What could I be doing to accidentally shutdown my Win10 VM?

[MrPete]

I am new to using Windows in a VM, but VERY experienced with windows.

Very often (multiple times a day), I'm online via noVNC in the ProxMox console, doing stuff in the VM.
Suddenly, the VM starts to shut down.

Windows event viewer says Explorer.exe did it at my request, "other (planned)" reason.
I have no custom scheduled tasks. It does NOT happen if I leave the VM alone. (It's set to never auto-off/sleep/etc in power settings.)

Is there perhaps a key combination in noVNC that causes shutdown?

I can't imagine what I'm doing.

And I see nothing special in ProxMox logs.

 

[leesteken]

Did you install some software to restart VMs automatically (and forgot about it or did not know because you ran some random script from the internet)? Maybe it loses connection to the VM (for some reason) and shuts it down nicely (using the Proxmox API or CLI). Please show the Proxmox journalctl from around the time of the shutdown (to see if it is gracefully), then it's something you installed. If it is killed hard, it's probably because of out of memory (OOM).

EDIT: There a lot of threads about similar issues because people ran tteck-scripts and complain here instead of at tteck. But maybe your issue it completely different...

 

[MrPete]

Thanks, good questions.

nothing at all in journalctl at that time... only when the shutdown is complete. So honestly I can't see how ProxMox is involved in initiating the shutdown.

Haven't set up auto-restart (although starting to wonder if that's a necessary workaround )
I can disconnect w/o issue. It's only while I am "live" connected that this happens... so far.

I was wondering about OOM but unless I'm completely clueless it is not that:
15GB ARC limit (and arc_summary confirms)
32+12GB max in two active VM's = 42GB
...and the host says 58GB is in use which sounds about right (42+15+1)
...and I have almost 80GB total.

AND, wouldn't that show up in journalctl or other logs?

(Likely a rabbit trail... I have several other VM's *defined*. If what I just learned about some host activities auto-warm-"pause" starting VM's could affect this, that might explain it if such things can happen during the day. (So far the only impact has been as 12:20 AM ) )

 

[leesteken]

nothing at all in journalctl at that time... only when the shutdown is complete. So honestly I can't see how ProxMox is involved in initiating the shutdown.

Since you don't want anyone to look at those logs, and assuming that Proxmox is not involved, it's a problem internal to the VM and maybe ask Microsoft or a Window forum.

 

[gfngfn256]

Does the shutdown look graceful? Normal windows shutdown like on Windows 10 bare metal?
If it does & assuming you have Guest Agent installed in VM - try disenabling the Guest Agent in VM - & then see if this stops happening.

The only other thing I can presently think of - is some Windows remote service like RPC Shutdown? Would be interesting if you weren't aware of this.

Edit: Maybe one other (wild) thing to check in Windows under Power Options - do you have any settings what "Pressing the Power Button" "Sleep button" "Closing Lid" etc. Maybe set them all to "do nothing". IDK in your VM which options you'll have there - but I'm just thinking maybe noVNC is somehow "Pressing / Closing " something? Just a wild thought?

 

[MrPete]

Since you don't want anyone to look at those logs, and assuming that Proxmox is not involved, it's a problem internal to the VM and maybe ask Microsoft or a Window forum.

I don't mind sharing the logs. Just... boring

I'm thinking it's in noVNC -- not internal to the VM, and not (exactly) in ProxMox either LOL.

Here's a sample log. VM 710 is the VM of interest:

(NOTE: nothing in syslog for a couple of minutes prior...)
(NOTE: shutdown began at T18:48:22 on 5/5/2024)
2024-05-05T18:48:30.230249-06:00 pve2a pvedaemon[265993]: VM 710 qmp command failed - VM 710 qmp command 'guest-ping' failed - got timeout
2024-05-05T18:48:32.862878-06:00 pve2a kernel: [48891.257540] zd32: p1 p2
2024-05-05T18:48:33.042878-06:00 pve2a kernel: [48891.438118] tap710i0: left allmulticast mode
2024-05-05T18:48:33.042887-06:00 pve2a kernel: [48891.438135] vmbr0: port 2(tap710i0) entered disabled state
2024-05-05T18:48:33.072955-06:00 pve2a qmeventd[1179]: read: Connection reset by peer
2024-05-05T18:48:33.590203-06:00 pve2a systemd[1]: 710.scope: Deactivated successfully.
2024-05-05T18:48:33.590295-06:00 pve2a systemd[1]: 710.scope: Consumed 7min 15.881s CPU time.
2024-05-05T18:48:33.612049-06:00 pve2a qmeventd[277806]: Starting cleanup for 710
2024-05-05T18:48:33.615853-06:00 pve2a qmeventd[277806]: Finished cleanup for 710

 

[MrPete]

Does the shutdown look graceful? Normal windows shutdown like on Windows 10 bare metal?
If it does & assuming you have Guest Agent installed in VM - try disenabling the Guest Agent in VM - & then see if this stops happening.

The only other thing I can presently think of - is some Windows remote service like RPC Shutdown? Would be interesting if you weren't aware of this.

Edit: Maybe one other (wild) thing to check in Windows under Power Options - do you have any settings what "Pressing the Power Button" "Sleep button" "Closing Lid" etc. Maybe set them all to "do nothing". IDK in your VM which options you'll have there - but I'm just thinking maybe noVNC is somehow "Pressing / Closing " something? Just a wild thought?

Great ideas! I will check them out.

Not aware of RPC Shutdown, but having never had this happen to any other device on our network, that seems least likely. I'll be back at some point