How to find out why a KVM VM had shut down SolusVM 2?

Answer

Generally, the entry reason=crashed indicates that internal processes within the guest OS (VM) led to the crash. Further investigation should therefore be done within the VM — access the VM and check the systemlog entries at the time of the crash.

If the issue occurs regularly and no root cause can be identified in the logs, consider installing monitoring tools, such as atop, to gather more details about the system state after the next crash.

The shutdown reason for a VM can be checked using the following command:

grep reason /var/log/libvirt/qemu/{UUID}.log

Replace {UUID} with the actual value.

For example:

grep reason /var/log/libvirt/qemu/22f245e5-75aa-460d-acc9-1b2e2ed321e1.log

2023-08-31 05:15:03.200+0000: shutting down, reason=destroyed