This KB describes the logs that must be collected when a vSRX instance crashes in a KVM environment, especially in cases where the vSRX itself does not have sufficient logs to determine the root cause.
In such situations, it is important to analyze KVM host-level logs, as the issue may originate from the hypervisor or underlying infrastructure rather than the vSRX guest.

No clear indication of root cause within guest OS logs

When a vSRX crashes inside a KVM environment, the guest logs alone may not tell the complete reason. The root cause could be related to the hypervisor or host environment, such as:

• Host running out of memory
• QEMU or libvirt errors
• Hugepages misconfiguration
• Kernel-level issues on the host

These issues are typically not visible in vSRX logs, so collecting host-level logs is essential for troubleshooting.

Logs to Collect:

1. QEMU / libvirt VM Log
This log captures VM lifecycle events and QEMU-level errors around the time of the crash.
/var/log/libvirt/qemu/<vm-name>.log

2. System / Kernel Logs (Around Crash Time)
Collect logs from the host system to identify any kernel or system-level issues.
Command:
journalctl --since "<crash date/time -30min>" --until "<crash date/time +10min>"

Alternatively, provide:

RHEL/CentOS:
/var/log/messages

Ubuntu:
/var/log/syslog

3. VM Configuration
Export the VM configuration to understand resource allocation and setup.
Command:
virsh dumpxml <vm-name>

4. Hugepages Status
Check hugepage allocation and usage, as misconfiguration can lead to crashes.
Command:
cat /proc/meminfo | grep -i huge

5. KVM Host Software Versions
Collect version details for troubleshooting compatibility or known issues.
Command:
qemu-system-x86_64 --version
virsh --version
uname -r