System Shutdown unexpected

C

comanche23

Hello all, we have been struggling with this for long now and so far we are not lucky on fixing this issue on our server. It keeps on crashing in a Daily basis for a random times Sometimes once, sometimes twice. I attached here some of the error on the logs and MiniDMP files. We have also replace the server on a different same model of server to be sure its not a hardware issue, but issue are still the same. Hope someone can help me with this. Many thanks.

Windows Server 2003
Enterprise Edition Service Pack 2

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date: 28-Jun-09
Time: 3:50:42 AM
User: N/A
Computer: RENDEZVOUS27
Description:
The previous system shutdown at 3:39:12 AM on 6/28/2009 was unexpected.


Data:
0000: d9 07 06 00 00 00 1c 00 Ù.......
0008: 03 00 27 00 0c 00 2e 03 ..'.....
0010: d9 07 06 00 00 00 1c 00 Ù.......
0018: 00 00 27 00 0c 00 2e 03 ..'.....


Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 28-Jun-09
Time: 3:50:42 AM
User: N/A
Computer: RENDEZVOUS27
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x1000007e (0xc0000005, 0xb8d5a3ec, 0xb8ec0c98, 0xb8ec0994). A dump was saved in: C:\WINDOWS\Minidump\Mini062809-01.dmp.
 

Attachments

  • MiniDMP.zip
    34.6 KB · Views: 11
We need a full description of the hard ware... motherboard, cpu, cpu fan, video graphics, hard drive, and memory of this Windows 2003 Server machine... and how long it has been misbehaving.
Not much of what you posted is helpful.
 
Per Error ID 6008, Source EventLog, Description: The previous system shutdown at 3:39:12 AM on 6/28/2009 was unexpected.

A description of the shutdown process from EventID.net:
When a computer is shutdown by an administrator or by an application a series of tasks as performed to ensure that all the applications are closed properly without loss of data: the various caches used by the operation systems are flushed (saved to hard disk), the system sends a “stop” command to all the applications/services running on that system and waits for them to shutdown properly.
Click to expand...
What happened to you:
The shutdown was not performed properly as various temporary files and software switches that should’have been deleted of turned “off” during shutdown as still present. This means that the computer was shutdown without having the chance to perform the shutdown-related tasks, in other words it was an unexpected shutdown
Click to expand...

The flawed shutdown took place at 3:39:12 AM on 6/28/2009.
It is possible you attempted to bring the system up again before it had fully shuddown and all processes stopped.

Possible causes:
  • The power cable is unplugged.
  • Hardware issues could also cause this error.
  • an inconsistency exists between the Browser service and the server service
  • Winlogon does not log off the user, and because of this, the screensaver continues.
  • A user with administrative privileges modifies the computer policy to permit shutdown from authentication.

From Mirosoft: try this first: To resolve this issue:

1. Click Start, point to Programs, point to Administrative Tools, and then click System Policy Editor.
2. Click File, and then click Open Registry.
3. Click Windows NT System, click Logon, and then click the Enable shutdown from Authentication command on the Logon menu to remove the check mark.

NOTE: Changing the System policy back to default values removes this option from all client sessions, but an administrator still has the option to shut down the Terminal Server from the Authentication dialog box.
Click to expand...

Let us know if this handles the problem.
 
Hi Raybay,
HP Proliant DL380 G5
OS Name: Windows Server 2003 Enterprise Edition
Version: 5.2.3790 Service Pack 2 Build 3790
X86-based PC
Processor: x86 Family 6 Model 15 Stepping 6 GenuineIntel ~3000 Mhz (x4) CPU's
Intel(R) Xeon(R) CPU 5160 @ 3.00GHz
Bios Version: HP P56, 28-Dec-06
SMBIOS Version: 2.3
Total Physical Memory: 3.326 GB DIMM

HDD: 3 SAS HP small form factor drive 72gb(x3)
 
Hello Bob/ray

Thanks for the quick reply. As for the System Policy Editor. This server is under GPO on the Domain Server. The only policy set was to exclude this from Screensaver other than that is nothing. We use this server for our Restaurant Management System onboard a Passenger Ship. The only moment we will find out that the probelm occur is that when the Restaurant staff called us that they cannot access the system and do Restaurant sitting/resevation. Finding out that the Server restarted by itself and we need to login again and restart all Restaurant Services.

