Re: SBS2000 X225 Server



Andrew,

Server, PC, Laptop, to me - it doesn't matter. If the machine encountered a power failure, a "hard shutdown," or any other abnormal shut down, I always make sure that chkdsk runs (often requiring 2 reboots) with the /f or /x switch. Windows will sometimes automatically run chkdsk while booting up after an abnormal shut down. If not, I force it to run (either from the command prompt or windows explorer). This is why a 2nd reboot is often necessary - chkdsk will not run on a system/boot drive while Windows is running - it will schedule a check at the next reboot. Set aside a couple hours for this (I've seen a chkdsk take more than an hour on an 80 GB RAID Array, even without the bad cluster [disk surface] check option).

I can almost guarantee you some file-system shenanegans after any abnormal shut down on any Windows-based system.

Besides that, there is the question of whether the updates completed successfully or not. Re-starts are typically to allow updates to replace files which are in use while Windows is running (and/or to restart services dependent on said files). Try checking your update history and/or log files. If you've got a half-finished update or two, you could have mixed file versions, inappropriate registry entries, etc. causing you grief.

Godspeed.
Fred

Andrew wrote:
Last week updates were downloaded and installed from Windowsupdate for the
server. The server was not restarted.

Yesterday morning the server had a message saying it was shutting down. We
do not know how long it was there but when nothing happened after 45minutes
it was hard shutdown.

A restart showed no errors in any of the logs and all services started okay.

Since then the server has Frozen or Hard Locked with no access from the
network, console, etc., 3 times. The last time it occurred it was being
monitored (task manager running, scanning drives, installing monitoring
software). Memory usage running at around 600Mb, processor at around 20%.
Screen just froze in place (ie. what was on the screen stayed there). No
mouse, keyboard (no numlocks or caplocks). Server is still running, fans
still running, no harddrive activity at all.

On each occasion there are no errors in any logs, no actual events in the
logs around the time of the freeze, nothing. And the server starts
perfectly each time

Server specs are:
X225 server, Xeon 2.4Ghz, 512Mb, 2 x 36Gb SCSI hot swap drives with a 5i
RAID card and drives are mirrorred. External modem, UPS. There are 3
partitions (RAID not windows) on the drive with paging split onto 2
different partitions.

Thoughts are leaning towards possible hardware problems (ram, SCSI
controller, SCSI cage) but seeing as a restart was not undertaken after the
update installation last week could this be a possibility?

Are now going through ensuring BIOS, Firmware, etc is all up to date but
just in case someone else has been down this path and thoughts would be
greatly appreciated.

Andrew



.



Relevant Pages

  • Re: been hit by hacker, servudaemon installed
    ... Every single one of the web servers and internet server operating systems ... Windows, Apache, you name it. ... commands they entered in your IIS server logs. ...
    (microsoft.public.inetserver.iis.security)
  • Re: been hit by hacker, servudaemon installed
    ... >Every single one of the web servers and internet server ... >Windows, Apache, you name it. ... >commands they entered in your IIS server logs. ...
    (microsoft.public.inetserver.iis.security)
  • SecurityFocus Microsoft Newsletter #154
    ... MICROSOFT VULNERABILITY SUMMARY ... ISS RealSecure Server Sensor SSL Denial Of Service Vulnerabi... ... Roger Wilco Remote Server Side Buffer Overrun Vulnerability ... available for Microsoft Windows operating systems. ...
    (Focus-Microsoft)
  • RE: CEICW-OMA errors
    ... I won't be able to take down the server to do all of this until tomorrow. ... then reproduce the issue by running CEICW again to capture logs. ... Filemon for Windows ... Windows Small Business Server\Support folder to me. ...
    (microsoft.public.windows.server.sbs)
  • SecurityFocus Microsoft Newsletter #49
    ... Subject: SecurityFocus Microsoft Newsletter #49 ... Microsoft Windows NNTP Denial of Service Vulnerability ... Microsoft IIS SSI Buffer Overrun Privelege Elevation Vulnerability ... Microsoft ISA Server H.323 Memory Leak Denial of Service... ...
    (Focus-Microsoft)

Loading