Event log quits logging - server quits responding

Server is an HP ML310 G5p running Windows SBS 2008, at SP2 level.

Recently the server experienced these symptoms:

1. Email stops being delivered to the clients
2. Cannot login to the server via rdp or console. After entering the
password it just sits at a blue screen that says Welcome.
3. Post-reboot review of the logs show that the application, system, and
security logs just stop logging events until the reboot.
4. Apparently DNS continues to function and maybe file services because the
clients can still access the shares and Internet.

The last entry in the logs is at approx. 5AM and no entries were recorded
until after the server was power cycled just before 4:30PM. What's also
puzzling is that one of the first entries after it got going again was about
an unexpected shutdown at 12:00PM.
There are no entries in the log from the Eventlog service that you normally
see with a restart.

I've tried searching for anything that might clue me in to what is causing
this but I've come up empty-handed so I'm asking if anyone here has any idea
what might be the cause or what to look for.

Jonathan

A best practices analyzer run would probably be a good idea.

If event logging is not logging, then you might want to look at disk
integrity and then perhaps create new event log files and restart. Without
logging it's going to be very hard to get grips on what is happening.

Is the event log service running?

JonathanL wrote:
> Server is an HP ML310 G5p running Windows SBS 2008, at SP2 level.
>
> Recently the server experienced these symptoms:
>
> 1. Email stops being delivered to the clients
> 2. Cannot login to the server via rdp or console. After entering the
> password it just sits at a blue screen that says Welcome.
> 3. Post-reboot review of the logs show that the application, system,
> and security logs just stop logging events until the reboot.
> 4. Apparently DNS continues to function and maybe file services
> because the clients can still access the shares and Internet.
>
> The last entry in the logs is at approx. 5AM and no entries were
> recorded until after the server was power cycled just before 4:30PM.
> What's also puzzling is that one of the first entries after it got
> going again was about an unexpected shutdown at 12:00PM.
> There are no entries in the log from the Eventlog service that you
> normally see with a restart.
>
> I've tried searching for anything that might clue me in to what is
> causing this but I've come up empty-handed so I'm asking if anyone
> here has any idea what might be the cause or what to look for.
>
> Jonathan

--
/kj