Re: SBS Server keeps shutting down

Probably not the UPS/Power
as we have had a few power cuts recently and the server kept chugging along.
The UPS is supposed to keep out brown electricity and is also
connected to a surge protected socket so that should be ok.

We are in the uk so have no need for airconditioning and there are
no manufacturing plants left!

thanks

jc


"Larry Struckmeyer [SBS MVP]" <lstruckmeyer@xxxxxxxxxxxxxxx> wrote in
message news:OJTWycV1JHA.6056@xxxxxxxxxxxxxxxxxxxxxxx
Hi:

My first thought is "what happens at that hour of the morning, and has it
changed?". For example, in Florida, where I live, this could be the
result of the central air conditioning kicking in and pulling the power
down below a safe load, causing sensitive equipment to power down. Or
maybe the really big manufacturing plant down the street changed their
shift hours and the entire plant comes on line at that time, pulling the
power down for the entire neighborhood.

The fact that one of the systems on the UPS powers off and the other does
not is suggestive but not definitive. The SBS hardware could simply be
more sensitive to the supply. Or worse, and I have seen this, the UPS is
split between surge and battery, and one device is plugged into surge
only, the other into battery. Worse still, someone bypassed the UPS and
plugged the SBS directly into the surge protector or the wall outlet.

"Trust, but verify."


--
Larry
Please post the resolution to your
issue so that others may benefit.


"Jonathan Crawford" <jc@xxxxxxxxxxxxxxx> wrote in message
news:%230S4ogU1JHA.4416@xxxxxxxxxxxxxxxxxxxxxxx
Hi Cliff

Thanks for your reply which I rerlly appreciate.
I am not a systems person so please forgive my stupidity.

I shall go through your points as best as I can
1) You mention that the logs indicate "nothing unusual." But when
windows shuts down *properly* it logs it (including reasons if you fill
them out in the dialog box.) You've given no indication if a shutdown
event is recorded or if the server is "freezing" and found in a powered
off state.

When I go to the server in the morning it is dead as far as I can tell.
The power light is green, but the other light that indicates it is on is
off.
The monitor is blank and no amount of bashing down on the key brings it
to life.
I switch the machine on by pressing the On button and it starts. It then
starts and eventually comes up with the "unexpected shutdown" and I have
to enter why this happens. "
I always put "No idea". I then go to the system log (control panel/admin
tools/computer management)
and check and there is no shut down evnet but on the restart there is a
message
Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date: 15/05/2009
Time: 06:54:45
User: N/A
Computer: ROMULUS
Description:
The previous system shutdown at 04:24:31 on 15/05/2009 was unexpected.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: d9 07 05 00 05 00 0f 00 Ù.......
0008: 04 00 18 00 1f 00 28 01 ......(.
0010: d9 07 05 00 05 00 0f 00 Ù.......
0018: 03 00 18 00 1f 00 28 01 ......(.

2) You checked scheduled tasks, which would imply that you think
something is issuing a shutdown command. This is every different than a
server that is just powering off unexpectedly. Does the OS complain
when it is brought back up about being powered down improperly? What
made you think to check scheduled tasks?

Only the fact that all the shut downs occurred betwen 4am and 5 am which
perhaps suggested
some kind of schedule. I thought perhaps is antivirus was running a scan
at that time it might be the culprit.
It is not.

3) Why do you think IPSec was blocking traffic? Have you enabled IPSec
(it isn't by default.) What logs/events led you to the conclusion that
the problem was IPSec related and not, say for example, a failing NIC.
If the NIC has a physical short, that could be causing all sorts of
electrical problems on the server...
I have no idea what IPSec is (though I would guess at IP Security)
I figured that it was the cause of no machine accessign the network
or the internet due to the following message in the system log

"The IPSec driver has entered Block mode. IPSec will discard all inbound
and outbound TCP/IP network traffic that is not permitted by boot-time
IPSec Policy exemptions. User Action: To restore full unsecured TCP/IP
connectivity, disable the IPSec services, and then restart the computer.
For detailed troubleshooting information, review the events in the
Security event log."
Can't find anything in the security event log though not sure what i am
looing for
After five reboots or so, this stopped happening and connectivity was
restored.
Have no idea why.

4) Why did you keep rebooting the server with the IPSec problem? The
definition of insanity is doing the same thing repeatedly and expecting
a different result.
Ok, I have been around computers for a long time and have given up
expecting
them to behave logically or consistently. I know from experience that
sometimes turning them on and off again
does work. I have had to do it with this SBS a couple of times over the
last few years.
Anyway, it is 6 in the morning an i don't know what i am doing and
certainly don't want to
mess around with IPSec on my own and I can't work so what else is there
to do!
You have to trust me it did work and I got my network.
As for worrying about it, I do, because the whole business hangs on this,
so I have doubly checked our backup/recovery processes are working
correctly
as that is in my hands.

