Virtual machine shutdown in Azure

%3CLINGO-SUB%20id%3D%22lingo-sub-332829%22%20slang%3D%22en-US%22%3EVirtual%20machine%20shutdown%20in%20Azure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-332829%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20been%20searching%20all%20over%20the%20internet%20to%20try%20and%20find%20a%20solution%20to%20a%20problem%20I%20got%20with%20some%20Virtual%20Machines%20in%20Azure.%20They%20are%20randomly%20shutting%20down%20and%20I%20can't%20find%20a%20solution%20to%20it%2C%20and%20I%20hope%20someone%20here%20can%20point%20me%20in%20the%20right%20direction.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECurrently%20got%204%20virtual%20machines%20deployed%3A%3C%2FP%3E%3CP%3E%3CSTRONG%3EB2MS%20-%20Windows%2010%20Pro%20-%20With%20Office%20and%20Microsoft%20Nav%202009R2%20installed%20-%20Domain%20joined%20with%20Azure%20AD%20DS%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3EThe%20machines%20is%20shutting%20down%20randomly%2C%20up%20to%207-8%20times%20a%20day.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20the%20information%20I%20am%20getting%20from%20the%20eventlog%3A%3C%2FP%3E%3CP%3E%3CEM%3ELoggnavn%3A%20System%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EKilde%3A%20User32%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EDato%3A%2007.02.2019%2015%3A12%3A30%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EHendelses-ID%3A%201074%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EOppgavekategori%3AIngen%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3ENiv%C3%A5%3A%20Information%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EN%C3%B8kkelord%3A%20Classic%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EBruker%3A%20S-1-5-21-3361540728-1458010002-743927306-1111%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EDatamaskin%3A%20VDI3.lorentzen.no%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EBeskrivelse%3A%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EProsessen%20C%3A%5CWindows%5CSystem32%5CRuntimeBroker.exe%20(VDI3)%20has%20initiated%20Shutdown%20for%20computer%20VDI3%20on%20behalf%20of%20user%20domain%5Cuser%20for%20the%20following%20reason%3A%20Other%20(Unplanned)%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%C3%85rsakskode%3A%200x0%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EAvslutningstype%3A%20Shutdown%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EKommentar%3A%20%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3EHendelses-XML-fil%3A%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CEVENT%20xmlns%3D%22%26quot%3B%26lt%3BA%22%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%22%3E%3CA%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttp%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%3C%2FA%3E%22%26gt%3B%3C%2FEVENT%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CSYSTEM%3E%3C%2FSYSTEM%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CPROVIDER%20name%3D%22%26quot%3BUser32%26quot%3B%22%20guid%3D%22%26quot%3B%7Bb0aa8734-56f7-41cc-b2f4-de228e98b946%7D%26quot%3B%22%20eventsourcename%3D%22%26quot%3BUser32%26quot%3B%22%3E%3C%2FPROVIDER%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CEVENTID%20qualifiers%3D%22%26quot%3B32768%26quot%3B%22%3E1074%3C%2FEVENTID%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CVERSION%3E0%3C%2FVERSION%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CLEVEL%3E4%3C%2FLEVEL%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CTASK%3E0%3C%2FTASK%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3COPCODE%3E0%3C%2FOPCODE%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CKEYWORDS%3E0x8080000000000000%3C%2FKEYWORDS%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CTIMECREATED%20systemtime%3D%22%26quot%3B2019-02-07T14%3A12%3A30.413409200Z%26quot%3B%22%3E%3C%2FTIMECREATED%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CEVENTRECORDID%3E8934%3C%2FEVENTRECORDID%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CCORRELATION%3E%3C%2FCORRELATION%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CEXECUTION%20processid%3D%22%26quot%3B492%26quot%3B%22%20threadid%3D%22%26quot%3B508%26quot%3B%22%3E%3C%2FEXECUTION%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CCHANNEL%3ESystem%3C%2FCHANNEL%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CCOMPUTER%3EVDI3.lorentzen.no%3C%2FCOMPUTER%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CSECURITY%20userid%3D%22%26quot%3BS-1-5-21-3361540728-1458010002-743927306-1111%26quot%3B%22%3E%3C%2FSECURITY%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3C%2FEM%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CBR%20%2F%3E%3CEM%3E%3CEVENTDATA%3E%3C%2FEVENTDATA%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CDATA%20name%3D%22%26quot%3Bparam1%26quot%3B%22%3EC%3A%5CWindows%5CSystem32%5CRuntimeBroker.exe%20(VDI3)%3C%2FDATA%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CDATA%20name%3D%22%26quot%3Bparam2%26quot%3B%22%3EVDI3%3C%2FDATA%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CDATA%20name%3D%22%26quot%3Bparam3%26quot%3B%22%3EOther%20(Unplanned)%3C%2FDATA%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CDATA%20name%3D%22%26quot%3Bparam4%26quot%3B%22%3E0x0%3C%2FDATA%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CDATA%20name%3D%22%26quot%3Bparam5%26quot%3B%22%3EShutdown%3C%2FDATA%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CDATA%20name%3D%22%26quot%3Bparam6%26quot%3B%22%3E%3C%2FDATA%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3CDATA%20name%3D%22%26quot%3Bparam7%26quot%3B%22%3ELORENTZEN%5Cradek%3C%2FDATA%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3C%2FEM%3E%3CBR%20%2F%3E%3CEM%3E%3C%2FEM%3E%3CP%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CEM%3E(I%20have%20translated%20the%20important%20parts%20of%20the%20event%20log)%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EI%20have%20googled%20as%20much%20as%20I%20can%20and%20I%20have%20tried%20the%20following%20fixes.%3C%2FSTRONG%3E%3C%2FP%3E%3CUL%3E%3CLI%3EDisable%20automatic%20Windows%20update%3C%2FLI%3E%3CLI%3EManually%20updated%20windows%3C%2FLI%3E%3CLI%3EDisable%20TimeBrokerSvc%20in%20regedit%3C%2FLI%3E%3CLI%3ETurned%20of%20every%20option%20like%20%22Download%20updates%20from%20other%20computers%22%3C%2FLI%3E%3CLI%3ERan%20stresstest%20to%20see%20if%20it%20triggers%20on%20high%20CPU%20usage%3C%2FLI%3E%3CLI%3EKilled%20the%20RuntimeBroker%20process%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20ran%20out%20of%20ideas%20and%20the%20customer%20is%20starting%20to%20get%20annoyed%20by%20the%20random%20shutdowns.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnyone%20that%20have%20experienced%20this%20either%20on-premises%20or%20in%20Azure%20and%20anyone%20know%20what%20the%20problem%20can%20be%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CLINGO-LABS%20id%3D%22lingo-labs-332829%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EVirtual%20Machine%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ewindows%2010%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-338555%22%20slang%3D%22en-US%22%3ERe%3A%20Virtual%20machine%20shutdown%20in%20Azure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-338555%22%20slang%3D%22en-US%22%3E%3CP%3EThat's%20really%20annoying%20for%20you.%20I%20have%20come%20across%20similar%20unexplained%20shutdowns%20which%20were%20caused%20by%20approaching%20the%20VM%20resource%20limit.%20The%20following%20article%20explains%20the%20reasons%20why.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20title%3D%22Understanding%20Random%20VM%20Reboots%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-machines%2Ftroubleshooting%2Funderstand-vm-reboot%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-machines%2Ftroubleshooting%2Funderstand-vm-reboot%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20helps%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-334667%22%20slang%3D%22en-US%22%3ERe%3A%20Virtual%20machine%20shutdown%20in%20Azure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-334667%22%20slang%3D%22en-US%22%3ESee%20the%20Post%20Update%20Log%20in%20following%20path%20c%3A%5Cwindows%20.%20Unstable%20security%20patch%20updates%20cause%20the%20rebooting.%3C%2FLINGO-BODY%3E
New Contributor

