Server crash analysis - PFRO logs?

blinkme323
blinkme323 used Ask the Experts™
on
Hey Everyone,

I recently had a server crash and unfortunately no dump was taken and the event logs haven't yielded much at all as far as a possible cause.  I did however, find a PFRO.log file in the root of C: that has some interesting "rebootrequired" messages that logged almost exactly when the server crashed.  Does anyone know what these could be point towards or what the PFRO.log file itself signifies?

2/11/2014 13:33:18 - PFRO Error:
\??\C:\CA\CAPKI\CAPKI\RebootRequired, |delete operation|,
0xc0000034
2/11/2014 13:33:18 - PFRO Error:
\??\C:\CA\CAPKI\CAPKI\RebootRequired, |delete operation|,
0xc0000034
2/11/2014 13:33:18 - PFRO Error:
\??\C:\CA\CAPKI\CAPKI\RebootRequired, |delete operation|,
0xc0000034
2/11/2014 13:33:18 - PFRO Error:
\??\C:\CA\CAPKI\CAPKI\RebootRequired, |delete operation|,
0xc0000034
2/11/2014 13:33:18 - 12 Successful PFRO operations

Open in new window


Thanks in advance
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2014
Commented:
Hi,

CAPKI is CA ARCserve Backup agent. it seems CA has initiated the reboot. check the agent and update if required.

Author

Commented:
Thanks!  So are we certain that the message indicates that a reboot was intitiated or was it possibly resultant of the crash?
Top Expert 2014

Commented:
yes, it indicates the reboot required not crash.
Angular Fundamentals

Learn the fundamentals of Angular 2, a JavaScript framework for developing dynamic single page applications.

Author

Commented:
So would it then kick off the reboot automatically?  Or is it just saying, "I need a reboot to rename these files" and then it will just occur the next time the server is rebooted?  Sorry for the questions, but I'm just trying to figure out the PFRO logic and whether it would reboot automatically.
Top Expert 2014

Commented:
pls check the agent options/settings for reboot. I must ask about reboot.

Author

Commented:
The only reference I can find to the "crash" is in the event logs.  No dump or any other trace is out there:

Event Type:      Error
Event Source:      EventLog
Event Category:      None
Event ID:      6008
Date:            2/21/2014
Time:            1:31:25 PM
User:            N/A
Computer:      xxxxxxxxxxxxxx
Description:
The previous system shutdown at 1:31:25 PM on ¿2/¿21/¿2014 was unexpected.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial