Linux VM repeatedly becomes unreachable — SSH handshake never starts, reboot doesn't recover, only redeploy/deallocate does

Gary Unterbrink 0 Reputation points
2026-08-30T19:43:35.4566667+00:00

A single Linux VM in East US has become unreachable twice in two weeks with the same symptoms, and I can't determine the cause from the data available to me.

Symptom SSH connects at the TCP layer but the server never sends its version banner, so the handshake never begins. ssh -v stops after printing the local version string. Same behavior from three separate client machines on different networks, with no changes to NSG rules or SSH keys. The Azure serial console was also extremely slow to respond during the incident.

Recovery A guest reboot does not fix it. On Aug 19 only Stop-Deallocate followed by Start restored service. On Aug 30 only Redeploy did. The fact that a guest reboot fails but moving to a new host succeeds suggests something host-side rather than in the guest.

Incident 1 — Wed Aug 19 2026 ResourceHealth event Activated at 15:01:17 CDT (20:01:17 UTC). Correlation ID f747fb2f-9358-4ff1-a0fc-42206452fbda. Event properties: type Downtime, cause Unknown, title Unknown, currentHealthStatus Unavailable, previousHealthStatus Available, "Event initiated by" blank. Restart did not resolve. Deallocate at 15:08:57 followed by Start did. Health event then resolved.

Incident 2 — Sun Aug 30 2026 Same symptoms. Azure Connectivity Diagnostics ran four times, all returning "no issues detected." The guided troubleshooter returned "unable to determine root cause details." Host-level CPU metrics showed roughly 12% average with a peak near 55% — no saturation. Guest memory metrics were unavailable. Redeploy at approximately 19:35 UTC restored service.

Questions

  1. What does cause: Unknown with type: Downtime typically indicate — is this host-side degradation, or lost guest heartbeat?
  2. Why would a guest reboot fail to recover while a redeploy succeeds, if the fault were inside the guest?
  3. Is there anything in my configuration that could produce this, or is this a platform-side pattern?
  4. What should I enable now so the next occurrence is diagnosable? Boot diagnostics and a Resource Health alert are on my list.
Azure Virtual Machines
Azure Virtual Machines

An Azure service that is used to provision Windows and Linux virtual machines.

0 comments No comments

2 answers

Sort by: Most helpful
  1. SUNOJ KUMAR YELURU 18,736 Reputation points MVP Volunteer Moderator
    2026-08-31T14:42:13.0266667+00:00

    Hello @Gary Unterbrink

    Let me address each question directly, then give you an action plan.

    Q1: What does cause: Unknown with type: Downtime indicate?

    cause: Unknown almost always means the platform detected the VM was unhealthy but could not attribute it to a scheduled event, user action, or known hardware failure within the logging window. The blank "Event initiated by" field confirms no user or Azure action triggered it.

    Combined with type: Downtime, this strongly points to one of:

    • Host node degradation — the physical host is still running but in a degraded state (memory controller fault, NIC firmware issue, storage path problem). The guest appears up to the hypervisor but I/O or network forwarding is impaired
    • Live Migration failure — Azure tried to migrate your VM off a host and the migration stalled or partially completed, leaving the VM in a limbo state on the destination
    • Fabric agent loss — the Azure guest agent or host-side fabric layer lost its heartbeat to the VM without a clean crash, so no RCA is recorded

    The serial console being extremely slow is the key corroborating detail — that points to the host I/O path being degraded, not a guest-side process hang.


    Q2: Why does guest reboot fail but redeploy succeed?

    A guest reboot (sudo reboot or portal restart) keeps the VM on the same physical host. If the fault is in the host's virtual switch, storage fabric, or NIC firmware, rebooting the guest changes nothing about the underlying hardware path.

    Stop-Deallocate and Redeploy both move the VM off the current host entirely:

    Action Moves host? Preserves IP?
    Restart No Yes
    -------- -------- --------
    Restart No Yes
    Stop-Deallocate + Start Yes (usually) No (dynamic IP)
    Redeploy Yes (always) Yes

    The fact that both host-moving actions recovered the VM while an in-place reboot did not is strong evidence the fault is in the host infrastructure, not the guest OS.


    Q3: Could your configuration cause this?

    Unlikely, but worth ruling out:

    • Single-instance VM with no Availability Zone or Set — you get no SLA on uptime and no automatic host health remediation in some failure modes. Azure will eventually auto-heal but the window is unpredictable
    • Premium SSD vs Standard — Standard HDD/SSD disks have a higher tolerance for host storage path issues before I/O errors surface
    • VM size Standard_B2ls_v2 — B-series VMs run on shared infrastructure and are more likely to be co-located on hosts under varying load, though this doesn't directly cause your symptom

    Q1: What does cause: Unknown with type: Downtime indicate?

    cause: Unknown almost always means the platform detected the VM was unhealthy but could not attribute it to a scheduled event, user action, or known hardware failure within the logging window. The blank "Event initiated by" field confirms no user or Azure action triggered it.

    Combined with type: Downtime, this strongly points to one of:

    • Host node degradation — the physical host is still running but in a degraded state (memory controller fault, NIC firmware issue, storage path problem). The guest appears up to the hypervisor but I/O or network forwarding is impaired
    • Live Migration failure — Azure tried to migrate your VM off a host and the migration stalled or partially completed, leaving the VM in a limbo state on the destination
    • Fabric agent loss — the Azure guest agent or host-side fabric layer lost its heartbeat to the VM without a clean crash, so no RCA is recorded

    The serial console being extremely slow is the key corroborating detail — that points to the host I/O path being degraded, not a guest-side process hang.


    Q2: Why does guest reboot fail but redeploy succeed?

    A guest reboot (sudo reboot or portal restart) keeps the VM on the same physical host. If the fault is in the host's virtual switch, storage fabric, or NIC firmware, rebooting the guest changes nothing about the underlying hardware path.

    Stop-Deallocate and Redeploy both move the VM off the current host entirely:

    Action Moves host? Preserves IP?
    Restart No Yes
    -------- -------- --------
    Restart No Yes
    Stop-Deallocate + Start Yes (usually) No (dynamic IP)
    Redeploy Yes (always) Yes

    The fact that both host-moving actions recovered the VM while an in-place reboot did not is strong evidence the fault is in the host infrastructure, not the guest OS.


    Q3: Could your configuration cause this?

    Unlikely, but worth ruling out:

    • Single-instance VM with no Availability Zone or Set — you get no SLA on uptime and no automatic host health remediation in some failure modes. Azure will eventually auto-heal but the window is unpredictable
    • Premium SSD vs Standard — Standard HDD/SSD disks have a higher tolerance for host storage path issues before I/O errors surface
    • VM size Standard_B2ls_v2 — B-series VMs run on shared infrastructure and are more likely to be co-located on hosts under varying load, though this doesn't directly cause your symptom

    The two incidents in two weeks on the same VM suggest the VM may have been placed back on the same degraded host after the Aug 19 deallocate, which is possible if the host hadn't been pulled from rotation yet.Q1: What does cause: Unknown with type: Downtime indicate?

    cause: Unknown almost always means the platform detected the VM was unhealthy but could not attribute it to a scheduled event, user action, or known hardware failure within the logging window. The blank "Event initiated by" field confirms no user or Azure action triggered it.

    Combined with type: Downtime, this strongly points to one of:

    • Host node degradation — the physical host is still running but in a degraded state (memory controller fault, NIC firmware issue, storage path problem). The guest appears up to the hypervisor but I/O or network forwarding is impaired
    • Live Migration failure — Azure tried to migrate your VM off a host and the migration stalled or partially completed, leaving the VM in a limbo state on the destination
    • Fabric agent loss — the Azure guest agent or host-side fabric layer lost its heartbeat to the VM without a clean crash, so no RCA is recorded

    The serial console being extremely slow is the key corroborating detail — that points to the host I/O path being degraded, not a guest-side process hang.


    Q2: Why does guest reboot fail but redeploy succeed?

    A guest reboot (sudo reboot or portal restart) keeps the VM on the same physical host. If the fault is in the host's virtual switch, storage fabric, or NIC firmware, rebooting the guest changes nothing about the underlying hardware path.

    Stop-Deallocate and Redeploy both move the VM off the current host entirely:

    Action Moves host? Preserves IP?
    Restart No Yes
    Stop-Deallocate + Start Yes (usually) No (dynamic IP)
    Redeploy Yes (always) Yes

    The fact that both host-moving actions recovered the VM while an in-place reboot did not is strong evidence the fault is in the host infrastructure, not the guest OS.


    Q3: Could your configuration cause this?

    Unlikely, but worth ruling out:

    • Single-instance VM with no Availability Zone or Set — you get no SLA on uptime and no automatic host health remediation in some failure modes. Azure will eventually auto-heal but the window is unpredictable
    • Premium SSD vs Standard — Standard HDD/SSD disks have a higher tolerance for host storage path issues before I/O errors surface
    • VM size Standard_B2ls_v2 — B-series VMs run on shared infrastructure and are more likely to be co-located on hosts under varying load, though this doesn't directly cause your symptom

    The two incidents in two weeks on the same VM suggest the VM may have been placed back on the same degraded host after the Aug 19 deallocate, which is possible if the host hadn't been pulled from rotation yet.

    Was this answer helpful?

    0 comments No comments

  2. Allan Solomon Mejia 7,585 Reputation points
    2026-08-30T21:58:53.0866667+00:00

    Hello @Gary Unterbrink

    Your reasoning is reasonable, but I wouldn't conclude host failure from the cause: Unknown alone. Azure Resource Health uses Unknown when it doesn't have enough information to determine the resource state/cause; it isn't specifically a host-degradation code.

    That said, the recovery pattern is significant. A normal restart keeps the VM on its existing host, whereas Redeploy moves the VM to a new Azure host while retaining its configuration and attached resources. Microsoft includes Redeploy as a troubleshooting step when an Azure Linux VM remains inaccessible after a restart.

    Since TCP/22 connects but no SSH banner arrives, the issue could still be inside the guest, for example, sshd blocked waiting on another subsystem, severe I/O/memory pressure, filesystem problems, or a hung kernel. The extremely slow Serial Console is another reason I wouldn't isolate this to SSH itself.

    Next time, enable Boot Diagnostics now and preserve the serial console output before redeploying. Also check Resource Health and run VM Assist for Linux while the VM is unhealthy. Microsoft specifically recommends Boot Diagnostics, Serial Console, Resource Health, and VM Assist for inaccessible Linux VMs.

    If it happens a third time and Restart again fails while Redeploy immediately restores the same OS disk/configuration, open an Azure support case and provide both Resource Health event correlation IDs and timestamps. Microsoft can correlate those with host/platform telemetry that isn't exposed to you. Resource Health can also provide access to support for a resource-health event even without an active support agreement.

    So I would treat host/platform degradation as a credible hypothesis, but not proven yet. The repeated Restart-vs-Redeploy behavior is the strongest evidence worth escalating.

    Sharing these references with you:

    Azure Resource Health overview

    Troubleshoot SSH connections to Azure Linux VMs

    Azure Serial Console for Linux

    Help make this community better for everyone: if this answer resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution.

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.