Unexpected shutdown of azure virtual machine

Question

Hello,
We are experiencing random shutdown of virtual machines in our Azure Tenant.

-> People are working and it suddenly have a shutting down screen for a few second
]1

They could have 2 shutdown in a 20minutes interval, and then the machine works properly.

In the system log we noticed this kind of message:

The process C:\Windows\system32\svchost.exe (TESTMACHINE01) has initiated the shutdown of computer TESTMACHINE01 on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned) Reason Code: 0x80000000 Shutdown Type: shutdown Comment: Calling CleanShutdown by wvchelper Reason for shutdown: Stop call

DHCPv4 client received shutdown notification

DHCPv6 client service is stopped. ShutDown Flag value is 1

DHCPv4 client service is stopped. ShutDown Flag value is 1

The kernel power manager has initiated a shutdown transition. Shutdown Reason: Kernel API

The operating system is shutting down at system time ‎2022‎-‎10‎-‎10T14:20:17.571656200Z.

The problem seems random and appeared on on multiple machines for a few weeks.

Have you any idea of what could happen?

Thanks a lot by advance,
Jonathan

Answer 1

Hello @Jonathan A ,

Welcome to the MS Q&A forum.

Looks like this specific shutdown (0x80000000 + process) was done from Azure Portal, Azure CLI or PowerShell. It could be as well an application, as example the automatic shutdown.
Do you see the corresponding event in the Azure Activity Log (especially check the "Event Initiated by" column) or under the VM Heath events? What do these say?

Sincerely,
Olga Os

Answer 2

https://learn.microsoft.com/en-us/windows/win32/shutdown/system-shutdown-reason-codes?WT.mc_id=AZ-MVP-5004796#:~:text=SHTDN_REASON_FLAG_PLANNED,or%20to%20Microsoft.

Based on the error code: SHTDN_REASON_FLAG_PLANNED
0x80000000
The shutdown was planned. The system generates a System State Data (SSD) file. This file contains system state information such as the processes, threads, memory usage, and configuration.
If this flag is not present, the shutdown was unplanned. Notification and reporting options are controlled by a set of policies. For example, after logging in, the system displays a dialog box reporting the unplanned shutdown if the policy has been enabled. An SSD file is created only if the SSD policy is enabled on the system. The administrator can use Windows Error Reporting to send the SSD data to a central location, or to Microsoft.

This unexpected reboot could have been caused by an Azure-initiated auto-recovery action. The auto-recovery action was triggered by a hardware issue on the physical node where the virtual machine was hosted. As designed, the VM was automatically moved to a different and healthy physical node to avoid further impact.
Microsoft recommended grouping two or more virtual machines in an availability set to ensure an increased level of protection and redundancy for the application in Azure.

You should also see an indication of the error - in the Activity Log in the Azure Portal, for that Virtual Machine.

Answer 3

Hello @Olga Os - MSFT , hello @Luke Murray , thank you very much for your answer,
unfortunately we do not have log analytics agents activated on azure for our machines yet. I need to ask our admin to activate it if possible.
The automatic shutdown is not set; but we have a set of group policy to shutdown the machine after a 2h idle:

also, in azure we have an alert which trigger a deallocation after a shutdown.
We've got one machine yesterday afternoon which shutdown many times due to the problem:

In the VM Ressource health events, there is informational events such as the following:

Stopping and deallocating (Customer Initiated)
At Thursday, October 13, 2022 at 5:42:53 PM GMT+2, the Azure monitoring system received the following information regarding your Virtual machine:
This virtual machine is stopped and deallocated as requested by an authorized user or process.

But no errors, and there was clearly not customer initiated.
It also happen to this poor guy while a Helpdesk agent was connected in remote to the machine: he reported the machines shutdown after an error in Adobe Acrobat reader application 2-3 times.

I tried on my VM but I'm not able to reproduce the problem.

@Luke Murray , you mention the SSD policy, is it linked to the windows backup ? if so, it is disable on our machines. Is there a way to only generate the system state information on demand?

Some machine seems to not having the problem at all. they are using the same windows image, same machine size, and are located on the same hostpool