ML370 Random Reboots!! 1

[snootalope]

Hello..

I got a Compaq Proliant ml370, which is the 1ghz processor, 1 gig of ram, and raid5. Running win2k server w/all the hotfixes and service packs and Citrix Metaframe XP..

The problem: It randomly reboots every day or every other few days on its own! There is absolutely no warning or error messages that help me.. It used to say that the system has rebooted from a bug check.. BUT I ALREADY REMOVED THE OPTION OF REBOOTING AFTER A BUG CHECK inside the comp properties, startup and recovery.. So, all the event viewer tells me is

The previous system shutdown at 4:55:13 PM on 6/23/2003 was unexpected.

..and that's it..

It's kind of interesting that, it's been doing it for about 6 months, it always seems to happen right before or at 5 p.m. and before we switched for daylight savings time it rebooted at or before 4 pm.. hhmmm.. interesting..
I've tryed almost everything I can think of except replacing hardware.. Has anyone ever heard of his before? Any Ideas?

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[ntinlin]

I've seen a lot of 'random' reboots happen on Citrix servers because of dodgy printer drivers.
My problem was exacerbated because my print server was on an NT4 box and one of the drivers was not truly W2K compliant. Replaced the driver and all was fine again. Well mostly.

See if you can work out who was logged on at the time, what were they doing. Maybe somebody is running a big process at exactly the same time each day which is causing the problem.

FR3/SP3 on XP also fixed quite a few problems.
Neill

 

[snootalope]

Thanks man..

I finally caught the blue screen before it went down last night!

it's a stop error:

IRQ_NOT_LESS_OR_EQUAL Address 8042CFSA at 80400000 Datestamp 3df90c0d ntoskrnl.exe

What the hell is that?!!?!?! I've been monitoring users who are on there for the past two months.. there's no pattern or anything out of the ordinary..

EXCEPT: One user proccess that is: IWAM_{SERVER NAME} running DLLHOST.EXE I can't find any trace of an IWAM system user.. thought that was weird..

Whats FR3/SP3 on XP ??

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[sg4me]

Snootalope,
My first question is, have you updated all the Compaq drivers and firmware? If not I would go ahead and update them.
My second question is this server hooked up to a KVM of some sorts? I have seen i8042prt errors on a few of my severs when the KVM was going bad. It is close but not exact so it may not be a cause.
Third is do you have modems hooked up to the server and if so what kind of multiport card are you using? I have experienced many bug checks and stop errors caused by mulitport boards.
Fourth is what Feature Release of Metaframe XP are you running if any? (By the way to answer your question FR3/SP3 is Feature Release 3 / Service Pack 3)
My last question has to do with the environment around the server. Is there anything around the server that would turn or off around 5pm (4pm daylight savings time)? I have seen electrical devices kick on or off and cause the power voltage to dip and crash systems.

Hope some of these ideas get you pointed in the right direction,
Ben

 

[snootalope]

first of all.. thanks for attention.. appreciate it!

1. Yep, all updates are installed!

2. Why yes, we do have a KVM.. A Tripp-Lite 8 port.. I would of never though of that being an issue.. Should I just unplugg it for a few nights and see what happens?? I will..

3. No modems.. But it does have ATI video, which I know has raised hell with servers in the past..

4. Looks like we're running Feature Release 2 Service Pack 2, that's what it says in add/remove programs.. and managment console..

5. I'm going to run around the servers right now and start hitting light switches, shredders, and all that stuff.. The server cabnit sits in a corner of our IT office, but there are a few people who sit right outside that corner..

Should I seriously look into the KV? hhmm..



"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[sg4me]

The KVM is possible but unlikely. But as the saying goes “Stranger things have happened.” I think the fact that it is happening at the same time almost every day would point to a scheduled task or something in the environment. I would check the event logs to see if there are any patterns of events before the reboot.

 

[snootalope]

beleive man.. I've been all over the event logs.. no pattern whats so ever..

I found that, in my device manager, ACPI Mulitprocessor PC is using ntoskrnl.exe as a driver.. In one of those articles is says it could be a system driver.. Is updating that specific device's driver possible? I've never updated a multiproccessor before..

Is ACPI processor even a canidate for this??



"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[julio007]

Look for brown outs as well.....u neva know.

 

[snootalope]

Brown out? what the hell is a brown out?

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[sg4me]

A brown out is what happens when the power voltage coming dips below the normal voltage. (i.e. 115v instead of the normal 120v) While this can cause a server to crash it is highly unlikely if the server is plugged into a UPS.
I have another question for you. Does the Compaq Integrated Management Log show any of the blue screen crashes? If so can you post one of them on here so we can take a look at it?

 

[snootalope]

um.. I can't seem to find the Compaq Integrated Management log.. You got any directions?

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me