We deployed Jenkins Windows Slave in our production server to automate our deployment process.

Since we have a firewall behind the production server and can impact the connection between Jenkins slave and master, the Jenkins slave will be restarted within the application per the error log.

BUT after a few hours, jenkins windows slave rebooted our production server (including our SQL server) which results in the downtime in our a few booking web sites.

I strongly advise Jenkins windows slave not to restart whole server at any time except somebody want to do it explicitly. The accident makes me very hard to persuade the company to use Jenkins to deploy the live environment.

And I noticed that in "jenkins-slave.xml", there is a configuration about "onfailure". It should be just restart the app within the JVM. Right?

<onfailure action="restart" />

Can you help why Jenkins Windows Slave restarted our whole server? (we found the server is restarted by Jenkins Slave through the trace stack in SQL dump file)
Thanks.