How to Investigate VM Shutdown Causes? | How to Identify VM Shutdown and Restart Reasons

In certain situations, it’s essential to investigate why a virtual machine unexpectedly shuts down or restarts.

For example, why does a VM shut down during non-maintenance periods? Was it due to a manual operation in vCenter, or was it caused by the VM’s Guest OS? In these scenarios, VMware logs can provide crucial clues for troubleshooting.

Of course, system logs within the VM’s Guest OS, such as Windows event logs or Linux syslogs, can also contain records of shutdowns or restarts. However, since these are virtual machines running in a VMware environment, the level of detail in Guest OS logs is often not as comprehensive as that in VMware logs. Therefore, VMware logs are the preferred tool for deeper investigation.

First, it’s important to understand the different ways a VM can be shut down or restarted:

1. Shutting down/restarting the VM from vCenter or ESXi Host Client.
2. Shutting down from within the VM system (e.g., logging into a Windows VM remotely and initiating shutdown).
3. Using API calls to shut down the VM (e.g., using Python’s pyVmomi library, or by vCenter invoking API calls for shutdown).

Note: If VMware Tools are installed on the virtual machine, you can simulate a Guest OS shutdown via vCenter.

---

How to Investigate VM Shutdown Causes on ESXi? Investigating VM Shutdown Causes

First, you need to know the path to the VM logs, which is located at:

\vmfs\volumes\<datastore UUID>\<VM name>\vmware.log

You can either SSH into the ESXi host to search for keywords online, or download the entire vm-support logs and check the VM’s directory.

Shutdown initiated from within the VM (Guest OS initiated):

• Keyword in vmware.log: PM Soft Off

Shutdown triggered from vCenter:

• Keyword in vmware.log: MKS poweroff

Forced shutdown from vCenter (depends on the ESXi version and might not always be logged):

• Keyword in vmware.log: MKS local poweroff

Shutdown via vSphere API:

• Keywords in vmware.log: Tools: sending ‘OS_Halt’ (state = 1) or PM Soft Off. Good-bye.

Below is an example where we shut down a VM via vCenter, and you can see “MKS Poweroff” in the vmware.log.

---

How to Investigate VM Restart Causes on ESXi? Investigating VM Restart Causes

Restart initiated from within the VM (Guest OS initiated):

• Keyword in vmware.log: CPU reset: soft

Restart triggered via “Reset” in vCenter:

• Keywords in vmware.log: CPU reset: soft and CPU reset: hard

Restart initiated via “Restart Guest OS” in vCenter:

• Keyword in vmware.log: SoftReboot succeeded

Restart via vSphere API:

• Keyword in vmware.log: CPU reset: hard

Below is an example where we reset a VM via vCenter, and both “CPU reset: soft” and “CPU reset: hard” are visible in the vmware.log.

---

Conclusion

Investigating the cause of a VM shutdown or restart is a critical step to ensure system stability. Whether you’re looking into how to check VM shutdown causes, analyze VM shutdown reasons, or investigate VM shutdowns, understanding the specific reason for a shutdown or restart is crucial. For in-depth analysis of VM shutdown causes, it’s recommended to rely on key records from the vmware.log. Additionally, learning how to investigate ESXi VM shutdown and restart causes is essential for troubleshooting virtual machine issues. By following these methods, you can effectively determine the specific reasons behind VM shutdowns or restarts, helping users maintain a stable virtualized environment.

If you have any questions, feel free to click the top right corner to contact us for technical support.