• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 381
  • Last Modified:

[2003 server] Network drives are disconnected at random

I'm having some difficulty with our network environment.
The users are using two mapped network drives on a 2003 server (domain controller, single server environment).
Since a month or so the users are experiencing random disconnects from the server (W:\ is not accessible)

We're using a domain logon script for the users (xp clients)
it's called logon.vbs and has worked fine for quite a while (more than a year, but now we are getting problems on every workstation).

content of logon.vbs
=======================
Dim oNet, sUser
Set oNet = CreateObject("Wscript.Network")
sUser =oNet.UserName

oNet.MapNetworkDrive "M:", "\\server\data"
oNet.MapNetworkDrive "W:", "\\server\home"
=======================

When you wait for a few seconds and click on the drive again, everything is working again.
I've looked at the event viewer at the server and no errors occur.
Only on the security part of the event viewer acts on the disconnect.

I get 9 event occuring at the server within the minute a disconnect appears.

first is oldest (so the first to happen on or after the disconnect):
... Event   User ...
===================
... 540  ANONYMOUS LOGON ...
... 538  ANONYMOUS LOGON ...
... 540 {user name} ...
... 576  SYSTEM ...
... 540  SYSTEM ...
... 576  SYSTEM ...
... 540  SYSTEM ...
... 576  SYSTEM ...
... 540  SYSTEM ...
===================

After this, the drive has reconnected again.
Any idea anyone?
0
JeePeeTee
Asked:
JeePeeTee
  • 21
  • 14
1 Solution
 
MazaraatCommented:
Those are actually success events saying that the logoff/logon was successfull then the succesfull use of rights to access files/folders.  Do you have any other events before the disconnect?  It could be a wide range of possibilities....(NIC, switch, cable, software, too much traffic....etc)
0
 
MazaraatCommented:
Here is a relevent KB article, it explains how to modify the autodisconnect value.  Though I would first check my hardware to make sure its not something simple as the switch plugged into wall getting spikes....


http://support.microsoft.com/default.aspx?scid=kb;en-us;297684
0
 
JeePeeTeeAuthor Commented:
Hi Mazaraat, thanks for the fast reply...

The strange thing is that when we're using it from the sharename \\server\folder there are no problems at this point.
This rules out hardware as far as I can see.
0
Transaction-level recovery for Oracle database

Veeam Explore for Oracle delivers low RTOs and RPOs with agentless transaction log backup and transaction-level recovery of Oracle databases. You can restore the database to a precise point in time, even to a specific transaction.

 
JeePeeTeeAuthor Commented:
P.S. i've already tried the KB article forgot to mention that in my startpost.
Didn't help. No other events in the EV
0
 
MazaraatCommented:
Have you recently made any changes to DNS or how the workstations use netbios over TCPIP?  Do you have a WINS server?
0
 
JeePeeTeeAuthor Commented:
No changes have been made recently (that I can recall), no WINS server either...
0
 
MazaraatCommented:
Do you have netbois over tcpip enabled on the server and/or workstation NICs?
0
 
JeePeeTeeAuthor Commented:
Yes, it's enabled on both...
0
 
MazaraatCommented:
I had this very same issue and I'm wracking my brain for the fix....let me go through my notes and see if I can dig it up.
0
 
JeePeeTeeAuthor Commented:
Great, nice to hear this...
I'll keep my fingers crossed for the fix... ;-)
0
 
JeePeeTeeAuthor Commented:
Hi Mazaraat, got a fix for me already?
The problem keeps occuring...

Thanks in advance!
0
 
JeePeeTeeAuthor Commented:
:-( still searching for the fix on this issue, anyone?
0
 
MazaraatCommented:
sorry about nto responding faster, its been really hectic

I looked and can't find what I did to fix the issue.  I know it was related to network settings (dns/tcpip...).  how is your DNS setup?  can you post an ipconfig /all of the workstation and one from the server?
0
 
JeePeeTeeAuthor Commented:
Ok, here we go...

Workstation ipconfig /all:
=======================================================
Windows IP Configuration

        Host Name . . . . . . . . . . . . : PC131
        Primary Dns Suffix  . . . . . . . : domain.local
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : domain.local

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
        Physical Address. . . . . . . . . : 00-0F-FE-1D-C7-51
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.100.131
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.100.130
        DNS Servers . . . . . . . . . . . : 192.168.100.130
======================================================
Server:
   Host Name . . . . . . . . . . . . : server
   Primary Dns Suffix  . . . . . . . : domain.local
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes
   DNS Suffix Search List. . . . . . : domain.local

PPP adapter RAS Server (Dial In) Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
   Physical Address. . . . . . . . . : 00-53-45-00-00-00
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.100.90
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . :

Ethernet adapter Internet Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/100 Network Connection
   Physical Address. . . . . . . . . : 00-B0-D0-F0-8B-3F
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 82.204.11.76
   Subnet Mask . . . . . . . . . . . : 255.255.255.248
   Default Gateway . . . . . . . . . : 82.204.11.73
   NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
   Physical Address. . . . . . . . . : 00-B0-D0-F0-8B-40
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.100.130
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 192.168.100.130

======================================================

thanks again for the effort
0
 
MazaraatCommented:
OK, those look good.

1.  Do you have symantec(norton) antivirus or security client installed?  Any type of firewall product?  Is the XP firewall enabled?

2.  check you license usage on the server.

3.  Check the power settings on the XP workstation that they are using the power scheme 'always on" and the settings are 'never,never,never,never'
0
 
MazaraatCommented:
Is the 2003 server an SBS server or does it have ISA installed on it?
0
 
JeePeeTeeAuthor Commented:
Ok, here are the answers:

Yes, we do have symantec Antivirus 9.0 (both on server as on workstations).
I hope this is causing this because I was planning to change to NOD32 anyway in the future.

