Identify and resolve downtime issues on Windows ECS instances -

If a Windows Elastic Compute Service (ECS) instance experiences issues such as kernel panics, out-of-memory (OOM) errors, or blue screen freezes, or if you receive a system event notification that the operating system has crashed, the instance is considered down. You can use the self-service diagnostics tool or system events to identify and resolve the cause.

Identify the cause of downtime

You can use the following methods to identify the specific cause of downtime for an ECS instance.

Method 1: (Recommended) Use the self-service diagnostics tool

Go to ECS console - Troubleshooting.
In the top navigation bar, select the region and resource group of the resource that you want to manage.
On the Instance Troubleshooting tab, choose Instance Connection Errors or Startup Exceptions > Instance Downtime. Then, select the ID of the instance that is down and click Start.
Identify and resolve the issue based on the diagnostic result and the proposed solution. For more information, see Common causes and solutions for downtime.

Method 2: Use system events

Go to ECS console - Events.
In the navigation pane on the left, click Unexpected O&M Events.
Click Diagnose Operating System Issue next to the instance that is down.
Identify and resolve the issue based on the diagnostic result and the proposed solution. For more information, see Common causes and solutions for downtime.

Common causes and solutions for downtime

The instance is down and returns error code 0000003b

Problem description
The instance is down and returns error code 0000003b.
Cause
A core system service process exited unexpectedly.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION document to troubleshoot the issue.

The instance is down and returns error code 0000000a

Problem description
The instance is down and returns error code 0000000a.
Cause
The kernel or a driver accessed invalid memory.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug check 0xA: IRQL_NOT_LESS_OR_EQUAL document to troubleshoot the issue.

The instance is down and returns error code 00000101

Problem description
The instance is down and returns error code 00000101.
Cause
The processor timed out when responding to a clock interrupt.
Solution
Follow the steps in the Bug check 0x101: CLOCK_WATCHDOG_TIMEOUT document to troubleshoot the issue.

The instance is down and returns error code 00000133

Problem description
The instance is down and returns error code 00000133.
Cause
A system Deferred Procedure Call (DPC) timed out.
Solution
Follow the steps in the Bug Check 0x133: DPC_WATCHDOG_VIOLATION document to troubleshoot the issue.

The instance is down and returns error code 000000ef

Problem description
The instance is down and returns error code 000000ef.
Cause
A core system process exited unexpectedly.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug check 0xEF: CRITICAL_PROCESS_DIED document to troubleshoot the issue.

The instance is down and returns error code 00000050

Problem description
The instance is down and returns error code 00000050.
Cause
The kernel or a driver accessed invalid memory.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug Check 0x50: PAGE_FAULT_IN_NONPAGED_AREA document to troubleshoot the issue.

The instance is down and returns error code 0000001e

Problem description
The instance is down and returns error code 0000001e.
Cause
An unhandled kernel exception occurred.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug check 0x1E: KMODE_EXCEPTION_NOT_HANDLED document to troubleshoot the issue.

The instance is down and returns error code 0000007e

Problem description
The instance is down and returns error code 0000007e.
Cause
An unhandled system thread exception occurred.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug Check 0x7E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED document to troubleshoot the issue.

The instance is down and returns error code 00000139

Problem description
The instance is down and returns error code 00000139.
Cause
A kernel data structure was corrupted.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug Check 0x139: KERNEL_SECURITY_CHECK_FAILURE document to troubleshoot the issue.

The instance is down and returns error code 0000013a

Problem description
The instance is down and returns error code 0000013a.
Cause
A kernel data structure was corrupted.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug check 0x13A: KERNEL_MODE_HEAP_CORRUPTION document to troubleshoot the issue.

The instance is down and returns error code 00000135

Problem description
The instance is down and returns error code 00000135.
Cause
A registry filter driver handled an exception incorrectly. This is usually caused by a third-party driver.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug Check 0x135: REGISTRY_FILTER_DRIVER_EXCEPTION document to troubleshoot the issue.

The instance is down and returns error code 00000019

Problem description
The instance is down and returns error code 00000019.
Cause
A system memory pool data structure was corrupted.
Solution
- Check for and uninstall unreliable third-party software or drivers on the instance. For more information, see How do I view the third-party software and drivers that are installed on an ECS instance?.
- Update system patches to the latest version. For more information, see How do I update system patches to the latest version?.
- Follow the steps in the Bug Check 0x19: BAD_POOL_HEADER document to troubleshoot the issue.

FAQ

Note

The following steps use Windows Server 2019 as an example. The steps for other Windows Server versions are similar.

How do I view the third-party software and drivers that are installed on an ECS instance?

Third-party software
1. In the Windows operating system, open Control Panel.
2. In Control Panel, choose Programs > Programs and Features.
3. You can view the third-party software in the list.
  Note
  The publisher of third-party software is typically not Microsoft. Some third-party software may also display an icon in the system tray, where you can find the software and check its publisher.
Third-party drivers
1. In the Windows operating system, open Device Manager.
2. Expand each device category to view the installed third-party drivers.

How do I update system patches to the latest version?

In the Windows operating system, open Windows Update settings.
On the Windows Update tab of the Update & Security page, click Check for updates.
The system automatically checks for and lists available system patches.
Click Install to install the latest system patches.