Windows Server keeps rebooting
Hi,
Our Windows Server keeps rebooting usually at least once a day, usually around 8:00am to 9:00am and I have no idea why. Upon logging in to it again, I get the shutdown event tracker asking why the computer shut down unexpectedly - so I suspect that it may be getting a blue screen.
The server is a domain controller and Exchange 2007 server (among other roles).
I have looked in the Scheduled Tasks to see if there is anything around that time that may be causing it to crash or reboot, and found nothing. I have looked in the event viewer and found nothing of interest, although there does seem to be a few particular events that are always the last recorded events before it happens, albeit five to ten minutes beforehand.
The last recorded event in the System event log before each crash/reboot is an entry logged by the Service Control Manager and the description is either "The WinHTTP Web Proxy Auto-Discovery Service service entered the running state." or "The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state." (both of these have event IDs 7036) These give me no clue whatsoever because these events occur at plenty of other times throughout the night and day.
In the Application event log, I also find no clues. The last recorded event before each time differs. One time the last recorded event is just our spam blocker logging the fact that it blocked a spam message destined to a particular recipient. Two times the last recorded Application event is from MSExchange ActiveSync, event ID 1040, the description of which begins with "The average of the most recent [317] heartbeat intervals used by clients is less than or equal to [540].....". Another time the last recorded event is from MSExchange ADAccess, event ID 2080, the description for this one begins with "Process MAD.EXE (PID=4848). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
(Server name | Roles | Enabled | ..."
I've got no idea what's going on.
Our Windows Server keeps rebooting usually at least once a day, usually around 8:00am to 9:00am and I have no idea why. Upon logging in to it again, I get the shutdown event tracker asking why the computer shut down unexpectedly - so I suspect that it may be getting a blue screen.
The server is a domain controller and Exchange 2007 server (among other roles).
I have looked in the Scheduled Tasks to see if there is anything around that time that may be causing it to crash or reboot, and found nothing. I have looked in the event viewer and found nothing of interest, although there does seem to be a few particular events that are always the last recorded events before it happens, albeit five to ten minutes beforehand.
The last recorded event in the System event log before each crash/reboot is an entry logged by the Service Control Manager and the description is either "The WinHTTP Web Proxy Auto-Discovery Service service entered the running state." or "The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state." (both of these have event IDs 7036) These give me no clue whatsoever because these events occur at plenty of other times throughout the night and day.
In the Application event log, I also find no clues. The last recorded event before each time differs. One time the last recorded event is just our spam blocker logging the fact that it blocked a spam message destined to a particular recipient. Two times the last recorded Application event is from MSExchange ActiveSync, event ID 1040, the description of which begins with "The average of the most recent [317] heartbeat intervals used by clients is less than or equal to [540].....". Another time the last recorded event is from MSExchange ADAccess, event ID 2080, the description for this one begins with "Process MAD.EXE (PID=4848). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
(Server name | Roles | Enabled | ..."
I've got no idea what's going on.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
In Addition to the above advises, try to disable ASR (Automated System Restart). at least Auto restart might prevented and you might be able to see real time occurence of teh event.
regards,
regards,
ASKER
Actually, it just so happens that the UPS has started beeping and the replace battery light is lit up now. I'm going to plug it straight into the wall and see if it keeps happening.
ASKER
It turns out it was just the UPS. Odd that it would shut off the power just because the battery is dying, when it's still connected to the mains.
ASKER
I feel so dumb right now :)
2) Run Exchange BPA ( best practices analyzer )Also Baselin analyzer
8-9 AM is the busiest time for logins, so maybe it is related to that also.
How are resouces on the server ( RAM, CPU etc )
Have you run perfmon in log mode ?
I hope this helps !