Exchange Server 2007 Unexpected Shutdown Issues

I recently performed some MS updates on my Exchange Server 2007 (Windows Server 2008 Std x64) which caused the server to not boot back up.  I uninstalled these updates and after finally renaming the pending.xml file I was able to get the server back up and running.
Since this time the server goes through unexpected reboots throughout the day (every 2-3 hours) and all I can find in the System Even Log is EventId 6008 - unexpected shutdown.  This seems to occur only between 9am-5pm and overnight the server runs great with no reboots.  I am wondering if there is some kind of load once a number of users log into their emails that causes this or if there could be a corrupt user that once they login this happens.  Any ideas or insight would really help as I lose email for about 10min a time 3-4 times daily right now.
If you require additional information please let me know.
mgerwelAFAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

strivoliCommented:
Please disable the default automatic reboot feature (if you are near the server during the day). Once it happens you should notice it quite immediately (users calling for help). Move to the server's console and write down what's reported on the BSOD.
Please post what you have written down.
0
mgerwelAFAuthor Commented:
Disabled the option .. will wait for a shutdown and post back the result.
0
Pradeep DubeyConsultantCommented:
you get event 6008, is there any other information with this event ( copy the event and post here).

Did you check the event log just before the reboot ? any warning/error?

check the pagefile settings ( if they are not correct you will not get the memory dump).

In the OS drive make sure you have much free space to create the dump.

Mini dump will not help you every time.
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

mgerwelAFAuthor Commented:
Details of event 6008 are below and there are no event logs just before the reboot:

"The previous system shutdown at 9:27:25 AM on 8/27/2013 was unexpected."

Details:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="EventLog" />
  <EventID Qualifiers="32768">6008</EventID>
  <Level>2</Level>
  <Task>0</Task>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2013-08-27T13:30:30.000Z" />
  <EventRecordID>305805</EventRecordID>
  <Channel>System</Channel>
  <Computer>Exchange.AlarmforceInc.com</Computer>
  <Security />
  </System>
- <EventData>
  <Data>9:27:25 AM</Data>
  <Data>8/27/2013</Data>
  <Data />
  <Data />
  <Data>5940</Data>
  <Data />
  <Data />
  <Binary>DD07080002001B0009001B0019008201DD07080002001B000D001B00190082013C0000003C000000000000000000000000000000000000000100000000000000</Binary>
  </EventData>
  </Event>

pagefile setting was off on drive C so i changed it to 'System Managed Size' and I have 10.9GB free space on drive C
0
strivoliCommented:
Could you kindly report all logical disks, their total space, their free space and where are the Exchange's databases and logs located? Such as:
C:, Total 200GB, Free 10,9GB
Exchange DBs and Logs located on C:

Thank you.
0
mgerwelAFAuthor Commented:
C:; Total 80GB, Free 11GB
D:; Total 3GB, Free 2GB -- Recovery (created by Server 2008 Installation )
E:; Total 335GB, Free 188GB
G:; Total 465GB, Free 345GB

OS, BES Express, Exchange Installation located on C:
Exchange DBs and Log Files located on E:
LCR Files located on G:

NOTE: Updated the BMC controller on the server as per Dell this morning and server has not rebooted all day so far, still watching it though
0
strivoliCommented:
A driver might be causing the problem. If the reboot happens under heavy network traffic a newer NIC driver might be the solution. Keep watching how the server's behaving and let us know. Thank you.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mgerwelAFAuthor Commented:
Server rebooted unexpectedly at 2:35:34 PM with no other System logs before this one

BSOD had the following:

STOP 0x0000007F (0x0000000000000008, 0x0000000080050031, 0x00000000000006F8, 0xFFFFF80001A867ED)
I have attached the the latest miniDump file for today
Mini082613-01 (8/26/2013 3:42pm)

C drive is also at 7.33GB free compared to 11GB this morning so there must be some large file that created itself on this last reboot.  Turned off pagefile on C as I assume this is what is taking all the space on the dirve.

