In certain situations, it’s essential to investigate why a virtual machine unexpectedly shuts down or restarts.
For example, why does a VM shut down during non-maintenance periods? Was it due to a manual operation in vCenter, or was it caused by the VM’s Guest OS? In these scenarios, VMware logs can provide crucial clues for troubleshooting.
Of course, system logs within the VM’s Guest OS, such as Windows event logs or Linux syslogs, can also contain records of shutdowns or restarts. However, since these are virtual machines running in a VMware environment, the level of detail in Guest OS logs is often not as comprehensive as that in VMware logs. Therefore, VMware logs are the preferred tool for deeper investigation.
First, it’s important to understand the different ways a VM can be shut down or restarted:
- Shutting down/restarting the VM from vCenter or ESXi Host Client.
- Shutting down from within the VM system (e.g., logging into a Windows VM remotely and initiating shutdown).
- Using API calls to shut down the VM (e.g., using Python’s pyVmomi library, or by vCenter invoking API calls for shutdown).
Note: If VMware Tools are installed on the virtual machine, you can simulate a Guest OS shutdown via vCenter.
How to Investigate VM Shutdown Causes on ESXi? Investigating VM Shutdown Causes
First, you need to know the path to the VM logs, which is located at:
\vmfs\volumes\<datastore UUID>\<VM name>\vmware.log
You can either SSH into the ESXi host to search for keywords online, or download the entire vm-support logs and check the VM’s directory.
Shutdown initiated from within the VM (Guest OS initiated):
- Keyword in
vmware.log: PM Soft Off
Shutdown triggered from vCenter:
- Keyword in
vmware.log: MKS poweroff
Forced shutdown from vCenter (depends on the ESXi version and might not always be logged):
- Keyword in
vmware.log: MKS local poweroff
Shutdown via vSphere API:
- Keywords in
vmware.log: Tools: sending ‘OS_Halt’ (state = 1) or PM Soft Off. Good-bye.
Below is an example where we shut down a VM via vCenter, and you can see “MKS Poweroff” in the vmware.log.
How to Investigate VM Restart Causes on ESXi? Investigating VM Restart Causes
Restart initiated from within the VM (Guest OS initiated):
- Keyword in
vmware.log: CPU reset: soft
Restart triggered via “Reset” in vCenter:
- Keywords in
vmware.log: CPU reset: soft and CPU reset: hard
Restart initiated via “Restart Guest OS” in vCenter:
- Keyword in
vmware.log: SoftReboot succeeded
Restart via vSphere API:
- Keyword in
vmware.log: CPU reset: hard
Below is an example where we reset a VM via vCenter, and both “CPU reset: soft” and “CPU reset: hard” are visible in the vmware.log.
Conclusion
Investigating the cause of a VM shutdown or restart is a critical step to ensure system stability. Whether you’re looking into how to check VM shutdown causes, analyze VM shutdown reasons, or investigate VM shutdowns, understanding the specific reason for a shutdown or restart is crucial. For in-depth analysis of VM shutdown causes, it’s recommended to rely on key records from the vmware.log. Additionally, learning how to investigate ESXi VM shutdown and restart causes is essential for troubleshooting virtual machine issues. By following these methods, you can effectively determine the specific reasons behind VM shutdowns or restarts, helping users maintain a stable virtualized environment.
If you have any questions, feel free to click the top right corner to contact us for technical support.