I am sure this has nothing to do with the Hardware as we have done swtiching parts already and we even switch it on a new whole server but only using the HDD.

We have uninstalled any Antivirus/ or even Exclude this on scanning the system when it is the most busiest time. We alse exclude this on our back up server to not run anything. So in short nothing was running on the background(Ex: backup, antivirus scan etc) when the system reboot or just before. We have this issue for like a year now and we have tried a lot of things already though I am not sure if there maybe more help I could use of.

The weird things is the Server is Restarting in a random times (daily). No other logs besides what i have post here that was linking to our issue.
 
Not everyone can even open the minidump files let alone read them.

I recommend you follow my suggestion to use the Event Viewer. I can help you with that.
 
Have read both minidumps, they cite 0x000007E and 0x00000C5. Both a bit general, but point towards driver issues

For the error code 0x0000007E - SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
A system thread generated an exception which the error handler did not catch. There are numerous individual causes for this problem, including hardware incompatibility, a faulty device driver or system service, or some software issues. Check Event Viewer (EventVwr.msc) for additional information.
Click to expand...
Following Bobbye's eventviewer suggestions will narrow this one down for us.

For the error code 0x000000C5 - DRIVER_CORRUPTED_EXPOOL
An attempt occurred to touch invalid memory at a process IRQL that is too high. This is almost always caused by drivers that have corrupted the system pool. If you’ve recently installed any new software, check to see if it’s properly installed; and check for updated drivers on the manufacturer’s web site.
Click to expand...

Just off these two minidumps, it would be rather hard to name which driver is causing the issue. Hopefully eventviewer can reveal more information.
 
raybay said:
We need a full description of the hard ware... motherboard, cpu, cpu fan, video graphics, hard drive, and memory of this Windows 2003 Server machine... and how long it has been misbehaving.
Not much of what you posted is helpful.
Click to expand...

A full description including the cpu fan???? :confused:
Don't think i've ever seen that requested before for system specs (certainly for up-front initial general troubleshooting specs)
 
In fact, simply interpreting the bug check codes, minidump data and event viewer logs will be far more telling then looking at system specs for this particular case..

comanche23

Will see if i can see anything in more detail when i have a chance to look at them in more detail.. but a few things that come to mind/ at the top of the list for things to check

These are access related violations. Top contenders are
>> memory issues
>> BIOS related settings or BIOS version vs. your current hardware
>> and/or a device driver issue.

Have you added any new devices / hardware / updated drivers lately?
Can you run the servers awhile with any/all or some of the external hardware devices detached to see if faults continue without the device?

I'd also run Memtest to verify you don't have memory failures
> Also check if any BIOS updates for your motherboard might exist that would apply to your hardware / problem situation
 
Perhaps I should have said CPU cooling system, but many give a better description when defined out... Surely with all your reading, LookingAround, you have seen the need to know heat and cooling setups... and whether they are jerry-rigged or "engineered" together.
 
<deleted by author> Ooops. Sorry. In haste, somehow managed to hit Quote (vs. Edit) when meaning to correct a typo... deleted the redundant post
 
raybay said:
Perhaps I should have said CPU cooling system, but many give a better description when defined out... Surely with all your reading, LookingAround, you have seen the need to know heat and cooling setups... and whether they are jerry-rigged or "engineered" together.
Click to expand...

gee, almost forgot i didn't reply yet.

So, yes, Raybay. I know exactly why one might need to know about heat and cooling setups and "whether they are jerry-rigged or "engineered" together"

Which is why its ridiculous to trouble a user to track down that level of hardware detail very first thing and upfront especially when you haven't even bothered to look at the minidump data they provided or you don't have the slightest clue its worth making them figure that level of detail out.

It's like going to your doctor to complain of coughing and head cold and he makes you leave because he won't talk to you till you come back with your blood type! :)
 
It has been my experience that when members argue among themselves or give out replies that seem sarcastic on a thread, the person with the problem becomes confused and rarely come back to a thread.

Up until Post #16, there had been no replies here for 3 days. One has to wonder why it was felt to be necessary to continue the disagreement with a new post.

comanche23, if you still need help, please begin a new thread.
 
1) As a matter of fact i was also following up (which is what took me back to this thread in the first place) reviewing the specifics for comanche23 by looking in more depth at HP support site for their board and other debugging data already supplied

2) As well as going to then ask comache23 for an update as hadn't heard back since the last questions on things to check

3) I also question the value of tossing out a laundry list of hardware generalities (vs. anything specific or at least instructions a user can actually use and follow) while still ignoring the data at hand. Also: in addition to a thread, this a forum... in hope's of making sure the information offered and asked of users, in fact, are correct and actually apply for their situation /* EDIT */ And not to mention any advice or instructions are themselves also technically correct

/* EDIT */
And to be clear my point 3) was only directed at Raybay request for cooling fan and other (some of which would only be a pain for a user to determine yet aren't even of relevant detail at this point) and wouldn't give much, if any, additional data of value to troubleshoot the problem as stands (including data the user already supplied)
 
hello all, first I would like to thank everybody who tried to help. I really appreciated it. But we have tried a lot of things already and so far no luck. As you can see from my previous post. The server has been replaced with the spare with no issue at all(all hardwares, same model) so I am sure this has something to do with the applications or drivers for the softwares. We are lookinf forward to move to another company which is Silverware and Dump the Infogenesis that we are not getting the proper prompt support. A few Events I have seen so far. Again thanks all who tried to help and sorry for the delay of my reply.


Event Type: Error
Event Source: VsJITDebugger
Event Category: None
Event ID: 4096
Date: 7/10/2009
Time: 2:05:00 AM
User: RENDEZVOUS27\Infouser27
Computer: RENDEZVOUS27
Description:
An unhandled win32 exception occurred in ResPAKImport.exe [2444]. Just-In-Time debugging this exception failed with the following error: Debugger could not be started because no user is logged on.

Check the documentation index for 'Just-in-time debugging, errors' for more information.

For more information, see Help and Support Center at
Data:
0000: 02 00 5c 80 ..\€


Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 1000
Date: 7/10/2009
Time: 7:01:33 PM
User: N/A
Computer: RENDEZVOUS27
Description:
Faulting application w3wp.exe, version 6.0.3790.3959, stamp 45d6968e, faulting module mscorwks.dll, version 2.0.50727.1433, stamp 471ef729, debug? 0, fault address 0x0008d242.
 
Just gotta love the Event Viewer!

Event Type: Error
Event Source: VsJITDebugger
Event ID: 4096
Date: 7/10/2009 Time: 2:05:00 AM
Description: An unhandled win32 exception occurred in ResPAKImport.exe [2444]. Just-In-Time debugging this exception failed with the following error: Debugger could not be started because no user is logged on.

From Microsoft:
Debugger could not be started because no user is logged on.
This error occurs if you attempt to do Just-In-Time debugging on a machine where there is no user logged onto the console. As a result, there is no session in which to display the Just-In-Time debugging dialog box.
Click to expand...

Resolution: To fix this problem, log onto the machine.

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event ID: 1000
Date: 7/10/2009, Time: 7:01:33 PM
Description: Faulting application w3wp.exe, version 6.0.3790.3959, stamp 45d6968e, faulting module mscorwks.dll, version 2.0.50727.1433, stamp 471ef729, debug? 0, fault address 0x0008d242.

HOTFIX: A .NET Framework 2.0 application that runs under a user account context when no user profile is associated with the user account context may crash, or you may receive an access violation error message

From Microsoft:
In this scenario, the application may crash, or you may receive an access violation error message. If you debug the crash, you find an access violation in the mscorwks!SecurityConfig::GetCacheEntry function.

Cause: This problem occurs when a null reference is in the user policy cache.
Resolution: A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article.

To download this hotfix from the MSDN Code Gallery, visit the following Microsoft Web site:
http://code.msdn.microsoft.com/KB913384 (http://code.msdn.microsoft.com/KB913384)

NOTE: Be sure the correct language is set before you downlaod.
Click to expand...
 

Similar threads

gubarrr
New build PC - seems to run mostly very well - but not shutting down cleanly
Replies
2
Views
1K
theupsstorelosan
T
J
Need help with BSOD Event ID 41
Replies
1
Views
2K
Kshipper
Kshipper
ravisunny2
Solved Need help with possible infection
Replies
11
Views
4K
Broni
Broni

Latest posts

Back