Frequent restarts 3

[kleinicus]

Perhaps this is just a normal Windows thing we'll always have to deal with, but I figured I should ask.

We have 8 Windows servers, 4 2000 and 4 2003. There are 2 DC's, one file/print server, 1 Exchange server, 2 web/ftp servers, a database server, and an RRAS/Certificate server. Some of the servers need to be rebooted about every 2-3 weeks. Not all of them at the same time, of course, but that's the average amount of time they last. What happens is the LanMan service fails. When it does, I try to go to the Services to restart the service, but the Services window won't open. RPC fails each time. There's nothing else to do but restart the server.

To try and prevent this, I've implemented automatic weekly reboots. I'll try that for a month or so, but I'm wondering if this is part of a larger problem. It doesn't do it on all of the servers. The DC's never need to be rebooted, and the Exchange server and database server don't much either. The big ones are the web servers and the file/print server.

Anyone have any general advice to offer?

 

[Niksen]

Hows your patch level on these servers ? theres some vulnerabilities involving lanman out there that could make the lanman service stop. keep run windows update till exausted.
also check if you run any print related stuff on the servers, and if so, try remove it.

You might wanna try this tool from sysinternals:

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

(download link at the buttom)
run it before and after problem arises and compare.

bst rgds

 

[technome]

Niksen's idea is good

Possible memory leak..
Are the resident programs the same on all the machines. What is different? Remove all unecessay resident programs.
Check for malware, in safe mode. Run anti virus scan.

Print screen the taskmanager process screen, and save, shorted by memory usage (descending) every few days, after a restart.
If you have two exact machines, one OK the other with the problem, print screen both machines. Compare the useage over time. Memory useage should peak at some point, and stabilize, hitting peak useage. Look through the processes on a "good" machine and a "bad" machine, for differences.

Do you have the bios levels the same, couple of times bios updates have correct such a problem.

Instead of rebooting you might try a scheduled task which would stop and restart services which are created by resident programs which you have installed, late at night such as backup programs like Backup Exec, NIc managers, Video card snapins, ect. Have a task scheduler stop them for 30 seconds and another restart them.. many times a program once stopped will release "stolen" memory. Had the with Veritas software a few times, I would run the task at 5 am on Sundays

 

[kleinicus]

Thanks for the info, both of you. I'll give Windows updates a try first.

 

[ITPangaeaArchitect]

sounds viral really

i would grab a perfmon if issue persists

see if you can identify anything leaking

also, if you cant open teh services window, what happens if you run net start lanmanserver (or workstation whichever your prob is with)...does it fail? with what error?

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[kleinicus]

I doubt that we have a virus. We have McAfee 8.0i and we have an ePO server that manages the dat files for all the clients. I guess it's possible, but I don't think it's very likely.

I haven't tried restarting the lanman service manually. But I will if it happens again after the windows updates.

I would consider using perfmon, but I don't think I would be able to identify a memory leak if I saw it. Any tutorials regarding memory leak detection out there?

Thanks.

 

[zoeythecat]

You should also check your Event Viewer messages. Your event viewer (I.E. System and Application logs) at the point of failure should give you some messages you may be able to research on Microsofts knowledgebase. Just trying to add my 2 cents here.

 

[ITPangaeaArchitect]

just check your run key and running processes...look for anything out of place. if nothing in those then you're ok on that.



-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[kleinicus]

Cool. Thanks to everyone who helped here.