (15) `*** STOP: 0x00000024 (0x00000000001904FB,0xFFFFF880069B2CE8,0xFFFFF880069B2540,0'

svga| I120: WinBSOD: (16) `xFFFFF880014F5FA2)

Ensure that you did not experience an outage due to the unavailability of shared resources. For more information, see Assessing commonalities of an outage affecting multiple virtual machines (1019000).

Determine if the virtual machine was restarted by High Availability Virtual Machine Monitoring.

Review the vmware.log for the affected virtual machine (/vmfs/volumes/<datastore>/<VM directory>/vmware.log), you will see entries similar to:

vmx| Vix: [104333 vmxCommands.c:457]: VMAutomation_Reset. Trying hard reset

For more information, see Determining if a High Availability Virtual Machine Monitoring event caused a virtual machine to reboot (1027734).

Related Information

VMware Skyline Health Diagnostics for vSphere - FAQ
For more information, see the main article in this series Troubleshooting a virtual machine that has stopped responding (1007819).

Identifying critical Guest OS failures within virtual machines
Troubleshooting a virtual machine that has stopped responding
Assessing commonalities of an outage affecting multiple virtual machines
Determining if a High Availability Virtual Machine Monitoring event caused a virtual machine to reboot
仮想マシンがパワーオフまたは再起動した原因を特定する
确定虚拟机关闭电源或重新启动的原因

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware VirtualCenter

VMware vCenter Server Appliance

VMware vCenter Server

Related Versions:

VMware vSphere ESXi 7.0.0

VMware vSphere ESXi 6.7

VMware vSphere ESXi 6.5

VMware vSphere ESXi 6.0

VMware vCenter Server Appliance 6.5.x

VMware vCenter Server 7.0.x

VMware vCenter Server 6.7.x

VMware vCenter Server 6.5.x

VMware vCenter Server 6.0.x

view all

Take Our Survey

Support Assistant