Re: Server loses network - bizzare behavior

Thanks that is good info, and close to my situation. Since I disabled my
unused NICS so far the problem has not come back, although it has only been a
few days, I'll no for sure in a few moe as it usually ocurs withing a week of
rebooting.

"DaveMills" wrote:

Please excuse my jumping in here but I once had a similar situation with an NT4
server. The DNS issue was found to be the second NIC which was not connected but
had once been manually configures for a different domain. The cable had been
disconnected but the networking was still retrieving the network configuration
info from the unplugged NIC's data. I enable the second NIC and connected a
cable then removed all the settings for the NIC and disabled it before removing
the cable.

I found the cause by running a network trace and noticing the incorrect
domain/dns info. Sorry I cannot remember the exact details, NT4 is a long time
ago. I do recall that the problem had been intermittent though.


On Wed, 29 Apr 2009 13:06:01 -0700, Bartly <Bartly@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:

Yes, they are both correctly registered in forward and reverse zones. I have
a feeling that these errors are symptoms of a problem that is not being
recorded in the event logs. The ID 12 makes no sense at all because no one is
doing anything to the hardware on these servers. And then there is the mouse
behavior when this happens. I have 10 other servers that are not having any
network issues at all. I should contact IBM to see if they have any ideas.

Meanwhile I'll see if disabling the unused NIC's helps, and if not, I will
disconnect from the KVM as Dan suggested. Thank you so much for your time
and effort, and let me know if you have any other ideas. It happens
intermitantly, anywhere from a few days apart to a week apart, so if I don't
here from you again I will check back in a week

"Meinolf Weber [MVP-DS]" wrote:

Hello Bartly,

All errors, except id 12, states about connectivity to the domain DNS servers,
please post an unedited ipconfig /all from them and make sure that both problem
servers are registered in the DNS zones correct.

Did you have restored either the DC's or the problem servers? Are they Virtual
machines? Any firewall that is blocking traffic?

Event ID 12:
This error may occur if you remove the disk without using the Safely Remove
Hardware icon in the notification area to stop the disk first. If this is
a built-in diskdrive something with it should be broken and need to be replaced.

http://www.eventid.net/display.asp?eventid=12&eventno=2984&source=PlugPlayManager&phase=1

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


Okay, I disabled the unused NIC's and that cleaned up the netdiag
errors.

Errors Newforma-ex-
In the System event log the only error that shows when the problem
occurs is
this:
----------------------------------------------------------------------
-----------------
Event Type: Error
Event Source: PlugPlayManager
Event Category: None
Event ID: 12
Date: 4/19/2009
Time: 2:23:17 AM
User: N/A
Computer: NEWFORMA-EX
Description:
The device 'MATSHITA UJDA780 DVD/CDRW'
(IDE\CdRomMATSHITA_UJDA780_DVD/CDRW_______________CA21____\5&5efe980&0
&0.0.0)
disappeared from the system without first being prepared for removal.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 ....
----------------------------------------------------------------------
-----
Then a few minutes later in the Application logs this error start
appearing
and continues until the server is rebooted:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1053
Date: 4/19/2009
Time: 2:52:30 AM
User: NT AUTHORITY\SYSTEM
Computer: NEWFORMA-EX
Description:
Windows cannot determine the user or computer name. (The specified
domain
either does not exist or could not be contacted. ). Group Policy
processing
aborted.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
----------------------------------------------------------------------
---------------- Errors Exchange-1-

System Log:

