2003 Server Crashing at Night

[nervous2]

Often I log into my Server 2003 in the mornings only to see a message upon login at the Server had been restarted unexpectedly in which it then gives me an opportunity to put in a reason, and each time I put "didn't know it went down"

Now I'm trying to determine the cause and I'm assuming in event viewer I may be able to figure this out, there is no stop errors reported but I'm not sure what and where to look for would anyone have any tips they can give me to resolve this?

 

[Roadki11]

Did you check your scheduled tasks for an auto reboot job running at night?

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[JackOfSomeTrades]

Auto reboot is unlikey, as this would be a graceful shutdown, and not give the 'unexpected shutdown' error.

Its usually (in my experience) Hardware related - CPU increase due to a Backup or such... or RAM for a similar reason. This would indicate a hardware fault.

You will see in the System log an Error stating the Last Shutdown was Unexpected - followed by 2 Log entries which state the OS Build and Version and the Eventlog having started - this of course is the machine booting up.

You have to back track from this time (remember to note the time, and check the Application Log too), to work out what went on.
9 times out of 10 you'll have nothing after, say, 21:00, then it will have suffered an unexpected shutdown at 03:00 - which is no help at all... But sometimes you might be in luck!

Also, under 'Recover' - System Properties somewhere - untick the 'reboot on Stop error' - your server will remain down, but at least you should have the Blue Screen error telling you why it failed - or what failed. Its not always the culprit, but may point you in the direction of what is causing it...

What machine is it? an decent HP? and Dell? something you can run diags on - they usually report all is well... but you never know...

Good luck!!!

Cheers, Mark

 

[mdcr1]

Do Automatic Updates sometimes cause this? We've seen before where a server that is set to receive updates automatically will get a security update (or some update that is critical?) and in the morning, it will say it unexpectedly shut down. We would prefer that not to happen, but we know something happened because after logging in, that little baloon comes up in the bottom right corner of the screen saying "an important update was applied, click here for more info" or something else like that...

 

[nervous2]

Thank You for the assistance, interesting enough when I tried to log in to read the logs I was prompted with another crash again the problem is I don't' know why. This is a remote server, I physically don't have access to it. I stated the reason for the shutdown and it is displayed in the event viewer BUT the problem is that it displays the event at the time of when I put in the reason, so if the event occured 3 hours ago and I only noticed this now then then recorded log shows the time when I entered in the reason.


I have checked the scheduled tasks and there is no tasks running. I will install hardware monitoring software tonight such as qfan to give read me some temperatures, hopefully I can log them It could be my live update or BU exec it's hard to figure this one out as it's remote and it's sporadic

 

[rwogs]

I had the same problem with my SBS 2003 R2 server (Old dell poweredge 6400) and the problem was caused by a virus that avoided initial detection and then would repeatedly try and break into the server as an administrator causing thousands of entries in the system event log. This would cause the server to unexpectedly shutdown almost every night. Eventually removed it with trend Micro's "worry free business security". No problems since then.

 

[cmeagan656]

Is the remote server behind a locked door with it's own power supply? If not, I've seen janitors and other maintenance crews unplug the server to plug in their equipment or to make it easy for them to vacuum or work around it.

Hope this helps.

Please help us help you. Read Tek-Tips posting polices before posting.
Canadian members check out Tek-Tips in Canada for socializing, networking, and anything non-technical.

 

[technome]

Electric utilities do there power switching during the early morning hours, 1-5 am. If the UPS battery is marginal, sometimes the switching causes server roll over. If you have a VOHM with a peak hold button, positive/negative probes in the outlet, over night, will tell you the lowest/highest voltage reading during the period.


........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm