Re: SBS 2K3 reboots at noon everyday
- From: "Dave Nickason [SBS MVP]" <gwdibble@xxxxxxxxxxxxxxxxxxxxxx>
- Date: Sat, 22 Oct 2005 12:42:11 -0400
Interesting. Sounds like you know more about this than I do. Everything
you said makes sense - I wasn't reading your original post right, thinking
of a setting (can't write to security log shuts down server) rather than a
service crashing/recovering. Obviously you're right that event log recovery
reboots the server, and the permission issue was apparently crashing the
event log, so hopefully you've got it solved.
I don't think you need to be embarrassed by this - to the contrary you
solved a pretty unique and bizarre problem. I've been reading the SBS
groups since 1998 and this is the first I've ever heard of this. Plus,
maybe your client broke this themselves by playing with security permissions
: -)
"Jim Pollum" <JimPollum@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6D3C59DF-8A53-4EF5-BEF9-F8CAFD7ECB49@xxxxxxxxxxxxxxxx
> Yes, it is the System Event Log entry to which I am refering . However,
> the
> Eventlog service does reboot the server if it crashes, according to the
> recovery tab under services. There is nothing scheduled for noon, and the
> VSS
> service is and has been disabled. There is nothing logged anywhere at
> noon,
> and I felt the problem has to do with this entry as it is the only entry
> missing, and the only clue I have. Since I wrote the first time, I did
> stumble across that when I save the Event Logs to the Administrator's "My
> Documents", I can do so and then clear the events. If I try to clear the
> events first and when it asks if I want to save the events first and say
> yes,
> it is unable to write the file. Researching Microsoft, they say that if I
> save first, it uses the account I am using (Administrator). If you clear
> the
> events and save the files, it uses the System account. Looking at the
> Administrator's "My Documents" directory, I found that the System account
> was
> omitted. I do not know how or why, since it used to work a couple of weeks
> ago, but nonetheless, when I put the System account priveleges back on the
> directory, it does not reboot at noon now. At least it has not since
> Thursday
> (it is now Saturday). Now I see that it reboots at 4:06AM. It did before,
> but
> I thought it was a dingle problem. I bet this is a scheduled event issue,
> and
> I will look into it Real Soon Now. I appreciate your help. I was getting
> rather despirate becuase nothing I was investigating lead anywhere at all.
> It
> was embarrasing to say that after spending many hours diagnosing the
> problem
> to tell my customer that I had not a clue as to what was happening, other
> than I "felt" that the 1 event had something to do with it.
> Thanks again.
>
> "Dave Nickason [SBS MVP]" wrote:
>
>> The uptime information is logged to the System log at noon. However, I
>> believe that the setting you're referring to applies to the Security
>> log -
>> that the server shuts down if it can't write to the log. If we're
>> talking
>> about the same thing, that would be a shutdown rather than a reboot, and
>> wouldn't apply anyway since it doesn't apply to the System log.
>>
>> I'd be looking at any scheduled task that's set to run at noon. The only
>> one I know of by default is a VSS shadow copy. Is there anything
>> scheduled
>> in an AV program or 3rd party backup? UPS management program? Anything
>> logged in the Application log at the time it happens?
>>
>> If this is happening right at noon every day, IMO it's got to be
>> something
>> scheduled. Even a regular failure of some other kind wouldn't be
>> happening
>> exactly at the same time daily.
>>
>>
>> "Jim Pollum" <JimPollum@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
>> news:BC6EE179-187F-470E-818B-7BD13A6CE2F4@xxxxxxxxxxxxxxxx
>> >I have 1 SBS server that has decided to reboot everyday at noon. This
>> >started
>> > about 3 weeks ago. What little I have been able to figure out is that
>> > at
>> > noon
>> > daily, there is normally an event entered in the system log that
>> > informs
>> > of
>> > the system uptime (event ID: 6013). This is missing from this server,
>> > and
>> > I
>> > believe is the cause of the reboot. The eventlog service is set to
>> > reboot
>> > the
>> > computer is it fails as this is the default setting and no other
>> > options
>> > are
>> > available. I believe the event log service is failing trying to write
>> > this
>> > entry and rebooting. However, I am not able to locate any more
>> > information
>> > as
>> > to what service is enetering this event, or any other explanation for
>> > this
>> > anomaly. Any suggestions?
>>
>>
>>
.
- Follow-Ups:
- Re: SBS 2K3 reboots at noon everyday
- From: Jim Pollum
- Re: SBS 2K3 reboots at noon everyday
- Prev by Date: Answer to : Error while configuring SBS 2003 the monitoring features
- Next by Date: Re: RWW without a Local Workstaton
- Previous by thread: Answer to : Error while configuring SBS 2003 the monitoring features
- Next by thread: Re: SBS 2K3 reboots at noon everyday
- Index(es):
Relevant Pages
|