5) What makes you think the IPSec issue and the power issue *could* be
related? That seems like an odd leap, except when taken with the
multiple reboot mentioned above and some other troubleshooting steps
that led you to the IPSec conclusion in the first place. Perhaps the
two are related...but you've probably extrapolated that idea from
information you haven't properly (or at all) conveyed here.

I suspect that the issues are unrelated and debated with myself whether
to mention
the IPSEC issue or not (Curiously, exposing myself as insane and
complacent was
not part of that debate!) as it happened in only one of the four
shutdowns.
However as it was the only error in the system log (apart from the
unexpected reboot)
I thought it may be useful

I can also add that it shares a redundant power supply with another
machine which remained on
so was not a power issue (unless it is the machines powere unit faulting
though why only at 4am)

We have AVG antivirus for Server 2003 and it is uptodate and scans are
clean

Hope I have been clearer.

thanks

jc



"Cliff Galiher" <cgaliher@xxxxxxxxx> wrote in message
news:ekA1I5S1JHA.3780@xxxxxxxxxxxxxxxxxxxxxxx
I think it would be beneficial to know more about what troubleshooting
you've done and what has led you to draw the conclusions you have. I
feel like you really didn't paint an accurate picture of what is
*actually* occurring. I realize that this statement comes across
accusatory and I assure you that this is not my intention...but there
*are* significant leaps of logic here and gaps as well. So, in no
particular order, these are the thoughts that ran through my head when
reading your post. Please note that answering these/addressing these is
by no means exhaustive...and would likely just lead to more
questions....so it'd be better if you start from the beginning and just
tell us *EVERYTHING*....but at least by reading my list you can see *WHY*
I am as confused as I am.

1) You mention that the logs indicate "nothing unusual." But when
windows shuts down *properly* it logs it (including reasons if you fill
them out in the dialog box.) You've given no indication if a shutdown
event is recorded or if the server is "freezing" and found in a powered
off state.

2) You checked scheduled tasks, which would imply that you think
something is issuing a shutdown command. This is every different than a
server that is just powering off unexpectedly. Does the OS complain
when it is brought back up about being powered down improperly? What
made you think to check scheduled tasks?

3) Why do you think IPSec was blocking traffic? Have you enabled IPSec
(it isn't by default.) What logs/events led you to the conclusion that
the problem was IPSec related and not, say for example, a failing NIC.
If the NIC has a physical short, that could be causing all sorts of
electrical problems on the server...

4) Why did you keep rebooting the server with the IPSec problem? The
definition of insanity is doing the same thing repeatedly and expecting
a different result. If IPSec was interfering with your network after
reboot #2, why repeat? What *else* were you changing to change the
result? Did it *REALLY* just fix itself with no intervention?!? Even
if your server WASN'T shutting down, that is cause for SERIOUS
concern!!! You've not indicated what fixed this issue and seem not
particularly concerned if it, indeed, seemed to magically fix itself
after MUTLIPLE reboots failed to fix it (one reboot fixes a lot of
things...but multiple ones don't.)

5) What makes you think the IPSec issue and the power issue *could* be
related? That seems like an odd leap, except when taken with the
multiple reboot mentioned above and some other troubleshooting steps
that led you to the IPSec conclusion in the first place. Perhaps the
two are related...but you've probably extrapolated that idea from
information you haven't properly (or at all) conveyed here.

I guess what I'm saying is that it sounds like you have a *LOT* of stuff
going on....and as helpful as many folks here can be....nobody is
psychic and I feel like there are just way too many moving parts and
missing pieces to see the entire puzzle.

-Cliff



"Jonathan Crawford" <jc@xxxxxxxxxxxxxxx> wrote in message
news:#MpY$SS1JHA.1900@xxxxxxxxxxxxxxxxxxxxxxx
Hi

Our SBS server has shut down unexpecedly between 4am and 5am
and not restarted on four of the last six days.

I have checked the event logs (system and application)
and they record nothing within 5 minutes of the shutdown
and don't indicate any problems around that time
I have also checked scheduled tasks and have nothing running at that
time either.

One time on the restart IPSec was blocking all IP trafffic which wasn't
fun,
but after about five reboots it let the world in. Don't know if this is
connected or not.

Bit of a loss what to do about it

Any advice appreciated

thanks

jc







.