I have a hosted VPS (Windows Server 2012) and shutting it down in the hypervisor causes the following critical event in the System view of the Windows logs:

> Log Name: System Source: Microsoft-Windows-Kernel-Power Date:
> 4/13/2015 12:05:28 PM Event ID: 41 Task Category: (63) Level: Critical
> Keywords: (2) User: SYSTEM Computer: ********** Description: The
> system has rebooted without cleanly shutting down first. This error
> could be caused if the system stopped responding, crashed, or lost
> power unexpectedly. Event Xml: <Event
> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> <System> <Provider Name="Microsoft-Windows-Kernel-Power"
> Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" /> <EventID>41</EventID>
> <Version>3</Version> <Level>1</Level> <Task>63</Task>
> <Opcode>0</Opcode> <Keywords>0x8000000000000002</Keywords>
> <TimeCreated SystemTime="2015-04-13T10:05:28.557824700Z" />
> <EventRecordID>594549</EventRecordID> <Correlation /> <Execution
> ProcessID="4" ThreadID="8" /> <Channel>System</Channel>
> <Computer>**********</Computer> <Security UserID="S-1-5-18" />
> </System> <EventData> <Data Name="BugcheckCode">239</Data> <Data
> Name="BugcheckParameter1">0xfffffa8007110700</Data> <Data
> Name="BugcheckParameter2">0x0</Data> <Data
> Name="BugcheckParameter3">0x0</Data> <Data
> Name="BugcheckParameter4">0x0</Data> <Data
> Name="SleepInProgress">0</Data> <Data
> Name="PowerButtonTimestamp">0</Data> <Data
> Name="BootAppStatus">0</Data> </EventData> </Event>

There is information about the event (41) here: https://support.microsoft.com/en-us/kb/2028504#method1

And information about the bugcheck here (239 = 0xEF): https://msdn.microsoft.com/en-us/library/windows/hardware/ff560358(v=vs.85).aspx

This event was triggered by connecting my VPS to a second ethernet network.

I have reported this to the hosting party and they assure me that:

"this is a normal event when a VPS is shutdown in the hypervisor"

They are a very reliable provider so I am inclined to believe them but not entirely sure either. So my question is: is this event worrisome or normal in this scenario?

--- UPDATE from hoster (transip.nl)

The message "The System Has rebooted without cleanly shutting down first. This error Could be Caused if the system stopped responding, crashed, or solves power unexpectedly." is logical.

For we have no access to the OS itself and therefore can not perform a reboot from there, we do this by switching off the VPS in the hypervisor what indeed will cause yields such a report.

After insisting on elobarating:

Well, I really can not give you another answer. When you add VPS to a private network or remove it, or when you restart it via the console then this will never yield a "clean shutdown".

If we were to do so, then in case of a kernel panic or another critical problem within the OS, then it could not re-start, because it would not respond to this command.

UPDATE After sharing the ACPI option:

ACPI would indeed be a possibility, if it weren't for the fact that this would require a daemon running within the OS and therefore customers would always have the option to turn it off . In addition, this would have no effect in case of a Kernel Panic / BSOD because the daemon in the OS is also stalled.

It would not give us any guarantee that a shutdown / reboot is actually executed and that would make the 'reset ' option rather unreliable.

  • Your hosting provider are plainly incompetent, and you should move as soon as possible. They should be able to provide a "normal" ACPI-based shutdown in addition to a hard power off; every hypervisor on the market today is capable of this. – Michael Hampton Apr 15 '15 at 2:26
  • Well that's just extra proof that they're incompetent. Every OS already includes such an ACPI service, and it's usually enabled by default. It certainly is in Windows. Run like hell. – Michael Hampton Apr 15 '15 at 5:11

Obviously it isn’t okay. Why would it be? It’s a BSOD. You wouldn’t kill the init process on Linux, so why would it be okay to do so on Windows?

Apparently, they don’t support shutdown via ACPI (which is not that cool) but simply “kill the power”. You should encourage them to implement a ACPI power button solution. It’s what VirtualBox does and it works great, with probably every OS around.

However, that still doesn’t explain why you get a BSOD, though.

In the meantime, you should shut down your VPS via RDP to avoid data corruption.

| improve this answer | |
  • Thanks. I updated my question with their explanation. Not trying to paint them black - just trying to undertand their view. – Frank Rem Apr 13 '15 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.