Spontaneous Reboot

[hpoincare]

Late model IBM Server Windows2003 Server standard SP2, almost all updates
except for the ones dating back a week (or two).

The server will go through the POST and then display Windows Splash Screen,
then show progress messages; “Starting Windows”, “Applying Security”,
“Applying Settings”.. – eventually showing the login (if lucky). But before
login, the server will spontaneously shutdown/reboot.

I was able to boot to safe mode just fine. No shutdowns/reboots at all in
safe mode.

The last error in the System event log before shutdown refers to the WSUS.

Event ID 1010
“A process serving application pool Wsus Pool failed to respond to a ping”

Next event shows “unexpected shutdown”

Can someone advise on best course of action - Is it possible to address this
surgically and avoid reimage. I have a full backup but would rather not have
to turn to this route.

thanks

 

[Thee Chicago Wolf]

Re: Spontaneous Reboot

>Late model IBM Server Windows2003 Server standard SP2, almost all updates
>except for the ones dating back a week (or two).
>
>The server will go through the POST and then display Windows Splash Screen,
>then show progress messages; “Starting Windows”, “Applying Security”,
>“Applying Settings”.. – eventually showing the login (if lucky). But before
>login, the server will spontaneously shutdown/reboot.
>
>I was able to boot to safe mode just fine. No shutdowns/reboots at all in
>safe mode.
>
>The last error in the System event log before shutdown refers to the WSUS.
>
>Event ID 1010
>“A process serving application pool Wsus Pool failed to respond to a ping”
>
>Next event shows “unexpected shutdown”
>
>Can someone advise on best course of action - Is it possible to address this
>surgically and avoid reimage. I have a full backup but would rather not have
>to turn to this route.
>
>thanks

What version of WSUS? Have you installed the update that turns off the
SNP? NIC driver fully up to date?

- Thee Chicago Wolf

 

[hpoincare]

Re: Spontaneous Reboot

WSUS 3.0
KB948496 -turning off SNP is installed as of March 12.
I'm checking the NIC drivers now.

I appreciate all the advice I can get but with all due respect, I don't see
in this article where spontaneous reboots are a problem identified? Also, I
should have mentioned that when i shut the server down it had been working
for a number of days. The reason I restarted the Server was a process
w3wp.exe that was at 50 cpu's. My restart seems to have precipitated this
event.

"Thee Chicago Wolf" wrote:

> >Late model IBM Server Windows2003 Server standard SP2, almost all updates
> >except for the ones dating back a week (or two).
> >
> >The server will go through the POST and then display Windows Splash Screen,
> >then show progress messages; “Starting Windows”, “Applying Security”,
> >“Applying Settings”.. – eventually showing the login (if lucky). But before
> >login, the server will spontaneously shutdown/reboot.
> >
> >I was able to boot to safe mode just fine. No shutdowns/reboots at all in
> >safe mode.
> >
> >The last error in the System event log before shutdown refers to the WSUS.
> >
> >Event ID 1010
> >“A process serving application pool Wsus Pool failed to respond to a ping”
> >
> >Next event shows “unexpected shutdown”
> >
> >Can someone advise on best course of action - Is it possible to address this
> >surgically and avoid reimage. I have a full backup but would rather not have
> >to turn to this route.
> >
> >thanks
>
> What version of WSUS? Have you installed the update that turns off the
> SNP? NIC driver fully up to date?
>
> - Thee Chicago Wolf
>

 

[Thee Chicago Wolf]

Re: Spontaneous Reboot

>WSUS 3.0
>KB948496 -turning off SNP is installed as of March 12.
>I'm checking the NIC drivers now.
>
>I appreciate all the advice I can get but with all due respect, I don't see
>in this article where spontaneous reboots are a problem identified? Also, I
>should have mentioned that when i shut the server down it had been working
>for a number of days. The reason I restarted the Server was a process
>w3wp.exe that was at 50 cpu's. My restart seems to have precipitated this
>event.

I know it may seem out of the parameter's of your question, I was
asking for some fundamentals and background info first. That said, you
could likely bump WSUS 3 to the SP1 version. Above you say you have
WSUS 3.0, but not at SP1. Give that a shot next.

- Thee Chicago Wolf

 

[Thee Chicago Wolf]

Re: Spontaneous Reboot

>WSUS 3.0
>KB948496 -turning off SNP is installed as of March 12.
>I'm checking the NIC drivers now.
>
>I appreciate all the advice I can get but with all due respect, I don't see
>in this article where spontaneous reboots are a problem identified? Also, I
>should have mentioned that when i shut the server down it had been working
>for a number of days. The reason I restarted the Server was a process
>w3wp.exe that was at 50 cpu's. My restart seems to have precipitated this
>event.

By the way, eventid.net mentions only one thing for your event ID and
points to the follwoing KB article. Take a look:
http://support.microsoft.com/kb/919792

Can you double check your event ID item and let me know what the
"Source" shows, IISService?

- Thee Chicago Wolf

 

[hpoincare]

Re: Spontaneous Reboot

I'm downloading WSUS 3.O SP1 right now. I think I should mention that WSUS
has no purpose on this server, we run WSUS from another server altogether.
Maybe I should just uninstall it?

