01
The agent answers while the guest is wedged
What you saw
qm agent ping returns. The guest agent is responding, so the guest must be fine.
What was happening
Ping is the cheapest call the agent has. It answers from a thread that was still alive while the filesystem underneath had been frozen since the small hours.
Ask it to do real work, not to say hello
# ping proves almost nothing
qm guest cmd <vmid> ping
# this proves the filesystem is thawed
qm guest cmd <vmid> fsfreeze-status
The cheapest call an agent answers is the one that proves the least.
02
Replication is a snapshot storm
What you saw
Replication every 15 minutes, all jobs green, no alerts.
What was happening
Each run triggers a snapshot inside the guest. On Windows that is VSS, four times an hour, every hour. The timeouts showed up in the guest's own event log and nowhere on the hypervisor.
Read the guest's log, not only the host's
# the host says the job succeeded
# the guest's event log says Volsnap timed out
# give each guest its own window instead of one shared schedule
A job that succeeds on the host can be failing inside the guest.
03
Declared agent, absent agent
What you saw
The VM config has the guest agent enabled. The field is right there.
What was happening
Enabling it in the config says the host will try to talk to an agent. It does not say one is installed and running in the guest. Snapshots fell back to unquiesced without saying so loudly.
Probe the socket, do not trust the flag
# is anything actually listening?
qm agent <vmid> ping
# the config flag only says the host will try
qm config <vmid> | grep agent
Declared is not installed, and installed is not running.
04
It serves traffic but cannot be managed
What you saw
The service on the guest is up and users are not complaining.
What was happening
The guest was serving fine and had stopped answering every management path — no agent, no remote shell, ACPI ignored. It could do its job and could not be told to stop.
Test the management path separately from the service path
# serving and manageable are two different checks
# if the only way left is a hard reset, you already lost one of them
Being up and being reachable are not the same property.
House rules: no real addresses, no real hostnames, no topology — every screen is
generic, scale figures only. No sponsors. Open-source tools get named; anything for-profit stays
generic. Every failure here happened in this rack.