TechSpot

System Shutdown unexpected

By comanche23
Jun 28, 2009
  1. Hello all, we have been struggling with this for long now and so far we are not lucky on fixing this issue on our server. It keeps on crashing in a Daily basis for a random times Sometimes once, sometimes twice. I attached here some of the error on the logs and MiniDMP files. We have also replace the server on a different same model of server to be sure its not a hardware issue, but issue are still the same. Hope someone can help me with this. Many thanks.

    Windows Server 2003
    Enterprise Edition Service Pack 2

    Event Type: Error
    Event Source: EventLog
    Event Category: None
    Event ID: 6008
    Date: 28-Jun-09
    Time: 3:50:42 AM
    User: N/A
    Computer: RENDEZVOUS27
    Description:
    The previous system shutdown at 3:39:12 AM on 6/28/2009 was unexpected.


    Data:
    0000: d9 07 06 00 00 00 1c 00 Ù.......
    0008: 03 00 27 00 0c 00 2e 03 ..'.....
    0010: d9 07 06 00 00 00 1c 00 Ù.......
    0018: 00 00 27 00 0c 00 2e 03 ..'.....


    Event Type: Information
    Event Source: Save Dump
    Event Category: None
    Event ID: 1001
    Date: 28-Jun-09
    Time: 3:50:42 AM
    User: N/A
    Computer: RENDEZVOUS27
    Description:
    The computer has rebooted from a bugcheck. The bugcheck was: 0x1000007e (0xc0000005, 0xb8d5a3ec, 0xb8ec0c98, 0xb8ec0994). A dump was saved in: C:\WINDOWS\Minidump\Mini062809-01.dmp.
     

    Attached Files:

  2. raybay

    raybay TS Evangelist Posts: 7,241   +9

    We need a full description of the hard ware... motherboard, cpu, cpu fan, video graphics, hard drive, and memory of this Windows 2003 Server machine... and how long it has been misbehaving.
    Not much of what you posted is helpful.
     
  3. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Per Error ID 6008, Source EventLog, Description: The previous system shutdown at 3:39:12 AM on 6/28/2009 was unexpected.

    A description of the shutdown process from EventID.net:
    What happened to you:
    The flawed shutdown took place at 3:39:12 AM on 6/28/2009.
    It is possible you attempted to bring the system up again before it had fully shuddown and all processes stopped.


    Possible causes:
    • The power cable is unplugged.
    • Hardware issues could also cause this error.
    • an inconsistency exists between the Browser service and the server service
    • Winlogon does not log off the user, and because of this, the screensaver continues.
    • A user with administrative privileges modifies the computer policy to permit shutdown from authentication.

    From Mirosoft: try this first: To resolve this issue:

    Let us know if this handles the problem.
     
  4. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Good tip I had long forgotten, Bobbye
     
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    I didn't think you'd mind- you know what a nag I am about the Event Viewer!
     
  6. comanche23

    comanche23 TS Rookie Topic Starter

    Hi Raybay,
    HP Proliant DL380 G5
    OS Name: Windows Server 2003 Enterprise Edition
    Version: 5.2.3790 Service Pack 2 Build 3790
    X86-based PC
    Processor: x86 Family 6 Model 15 Stepping 6 GenuineIntel ~3000 Mhz (x4) CPU's
    Intel(R) Xeon(R) CPU 5160 @ 3.00GHz
    Bios Version: HP P56, 28-Dec-06
    SMBIOS Version: 2.3
    Total Physical Memory: 3.326 GB DIMM

    HDD: 3 SAS HP small form factor drive 72gb(x3)
     
  7. comanche23

    comanche23 TS Rookie Topic Starter

    Hello Bob/ray

    Thanks for the quick reply. As for the System Policy Editor. This server is under GPO on the Domain Server. The only policy set was to exclude this from Screensaver other than that is nothing. We use this server for our Restaurant Management System onboard a Passenger Ship. The only moment we will find out that the probelm occur is that when the Restaurant staff called us that they cannot access the system and do Restaurant sitting/resevation. Finding out that the Server restarted by itself and we need to login again and restart all Restaurant Services.