Also a very likely culprit in this is our "Ticket System" which is junk
software. I'm thinking it might be an idea to disable IIS and MySql and see
if I can then start the server reliably? The ticket system is always having
problems, although it has never caused the server to crash before, it uses
MySql and IIS to run and could be the issue.

I have identified 2 services that reference IIS and Mysql - do you think
this is a reasonable idea?

thanks

"Thee Chicago Wolf" wrote:

> >WSUS 3.0
> >KB948496 -turning off SNP is installed as of March 12.
> >I'm checking the NIC drivers now.
> >
> >I appreciate all the advice I can get but with all due respect, I don't see
> >in this article where spontaneous reboots are a problem identified? Also, I
> >should have mentioned that when i shut the server down it had been working
> >for a number of days. The reason I restarted the Server was a process
> >w3wp.exe that was at 50 cpu's. My restart seems to have precipitated this
> >event.
>
> I know it may seem out of the parameter's of your question, I was
> asking for some fundamentals and background info first. That said, you
> could likely bump WSUS 3 to the SP1 version. Above you say you have
> WSUS 3.0, but not at SP1. Give that a shot next.
>
> - Thee Chicago Wolf
>

 

[hpoincare]

Re: Spontaneous Reboot

The "Source" identifies "W3SVC"

"Thee Chicago Wolf" wrote:

> >WSUS 3.0
> >KB948496 -turning off SNP is installed as of March 12.
> >I'm checking the NIC drivers now.
> >
> >I appreciate all the advice I can get but with all due respect, I don't see
> >in this article where spontaneous reboots are a problem identified? Also, I
> >should have mentioned that when i shut the server down it had been working
> >for a number of days. The reason I restarted the Server was a process
> >w3wp.exe that was at 50 cpu's. My restart seems to have precipitated this
> >event.
>
> By the way, eventid.net mentions only one thing for your event ID and
> points to the follwoing KB article. Take a look:
> http://support.microsoft.com/kb/919792
>
> Can you double check your event ID item and let me know what the
> "Source" shows, IISService?
>
> - Thee Chicago Wolf
>

 

[hpoincare]

Re: Spontaneous Reboot

Disabling the IIS Service allowed me to restart and bring the server back
online. Minus the IIS service of course but then it served only one
application and that application is not critical.

thanks for your assistance!

"Thee Chicago Wolf" wrote:

> >WSUS 3.0
> >KB948496 -turning off SNP is installed as of March 12.
> >I'm checking the NIC drivers now.
> >
> >I appreciate all the advice I can get but with all due respect, I don't see
> >in this article where spontaneous reboots are a problem identified? Also, I
> >should have mentioned that when i shut the server down it had been working
> >for a number of days. The reason I restarted the Server was a process
> >w3wp.exe that was at 50 cpu's. My restart seems to have precipitated this
> >event.
>
> By the way, eventid.net mentions only one thing for your event ID and
> points to the follwoing KB article. Take a look:
> http://support.microsoft.com/kb/919792
>
> Can you double check your event ID item and let me know what the
> "Source" shows, IISService?
>
> - Thee Chicago Wolf
>

 

[Thee Chicago Wolf]

Re: Spontaneous Reboot

>I'm downloading WSUS 3.O SP1 right now. I think I should mention that WSUS
>has no purpose on this server, we run WSUS from another server altogether.
>Maybe I should just uninstall it?

Yes, if another server is doing WSUS duties, no need for it to be
taking up resources on a secondary non-WSUS server.

>Also a very likely culprit in this is our "Ticket System" which is junk
>software. I'm thinking it might be an idea to disable IIS and MySql and see
>if I can then start the server reliably? The ticket system is always having
>problems, although it has never caused the server to crash before, it uses
>MySql and IIS to run and could be the issue.

What about the MySQL version? Have you patched it up to the current
version? What ticketing system and version is this (so maybe I can
avoid it too, ha ha)?

>I have identified 2 services that reference IIS and Mysql - do you think
>this is a reasonable idea?

Yes I think it is pointing more and more to IIS from what little I've
found with Google and what EventID.net says. It's very likely a simple
update somewhere is all that's needed. Perhaps something as simple as
a post-SP2 hotfix of some sort.

- Thee Chicago Wolf

 

[Thee Chicago Wolf]

Re: Spontaneous Reboot

>The "Source" identifies "W3SVC"

Here's some more info from eventid.net. The first one might have some
clues for you (Application Pool Idle Time).

Anonymous (Last update 5/6/2006):
Check the application pool idle time. Increase it or take it out
completely. See the link to "Configure Application Pool Performance"
for information on how to configure idle timeout.

Mihai Andrei (Last update 9/30/2005):
This problem occurs because the Advanced Client computers that are
running Microsoft Systems Management Server (SMS), cannot connect to
the management point. See KB890740 for details.
http://support.microsoft.com/kb/890740

- Thee Chicago Wolf

 

[Thee Chicago Wolf]

Re: Spontaneous Reboot

>Disabling the IIS Service allowed me to restart and bring the server back
>online. Minus the IIS service of course but then it served only one
>application and that application is not critical.
>
>thanks for your assistance!

Sure. Check the other two messages I posted as well.

- Thee Chicago Wolf