Avatar of mgerwelAF
mgerwelAF asked on

Exchange Server 2007 Unexpected Shutdown Issues

I recently performed some MS updates on my Exchange Server 2007 (Windows Server 2008 Std x64) which caused the server to not boot back up.  I uninstalled these updates and after finally renaming the pending.xml file I was able to get the server back up and running.
Since this time the server goes through unexpected reboots throughout the day (every 2-3 hours) and all I can find in the System Even Log is EventId 6008 - unexpected shutdown.  This seems to occur only between 9am-5pm and overnight the server runs great with no reboots.  I am wondering if there is some kind of load once a number of users log into their emails that causes this or if there could be a corrupt user that once they login this happens.  Any ideas or insight would really help as I lose email for about 10min a time 3-4 times daily right now.
If you require additional information please let me know.
ExchangeWindows Server 2008

Avatar of undefined
Last Comment
Pradeep Dubey

8/22/2022 - Mon
strivoli

Please disable the default automatic reboot feature (if you are near the server during the day). Once it happens you should notice it quite immediately (users calling for help). Move to the server's console and write down what's reported on the BSOD.
Please post what you have written down.
ASKER
mgerwelAF

Disabled the option .. will wait for a shutdown and post back the result.
Pradeep Dubey

you get event 6008, is there any other information with this event ( copy the event and post here).

Did you check the event log just before the reboot ? any warning/error?

check the pagefile settings ( if they are not correct you will not get the memory dump).

In the OS drive make sure you have much free space to create the dump.

Mini dump will not help you every time.
Your help has saved me hundreds of hours of internet surfing.
fblack61
ASKER
mgerwelAF

Details of event 6008 are below and there are no event logs just before the reboot:

"The previous system shutdown at 9:27:25 AM on 8/27/2013 was unexpected."

Details:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="EventLog" />
  <EventID Qualifiers="32768">6008</EventID>
  <Level>2</Level>
  <Task>0</Task>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2013-08-27T13:30:30.000Z" />
  <EventRecordID>305805</EventRecordID>
  <Channel>System</Channel>
  <Computer>Exchange.AlarmforceInc.com</Computer>
  <Security />
  </System>
- <EventData>
  <Data>9:27:25 AM</Data>
  <Data>8/27/2013</Data>
  <Data />
  <Data />
  <Data>5940</Data>
  <Data />
  <Data />
  <Binary>DD07080002001B0009001B0019008201DD07080002001B000D001B00190082013C0000003C000000000000000000000000000000000000000100000000000000</Binary>
  </EventData>
  </Event>

pagefile setting was off on drive C so i changed it to 'System Managed Size' and I have 10.9GB free space on drive C
strivoli

Could you kindly report all logical disks, their total space, their free space and where are the Exchange's databases and logs located? Such as:
C:, Total 200GB, Free 10,9GB
Exchange DBs and Logs located on C:

Thank you.
ASKER
mgerwelAF

C:; Total 80GB, Free 11GB
D:; Total 3GB, Free 2GB -- Recovery (created by Server 2008 Installation )
E:; Total 335GB, Free 188GB
G:; Total 465GB, Free 345GB

OS, BES Express, Exchange Installation located on C:
Exchange DBs and Log Files located on E:
LCR Files located on G:

NOTE: Updated the BMC controller on the server as per Dell this morning and server has not rebooted all day so far, still watching it though
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER CERTIFIED SOLUTION
strivoli

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
ASKER
mgerwelAF

Server rebooted unexpectedly at 2:35:34 PM with no other System logs before this one

BSOD had the following:

STOP 0x0000007F (0x0000000000000008, 0x0000000080050031, 0x00000000000006F8, 0xFFFFF80001A867ED)
I have attached the the latest miniDump file for today
Mini082613-01 (8/26/2013 3:42pm)

C drive is also at 7.33GB free compared to 11GB this morning so there must be some large file that created itself on this last reboot.  Turned off pagefile on C as I assume this is what is taking all the space on the dirve.

Where can I find the pagefile.sys?
strivoli

The pagefile.sys is a hidden file located in the root of the drive set to host it.
You should inspect the C: drive and find any data that can be moved to another drive or deleted. The aim is to get enough room for the near future (11GB are too little - running the C: drive out of space might create big problems) and enough room for a Kernel Memory Dump (the Mini might not be enough).
The NIC's driver update didn't help.
Do you confirm that the BSOD only reported the STOP string you posted?
ASKER
mgerwelAF

I have not done the NIC update yet as I need to break the team and then install the updates so I will do this tomorrow during a downtime.  
BSOD string is confirmed.
I cannot see the page file in the root of C even after enabling hidden items. How can I find it and then move its location going forward?
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
strivoli

You manage the pagefile.sys location and size using "Advanced System Settings">"Performance">"Advanced">"Virtual Memory".
Run "dir *.* /ah" and you should see it.
SOLUTION
Log in to continue reading
Log In
Sign up - Free for 7 days
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
mgerwelAF

Find 2 pagefile.sys on both C:\ and E:\.  Both files are 17GB in size.  You can see the drive breakdown in an earlier thread to understand the drive letters.

I changed the virtual memory settings to the following:
C:\ - NONE
D:\ - NONE
E:\ - NONE
G:\ - SYSTEM MANAGED

Is this setup OK?  Also can I delete the pagefile.sys on the C:\ drive so that I can regain my space and have 25% free drive space back?  Also can the one currently on E:\ be deleted also?
strivoli

WARNING: you do NOT need to delete pagefile.sys. The pagefile.sys file is completely managed by the system. When you set the C: drive to NONE (NO Virtual Memory) the system will delete the pagefile.sys automatically either immediately or after the 1st reboot.

If you still have a pagefile.sys file on C: after you have set NONE, reboot the server and the SYS file should disappear automatically.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
mgerwelAF

Thanks ... pagefile was removed on reboot.  

Here are the new logical drive sizes:
C:; Total 80GB, Free 23.8GB
D:; Total 3GB, Free 2GB -- Recovery (created by Server 2008 Installation )
E:; Total 335GB, Free 199GB
G:; Total 465GB, Free 333GB
** Note that C, D & E are partitions of the same drive

The following has been updated:
Broadcom drivers with the FULL installation suite including BACS 4.0

Broadcom Firmware to the latest
Server BIOS to the latest

I will keep an eye on the server for the next 24hrs and report my findings.
strivoli

Does the server run fine after the low level updates you performed?
ASKER
mgerwelAF

Have not had any issues since all the updates.  Still monitoring it but looks good so far.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
ASKER
mgerwelAF

After updating all the NIC and motherboard drivers the server has been running with no reboots or errors for 5 days now .. so it appears that was the issue.  Thanks
ASKER
mgerwelAF

Thanks to pradeep08_81 for the information about the pagefile.sys
strivoli

You are welcome.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
Pradeep Dubey

Welcome Mgerwel, but you did not awarded it. :-)
ASKER
mgerwelAF

I know pradeep08_81.. sorry new to the site and once I awarded didn't know how to award additional recognition.
Pradeep Dubey

you can ask moderator to open question again so that you can select multiple answers. use below link for this "request attention"

https://www.experts-exchange.com/newRequest.jsp?qid=28223784
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
SOLUTION
Log in to continue reading
Log In
Sign up - Free for 7 days
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
mgerwelAF

Thanks to all for the help
Pradeep Dubey

Thank you!!!