    I am sure this has nothing to do with the Hardware as we have done swtiching parts already and we even switch it on a new whole server but only using the HDD.

    We have uninstalled any Antivirus/ or even Exclude this on scanning the system when it is the most busiest time. We alse exclude this on our back up server to not run anything. So in short nothing was running on the background(Ex: backup, antivirus scan etc) when the system reboot or just before. We have this issue for like a year now and we have tried a lot of things already though I am not sure if there maybe more help I could use of.

    The weird things is the Server is Restarting in a random times (daily). No other logs besides what i have post here that was linking to our issue.
     
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Raybay, can you check the minidump files? I don't do that.
     
  9. comanche23

    comanche23 TS Rookie Topic Starter

    hi guys, just checking. I hope someone can read the mini dump file. Thanks.
     
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Not everyone can even open the minidump files let alone read them.

    I recommend you follow my suggestion to use the Event Viewer. I can help you with that.
     
  11. snowchick7669

    snowchick7669 TS Maniac Posts: 660

    Have read both minidumps, they cite 0x000007E and 0x00000C5. Both a bit general, but point towards driver issues

    For the error code 0x0000007E - SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
    Following Bobbye's eventviewer suggestions will narrow this one down for us.

    For the error code 0x000000C5 - DRIVER_CORRUPTED_EXPOOL
    Just off these two minidumps, it would be rather hard to name which driver is causing the issue. Hopefully eventviewer can reveal more information.
     
  12. LookinAround

    LookinAround Ex Tech Spotter Posts: 6,491   +183

    A full description including the cpu fan???? :confused:
    Don't think i've ever seen that requested before for system specs (certainly for up-front initial general troubleshooting specs)
     
  13. LookinAround

    LookinAround Ex Tech Spotter Posts: 6,491   +183

    In fact, simply interpreting the bug check codes, minidump data and event viewer logs will be far more telling then looking at system specs for this particular case..

    comanche23

    Will see if i can see anything in more detail when i have a chance to look at them in more detail.. but a few things that come to mind/ at the top of the list for things to check

    These are access related violations. Top contenders are
    >> memory issues
    >> BIOS related settings or BIOS version vs. your current hardware
    >> and/or a device driver issue.

    Have you added any new devices / hardware / updated drivers lately?
    Can you run the servers awhile with any/all or some of the external hardware devices detached to see if faults continue without the device?

    I'd also run Memtest to verify you don't have memory failures
    > Also check if any BIOS updates for your motherboard might exist that would apply to your hardware / problem situation
     
  14. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Perhaps I should have said CPU cooling system, but many give a better description when defined out... Surely with all your reading, LookingAround, you have seen the need to know heat and cooling setups... and whether they are jerry-rigged or "engineered" together.
     
  15. LookinAround

    LookinAround Ex Tech Spotter Posts: 6,491   +183

    <deleted by author> Ooops. Sorry. In haste, somehow managed to hit Quote (vs. Edit) when meaning to correct a typo... deleted the redundant post
     
  16. LookinAround

    LookinAround Ex Tech Spotter Posts: 6,491   +183

    gee, almost forgot i didn't reply yet.

    So, yes, Raybay. I know exactly why one might need to know about heat and cooling setups and "whether they are jerry-rigged or "engineered" together"

    Which is why its ridiculous to trouble a user to track down that level of hardware detail very first thing and upfront especially when you haven't even bothered to look at the minidump data they provided or you don't have the slightest clue its worth making them figure that level of detail out.

    It's like going to your doctor to complain of coughing and head cold and he makes you leave because he won't talk to you till you come back with your blood type! :)
     
  17. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    It has been my experience that when members argue among themselves or give out replies that seem sarcastic on a thread, the person with the problem becomes confused and rarely come back to a thread.

