Virtual Machine enters into "Suspended" state while using "export system logs" option from vCenter

Products

• VMware vCenter Server

Issue/Introduction

• A Virtual Machine (VM) unexpectedly transitions into a Suspended state.
• May encounter a VM in a suspended state, with the task not providing sufficient information.
• Exporting virtual machines logs from vCenter Server using the Export Logs function and selecting the Select All option may result in virtual machine state change.
• This selection includes options like VirtualMachines:CoreDumpHung and HungVM, which include embedded commands such as Suspend_VM and Send_NMI_To_Guest.  
• The targeted virtual machines immediately transition into a suspended state while the log bundle downloads.
• An event is recorded on the ESXi host where the VM is running stating "VM-Name is suspended" but the system does not explicitly indicate that the suspension was caused by the log export task.
• The following log entries are observed within the vmware.log file, found in the virtual machine's directory on the ESXi Host where it is registered:

/vmfs/volumes/<Datastore Name>/<VM Name>/vmware.log:

In(05) vmx - MonitorVMMCoreRequest: ********************************************
In(05) vmx - MonitorVMMCoreRequest: Sync core dump requested; not a real fault
In(05) vmx - MonitorVMMCoreRequest: ********************************************
YYYY-MM-DDTHH:MM:SS vmx - Setting log_vmsample: 1
YYYY-MM-DDTHH:MM:SS  vmx- Setting log_vmsample: 1
YYYY-MM-DDTHH:MM:SS vmx-(VCPU 0) VMSAMPLE: cs=0x10, rip=0xffffffff81a13e5e halted progress=412268022690046
YYYY-MM-DDTHH:MM:SS- vmx-Setting log_vmsample: 0
YYYY-MM-DDTHH:MM:SS vmx - Setting log_vmsample: 0
YYYY-MM-DDTHH:MM:SS vmx - SUSPEND: Start suspend (flags=0)
YYYY-MM-DDTHH:MM:SS vcpu-0 - SUSPEND: Completed suspend: 'Operation completed successfully' (0)
YYYY-MM-DDTHH:MM:SS In(05) vmx - Stopping VCPU threads..

• The following log entries are observed in /var/run/log/hostd.log in ESXi Host:

info hostd[#######] [Originator@#### sub=Vimsvc.CgiServiceManager opID=CGI-server-####] Validating CGI ticket for URL '/cgi-bin/vm-support.cgi?listmanifests=1'
info hostd[#######] [Originator@#### sub=Vimsvc.CgiServiceManager opID=CGI-server-####] Validating CGI ticket for URL '/cgi-bin/vm-support.cgi?manifests=VirtualMachines:CoreDumpHung HungVM:Send_NMI_To_Guest HungVM:Suspend_VM'

Cause

• The Virtual Machine entered into suspended state intentionally by the ESXi host's diagnostic subsystem (vmdumper) to capture a consistent memory state. This occurs when an administrator initiates a log collection like the one listed in Generating a VMkernel zdump manually from a dump file in ESXi host
• Selecting the "Select All" option bundles routines like VirtualMachines:CoreDumpHung and HungVM. These routines contain direct commands Suspend_VM and Send_NMI_To_Guest designed to force a core dump.

 

Resolution

This is expected behavior when the "select all" option is selected, as it includes VirtualMachines:CoreDumpHung and HungVM actions.

1. Resume the VM:

1. • • Log in to the vSphere Client or ESXi Host Client.
     • Right-click the suspended Virtual Machine.
     • Select Power > Power On (or Resume).
       
       
2. Verify Timestamps (Optional):
   • • Compare the "Date Modified" timestamp of the vmdumper.log file in the VM's datastore folder with the suspension time in vCenter events. A match confirms the dump generation caused the suspension.

• Workaround :To collect logs without suspending the VM in the future:

• • • Use the standard Export System Logs workflow.
    • Ensure options related to "Hung VM," "Memory Checkpoint," or "Performance Snapshots" are deselected unless the VM is actually unresponsive and a core dump is required for root cause analysis.