Where can I find the pagefile.sys?
0
strivoliCommented:
The pagefile.sys is a hidden file located in the root of the drive set to host it.
You should inspect the C: drive and find any data that can be moved to another drive or deleted. The aim is to get enough room for the near future (11GB are too little - running the C: drive out of space might create big problems) and enough room for a Kernel Memory Dump (the Mini might not be enough).
The NIC's driver update didn't help.
Do you confirm that the BSOD only reported the STOP string you posted?
0
mgerwelAFAuthor Commented:
I have not done the NIC update yet as I need to break the team and then install the updates so I will do this tomorrow during a downtime.  
BSOD string is confirmed.
I cannot see the page file in the root of C even after enabling hidden items. How can I find it and then move its location going forward?
0
strivoliCommented:
You manage the pagefile.sys location and size using "Advanced System Settings">"Performance">"Advanced">"Virtual Memory".
Run "dir *.* /ah" and you should see it.
0
Pradeep DubeyConsultantCommented:
Pagefile.sys should be on the root of the drive like c:\ or D:\ or E:\. make sure while selecting option "show hidden files" uncheck the option "Hide protected operating system files (recommended)" if you not did, you will not be able to see the pagefile.sys

to change page file location you can go through the attached screenshot and given link is for pagefile settings:

http://support.microsoft.com/kb/889654
pagefile.png
0
mgerwelAFAuthor Commented:
Find 2 pagefile.sys on both C:\ and E:\.  Both files are 17GB in size.  You can see the drive breakdown in an earlier thread to understand the drive letters.

I changed the virtual memory settings to the following:
C:\ - NONE
D:\ - NONE
E:\ - NONE
G:\ - SYSTEM MANAGED

Is this setup OK?  Also can I delete the pagefile.sys on the C:\ drive so that I can regain my space and have 25% free drive space back?  Also can the one currently on E:\ be deleted also?
0
strivoliCommented:
WARNING: you do NOT need to delete pagefile.sys. The pagefile.sys file is completely managed by the system. When you set the C: drive to NONE (NO Virtual Memory) the system will delete the pagefile.sys automatically either immediately or after the 1st reboot.

If you still have a pagefile.sys file on C: after you have set NONE, reboot the server and the SYS file should disappear automatically.
0
mgerwelAFAuthor Commented:
Thanks ... pagefile was removed on reboot.  

Here are the new logical drive sizes:
C:; Total 80GB, Free 23.8GB
D:; Total 3GB, Free 2GB -- Recovery (created by Server 2008 Installation )
E:; Total 335GB, Free 199GB
G:; Total 465GB, Free 333GB
** Note that C, D & E are partitions of the same drive

The following has been updated:
Broadcom drivers with the FULL installation suite including BACS 4.0

Broadcom Firmware to the latest
Server BIOS to the latest

I will keep an eye on the server for the next 24hrs and report my findings.
0
strivoliCommented:
Does the server run fine after the low level updates you performed?
0
mgerwelAFAuthor Commented:
Have not had any issues since all the updates.  Still monitoring it but looks good so far.
0
mgerwelAFAuthor Commented:
After updating all the NIC and motherboard drivers the server has been running with no reboots or errors for 5 days now .. so it appears that was the issue.  Thanks
0
mgerwelAFAuthor Commented:
Thanks to pradeep08_81 for the information about the pagefile.sys
0
strivoliCommented:
You are welcome.
0
Pradeep DubeyConsultantCommented:
Welcome Mgerwel, but you did not awarded it. :-)
0
mgerwelAFAuthor Commented:
I know pradeep08_81.. sorry new to the site and once I awarded didn't know how to award additional recognition.
0
Pradeep DubeyConsultantCommented:
you can ask moderator to open question again so that you can select multiple answers. use below link for this "request attention"

http://www.experts-exchange.com/newRequest.jsp?qid=28223784
0
Pradeep DubeyConsultantCommented:
mgerwel,

Its your turn now.
0
mgerwelAFAuthor Commented:
Thanks to all for the help
0
Pradeep DubeyConsultantCommented:
Thank you!!!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.