criticalFoundationSymptom-first#vm#spot#eviction#deallocate#cost

VM deallocated unexpectedly — spot eviction or unpaid credit

VM powerState shows stopped (deallocated) without manual action

Likely source:availabilitydata-loss

Focused incident mode — strips away everything but this runbook.

Symptoms

  • VM powerState shows stopped (deallocated) without manual action
  • Azure activity log shows a VM Eviction or billing-related event
  • Spot instance disappears from running workloads without warning

Spot VMs are evictable by design — protect critical workloads with availability sets, or use regular priority for stateful services.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • VM power state

    az vm show -g <RG> -n <VM-NAME> --query powerState -o tsv

  • Activity log eviction event

    az monitor activity-log list --resource-group <RG> --query "[].operationName.value" -o tsv | grep -i deallocate

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • VM priority = Spot
  • Activity log shows eviction event
  • Azure capacity dashboard shows high utilization in the region

Confirm before fixing

az vm show -g <RG> -n <VM-NAME> --query priority -o tsv
READ

Confirm Spot priority

Fix

az vm start -g <RG> -n <VM-NAME> --query powerState -o tsv
CHANGE

Restart the VM (it may be evicted again under load)

Expected: running

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
az vm show -g <RG> -n <VM-NAME> --query "{state:powerState,priority:priority}" -o json
READ

Confirm VM state and priority

2
az monitor activity-log list --resource-group <RG> --query "[].{op:operationName.value,time:eventTimestamp}" --output table | grep -i deallocate
READ

Find the eviction event

3
az vm start -g <RG> -n <VM-NAME> --query powerState -o tsv
CHANGE

Restart the deallocated VM

Prevention

  • Use Spot VMs only for stateless, batch, or interruptible workloads.
  • Set eviction policy to Deallocate (not Delete) to preserve the VM disk.
  • Use VMSS with balancing evictions to spread eviction risk across instances.
  • Monitor Azure Advisor capacity alerts and set budget thresholds in Cost Management.

Related runbooks

Same stack, same failure family — worth a skim.

VM allocation failed — insufficient capacity in region or zonecritical

az vm create returns An operation on target allocation failed

AzureFoundation3 causes
Open runbook
VM stuck in Provisioning state — boot diagnostics unavailablecritical

az vm show returns ProvisioningState = Creating for over 15 minutes

AzureIntermediate3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.