Virtual machines enter a suspended state after the log export function is used in vCenter Server.

Products

• VMware vCenter Server

Issue/Introduction

• Exporting virtual machines logs from vCenter Server using the Export Logs function and selecting the Select All option may result in virtual machine state change.
• This selection includes options like VirtualMachines:CoreDumpHung and HungVM, which include embedded commands such as Suspend_VM and Send_NMI_To_Guest.  
• The targeted virtual machines immediately transition into a suspended state while the log bundle downloads.
• An event is recorded on the ESXi host where the VM is running stating "VM-Name is suspended" but the system does not explicitly indicate that the suspension was caused by the log export task.
  
  
• The following log entries are observed within the vmware.log file, found in the virtual machine's directory on the ESXi Host where it is registered:/vmfs/volumes/<Datastore Name>/<VM Name>/vmware.log:
In(05) vmx - MonitorVMMCoreRequest: ********************************************
In(05) vmx - MonitorVMMCoreRequest: Sync core dump requested; not a real fault
In(05) vmx - MonitorVMMCoreRequest: ********************************************


• The following log entries are observed in /var/run/log/hostd.log in ESXi Host:
  info hostd[#######] [Originator@#### sub=Vimsvc.CgiServiceManager opID=CGI-server-####] Validating CGI ticket for URL '/cgi-bin/vm-support.cgi?listmanifests=1'
info hostd[#######] [Originator@#### sub=Vimsvc.CgiServiceManager opID=CGI-server-####] Validating CGI ticket for URL '/cgi-bin/vm-support.cgi?manifests=VirtualMachines:CoreDumpHung HungVM:Send_NMI_To_Guest HungVM:Suspend_VM'
  
  

Environment

vSphere ESXi 7.x
vSphere ESXi 8.x

Cause

• The virtual machine is placed into a suspended state due to the execution of diagnostic commands during the Export Logs function.
• Selecting the "Select All" option bundles routines like VirtualMachines:CoreDumpHung and HungVM. These routines contain direct commands Suspend_VM and Send_NMI_To_Guest designed to force a core dump.
• The execution of Suspend_VM immediately transitions the target virtual machines into a suspended state.

Resolution

• This is expected behavior when the "select all" option is selected, as it includes VirtualMachines:CoreDumpHung and HungVM actions.
• The virtual machine must be restarted to return to a running state.