Spontaneous Reboot

Late model IBM Server Windows2003 Server standard SP2, almost all updates
except for the ones dating back a week (or two).

The server will go through the POST and then display Windows Splash Screen,
then show progress messages; “Starting Windowsâ€, “Applying Securityâ€,
“Applying Settingsâ€.. – eventually showing the login (if lucky). But before
login, the server will spontaneously shutdown/reboot.

I was able to boot to safe mode just fine. No shutdowns/reboots at all in
safe mode.

The last error in the System event log before shutdown refers to the WSUS.

Event ID 1010
“A process serving application pool Wsus Pool failed to respond to a pingâ€

Next event shows “unexpected shutdownâ€

Can someone advise on best course of action - Is it possible to address this
surgically and avoid reimage. I have a full backup but would rather not have
to turn to this route.

thanks

 

Late model IBM Server Windows2003 Server standard SP2, almost all updates

What version of WSUS? Have you installed the update that turns off the
SNP? NIC driver fully up to date?

- Thee Chicago Wolf

 

WSUS 3.0
KB948496 -turning off SNP is installed as of March 12.
I'm checking the NIC drivers now.

I appreciate all the advice I can get but with all due respect, I don't see
in this article where spontaneous reboots are a problem identified? Also, I
should have mentioned that when i shut the server down it had been working
for a number of days. The reason I restarted the Server was a process
w3wp.exe that was at 50 cpu's. My restart seems to have precipitated this
event.

 

WSUS 3.0

I know it may seem out of the parameter's of your question, I was
asking for some fundamentals and background info first. That said, you
could likely bump WSUS 3 to the SP1 version. Above you say you have
WSUS 3.0, but not at SP1. Give that a shot next.

- Thee Chicago Wolf

 

WSUS 3.0

By the way, eventid.net mentions only one thing for your event ID and
points to the follwoing KB article. Take a look:
http://support.microsoft.com/kb/919792

Can you double check your event ID item and let me know what the
"Source" shows, IISService?

- Thee Chicago Wolf

 

I'm downloading WSUS 3.O SP1 right now. I think I should mention that WSUS
has no purpose on this server, we run WSUS from another server altogether.
Maybe I should just uninstall it?

Also a very likely culprit in this is our "Ticket System" which is junk
software. I'm thinking it might be an idea to disable IIS and MySql and see
if I can then start the server reliably? The ticket system is always having
problems, although it has never caused the server to crash before, it uses
MySql and IIS to run and could be the issue.

I have identified 2 services that reference IIS and Mysql - do you think
this is a reasonable idea?

thanks

 

The "Source" identifies "W3SVC"

 

Disabling the IIS Service allowed me to restart and bring the server back
online. Minus the IIS service of course but then it served only one
application and that application is not critical.

thanks for your assistance!

 

I'm downloading WSUS 3.O SP1 right now. I think I should mention that WSUS

Yes, if another server is doing WSUS duties, no need for it to be
taking up resources on a secondary non-WSUS server.

What about the MySQL version? Have you patched it up to the current
version? What ticketing system and version is this (so maybe I can
avoid it too, ha ha)?

Yes I think it is pointing more and more to IIS from what little I've
found with Google and what EventID.net says. It's very likely a simple
update somewhere is all that's needed. Perhaps something as simple as
a post-SP2 hotfix of some sort.

- Thee Chicago Wolf

 

The "Source" identifies "W3SVC"

Here's some more info from eventid.net. The first one might have some
clues for you (Application Pool Idle Time).

Anonymous (Last update 5/6/2006):
Check the application pool idle time. Increase it or take it out
completely. See the link to "Configure Application Pool Performance"
for information on how to configure idle timeout.

Mihai Andrei (Last update 9/30/2005):
This problem occurs because the Advanced Client computers that are
running Microsoft Systems Management Server (SMS), cannot connect to
the management point. See KB890740 for details.
http://support.microsoft.com/kb/890740

- Thee Chicago Wolf

 

Disabling the IIS Service allowed me to restart and bring the server back

Sure. Check the other two messages I posted as well.

- Thee Chicago Wolf