Event Type: Error
Event Source: PlugPlayManager
Event Category: None
Event ID: 12
Date: 4/27/2009
Time: 8:54:22 AM
User: N/A
Computer: EXCHANGE-1
Description:
The device 'MATSHITA UJDA780 DVD/CDRW'
(IDE\CdRomMATSHITA_UJDA780_DVD/CDRW_______________CA21____\5&871aba8&0
&0.0.0)
disappeared from the system without first being prepared for removal.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 ....
------------------------------------------------------
Application Log, these event keep occuring until the server is
rebooted:
Event Type: Error
Event Source: Microsoft Operations Manager
Event Category: None
Event ID: 26008
Date: 4/27/2009
Time: 8:55:03 AM
User: NT AUTHORITY\SYSTEM
Computer: EXCHANGE-1
Description:
The agent could not resolve the IP of the MOM Server
MOM.corp.gglo.com. The
error reported is 'The requested name is valid, but no data of the
requested
type was found.'.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
----------------------------------------------------------------------
-----
Event Type: Error
Event Source: MSExchange RPC Over HTTP Autoconfig
Event Category: General
Event ID: 2001
Date: 4/27/2009
Time: 8:55:57 AM
User: N/A
Computer: EXCHANGE-1
Description:
An error has occurred. The problem may resolve itself. The service
will
retry the operation in 15 minutes. Message:
Could not find any available Domain Controller.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
---------------------------------------------------------------------
Event Type: Error
Event Source: MSExchange ADAccess
Event Category: Topology
Event ID: 2104
Date: 4/27/2009
Time: 8:56:54 AM
User: N/A
Computer: EXCHANGE-1
Description:
Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1420). None of the domain
controllers in the domain are responding. This event can occur if the
domain
controllers in local or all domains become unreachable because of
network
problems. Use the Ping or PathPing command-line tools to test network
connectivity to local domain controllers. Run the Dcdiag command line
tool to
test domain controller health.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
----------------------------------------------------------------------
--
Event Type: Error
Event Source: MSExchange ADAccess
Event Category: Topology
Event ID: 2120
Date: 4/27/2009
Time: 8:57:06 AM
User: N/A
Computer: EXCHANGE-1
Description:
Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1420). Error
ERROR_TIMEOUT
(0x800705b4) occurred when DNS was queried for the service location
(SRV)
resource record used to locate a domain controller for domain
corp.gglo.com
The query was for the SRV record for
_ldap._tcp.dc._msdcs.corp.gglo.com
. The DNS servers used by this computer for name resolution are not
responding. This computer is configured to use DNS servers with the
following
IP addresses:
10.0.0.18
10.0.0.9
. Verify that this computer is connected to the network, that these
are the
correct DNS server IP addresses, and that at least one of the DNS
servers is
running.
For information about correcting this problem, type in the command
line:
hh tcpip.chm::/sag_DNS_tro_dcLocator_messageB.htm
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

"Meinolf Weber [MVP-DS]" wrote:

Hello Bartly,

Ok, but you have to remove the old DNS suffix.

EXCHANGE-1:
- disable unused and especially broken adapters(better remove or
replace)
"[WARNING] The net card 'Broadcom NetXtreme Gigabit Ethernet' may not
be
working"
- disable also the adapter with that ip address = 169.254.107.224

NEWFORMA-EX:
- disable unused and especially broken adapters(better remove or
replace)
"[WARNING] The net card 'Broadcom NetXtreme Gigabit Ethernet - Trend
Micro
Common Firewall Miniport' may not be working.
[WARNING] The net card 'Broadcom NetXtreme Gigabit Ethernet' may not
be working"
I talk about errors from the event viewer, especially that ones that
belongs to connection problem or authentication. If you open the
event properties you have in the right down corner a 2paper button to
copy to clipboard, use it and copy it in the posting.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
The DC's passed all tests. Sorry about the domain confusion, I
started to
change them for obscurity and forgot. Won't do that anymore.
corp.gglo.com is
the domain.
Here are the netdiag results. Please clarify what you want from the
event
logs, the whole application and system logs? Or just a few days
worth
around
the time of the problem? Or just errors and warnings ony? Thanks a
so
much.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\Documents and Settings\Administrator.GGLO>netdiag
'netdiag' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\Administrator.GGLO>cd \
C:\>cd windows

C:\WINDOWS>netdiag
'netdiag' is not recognized as an internal or external command,
operable program or batch file.
C:\WINDOWS>cd system32
C:\WINDOWS\system32>netdiag
'netdiag' is not recognized as an internal or external command,
operable program or batch file.
C:\WINDOWS\system32>cd \tools
C:\tools>netdiag

..................................

Computer Name: EXCHANGE-1
DNS Host Name: exchange-1.corp.gglo.com
System info : Microsoft Windows Server 2003 (Build 3790)
Processor : EM64T Family 6 Model 23 Stepping 7, GenuineIntel
List of installed hotfixes :
KB923561
KB924667-v2
KB925398_WMP64
KB925902
KB926122
KB926139-v2
KB927891
KB929123
.