Link to home
Create AccountLog in
Avatar of mgerwelAF

asked on

Exchange Server 2007 Unexpected Shutdown Issues

I recently performed some MS updates on my Exchange Server 2007 (Windows Server 2008 Std x64) which caused the server to not boot back up.  I uninstalled these updates and after finally renaming the pending.xml file I was able to get the server back up and running.
Since this time the server goes through unexpected reboots throughout the day (every 2-3 hours) and all I can find in the System Even Log is EventId 6008 - unexpected shutdown.  This seems to occur only between 9am-5pm and overnight the server runs great with no reboots.  I am wondering if there is some kind of load once a number of users log into their emails that causes this or if there could be a corrupt user that once they login this happens.  Any ideas or insight would really help as I lose email for about 10min a time 3-4 times daily right now.
If you require additional information please let me know.
Avatar of strivoli
Flag of Italy image

Please disable the default automatic reboot feature (if you are near the server during the day). Once it happens you should notice it quite immediately (users calling for help). Move to the server's console and write down what's reported on the BSOD.
Please post what you have written down.
Avatar of mgerwelAF


Disabled the option .. will wait for a shutdown and post back the result.
you get event 6008, is there any other information with this event ( copy the event and post here).

Did you check the event log just before the reboot ? any warning/error?

check the pagefile settings ( if they are not correct you will not get the memory dump).

In the OS drive make sure you have much free space to create the dump.

Mini dump will not help you every time.
Details of event 6008 are below and there are no event logs just before the reboot:

"The previous system shutdown at 9:27:25 AM on 8/27/2013 was unexpected."

- <Event xmlns="">
- <System>
  <Provider Name="EventLog" />
  <EventID Qualifiers="32768">6008</EventID>
  <TimeCreated SystemTime="2013-08-27T13:30:30.000Z" />
  <Security />
- <EventData>
  <Data>9:27:25 AM</Data>
  <Data />
  <Data />
  <Data />
  <Data />

pagefile setting was off on drive C so i changed it to 'System Managed Size' and I have 10.9GB free space on drive C
Could you kindly report all logical disks, their total space, their free space and where are the Exchange's databases and logs located? Such as:
C:, Total 200GB, Free 10,9GB
Exchange DBs and Logs located on C:

Thank you.
C:; Total 80GB, Free 11GB
D:; Total 3GB, Free 2GB -- Recovery (created by Server 2008 Installation )
E:; Total 335GB, Free 188GB
G:; Total 465GB, Free 345GB

OS, BES Express, Exchange Installation located on C:
Exchange DBs and Log Files located on E:
LCR Files located on G:

NOTE: Updated the BMC controller on the server as per Dell this morning and server has not rebooted all day so far, still watching it though
Avatar of strivoli
Flag of Italy image

Link to home
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Server rebooted unexpectedly at 2:35:34 PM with no other System logs before this one

BSOD had the following:

STOP 0x0000007F (0x0000000000000008, 0x0000000080050031, 0x00000000000006F8, 0xFFFFF80001A867ED)
I have attached the the latest miniDump file for today
Mini082613-01 (8/26/2013 3:42pm)

C drive is also at 7.33GB free compared to 11GB this morning so there must be some large file that created itself on this last reboot.  Turned off pagefile on C as I assume this is what is taking all the space on the dirve.

Where can I find the pagefile.sys?
The pagefile.sys is a hidden file located in the root of the drive set to host it.
You should inspect the C: drive and find any data that can be moved to another drive or deleted. The aim is to get enough room for the near future (11GB are too little - running the C: drive out of space might create big problems) and enough room for a Kernel Memory Dump (the Mini might not be enough).
The NIC's driver update didn't help.
Do you confirm that the BSOD only reported the STOP string you posted?
I have not done the NIC update yet as I need to break the team and then install the updates so I will do this tomorrow during a downtime.  
BSOD string is confirmed.
I cannot see the page file in the root of C even after enabling hidden items. How can I find it and then move its location going forward?
You manage the pagefile.sys location and size using "Advanced System Settings">"Performance">"Advanced">"Virtual Memory".
Run "dir *.* /ah" and you should see it.
Link to home
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Find 2 pagefile.sys on both C:\ and E:\.  Both files are 17GB in size.  You can see the drive breakdown in an earlier thread to understand the drive letters.

I changed the virtual memory settings to the following:
C:\ - NONE
D:\ - NONE
E:\ - NONE

Is this setup OK?  Also can I delete the pagefile.sys on the C:\ drive so that I can regain my space and have 25% free drive space back?  Also can the one currently on E:\ be deleted also?
WARNING: you do NOT need to delete pagefile.sys. The pagefile.sys file is completely managed by the system. When you set the C: drive to NONE (NO Virtual Memory) the system will delete the pagefile.sys automatically either immediately or after the 1st reboot.

If you still have a pagefile.sys file on C: after you have set NONE, reboot the server and the SYS file should disappear automatically.
Thanks ... pagefile was removed on reboot.  

Here are the new logical drive sizes:
C:; Total 80GB, Free 23.8GB
D:; Total 3GB, Free 2GB -- Recovery (created by Server 2008 Installation )
E:; Total 335GB, Free 199GB
G:; Total 465GB, Free 333GB
** Note that C, D & E are partitions of the same drive

The following has been updated:
Broadcom drivers with the FULL installation suite including BACS 4.0

Broadcom Firmware to the latest
Server BIOS to the latest

I will keep an eye on the server for the next 24hrs and report my findings.
Does the server run fine after the low level updates you performed?
Have not had any issues since all the updates.  Still monitoring it but looks good so far.
After updating all the NIC and motherboard drivers the server has been running with no reboots or errors for 5 days now .. so it appears that was the issue.  Thanks
Thanks to pradeep08_81 for the information about the pagefile.sys
You are welcome.
Welcome Mgerwel, but you did not awarded it. :-)
I know pradeep08_81.. sorry new to the site and once I awarded didn't know how to award additional recognition.
you can ask moderator to open question again so that you can select multiple answers. use below link for this "request attention"
Link to home
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Thanks to all for the help
Thank you!!!