    Up until Post #16, there had been no replies here for 3 days. One has to wonder why it was felt to be necessary to continue the disagreement with a new post.

    comanche23, if you still need help, please begin a new thread.
     
  18. LookinAround

    LookinAround Ex Tech Spotter Posts: 6,491   +183

    1) As a matter of fact i was also following up (which is what took me back to this thread in the first place) reviewing the specifics for comanche23 by looking in more depth at HP support site for their board and other debugging data already supplied

    2) As well as going to then ask comache23 for an update as hadn't heard back since the last questions on things to check

    3) I also question the value of tossing out a laundry list of hardware generalities (vs. anything specific or at least instructions a user can actually use and follow) while still ignoring the data at hand. Also: in addition to a thread, this a forum... in hope's of making sure the information offered and asked of users, in fact, are correct and actually apply for their situation /* EDIT */ And not to mention any advice or instructions are themselves also technically correct

    /* EDIT */
    And to be clear my point 3) was only directed at Raybay request for cooling fan and other (some of which would only be a pain for a user to determine yet aren't even of relevant detail at this point) and wouldn't give much, if any, additional data of value to troubleshoot the problem as stands (including data the user already supplied)
     
  19. comanche23

    comanche23 TS Rookie Topic Starter

    hello all, first I would like to thank everybody who tried to help. I really appreciated it. But we have tried a lot of things already and so far no luck. As you can see from my previous post. The server has been replaced with the spare with no issue at all(all hardwares, same model) so I am sure this has something to do with the applications or drivers for the softwares. We are lookinf forward to move to another company which is Silverware and Dump the Infogenesis that we are not getting the proper prompt support. A few Events I have seen so far. Again thanks all who tried to help and sorry for the delay of my reply.


    Event Type: Error
    Event Source: VsJITDebugger
    Event Category: None
    Event ID: 4096
    Date: 7/10/2009
    Time: 2:05:00 AM
    User: RENDEZVOUS27\Infouser27
    Computer: RENDEZVOUS27
    Description:
    An unhandled win32 exception occurred in ResPAKImport.exe [2444]. Just-In-Time debugging this exception failed with the following error: Debugger could not be started because no user is logged on.

    Check the documentation index for 'Just-in-time debugging, errors' for more information.

    For more information, see Help and Support Center at
    Data:
    0000: 02 00 5c 80 ..\€


    Event Type: Error
    Event Source: .NET Runtime 2.0 Error Reporting
    Event Category: None
    Event ID: 1000
    Date: 7/10/2009
    Time: 7:01:33 PM
    User: N/A
    Computer: RENDEZVOUS27
    Description:
    Faulting application w3wp.exe, version 6.0.3790.3959, stamp 45d6968e, faulting module mscorwks.dll, version 2.0.50727.1433, stamp 471ef729, debug? 0, fault address 0x0008d242.
     
  20. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Some days are like that...

    Thanks for the detailed update...
     
  21. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Just gotta love the Event Viewer!

    Event Type: Error
    Event Source: VsJITDebugger
    Event ID: 4096

    Date: 7/10/2009 Time: 2:05:00 AM
    Description: An unhandled win32 exception occurred in ResPAKImport.exe [2444]. Just-In-Time debugging this exception failed with the following error: Debugger could not be started because no user is logged on.

    From Microsoft:
    Resolution: To fix this problem, log onto the machine.

    Event Type: Error
    Event Source: .NET Runtime 2.0 Error Reporting
    Event ID: 1000

    Date: 7/10/2009, Time: 7:01:33 PM
    Description: Faulting application w3wp.exe, version 6.0.3790.3959, stamp 45d6968e, faulting module mscorwks.dll, version 2.0.50727.1433, stamp 471ef729, debug? 0, fault address 0x0008d242.

    HOTFIX: A .NET Framework 2.0 application that runs under a user account context when no user profile is associated with the user account context may crash, or you may receive an access violation error message

    From Microsoft:
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...