We don't have a firewall on our workstations and only our internet connection on the server is firewalled (with Visnetic Firewall).

License usage on the server is ok.
Power settings on the workstations are also ok, never, never, never ;-)
It's a 2003 standard edition and no isa is installed.

Hope this helps a bit. What's the reason for the specific question for Symantec? Is it such a bad product?
0
 
JeePeeTeeAuthor Commented:
If it helps anything, when I monitor the CPU usage, it's mostly on 100%. This is mostly because it's heavilly used by database engines like Microsoft SQL server and MySQL, but the strange thing is that a lot of the time the "system" process is taking up 99% of the cpu usage. This is strange because on other server this system process is a very small process. I've scanned for virusses/spyware/ etc. with different tools but that's not it.

We've already ordered another server because we've managed to bring this one to it's knees, so the problem will solve itself probably, but I would like to know the cause of the problem and the solution for it, because we still need this server for other usage than our main server

Current specs of the machine.

Intel 933 Mhz Poweredge 2550 rack server. 18 GB 15.000 RPM / 36 GB 10.000 RPM disks and 1500 MB memory.
Functions (5-10  concurrent users for most part):
Microsoft SQL 2000 Standard DB server
MySQL 5 DB server (slave setup)
MDaemon Pro 8 mailserver
ftp server (internall)
Domain controller
(and a lot more small stuff)
0
 
JeePeeTeeAuthor Commented:
P.S. i've replaced symantec antivirus for NOD32, this hasn't solved the problem...
0
 
MazaraatCommented:


seperate from your original problem, but may be causing issues if your system is too busy to answer/maintain the connections.
Is your SQL server configured for background or foreground applications/services?

control panel->system->advanced tab->settings->advanced tab

for SQl to run properly this should be set to -->'background services' (NOTprograms)
memory usage should be set for --> 'Programs' NOT system cache
virtual memory should have 2 files, one on the boot partition that is equal to the amount of RAM installed and the second should be on a sperate partition/drive that is equal to 1.5 times the RAM.


reboot server, did this make any difference in CPU usage???

if the system idle process is high thats ok....
0
 
JeePeeTeeAuthor Commented:
I've double checked for the "background services" and "programs" and these settings are (and were) correct.
I only had one swap file and that was on my second (d:) drive, it's size was 2,5 times the internal memory.
I've changed it to your suggestion, but I don't expect miracles from this, will keep you posted.

Can you explain to me why an additional swap file on the boot partition is best?

Thanks again!
0
 
MazaraatCommented:
In order for the system to do a proper crash log it requires the swap file to be on the boot partition....you also get a noticably better swap file performance if you can split it between drives (or partitions).

how many people are accessing the SQL?  what version of SQL are you using? (msde,standar,enterprise, mysql?)
0
 
JeePeeTeeAuthor Commented:
...addition: it's not the "system idle" process but the "system" process.
0
 
JeePeeTeeAuthor Commented:
...addition: it's not the "system idle" process but the "system" process.
0
 
MazaraatCommented:
If your system process is running that high, something is not right...it should never run consistently at 99% like that.  Is it that high all the time or only when the users are online accessign the server and SQL (daytime)?  
0
 
JeePeeTeeAuthor Commented:
Ok, thanks for the response. I've changed the swap part but reboot is required and not yet possible.

As mentioned above it's a Microsoft SQL 2000 standard edition serving 5 to 10 clients (more 5 then 10).
0
 
MazaraatCommented:
hmm, thats not enough users to tax it like that.  Something is running the system process up.  Do you have any applications installed on the server besides the ones listed above?
0
 
JeePeeTeeAuthor Commented:
The "system" process is having peeks, it's good (0-5% usage) for a minute and then it's 100% again for a minute. When it's not up to 100% other processes take up most (65-75%) of the CPU time (SQL server, MySQL, MDaemon etc.)
0
 
JeePeeTeeAuthor Commented:
applications installed and running at the moment:

Microsoft SQL server 2000 standard (+/- 2GB compressed DB size)
MySQL 5.0 (+/- 1GB compressed DB size)
Alt-N MDaemon mailserver (+/- 1GB total mailbox size split over 10 users)
Alt-N Relayfax faxserver (not doing anything 99% of the time)
Veritas backup exec 9 (only running after 23:00)
NOD32 2.5 antivirus Enterprise
ServU ftp 6.1
Deerfield Visnetic Firewall 2.2.6
Windows 2003 active directory/domain controller/dns/routing and remote access
0
 
MazaraatCommented:
heheh, thats packing it in =) Tonight (or when you ahve time) disable or stop each of those one at a time to find which is causing the system process to be so high.  If none of them affect the system process's high cpu usage then we will have to dig deeper.
0
 
JeePeeTeeAuthor Commented:
Ok, will do I'll keep you posted...
0
 
JeePeeTeeAuthor Commented:
Here's one update but I can't imagine this is the problem.
I've installed the Dell Openmanage to find out if the status of all the hardware was correct becaus I found out that the status light was blinking orange.

Everything is ok and checked except for the Mainboard battery it's critically low. It's 0.9 Volts and should be above 2.4 Volts.
I don't thinks this is related but wanted to mention it anyway.

Update for the rest is sceduled for the weekend.
0
 
MazaraatCommented:
I don't think its related either...but good to know so you can replace it soon =)
0
 
JeePeeTeeAuthor Commented:
:-), obviously
0
 
JeePeeTeeAuthor Commented:
Update: Because we also decided to upgrade the server to a new one i'm going to clean this one and reinstall full.
This will most likely solve this problem. Thanks for the time anyway....
0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

  • 21
  • 14
Tackle projects and never again get stuck behind a technical roadblock.
Join Now