Comprehensive data protection for all workloads
Post Reply
Connectsys
Novice
Posts: 4
Liked: never
Joined: Nov 15, 2009 4:20 pm
Full Name: Ollie Tansley
Contact:

The process VeeamGuestAgent has initiated the restart

Post by Connectsys » Jul 10, 2013 1:37 pm

Hi there

One of our customer's server VMs keeps rebooting. When I investigated I found that the server is being rebooted by VeeamGuestAgent.exe at some point during the backup with the following message:

The process VeeamGuestAgent.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x80040001
Shutdown Type: restart
Comment:


I don't really understand why this has occurred, as far as I'm aware Veeam doesn't have any reboot functionality for guest OS's and I certainly don't want my backup software deciding to reboot servers without even asking me. Does anybody know why this would be happening? I've been through the support logs but there isn't anything obvious, no real reference to it.

Many thanks

Oliver Tansley

veremin
Product Manager
Posts: 16908
Liked: 1440 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: The process VeeamGuestAgent has initiated the restart

Post by veremin » Jul 10, 2013 1:55 pm

Hi, Oliver. Up to this moment no one has reported about similar issue. So, it might be worth opening a ticket with our support team and letting them investigate it directly. Thanks.

foggy
Veeam Software
Posts: 18291
Liked: 1568 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: The process VeeamGuestAgent has initiated the restart

Post by foggy » Jul 10, 2013 1:57 pm

Sure, no need to dive into debug logs by yourself, our technical support is always ready to assist you in this.

Connectsys
Novice
Posts: 4
Liked: never
Joined: Nov 15, 2009 4:20 pm
Full Name: Ollie Tansley
Contact:

Re: The process VeeamGuestAgent has initiated the restart

Post by Connectsys » Jul 10, 2013 2:09 pm

Sorry the reason I posted on the forums and looked at the debug logs was because when I open a support case it seems to take a minimum of 48hrs before I get any sort of response and I really need this fixed ASAP (customer is extremely upset that their main file server went off during the middle of the day). I will try a support case but was hoping somebody else had already come across this before and might have a fast resolution.

foggy
Veeam Software
Posts: 18291
Liked: 1568 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: The process VeeamGuestAgent has initiated the restart

Post by foggy » Jul 10, 2013 2:13 pm

You are welcome to post about technical issues, just include your support case ID for reference. Thanks.

dellock6
Veeam Software
Posts: 5734
Liked: 1626 times
Joined: Jul 26, 2009 3:39 pm
Full Name: Luca Dell'Oca
Location: Varese, Italy
Contact:

Re: The process VeeamGuestAgent has initiated the restart

Post by dellock6 » Jul 10, 2013 10:51 pm

Only a doubt, is the windows server fully patched, and protected by an antivirus? Because the same message was coming out in the past from Sasser or MSBlast viruses, and in different cases the binary name quoted during the reboot event was different (winlogon, sql, whatever). If you search around for the string "has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM" you are going to find many pages about this problem...

Luca.
Luca Dell'Oca
Principal EMEA Cloud Architect @ Veeam Software

@dellock6
https://www.virtualtothecore.com/
vExpert 2011 -> 2019
Veeam VMCE #1

bitbite
Influencer
Posts: 10
Liked: 1 time
Joined: Aug 13, 2013 12:18 am

Re: The process VeeamGuestAgent has initiated the restart

Post by bitbite » Aug 29, 2013 4:01 am

Hello,

We have had this issue occur for our customer this Monday. The server rebooted in the middle of a business day and after the reboot stopped working. Our customer (50 employees) lost an entire business day because of this and the time it took us to figure out what happened.

The following error was logged:
The process VeeamGuestAgent.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Application: Maintenance (Planned)
Reason Code: 0x80040001
Shutdown Type: restart
Comment:

Log Name: System
Source: USER32
Date: 26/08/2013 11:16:29
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: (SERVER.domain.local)
Description:
The process VeeamGuestAgent.exe has initiated the restart of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason: Application: Maintenance (Planned)
Reason Code: 0x80040001
Shutdown Type: restart
Comment:

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="USER32" />
<EventID Qualifiers="32768">1074</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-08-26T01:16:29.000Z" />
<EventRecordID>3622118</EventRecordID>
<Channel>System</Channel>
<Computer>SERVER.domain.local</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>VeeamGuestAgent.exe</Data>
<Data>SERVER</Data>
<Data>Application: Maintenance (Planned)</Data>
<Data>0x80040001</Data>
<Data>restart</Data>
<Data>
</Data>
<Data>NT AUTHORITY\SYSTEM</Data>
<Binary>01000480</Binary>
</EventData>
</Event>
In addition to that, the server booted up with directory services disabled, stopping the entire company from being able to work for a full day. It took us the whole day to realize what the issue with directory services was: Safe boot was enabled with Active Directory repair!

Image

We need to provide our customer answers to the following questions:
1. Why this happened
2. What we our doing to prevent this from happening in the future.

Can anyone please help me answer these questions. Thanks.

veremin
Product Manager
Posts: 16908
Liked: 1440 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: The process VeeamGuestAgent has initiated the restart

Post by veremin » Aug 29, 2013 6:06 am

The op neither came back to update the topic with the found resolution, nor did he provide support ticket number, so that, we could follow his case. Moreover, with all technical problems it's always better to contact technical support directly (as explained when you click New Topic), since it’s rather hard to address certain issues thorough the forum correspondence.

So, kindly, open your own ticket with our support team and let them investigate it directly.

Thanks.

bitbite
Influencer
Posts: 10
Liked: 1 time
Joined: Aug 13, 2013 12:18 am

Re: The process VeeamGuestAgent has initiated the restart

Post by bitbite » Sep 10, 2013 12:48 am

Thank you. I have opened a case the same day I submitted the last message in this thread and have been dealing with technical support since then. Unfortunately I haven't received a satisfying answer and have been emailing the assigned senior engineer back and forth for a for a few days. Hopefully she will call me back today and provide a better answer. I will update this thread once I am satisfied with the solution.

bitbite
Influencer
Posts: 10
Liked: 1 time
Joined: Aug 13, 2013 12:18 am

Re: The process VeeamGuestAgent has initiated the restart

Post by bitbite » Sep 10, 2013 4:19 am

Finally got a satisfying answer from technical support. Basically the rep advised this issue occurred due to extremely high load on the guest machine which can cause unexpected behavior from the Veeam agent. In our particular case, the server was so overloaded the Veeam agent stopped unexpectedly and started. When it started, it mistakenly thought it was doing a restore. When doing a restore, the Veeam agent logs the above event and restarts the server in Active Directory Repair mode (this is the normal behavior of a restore event). The rep continued to advise that this issue is rare as it can only be caused in extreme high load situations during which unexpected behavior may occur and as a result this issue cannot be completely prevented.

The solution is therefore to reduce the load on the server. In our case we have Veeam installed on this guest machine which puts the VM under very high load (putting Veeam on a production machine is against Veeam's best practice...). We will be moving Veeam to a dedicated VM to free up guest resources.

foggy
Veeam Software
Posts: 18291
Liked: 1568 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: The process VeeamGuestAgent has initiated the restart

Post by foggy » Sep 10, 2013 7:01 am

Sounds reasonable. Thanks for updating the thread, much appreciated.

Post Reply

Who is online

Users browsing this forum: Bing [Bot], Google [Bot] and 19 guests