[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Another saga with Windows 2003 Server Event ID 333

Posted on 2011-10-20
8
Medium Priority
?
449 Views
Last Modified: 2012-05-12
After having a mrror set fail and replacing the bad drive, the other good one failed, too. Now the server has developed a frustrating habit. After a day or two of uptime, the system will stall with error msg, "Insuffcient resources exist for the requested service", requiring a restart. Two odd things: first, the shutdown dialog box never retains the reason I select for the restart. On restart. I'm required to give the reason for shutdown again. Second, restart requires a hard reboot. Unless I shut off the power completely, the restart will not proceed beyond the MB BIOS logo. Otherwise, the restart is normal and uptime is normal for a day or two. System Event Log shows that prior to the stall, there is a series of Event ID 333 's, lasting hours. Task manager shows the memory allotment of a process, (usually IE or Outlook- something left open to internet), climbing to 5 and6 times normal. I can't tell if this is a hardware issue or software issue. Any thoughts on which, and how to fix this?   Thanks for any help.
0
Comment
Question by:PCGenieLA
  • 4
  • 2
  • 2
8 Comments
 
LVL 11

Expert Comment

by:itguy565
ID: 37004830
If your system is using that much of your system resources there is a very good chance that you have a virus or some other type of malware, I would suggest downloading and installing malwarebytes for www.malwarebytes,org and running a full scan.

There are very few reasons that you would see outlook among other internet processes using extremely high system resources.

If malwarebytes comes up clean run a root kit scanner and attempt to find what is masking it. There should be no reason why your system would use that amount of system resources in 2 days.
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 37004953
The symptoms you describe point towards a hardware fault of some kind. What is the server? How old? how much ram?

Run some diagnostics software, memory check, built in server diagnostics etc.
0
 

Author Comment

by:PCGenieLA
ID: 37030996
Sorry to take so long to reply. I've spent several days trying to track down any rootkits. I've tried four different anti-rootkits, including one that crashed the system with a BSOD. All to no avail. The symtoms remain the same. The process starts with a series of Events ID 333: "An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry." once a minute for several hours, with occasional Event ID #2019. The fact that I have to physically shut off the power to  get the computer on restart to advance beyond POST screen and the fact the sometimes one of the hard drive of a mirror set shows up in POST as 0 GB and SATA I ( not II as do  the others) makes me wonder if we have a hardware issue. Any opinions?? If it's hardware, know any good hardware dianostics for Win2k3 R2 32 bit, running on AMD 64 chip?
0
Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.

 
LVL 37

Expert Comment

by:Neil Russell
ID: 37031099
Well like i commented 5 days ago, Sounds more like a physical hardware problem to me.

If you have a disk that is reporting wrong then thats where I would start. Break the mirror and run without that drive for a time, unless you happen to have on you can replace with now.
0
 

Author Comment

by:PCGenieLA
ID: 37048150
OK, I've tried the hardware approach. I took out the harddisk that was giving the error msg. But no diffference! Except one. The event log still shows a series of Event ID# 333, once a minute, beginning about 27 hours after reboot, still ending with a "Insfficient Resources..." msg and the system stalling. The only difference this time was a series of Event ID 11 (The driver detected a controller error on \Device\Harddisk5.) pointing to hardisk3,4,5, and 6. I determined that these are all slots in a usb card reader. Unplugging it, stopped the msgs, but that was two hours before the 333's began. Is it the MB controller that's gone bad?
0
 
LVL 11

Expert Comment

by:itguy565
ID: 37157009
PCGenie,

I honestly don't know it is possible that you have a controller that is going bad, However it doesn't make since that this would be the case. If your controller goes bad you are going to see ALOT more event log entries than what you are describing and they would be different entries.
0
 

Accepted Solution

by:
PCGenieLA earned 0 total points
ID: 37157613
Well, I finally found the problem with assistance from Microsoft @ $249 per call. It seems that after installing PoolMon and Perfmon utilities, it was determined that a corrupted driver was eating memory. The driver was USR0, for a U.S. Robotics fax modem I did not even use. Once it was disabled, all the error msgs in Event Log stopped. The server is functioning just fine now. Who knew??
0
 

Author Closing Comment

by:PCGenieLA
ID: 37175803
Thanks for trying to help.
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Usually shares are where we want them for our users and we tend to take them for granted. There are times, however, when those shares may disappear causing difficulty for your users. One of the first things to try is searching for files that shou…
Backups and Disaster RecoveryIn this post, we’ll look at strategies for backups and disaster recovery.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…
Suggested Courses

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question