Virtual Machine running Windows OS goes into a suspended state due to an OS crash

Products

• VMware vSphere ESXi

Issue/Introduction

• The following events will be reported in the Virtual Machine's event log, in the order specified:
  
  
  • The virtual machine's guest operating system has crashed
    
    
    
    
  • Virtual machine is suspended
    
    

Cause

• An operating system crash (Blue Screen of Death - BSOD) occurred within the Windows guest OS, directly resulting in the Virtual machine entering a suspended state.
  
  
• The /vmfs/volumes/<datastore>/<VM_Name>/vmware.log file will include the following logs.

[YYYY-MM-DDTHH:MM:SS] Wa(03) vmx - MonitorGuestIRQRequest: sending 2
[YYYY-MM-DDTHH:MM:SS] Wa(03) vcpu-0 - WinBSOD: Synthetic MSR[0x40000100] 0x80
[YYYY-MM-DDTHH:MM:SS] Wa(03)+ vcpu-0 -
[YYYY-MM-DDTHH:MM:SS] Wa(03) vcpu-0 - WinBSOD: Synthetic MSR[0x40000101] 0x4f4454
[YYYY-MM-DDTHH:MM:SS] Wa(03)+ vcpu-0 -
[YYYY-MM-DDTHH:MM:SS] Wa(03) vcpu-0 - WinBSOD: Synthetic MSR[0x40000102] 0x10
[YYYY-MM-DDTHH:MM:SS] Wa(03)+ vcpu-0 -
[YYYY-MM-DDTHH:MM:SS] Wa(03) vcpu-0 - WinBSOD: Synthetic MSR[0x40000103] 0x0
[YYYY-MM-DDTHH:MM:SS] Wa(03)+ vcpu-0 -
[YYYY-MM-DDTHH:MM:SS] Wa(03) vcpu-0 - WinBSOD: Synthetic MSR[0x40000104] 0x0
[YYYY-MM-DDTHH:MM:SS] Wa(03)+ vcpu-0 -
[YYYY-MM-DDTHH:MM:SS] In(05) vmx - SUSPEND: Start suspend (flags=0)


Resolution

• To continue troubleshooting, contact the operating system vendor to determine why the guest operating system encountered a BSOD. If the operating system vendor suspects that the outage was caused by VMware Tools drivers or the virtual hardware, contact Broadcom support.
  
  
• If it is determined that the operating system within the virtual machine reported a blue screen, kernel panic, or equivalent, see Identifying critical Guest OS failures within virtual machines.
  
  
• Refer to Converting a snapshot file to memory dump using the vmss2core tool to create a memory dump of the VM to be analyzed by the operating system vendor.

Additional Information

Determining why a VM was Powered off / Restarted / Rebooted

How to determine Virtual Machine Operations looking at the Virtual machine logs