Server crash analysis - PFRO logs?

Hey Everyone,

I recently had a server crash and unfortunately no dump was taken and the event logs haven't yielded much at all as far as a possible cause.  I did however, find a PFRO.log file in the root of C: that has some interesting "rebootrequired" messages that logged almost exactly when the server crashed.  Does anyone know what these could be point towards or what the PFRO.log file itself signifies?

2/11/2014 13:33:18 - PFRO Error:
\??\C:\CA\CAPKI\CAPKI\RebootRequired, |delete operation|,
0xc0000034
2/11/2014 13:33:18 - PFRO Error:
\??\C:\CA\CAPKI\CAPKI\RebootRequired, |delete operation|,
0xc0000034
2/11/2014 13:33:18 - PFRO Error:
\??\C:\CA\CAPKI\CAPKI\RebootRequired, |delete operation|,
0xc0000034
2/11/2014 13:33:18 - PFRO Error:
\??\C:\CA\CAPKI\CAPKI\RebootRequired, |delete operation|,
0xc0000034
2/11/2014 13:33:18 - 12 Successful PFRO operations

Open in new window


Thanks in advance
blinkme323Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Santosh GuptaCommented:
Hi,

CAPKI is CA ARCserve Backup agent. it seems CA has initiated the reboot. check the agent and update if required.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
blinkme323Author Commented:
Thanks!  So are we certain that the message indicates that a reboot was intitiated or was it possibly resultant of the crash?
0
Santosh GuptaCommented:
yes, it indicates the reboot required not crash.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

blinkme323Author Commented:
So would it then kick off the reboot automatically?  Or is it just saying, "I need a reboot to rename these files" and then it will just occur the next time the server is rebooted?  Sorry for the questions, but I'm just trying to figure out the PFRO logic and whether it would reboot automatically.
0
Santosh GuptaCommented:
pls check the agent options/settings for reboot. I must ask about reboot.
0
blinkme323Author Commented:
The only reference I can find to the "crash" is in the event logs.  No dump or any other trace is out there:

Event Type:      Error
Event Source:      EventLog
Event Category:      None
Event ID:      6008
Date:            2/21/2014
Time:            1:31:25 PM
User:            N/A
Computer:      xxxxxxxxxxxxxx
Description:
The previous system shutdown at 1:31:25 PM on ¿2/¿21/¿2014 was unexpected.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.