Server shutting off

[SynapseTech]

Built a new server for a customer that is running Server 2012 Essentials. Its been running great during the day but there has been 2 occasions in the last month where they have come in and the server has been off. I'm not good with log files and I don't know where to look to see what happened. I can see a bunch of them under computer managment>event viewer but there are so many.

I'll be on site on Monday to do some hardware testing but until then I want to see if there is anything I can check remotely to try and determine the problem.

Any log file gurus out there that can help me look in the right place?

 

[drjones]

You need to give waaaaaay more info:

First I think this is probably more of a hardware/electrical issue. That said:

- What type of server? This had better be brand new Dell, Lenovo, HP, etc. hardware, NOT a home/custom-built unit.

- What UPS is attached; brand, make & model? How old is it? If you're not sure or know it's a couple years old, install a replacement.

- Rule out any other electrical issues or connections; are the power cables being used for the server brand new? Is anything else plugged into the outlet/circuit that the server is using?

I'd start there...

 

[drjones]

Also, you must ensure the UPS attached is a Smart UPS with PFC - if it is not, that will cause this problem. AFAIK, virtually all servers require UPS's to have PFC and many higher-end power supplies do as well.

 

[4ycr]

can you see what time it shuts off at? Is it the same time every night?

I have GFI installed on servers that I manage and get an email when they don't check in, this helps me determine when thing went wrong so helps me look through the log files.

If you know the time look for warning or errors in all the logs. It is probably electrical but the last time I got called to a new customer with this problem they had used an illegal copy of server 2008 (not saying they have that) and it shut itself down.

Also check for automated task to see if something is set to shut down after completion.

 

[MobileTechie]

You have to learn to read log files if you work on servers, it's essential.

For this problem it should be especially easy since all the log entries will sudden stop at the time it went off. Then all you need to do is to look at the entries just before that. Start with the ones with red exclamation marks in the Administrative Events section

Also it's worth running bluescreenview to see if there have been any error dumps created which might tell you of problems with drivers, OS files, memory and so on.

 

[mr m]

Is this a "true" server with multiple power supplies? If not I'd bet you're fighting a flaky PS. Even with more than one PS you have to set them up right to ensure redundancy.

The classic symptom of a failing PS will log an event like "the previous system shutdown at x:xx:xx on x/x/xxxx was unexpected. Then it will state the system has rebooted without a clean shutdown."

I had a few PS's fail like this over the years. The last one would run great for a day or two then crash with no warning. The mobo LED was lit but the fans were silent. I'd have to cycle the power switch on the PS, reboot and all was well until the next crash. I swapped it for a spare I keep in my truck while I was troubleshooting their power etc. After a week I knew I had fixed.

 

[SynapseTech]

OK! Got some more information.

The server is running Server Essentials 2012. It is a custom built computer designed specifically for hosting a 20GB data file for 16 PC's to simultaneously access. This is its only job, PERIOD.

The server is not running a domain. Active directory has been disabled. It is currently operating on a workgroup. The reason for this is because all other workstations are running W7 HP and can not join the domain.

The server is turning off like clock work once a week. In digging through the logs I found this:

Log Name: System
Source: User32
Date: 1/16/2014 6:37:09 AM
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: XXXXXXX
Description:
The process C:\Windows\system32\silsvc.exe (XXXXXXX) has initiated the shutdown of computer XXXXXXX on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
Reason Code: 0x80070000
Shutdown Type: shutdown
Comment: Licensing Compliance Service caused a shutdown. Please look at the events under Microsoft > Windows > Server Infrastructure Licensing > Operational for details.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="User32" Guid="{b0aa8734-56f7-41cc-b2f4-de228e98b946}" EventSourceName="User32" />
<EventID Qualifiers="32768">1074</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2014-01-16T13:37:09.383244100Z" />
<EventRecordID>34256</EventRecordID>
<Correlation />
<Execution ProcessID="452" ThreadID="552" />
<Channel>System</Channel>
<Computer>XXXXXXX</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="param1">C:\Windows\system32\silsvc.exe (XXXXXXX)</Data>
<Data Name="param2">XXXXXXX</Data>
<Data Name="param3">Legacy API shutdown</Data>
<Data Name="param4">0x80070000</Data>
<Data Name="param5">shutdown</Data>
<Data Name="param6">Licensing Compliance Service caused a shutdown. Please look at the events under Microsoft &gt; Windows &gt; Server Infrastructure Licensing &gt; Operational for details.</Data>
<Data Name="param7">NT AUTHORITY\SYSTEM</Data>
</EventData>
</Event>

Any help on this would be great!

Oh and before anyone asks, yes it is running with a legitimate copy of SE2012.

 

[Mokester]

Okay...thats a system log pointing to licensing issues...did you dig into the log files in the location referenced for more details? Microsoft licensing for servers can get a little tricky unless you are familiar with it...please post the events in the log file referenced.

 

[NYJimbo]

"The server is turning off like clock work once a week. "

Can you pinpoint it, exact time of day/week or amount of hours passed ? Sounds like an event checking on licensing if its like this.

This might give you a start (refers to 2011, not 2012, but whatever)

http://social.technet.microsoft.com...unexpected-shutdown?forum=smallbusinessserver

 

[Markverhyden]

Watch out - the licensing Police will be coming after you (just kidding)

SE must be a Domain just like SBS. It's even in the EULA. Since you are breaking the EULA it is shutting down.

Running Instances of the Server Software. You may run, at any one time, one instance of the server software in one physical operating system environment or one instance in one virtual operating system environment on the licensed server. You must run the server software within a domain where the server’s Active Directory is configured:
· as the domain controller (a single server which contains all the flexible single master operations (FSMO) roles);
· as the root of the domain forest;
· not to be a child domain, and
· to have no trust relationships with any other domains.

 

[SynapseTech]

Watch out - the licensing Police will be coming after you (just kidding)

SE must be a Domain just like SBS. It's even in the EULA. Since you are breaking the EULA it is shutting down.

That was it! I turned the domain server back on and the issue has been resolved. I had already configured all my users so all connected workstations didn't even notice the change.

Thanks for pointing that out!