Re: SBS 2K3 reboots at noon everyday
- From: "Jim Pollum" <JimPollum@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Tue, 25 Oct 2005 02:38:05 -0700
Thanks for your reply. You make it sound like I know what I am doing. However
finding the cause occurred by stumbling across it while trying to save the
logs. It was part of the discovery process (guessing), but until then, I had
researched the problem using every means possible and was completely stymied
as to where to head. There was no crash logs, no errors reported anywhere,
and no other problems. And it was apparent to my client who had asked me to
come in and fix it. I had to be honest about it especially because my jaw
dropping stare at the monitor and head scratching gave me away. Fortunately,
it was not a huge problem since the server rebooted and everything would come
back in a few minutes, and the otner 2K3 server was still running. I heard
someone there say that it must be lunchtime because the server just crashed.
It would be nice to pass some blame, but this particular client is very good
at staying away from fooling around. There are no administrators except for
me.
It is time to find out why it reboots daily at 4:07 AM. Thanks again.
"Dave Nickason [SBS MVP]" wrote:
> Interesting. Sounds like you know more about this than I do. Everything
> you said makes sense - I wasn't reading your original post right, thinking
> of a setting (can't write to security log shuts down server) rather than a
> service crashing/recovering. Obviously you're right that event log recovery
> reboots the server, and the permission issue was apparently crashing the
> event log, so hopefully you've got it solved.
>
> I don't think you need to be embarrassed by this - to the contrary you
> solved a pretty unique and bizarre problem. I've been reading the SBS
> groups since 1998 and this is the first I've ever heard of this. Plus,
> maybe your client broke this themselves by playing with security permissions
> : -)
>
>
> "Jim Pollum" <JimPollum@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:6D3C59DF-8A53-4EF5-BEF9-F8CAFD7ECB49@xxxxxxxxxxxxxxxx
> > Yes, it is the System Event Log entry to which I am refering . However,
> > the
> > Eventlog service does reboot the server if it crashes, according to the
> > recovery tab under services. There is nothing scheduled for noon, and the
> > VSS
> > service is and has been disabled. There is nothing logged anywhere at
> > noon,
> > and I felt the problem has to do with this entry as it is the only entry
> > missing, and the only clue I have. Since I wrote the first time, I did
> > stumble across that when I save the Event Logs to the Administrator's "My
> > Documents", I can do so and then clear the events. If I try to clear the
> > events first and when it asks if I want to save the events first and say
> > yes,
> > it is unable to write the file. Researching Microsoft, they say that if I
> > save first, it uses the account I am using (Administrator). If you clear
> > the
> > events and save the files, it uses the System account. Looking at the
> > Administrator's "My Documents" directory, I found that the System account
> > was
> > omitted. I do not know how or why, since it used to work a couple of weeks
> > ago, but nonetheless, when I put the System account priveleges back on the
> > directory, it does not reboot at noon now. At least it has not since
> > Thursday
> > (it is now Saturday). Now I see that it reboots at 4:06AM. It did before,
> > but
> > I thought it was a dingle problem. I bet this is a scheduled event issue,
> > and
> > I will look into it Real Soon Now. I appreciate your help. I was getting
> > rather despirate becuase nothing I was investigating lead anywhere at all.
> > It
> > was embarrasing to say that after spending many hours diagnosing the
> > problem
> > to tell my customer that I had not a clue as to what was happening, other
> > than I "felt" that the 1 event had something to do with it.
> > Thanks again.
> >
> > "Dave Nickason [SBS MVP]" wrote:
> >
> >> The uptime information is logged to the System log at noon. However, I
> >> believe that the setting you're referring to applies to the Security
> >> log -
> >> that the server shuts down if it can't write to the log. If we're
> >> talking
> >> about the same thing, that would be a shutdown rather than a reboot, and
> >> wouldn't apply anyway since it doesn't apply to the System log.
> >>
> >> I'd be looking at any scheduled task that's set to run at noon. The only
> >> one I know of by default is a VSS shadow copy. Is there anything
> >> scheduled
> >> in an AV program or 3rd party backup? UPS management program? Anything
> >> logged in the Application log at the time it happens?
> >>
> >> If this is happening right at noon every day, IMO it's got to be
> >> something
> >> scheduled. Even a regular failure of some other kind wouldn't be
> >> happening
> >> exactly at the same time daily.
> >>
> >>
> >> "Jim Pollum" <JimPollum@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> >> news:BC6EE179-187F-470E-818B-7BD13A6CE2F4@xxxxxxxxxxxxxxxx
> >> >I have 1 SBS server that has decided to reboot everyday at noon. This
> >> >started
> >> > about 3 weeks ago. What little I have been able to figure out is that
> >> > at
> >> > noon
> >> > daily, there is normally an event entered in the system log that
> >> > informs
> >> > of
> >> > the system uptime (event ID: 6013). This is missing from this server,
> >> > and
> >> > I
> >> > believe is the cause of the reboot. The eventlog service is set to
> >> > reboot
> >> > the
> >> > computer is it fails as this is the default setting and no other
> >> > options
> >> > are
> >> > available. I believe the event log service is failing trying to write
> >> > this
> >> > entry and rebooting. However, I am not able to locate any more
> >> > information
> >> > as
> >> > to what service is enetering this event, or any other explanation for
> >> > this
> >> > anomaly. Any suggestions?
> >>
> >>
> >>
>
>
>
.
- References:
- Re: SBS 2K3 reboots at noon everyday
- From: Dave Nickason [SBS MVP]
- Re: SBS 2K3 reboots at noon everyday
- Prev by Date: RE: Routing and Remote Access restart problem
- Next by Date: RE: Can't set Local Security policies. They fail to save
- Previous by thread: Re: SBS 2K3 reboots at noon everyday
- Next by thread: Re: SP! installation woes
- Index(es):
Relevant Pages
|
