Eventlog error, source Srv, ID 2000, fills the System event log and degrades server performance
The scenario:
I have a server running Windows 2003 Server R2 Enterprise (32-bit) with a fully-patched SP2, acting exclusively as a large file server, connected to a decent-sized Lefthand SAN. The Windows components installed include DFS, File Server Management, Storage Manager for SAN. Installed applications include Dell OpenManage, LeftHand Centralized Management Console and SAN/iQ DSM for MPIO, .NET 2.0 and 3.0 + SP1, and Sophos Anti-Virus. The hardware is a Dell PowerEdge 1850 (Dual dual-core CPU x 3GHz, 4GB RAM) with dual Intel PRO/1000 MT NICs. This server is acting as a central file server and hosting 10 DFS roots that get significant use, and that is it's only role.
The server periodically starts generating error events in the system event log. When it begins generating errors, it generates dozens to hundreds per second and filled the event log in well under a minute. The only event generated is:
Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2000
User: N/A
Description:
The server's call to a system service failed unexpectedly.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00040000 00540001 00000000 c00007d0
0010: 00000000 c000010a 00000000 00000000
0020: 00000000 00000000 00bd0334
Once this error begins generating, server performance is degraded noticeably, but network services remain available.
I have already dug through at least a dozen links I found through Google, to no avail. I have already looked through EventID, the error code is not listed and potential suggestions listed did not help. The possible causes I have found elsewhere include removing Windows patches, which don't exist individually with SP2 installed. I have already checked the possible solution relating to both shared printers and DNS, and neither are the case, nor is Cheyenne Open File anything. Rebooting fixes the problem for a little while, but this server is a center-point for files on a global scale so reboots don't go over very well. The only thing I can think of that has not been done is re-installing SP2, which is not allowed until this weekend at the earliest due to the down time required (5-10 minutes downtime for a reboot requires blood). I will happily provide any and all additional information if it leads to a permanent fix to this issue.
Thanks in advance.
I have a server running Windows 2003 Server R2 Enterprise (32-bit) with a fully-patched SP2, acting exclusively as a large file server, connected to a decent-sized Lefthand SAN. The Windows components installed include DFS, File Server Management, Storage Manager for SAN. Installed applications include Dell OpenManage, LeftHand Centralized Management Console and SAN/iQ DSM for MPIO, .NET 2.0 and 3.0 + SP1, and Sophos Anti-Virus. The hardware is a Dell PowerEdge 1850 (Dual dual-core CPU x 3GHz, 4GB RAM) with dual Intel PRO/1000 MT NICs. This server is acting as a central file server and hosting 10 DFS roots that get significant use, and that is it's only role.
The server periodically starts generating error events in the system event log. When it begins generating errors, it generates dozens to hundreds per second and filled the event log in well under a minute. The only event generated is:
Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2000
User: N/A
Description:
The server's call to a system service failed unexpectedly.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00040000 00540001 00000000 c00007d0
0010: 00000000 c000010a 00000000 00000000
0020: 00000000 00000000 00bd0334
Once this error begins generating, server performance is degraded noticeably, but network services remain available.
I have already dug through at least a dozen links I found through Google, to no avail. I have already looked through EventID, the error code is not listed and potential suggestions listed did not help. The possible causes I have found elsewhere include removing Windows patches, which don't exist individually with SP2 installed. I have already checked the possible solution relating to both shared printers and DNS, and neither are the case, nor is Cheyenne Open File anything. Rebooting fixes the problem for a little while, but this server is a center-point for files on a global scale so reboots don't go over very well. The only thing I can think of that has not been done is re-installing SP2, which is not allowed until this weekend at the earliest due to the down time required (5-10 minutes downtime for a reboot requires blood). I will happily provide any and all additional information if it leads to a permanent fix to this issue.
Thanks in advance.
ASKER
Hi Phishman,
I have been given the go-ahead to re-install SP2 on Sunday November 9th, so I will let you know after that. Until then, I'm only allowed to simply reboot the server because of the down time needed (it happened again on the 22nd).
I have been given the go-ahead to re-install SP2 on Sunday November 9th, so I will let you know after that. Until then, I'm only allowed to simply reboot the server because of the down time needed (it happened again on the 22nd).
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
After the last reboot roughly two weeks ago the error has not returned, but SP2 has not been re-installed (or any other changes). I guess you'll get the points, phisman1000, since you're the only one that tried to help. A disappointing EE question, to say the least.
Tick1231,
thanks for the points but I don't really deserve them since i'm in the same boat,
you could always as for a refund of points you will not get a arguement from me
glad things are working better so far after the reboot
Phisman out ;-)
thanks for the points but I don't really deserve them since i'm in the same boat,
you could always as for a refund of points you will not get a arguement from me
glad things are working better so far after the reboot
Phisman out ;-)
Did either of you ever resolve this issue? I have the same issue, somebody suggested that it may be related to my backup software, arcserve IT 11.5
Cheers,
Andy
Cheers,
Andy
andy,
my original thought it was caused by our Anti-virus (Norton Corporate 10) we updated to Norton 11 and all was right for about a month and now the 2000 error can back, we also use something called Repli - Store to replicate to a contigency box overnight but we have this for many different servers and this particular box is the only one that has issues. we also have custom apps so the Developers are looking into it to make sure its not the apps themselves causing the problems
i'm not an admin on this box i just have admin rights to our Apps on them
you might want to post a new question with your Specs and maybe someone has an answer and similair situaton.
good luck
Phishman out
my original thought it was caused by our Anti-virus (Norton Corporate 10) we updated to Norton 11 and all was right for about a month and now the 2000 error can back, we also use something called Repli - Store to replicate to a contigency box overnight but we have this for many different servers and this particular box is the only one that has issues. we also have custom apps so the Developers are looking into it to make sure its not the apps themselves causing the problems
i'm not an admin on this box i just have admin rights to our Apps on them
you might want to post a new question with your Specs and maybe someone has an answer and similair situaton.
good luck
Phishman out
ASKER
Unfortunately I did not find a conclusive fix to this either. I was finally able to install the latest Windows patches/security updates (including SP2) and the issue has not returned, but I can't really say this is a conclusive fix. This kind of "fix" seems a short step away from fixing an error by replacing the computer. Sorry.
Posible solution - I started having the exact same issue yesterday. Any time I would reboot the server everything would seem to be ok, but after 20 or 30 minutes (with more and more users accessing the server) I would get the srv 2000 errors in the event log and everything would slow to a crawl on the network and server. It would never stay up for more than 30 minutes while users were accessing it. Overnight, the server opperated fine with no errors, but as soon as the employees would get in, it would lock up by 8:15am.
I ended up replacing the NIC in the server and so far have had no issues. It's only been a couple of hours, but I'll report back later for an update.
- Wilkox
I ended up replacing the NIC in the server and so far have had no issues. It's only been a couple of hours, but I'll report back later for an update.
- Wilkox
did reinstalling SP2 help? i'm having the same issues again. W3K sp2 we use it as an app server IBM 2X duel core as well. we uninstaledl the version of Symantec and reinstalled and that helped for about 2 months and now back in the same boat
thanks
phishman out