Azure – How to Identify What Triggered an Azure VM Reboot

azurevirtual-machineswindowswindows-server-2019

I have received some email notifications from Azure, containing this:

Activity log alert  Alert [Server Name] Health Status  
Properties {
    "title":"Reboot initiated from inside the machine",
    "details":"A reboot was triggered from inside the virtual machine. This could be due to a virtual machine operating system failure or as requested by an authorized user or process. The virtual machine will be back online after the reboot completes.",
    "currentHealthStatus":"Unavailable",
    "previousHealthStatus":"Unavailable",
    "type":"Downtime",
    "cause":"UserInitiated" }

This definitely was not 'UserInitiated' but could have been caused by Windows Update as the time falls within the 'out of hours' window defined.

However, is there any way to tell in the logs what triggered the reboot?

Best Answer

Have a look at "Resource health" to see if there are any other events in the history. You are right, if it falls into the "out of hours" windows it was probably Windows Update. In our environment we get exactly these notifications when Windows Update triggers a reboot.

If you want to be 100% sure it was Windows Updates, filter the system Event Log for IDs 1074, 6006 and 6008. Look for an event at the reboot time. It should say something like this:

    The process C:\windows\system32\wbem\wmiprvse.exe (HOSTNAME) has initiated the restart of computer HOSTNAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80070015
 Shutdown Type: restart
 Comment:

Microsoft could have added a reason so it would be easier to identify why...

Related Topic