The process VeeamGuestAgent has initiated the restart

[Connectsys]

Hi there

One of our customer's server VMs keeps rebooting. When I investigated I found that the server is being rebooted by VeeamGuestAgent.exe at some point during the backup with the following message:

The process VeeamGuestAgent.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80040001
Shutdown Type: restart
Comment:

I don't really understand why this has occurred, as far as I'm aware Veeam doesn't have any reboot functionality for guest OS's and I certainly don't want my backup software deciding to reboot servers without even asking me. Does anybody know why this would be happening? I've been through the support logs but there isn't anything obvious, no real reference to it.

Many thanks

Oliver Tansley

[veremin]

Hi, Oliver. Up to this moment no one has reported about similar issue. So, it might be worth opening a ticket with our support team and letting them investigate it directly. Thanks.

[foggy]

Sure, no need to dive into debug logs by yourself, our technical support is always ready to assist you in this.

[Connectsys]

Sorry the reason I posted on the forums and looked at the debug logs was because when I open a support case it seems to take a minimum of 48hrs before I get any sort of response and I really need this fixed ASAP (customer is extremely upset that their main file server went off during the middle of the day). I will try a support case but was hoping somebody else had already come across this before and might have a fast resolution.

[foggy]

You are welcome to post about technical issues, just include your support case ID for reference. Thanks.

[dellock6]

Only a doubt, is the windows server fully patched, and protected by an antivirus? Because the same message was coming out in the past from Sasser or MSBlast viruses, and in different cases the binary name quoted during the reboot event was different (winlogon, sql, whatever). If you search around for the string "has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM" you are going to find many pages about this problem...

Luca.

[bitbite]

Hello,

We have had this issue occur for our customer this Monday. The server rebooted in the middle of a business day and after the reboot stopped working. Our customer (50 employees) lost an entire business day because of this and the time it took us to figure out what happened.

The following error was logged:

The process VeeamGuestAgent.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Application: Maintenance (Planned)
Reason Code: 0x80040001
Shutdown Type: restart
Comment:

Log Name: System
Source: USER32
Date: 26/08/2013 11:16:29
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: (SERVER.domain.local)
Description:
The process VeeamGuestAgent.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Application: Maintenance (Planned)
Reason Code: 0x80040001
Shutdown Type: restart
Comment:

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="USER32" />
<EventID Qualifiers="32768">1074</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-08-26T01:16:29.000Z" />
<EventRecordID>3622118</EventRecordID>
<Channel>System</Channel>
<Computer>SERVER.domain.local</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>VeeamGuestAgent.exe</Data>
<Data>SERVER</Data>
<Data>Application: Maintenance (Planned)</Data>
<Data>0x80040001</Data>
<Data>restart</Data>
<Data>
</Data>
<Data>NT AUTHORITY\SYSTEM</Data>
<Binary>01000480</Binary>
</EventData>
</Event>

In addition to that, the server booted up with directory services disabled, stopping the entire company from being able to work for a full day. It took us the whole day to realize what the issue with directory services was: Safe boot was enabled with Active Directory repair!



We need to provide our customer answers to the following questions:
1. Why this happened
2. What we our doing to prevent this from happening in the future.

Can anyone please help me answer these questions. Thanks.

[veremin]

The op neither came back to update the topic with the found resolution, nor did he provide support ticket number, so that, we could follow his case. Moreover, with all technical problems it's always better to contact technical support directly (as explained when you click New Topic), since it’s rather hard to address certain issues thorough the forum correspondence.

So, kindly, open your own ticket with our support team and let them investigate it directly.

Thanks.

[bitbite]

Thank you. I have opened a case the same day I submitted the last message in this thread and have been dealing with technical support since then. Unfortunately I haven't received a satisfying answer and have been emailing the assigned senior engineer back and forth for a for a few days. Hopefully she will call me back today and provide a better answer. I will update this thread once I am satisfied with the solution.

[bitbite]

Finally got a satisfying answer from technical support. Basically the rep advised this issue occurred due to extremely high load on the guest machine which can cause unexpected behavior from the Veeam agent. In our particular case, the server was so overloaded the Veeam agent stopped unexpectedly and started. When it started, it mistakenly thought it was doing a restore. When doing a restore, the Veeam agent logs the above event and restarts the server in Active Directory Repair mode (this is the normal behavior of a restore event). The rep continued to advise that this issue is rare as it can only be caused in extreme high load situations during which unexpected behavior may occur and as a result this issue cannot be completely prevented.

The solution is therefore to reduce the load on the server. In our case we have Veeam installed on this guest machine which puts the VM under very high load (putting Veeam on a production machine is against Veeam's best practice...). We will be moving Veeam to a dedicated VM to free up guest resources.

[foggy]

Sounds reasonable. Thanks for updating the thread, much appreciated.