Hi All,

we have windows 2012 Hyper-V (in clustered environment) in place on have few guest machines, one of the guest machine (guest machine is windows 2012 R2) went down unexpectedly two days before then we started it manually.

on guest machine we have found event id 41 after searching in the net we got the below article describing the issue.

http://support.microsoft.com/en-us/kb/2028504#method3

on the same host machine rest of the guest machines working fine without any issues.

My query is below:

Is any event id generated on the hyper-v host when the guest machine shutdowns unexpectedly or graceful shutdown.

Please suggest

• Edited by trvenkat_24 Tuesday, March 31, 2015 10:39 AM

Hi,

You can try to read the "Applications and Services Logs > Microsoft > Windows > Hyper-V-Worker > Admin" in a event viewer to find virtual machines shut down information in the Hyper-V host.

Regards, Terry | My Blog: http://tls1.cc
This posting is provided AS IS with no warranties, and confers no rights.

• Edited by Terry_LauMVP Tuesday, March 31, 2015 12:57 PM Provide detail information

Thanks for the update.

in the event id 18502 description epically in user column it states VM's guid which belonging to itself.

none done the turnoff. 

Yes events are generated for N/ disconnection of the particular VM

1. 'guestVMName' Network Adapter (8eb66c62-9ca9-45e0-a7aa-4e432fabd34b--54a9ccd6-316a-4b35-aef1-0f22821b3d85) Disconnected from virtual network. (Virtual Machine ID 8EB66C62-9CA9-45E0-A7AA-4E432FABD34B)

Event ID will be 12598  populates under - eventviewer >microsoft>windows>Hyper-V-Synthnic.

Again one more event generates.

2. 'guestVMname' was turned off. (Virtual machine ID 8EB66C62-9CA9-45E0-A7AA-4E432FABD34B

Event ID will be 18502  populates under - eventviewer >microsoft>windows>Hyper-V-Hyper-V-Worker.

Hi All,

I am getting event id:12598. but my queries is what caused the entire events (event id 18502 & 12598) as I mentioned earlier nobody done manual turnoff.

please suggest. 

Hi Sir,

That unexpected reboot can be caused by many reasons( RAM,hardware,driver etc ...), you can try to analyze them with Debugging Tools by yourself.

You can install it and its Symbol Packages from the following link: 
http://www.microsoft.com/whdc/Devtools/Debugging/default.mspx
WinDbg will tell you the possible cause. For more information, please read Microsoft KB Article: 
How to read the small memory dump files that Windows creates for debugging 
http://support.microsoft.com/kb/315263

Also :

http://blogs.technet.com/b/askcore/archive/2008/11/01/how-to-debug-kernel-mode-blue-screen-crashes-for-beginners.aspx

If there is no clue , please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607

Best Regards,

Elton Ji

Hyper-V event logs can only tell you if Hyper-V initiated the shut down / turn off action.

If it did not, it will only report the state change of the VM.

It will never indicate 'who'

As has been mentioned, things happen within the OS of the VM as well. Such as a crash, a shutdown, and a number of other possible stop actions, or backup agent problems.

My point: Don't assume that the action is only possible at the hypervisor. That is simply one place to look and one possibility to rule out.

Hi Sir,

I would like to check if you need further assistance .

Best Regards,

Elton Ji