Windows 2012 R2 Hyper-V Server Randomly Rebooting

[DonallyB]

Hi all,

I have a Windows 2012 R2 Hyper-V server in a remote site that we manage that hosts 3 VM's on it.

In the last few <g class="gr_ gr_23 gr-alert gr_gramm gr_inline_cards gr_run_anim Punctuation only-ins replaceWithoutSep" data-gr-id="23" id="23">days</g> it has started to randomly reboot, it could do this from 4 -7 time a day, each time coming back with the error Event 41, Kernal-Power

"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

My first thought was a loss of power in the rack over in this site, <g class="gr_ gr_27 gr-alert gr_gramm gr_inline_cards gr_run_anim Punctuation only-ins replaceWithoutSep" data-gr-id="27" id="27">however</g> I checked with our Network team for the uptime of the firewall, switches over there and they haven’t been affected

Without being able to go on-site and check the hardware myself, I have done the usually remotely checks just in case:

• Ensure system firmware bios is up-to-date
• Windows updates are up to date
• Removed 3^rd party software

Have used the hardware vendors diagnostics to run check to see if there are any faulty H/W <g class="gr_ gr_21 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling" data-gr-id="21" id="21">wtc</g>

We have no It personnel on site that could assist with the troubleshooting so this <g class="gr_ gr_26 gr-alert gr_gramm gr_inline_cards gr_run_anim Grammar multiReplace" data-gr-id="26" id="26">have</g> been all done remotely

Digging a bit deeper I found that the server had a <g class="gr_ gr_22 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling" data-gr-id="22" id="22">bugcheck</g> error on the 4^th of Jan this year, and doing so created a memory.<g class="gr_ gr_20 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling ins-del multiReplace" data-gr-id="20" id="20">dmp</g> file.

I have the detail of the memory.dmp file below which relates to Hypervisor error, however the troubleshooting that I have done so far haven’t turned up anything of note:

Any help with this would be greatly appreciated


*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


HYPERVISOR_ERROR (20001)

The hypervisor has encountered a fatal error.

Arguments:

Arg1: 0000000000000011

Arg2: 000000000031c541

Arg3: 0000000000001001

Arg4: ffffe8030020b870


Debugging Details:

------------------



KEY_VALUES_STRING: 1



STACKHASH_ANALYSIS: 1


TIMELINE_ANALYSIS: 1



DUMP_CLASS: 1


DUMP_QUALIFIER: 401


BUILD_VERSION_STRING: 9600.18340.amd64fre.winblue_ltsb.160513-1153


SYSTEM_MANUFACTURER: LENOVO


SYSTEM_PRODUCT_NAME: 30AHS0DE00


SYSTEM_SKU: LENOVO_MT_30AH


SYSTEM_VERSION: ThinkStation P300


BIOS_VENDOR: LENOVO


BIOS_VERSION: FBKTC1AUS


BIOS_DATE: 03/01/2016


BASEBOARD_MANUFACTURER: LENOVO


BASEBOARD_PRODUCT: SHARKBAY


BASEBOARD_VERSION: SDK0E50510 PRO


DUMP_TYPE: 1


BUGCHECK_P1: 11


BUGCHECK_P2: 31c541


BUGCHECK_P3: 1001


BUGCHECK_P4: ffffe8030020b870


BUGCHECK_STR: 0x20001_11_31c541


CPU_COUNT: 8


CPU_MHZ: e08


CPU_VENDOR: GenuineIntel


CPU_FAMILY: 6


CPU_MODEL: 3c


CPU_STEPPING: 3


CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1D'00000000 (cache) 1D'00000000 (init)


DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT


PROCESS_NAME: System


CURRENT_IRQL: f


ANALYSIS_SESSION_HOST: IE4-CP-L507


ANALYSIS_SESSION_TIME: 01-07-2019 09:49:53.0536


ANALYSIS_VERSION: 10.0.17763.1 amd64fre


LAST_CONTROL_TRANSFER: from fffff800cd7e1bc4 to fffff800cd7643a0


STACK_TEXT:

fffff800`cef99c98 fffff800`cd7e1bc4 : 00000000`00020001 00000000`00000011 00000000`0031c541 00000000`00001001 : nt!KeBugCheckEx

fffff800`cef99ca0 fffff800`cd7f7b97 : 00000000`ffffffff ffffe001`293e90f0 0000000e`24a43bbc fffff800`cd7fa6b3 : nt!HvlNmiCallbackRoutine+0x54

fffff800`cef99ce0 fffff800`cd76d8c2 : fffff800`cd913180 fffff800`cef99ef0 00000000`00000000 00000000`00000000 : nt!KiProcessNMI+0x123

fffff800`cef99d30 fffff800`cd76d736 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxNmiInterrupt+0x82

fffff800`cef99e70 fffff800`cd823d14 : 00000000`00000001 00000000`00000000 ffffe001`293e9010 fffff800`cd913180 : nt!KiNmiInterrupt+0x176

fffff800`cef878f0 fffff800`cd668738 : fffff800`cd913180 fffff800`cef87a00 ffffe001`293e9010 ffffe001`2764aa70 : nt!PpmIdleGuestExecute+0x1c

fffff800`cef87920 fffff800`cd668196 : fffff800`cd913180 fffff800`cef87b4c fffff800`cef87b50 fffff800`cef87b58 : nt!PpmIdleExecuteTransition+0x3e8

fffff800`cef87b10 fffff800`cd767ebc : fffff800`cd913180 fffff800`cd913180 fffff800`cd96ba00 ffffe001`2bda5de0 : nt!PoIdle+0x2f6

fffff800`cef87c60 00000000`00000000 : fffff800`cef88000 fffff800`cef82000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c



THREAD_SHA1_HASH_MOD_FUNC: 0e39650ace78a1d08420f43df21a6350d5ccd2a2


THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 99a9b1a5c4449526978c9177297eae3e60333cd1


THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe


FOLLOWUP_IP:

nt!HvlNmiCallbackRoutine+54

fffff800`cd7e1bc4 cc int 3


FAULT_INSTR_CODE: 48c032cc


SYMBOL_STACK_INDEX: 1


SYMBOL_NAME: nt!HvlNmiCallbackRoutine+54


FOLLOWUP_NAME: MachineOwner


MODULE_NAME: nt


IMAGE_NAME: ntkrnlmp.exe


DEBUG_FLR_IMAGE_TIMESTAMP: 573643bd


STACK_COMMAND: .thread ; .cxr ; kb


BUCKET_ID_FUNC_OFFSET: 54


FAILURE_BUCKET_ID: 0x20001_11_31c541_nt!HvlNmiCallbackRoutine


BUCKET_ID: 0x20001_11_31c541_nt!HvlNmiCallbackRoutine


PRIMARY_PROBLEM_CLASS: 0x20001_11_31c541_nt!HvlNmiCallbackRoutine


TARGET_TIME: 2019-01-04T12:29:29.000Z


OSBUILD: 9600


OSSERVICEPACK: 0


SERVICEPACK_NUMBER: 0


OS_REVISION: 0


SUITE_MASK: 272


PRODUCT_TYPE: 3


OSPLATFORM_TYPE: x64


OSNAME: Windows 8.1


OSEDITION: Windows 8.1 Server TerminalServer SingleUserTS


OS_LOCALE:


USER_LCID: 0


OSBUILD_TIMESTAMP: 2016-05-13 22:14:37


BUILDDATESTAMP_STR: 160513-1153


BUILDLAB_STR: winblue_ltsb


BUILDOSVER_STR: 6.3.9600.18340.amd64fre.winblue_ltsb.160513-1153


ANALYSIS_SESSION_ELAPSED_TIME: 1917


ANALYSIS_SOURCE: KM


FAILURE_ID_HASH_STRING: km:0x20001_11_31c541_nt!hvlnmicallbackroutine


FAILURE_ID_HASH: {1109cd1e-44b7-a5b3-8da3-97122814f0df}


Followup: MachineOwner

Continue reading...