Reboots everday at same time.

[rurbaniak]

Okay, I got a tricky one that I'm not able to find. Here's the scenario.

It's an MS SBS 2003 server running many apps, including Backup Exec, Symantec Antivirus Corporate Edition, Exchange server, and other medical apps.

Everyday at 6:57am the server will reboot. This eventlog is created after it restarts:

The previous system shutdown at 6:57:34 AM on 12/17/2008 was unexpected.

It does not create a Memory Dump file.

I've updated drivers, and patched.

I've tried disabling services for Symantec, and Backup Exec and it still reboots the next morning.

I've ran scans for Viruses/Spyware/Malware with other programs other than Symantecs.

Ran memory tests, all came back good.

There is nothing in event viewer showing anything starting around that time.


This server had been up and running in it's current state for a while, no upgrades, or installs besides the driver and windows update.

Any suggestions? Any programs that you can recommend to capture whats happening at the time of reboot?

 

[arrow_runner]

Does it only reboot during weekdays or every day? (I'm thinking user-logon stress?)

Any chance you can sit in front of it and look at system resources/process monitor just prior to and during the time it reboots?

Possible work-around/test. Schedule a reboot at 6:55 tomorrow?

 

[rurbaniak]

Does it only reboot during weekdays or every day? (I'm thinking user-logon stress?)

Any chance you can sit in front of it and look at system resources/process monitor just prior to and during the time it reboots?

Possible work-around/test. Schedule a reboot at 6:55 tomorrow?

Definitely not login stress, only one person arrives before 8am.

 

[Rider]

Can you duplicate the problem? Try changing the clock so you can watch it reboot. Then disconnect it from the network and you can isolate the problem.

 

[usacvlr]

What happens in the log BEFORE :57...

 

[rurbaniak]

Can you duplicate the problem? Try changing the clock so you can watch it reboot. Then disconnect it from the network and you can isolate the problem.

I've been thinking about that. If it's some kind of scheduled item that's not a Windows Schedule Task that is firing off during that specific time then in theory changing the time should work.. We'll see, the client shuts down Wednesday afternoons, so I'll be able to try it today.

 

[rurbaniak]

What happens in the log BEFORE :57...

Nothing in particular, and nothing around that time. Last thing showing is some exchange process running and completing at 3:15am.

 

[MHCG]

Cleaning person unplugging the server to plug in the floor polisher?

 

[Jager]

Cleaning person unplugging the server to plug in the floor polisher?

I love reading those kind of computer stupidities...

 

[rurbaniak]

Changing time on the server and waiting didn't make this reboot it's self, so..

I'm running a Scheduled Task at 6:45am to run Process Monitor capture and record that in a file. So hopefully, something will show up in the log, and I'll find it then.

 

[Rider]

Did you change the time in BIOS?

 

[NYJimbo]

Reboots like this are often CPU thermal issues. Check the CPU temp after stressing the CPU, if it is way up then you might have to clean the fan/heatsink or replace it.

 

[Rider]

Reboots like this are often CPU thermal issues.

I would tend to agree with you but he said it does it everyday at the same exact time.

 

[NYJimbo]

I would tend to agree with you but he said it does it everyday at the same exact time.

That was my point.

 

[Rider]

At the same extact time, down to the minute? Sounds to me like something is scheduled to happen at that time and the computer doesn't like it.

 

[rurbaniak]

Crap. Process Monitor created a log file, but I'm finding out that if it doesn't close gracefully then it will be corrupt the file and it's useless.

So, still rebooting same time. I need to find something along the line of Process Monitor that will give me some extensive logging of what the servers doing, any ideas?

 

[rurbaniak]

I am just tossing this one out there, but here is a couple of suggestions;

Put something like a clock radio in over there, right next to the server, on the same socket or power strip/ups and set the time. If you come in the next day, and it's not the right time, you know it's power related.

Try removing the systems password, if I remember correctly, no program can run as a task if there is no password set. Again, uncertain about this.

Might also want to open up the command line and type the 'at' command, this will list any sneaky types of commands that may be run at certain times. for a full list of at features, type at /?

could also try this; http://www.technibble.com/repair-tool-of-the-week-whocrashed/#more-1758

Power problem at same time of day? Maybe, but it's plugged into a UPS, so that is highly doubtful.

The Scheduled Task ran I set. Thats not an issue, and their are no other schedule tasks..

Also, the whocrashed won't help because there are no Memory Dump files being created, so nothing to analyze.

 

[rurbaniak]

Well, I took a stab in the dark and solved it. It ended up being a flaky UPS battery. I replaced that, haven't had a problem since. It's VERY strange that it would happen the same time everyday, and nothing else outside the UPS was affected. Weird.

 

[NYJimbo]

Well, I took a stab in the dark and solved it. It ended up being a flaky UPS battery. I replaced that, haven't had a problem since. It's VERY strange that it would happen the same time everyday, and nothing else outside the UPS was affected. Weird.

How did you isolate the UPS battery?. I mean what gave you the clue it was the battery ?.

 

[rurbaniak]

How did you isolate the UPS battery?. I mean what gave you the clue it was the battery ?.

Removed it from the UPS to start, and the issue was gone. Then replaced the battery, and that worked. No lights or anything on the UPS indicating any problems.