I've joined as system admin from desktop support and we have SCOM monitoring our servers. Critical alerts are reported to us via SMS to our mobiles.
Two weeks ago we got a Network File Access sms because the dhcp service on the File/Print cluster was stopped and started by a admin account called "xadmin" (exchange admin).
I checked the event log and this has been happening on/off since OCt 2007.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 1/28/2008
Time: 6:56:49 PM
User: company\xadmin
Computer: companyCL1N2
Description:
The DHCP Client service was successfully sent a stop control.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 1/28/2008
Time: 6:56:52 PM
User: company\xadmin
Computer: companyCL1N2
Description:
The DHCP Client service was successfully sent a start control.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 1/28/2008
Time: 7:42:38 PM
User: company\xadmin
Computer: companyCL1N2
Description:
The WinHTTP Web Proxy Auto-Discovery Service service was successfully sent a start control.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 1/28/2008
Time: 7:43:28 PM
User: company\xadmin
Computer: companyCL1N2
Description:
The Backup Exec Remote Agent for Windows Servers service was successfully sent a start control.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
What could be the reason? Manual ip set on this cluster all the time - no dhcp ip provided to it.
