VM Hangs – Azure, AWS, GCP – How to analyse why?

Get data

Connect to Serial Console in Azure.
type cmd.
press escape – TAB – you should reach page when you can enter the username and password.
try to authenticate and now you have access to the operating system, so you can do the analyses.
if it is not possible, return to Serial Console (escape TAB).
Type crashdump and press enter. This generate memory dump that can be analised.
Restart machine and somehow download c:\windows\memory.dmp

Install Window Debuger . The best is to use Windows 11 for this.

Launch WinDBG and open the downloaded memory.dmp. You do not need to add symbols server – just in the latest version it will be picked automatically.

Execute the follwoing:

!analyze -v – in this scenario it tells you nothing just you intentianally invoke the system crash. If System restart automatically it could help in analises (espacially for blue screens).
!process 0 0 – show all processes.
!process 0 7 – look for any with unusual CPU time or state.
!locks – Shows kernel locks and potential deadlocks.
!irql – Check interrupt request levels.
!ready – Shows threads ready to run (may indicate scheduling issues).
!vm – Virtual memory usage.
!poolused – Kernel pool usage – look for pool exhaustion.
!verifier – Driver verifier status.
!devnode 0 1 – Device tree – look for failed devices.
lm t n – List loaded modules/drivers with timestamps.
!drvobj – Examine specific driver objects if you see suspicious ones.
!thread – Examine the current thread context.
!qlocks – Queue locks.
!wdfkd.wdflogdump – Windows Driver Framework logs (if applicable.
!poolused 2 – This shows pool usage sorted by size (largest first) – helps identify the biggest memory consumers.
!deadlock – Looks for deadlock detection information.

You can put the results for any AI tool for the analyses.

My last analyses ends with message:

******* 266688 kernel stack PTE allocations have failed ******
******* 365226304 kernel stack growth attempts have failed ******

Added to Cart