Virtual Machine: Unexpected Shutdown — Resource Failure

Question

Problem description

I am experiencing an issue with my Linux virtual machine where it has been stopped unexpectedly. There is no specific error message or additional context provided, making it unclear why the VM failed.

Environment

The affected resource is a Linux Virtual Machine.

What I've already tried

I have not tried anything yet.

Current status

I am seeking assistance to understand the cause of the failure and guidance on how to prevent it from happening again.

Answer 1

Hello @CarlosVillagomez-0608

An unexpected shutdown of an Azure Linux VM can originate from the Azure platform, an authorized user/automation process, or the guest OS itself. Without a specific error, I wouldn't assume a resource failure until you check the event history. Microsoft documents these different initiation contexts in VM Resource Health annotations.

First, check VM → Help → Resource health and review the event corresponding to the shutdown. Resource Health can indicate whether the interruption was Platform-Initiated, Customer-Initiated, VM-initiated, or Unknown. Microsoft may also add detailed root-cause information after the event; in some cases, additional RCA details can appear within 72 hours.

Next, go to:

VM → Diagnose and solve problems → Common problems → VM restarted or stopped unexpectedly

Select My resource has been stopped unexpectedly and run the diagnostics. Azure provides this specifically to investigate unexpected VM interruptions.

Also check the Activity Log around the exact UTC timestamp. If Azure received a Stop/Deallocate operation, inspect the Caller to determine whether it came from a user, service principal, automation/runbook, policy, script, or another management process.

If nothing appears in Activity Log, don't immediately rule out an Azure-side interruption. Microsoft notes that some short VM downtime events may not appear there even though the downtime can still be visible in Resource Health.

For the Linux guest, check the logs around the shutdown:

last -x | head -30
journalctl --list-boots
journalctl -b -1 -e
journalctl -k -b -1

Look for kernel panics, OOM, watchdog events, filesystem/storage errors, or an orderly shutdown request.

If Resource Health identifies a platform-initiated event, or the guest logs show an abrupt interruption without an OS-initiated shutdown, preserve the exact UTC timestamp and Resource Health details for correlation with Azure infrastructure events.

Sharing these references with you:

Microsoft — Understand a system reboot for an Azure VM

Microsoft — Azure Resource Health VM annotations

If you can share the Resource Health event and Activity Log entries around the shutdown time, with sensitive information removed, we can narrow this down considerably.

Please "Accept the Answer" if this information helped you. This will help us and others in the community.