Hello,

 

I have been searching all over the internet to try and find a solution to a problem I got with some Virtual Machines in Azure. They are randomly shutting down and I can't find a solution to it, and I hope someone here can point me in the right direction.

 

Currently got 4 virtual machines deployed:

B2MS - Windows 10 Pro - With Office and Microsoft Nav 2009R2 installed - Domain joined with Azure AD DS

The machines is shutting down randomly, up to 7-8 times a day. 

 

This is the information I am getting from the eventlog:

Loggnavn: System
Kilde: User32
Dato: 07.02.2019 15:12:30
Hendelses-ID: 1074
Oppgavekategori:Ingen
Nivå: Information
Nøkkelord: Classic
Bruker: S-1-5-21-3361540728-1458010002-743927306-1111
Datamaskin: VDI3.lorentzen.no
Beskrivelse:
Prosessen C:\Windows\System32\RuntimeBroker.exe (VDI3) has initiated Shutdown for computer VDI3 on behalf of user domain\user for the following reason: Other (Unplanned)
Årsakskode: 0x0
Avslutningstype: Shutdown
Kommentar:
Hendelses-XML-fil:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="User32" Guid="{b0aa8734-56f7-41cc-b2f4-de228e98b946}" EventSourceName="User32" />
<EventID Qualifiers="32768">1074</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2019-02-07T14:12:30.413409200Z" />
<EventRecordID>8934</EventRecordID>
<Correlation />
<Execution ProcessID="492" ThreadID="508" />
<Channel>System</Channel>
<Computer>VDI3.lorentzen.no</Computer>
<Security UserID="S-1-5-21-3361540728-1458010002-743927306-1111" />
</System>
<EventData>
<Data Name="param1">C:\Windows\System32\RuntimeBroker.exe (VDI3)</Data>
<Data Name="param2">VDI3</Data>
<Data Name="param3">Other (Unplanned)</Data>
<Data Name="param4">0x0</Data>
<Data Name="param5">Shutdown</Data>
<Data Name="param6">
</Data>
<Data Name="param7">LORENTZEN\radek</Data>
</EventData>
</Event>

 

(I have translated the important parts of the event log)

 

I have googled as much as I can and I have tried the following fixes.

  • Disable automatic Windows update
  • Manually updated windows
  • Disable TimeBrokerSvc in regedit
  • Turned of every option like "Download updates from other computers"
  • Ran stresstest to see if it triggers on high CPU usage
  • Killed the RuntimeBroker process

 

I have ran out of ideas and the customer is starting to get annoyed by the random shutdowns. 

 

Anyone that have experienced this either on-premises or in Azure and anyone know what the problem can be?

 

 

Thanks in advance.

 

 

2 Replies
See the Post Update Log in following path c:\windows . Unstable security patch updates cause the rebooting.

That's really annoying for you. I have come across similar unexplained shutdowns which were caused by approaching the VM resource limit. The following article explains the reasons why. 

 

https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/understand-vm-reboot

 

Hope this helps

We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE