Re: Server semi-shutdown
From: Dave Nickason [SBS MVP] (gwdibble_at_NOSPAM.frontiernet.net)
Date: 09/23/04
- Next message: Chris Puckett [MSFT]: "Re: How to install SBS2003 to existing Win2003 Std Domain"
- Previous message: 1SE: "Re: RWW Locks up server."
- In reply to: Andrew H: "Re: Server semi-shutdown"
- Next in thread: Andrew H: "Re: Server semi-shutdown"
- Messages sorted by: [ date ] [ thread ]
Date: Thu, 23 Sep 2004 10:38:41 -0400
Andrew - thanks for keeping me posted on this. I'm working with CA and
Microsoft to solve this, so any information you can provide will be very
much appreciated (particularly if cycling the realtime server service fixes
your problem).
Dave
"Andrew H" <ajhpms@hotmail.com> wrote in message
news:ciueom$6kp$1@ctb-nnrp2.saix.net...
> Hi Dave
>
> No, I'm not using ArcServe (although I used to in the SBS 2000 days). So
> far this week things have been OK, but if I have the issue come
> Friday/Monday, I'll try your suggestion with the Net Stop command.
>
> Regards
>
> Andrew
>
> "Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in
> message news:OWW21s%23nEHA.1248@TK2MSFTNGP09.phx.gbl...
>> What's happening with me is that the server becomes unresponsive -
>> ctrl+alt+delete will immediately bring up a login prompt, but it may take
>> up to 45 minutes or more for the desktop to display. I double-click a
>> shortcut to the command prompt, and it takes 20 minutes to open. But it
>> works normally once it appears. Same with Task Manager - 20 minutes to
>> open, then responds normally. Functions such as mouse, num lock, etc.
>> are normal. I can't access remotely with RDP, but I often can access
>> remotely with the Computer Management console. It's my impression that
>> this gets progressively worse as time goes on, but I can't swear to that.
>> I have had a number of times where hitting the reset button was my only
>> option, but I'd imagine that the server would have eventually responded
>> if I could have waited longer.
>>
>> This usually happens overnight 6 or 7 days after a reboot, and
>> immediately after the (Arcserve) backup completes. The last two times it
>> happened were after Thursday evening reboots. Once was on the following
>> Thursday morning, once the following Friday morning. The backup
>> completes around 3:45 AM, and the first errors are logged around 3:55 AM.
>> These are errors related to processes timing out due to the problem,
>> they're not anything that indicates a source for the problem itself.
>>
>> Here's the #1 eTrust connection: restarting the "eTrust Antivirus
>> Realtime Server" service has the same effect as rebooting - it fixes the
>> slowdown if it's happening, and it restarts the 6-7 day clock otherwise.
>> You can test this yourself by putting a shortcut to a command prompt on
>> your desktop (so you don't have to wait an hour for the start menu). If
>> you can get a prompt to open, type net stop "eTrust Antivirus Realtime
>> Server" and see if your server goes back to normal as soon as the command
>> completes (which will take a while).
>>
>> This started when the server was running SBS 2000 and eTrust 7.0 fully
>> patched. Since it started, I've upgraded the server to SBS 2003, and
>> I've updated eTrust to 7.1. This was a complete uninstall of eTrust 7 at
>> CA's instructions - deleted all folders, registry keys, etc. prior to
>> reinstalling 7.1. They have (repeatedly) reviewed every setting on the
>> server, not that there should be a settting to make the server
>> unresponsive.
>>
>> Current status: at CA's request, I have moved the backup time to 2.5
>> hours earlier to see if this slowdown is tied to the backup, or if the
>> timing at the end of the backup job is a coincidence. Also at CA's
>> request, I've installed a driver update they released last week. There
>> is an issue addressed in this driver that could be the cause - it's
>> described as much less serious than the problem I'm having, but maybe I'm
>> just on the far end of the spectrum. I last rebooted last Friday, so I
>> should know more this Friday or Saturday.
>>
>> I'd be interested in hearing of any similarities in your situation. It
>> sounds like you could be experiencing this, or the USB backup problem
>> that seems to be quite a bit more common than this issue. Are you by any
>> chance using Arcserve?
>>
>> I'll keep you posted as I progress with this, unless you post back that
>> you've found the cause of your problem.
>>
>>
>>
>> "Andrew H" <ajhpms@hotmail.com> wrote in message
>> news:%239jlyH7nEHA.556@tk2msftngp13.phx.gbl...
>>> Yep, it's eTrust AV 7.0.0405 with current patches and Exchange
>>> integration. I've had utilisation issues before with eTrust, but the
>>> patches seem to have fixed them. I'd be interested in hearing your
>>> experiences.
>>>
>>>
>>>
>>>
>>> "Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in
>>> message news:%23lDi7lynEHA.2052@TK2MSFTNGP10.phx.gbl...
>>>> And I'm seeing a problem where my server becomes similarly unresponsive
>>>> on the 7th or 8th day after a reboot. What anti-virus program are you
>>>> using? I've narrowed my problem down to eTrust AV 99.5% (restarting the
>>>> eTrust realtime service has the same effect as rebooting).
>>>>
>>>> If you happen to be using eTrust AV, let me know and I'll give you some
>>>> more details (no sense boring you with it if you're not).
>>>>
>>>>
>>>> "Les Connor" <les.connor@DEL.cfive.ca> wrote in message
>>>> news:Ojxm8hxnEHA.2024@TK2MSFTNGP09.phx.gbl...
>>>>> Andrew,
>>>>>
>>>>> I've seen a problem that sounds very similar - using USB for backup.
>>>>>
>>>>> The server had USB 1.1 integrated, and a USB 2.x pci card was added,
>>>>> and the backup drive connected to it. Twice, the USB sybsystem seemed
>>>>> to get confused. The system believed the USB drive was connected to
>>>>> the 1.1, when in fact it was connected to the 2.0 card. The backup ran
>>>>> (I have no idea how), but a backup that started at 11:00 pm and
>>>>> normally completed within 2 hours, was still running at 8:00 am in the
>>>>> morning. The SBS was extremely sluggish, users were faced with very
>>>>> long waits to log in, and couldn't do anything once logged in.
>>>>>
>>>>> There were numerous DNS errors logged, 4015, 4016, relating to
>>>>> timeouts. There were also other events logged relating to timeouts.
>>>>>
>>>>> The solution in this case was to disable the integrated USB in bios,
>>>>> and also to keep the USB drive permanently connected to the server. A
>>>>> second USB drive is connected on schedule, and the most recent backup
>>>>> file is copied from the permanent drive to the second drive for
>>>>> off-site storage.
>>>>>
>>>>> So, suspect the USB/backup configuration. If the server only reacts
>>>>> this way during/after a backup, then you have the cause and then need
>>>>> to find a solution.
>>>>>
>>>>> --
>>>>> Les Connor
>>>>> -------------------------------------
>>>>> SBS Rocks !
>>>>>
>>>>>
>>>>>
>>>>> "Andrew H" <ajhpms@hotmail.com> wrote in message
>>>>> news:OyTkASvnEHA.2576@TK2MSFTNGP10.phx.gbl...
>>>>>> I've been experiencing a problem with an SBS2003 server the last
>>>>>> several weeks, apparently during the weekend. Each Monday the server
>>>>>> is non-responsive - the mouse moves, but nothing will open and there
>>>>>> is no response to Ctrl-Alt-Del. The task bar is shown in outline,
>>>>>> with the buttons inaccessable - Explorer is frozen.
>>>>>>
>>>>>> However, I am able to login at a workstation, use files on the
>>>>>> server, connect to the Internet using the server's ISA, and use the
>>>>>> Event Viewer to look at the server's event logs. Remote desktop
>>>>>> access to the server freezes and Companyweb won't open, but Outlook
>>>>>> opens and connects to the server.
>>>>>>
>>>>>> On the server, I eventually have no choice but to hard reset on
>>>>>> Monday morning. Once the server restarts, everything is back to
>>>>>> normal. I can't see anything in the event logs that explains the
>>>>>> problem, except for the fact that the server believes it was shut
>>>>>> down the previous Friday, not on the Monday it was actually shut
>>>>>> down. There is nothing in any of the event logs between the "Friday"
>>>>>> shutdown and the restart on Monday.
>>>>>>
>>>>>> I also had the experience of working late one Friday evening, keeping
>>>>>> an eye on the workstation's clock to get an idea of time. After what
>>>>>> seemed a few hours activity, according to the workstation and the
>>>>>> server it was approximately 10pm - but the sun was rising outside,
>>>>>> and the real time was somewhere around 6am. I had inadvertently
>>>>>> worked through the night because I relied on the server clock. My
>>>>>> guess is that the clock gradually slowed down during the evening to
>>>>>> the point it hardly moved, and somehow this must be another aspect of
>>>>>> the server semi-shutdown.
>>>>>>
>>>>>> The only thing I can think of that has changed in the last few weeks
>>>>>> relating to the weekend is that the backup wizard has been scheduled
>>>>>> to do a backup to a new external USB 2.0 Iomega HDD at 4am on Friday
>>>>>> mornings. This backup completes, according to the logs, and I've done
>>>>>> manual full system backups without any issues.
>>>>>>
>>>>>> Server and workstations are fully patched (HFNetChk Pro) and have
>>>>>> been scanned using latest Antivirus signatures.
>>>>>>
>>>>>> I know time flows differently for Microsoft systems than in the real
>>>>>> world, but this is ridiculous.
>>>>>>
>>>>>> Any suggestions as to next step, please?
>>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>
- Next message: Chris Puckett [MSFT]: "Re: How to install SBS2003 to existing Win2003 Std Domain"
- Previous message: 1SE: "Re: RWW Locks up server."
- In reply to: Andrew H: "Re: Server semi-shutdown"
- Next in thread: Andrew H: "Re: Server semi-shutdown"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
