none
Server 2008 freezes every 4-6 days

    Question

  • Scenario

    Windows 2008 server appears to freezes every few days. There is no pattern to the freezing (time of day) but it is very regular.

    Server can be pinged but does not respond to anything else. Console keyboard/mouse frozen.

    I have installed the Dell online diagnostic tools and run a full extended suite of tests and all hardware passed.

    Latest BIOS installed and latest PERC BIOS installed.

    I have removed Shadowprotect but this did not fix.

    In the SYSTEM Event Log it appears that the server has lost access to the disks.

    There can be lots of Event ID 51 - An error was detected on device \Device\Harddisk0\DR0 during a paging operation.

    Also Event ID 6 - An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): '\SystemRoot\System32\Config\SOFTWARE'.

    Hardware

    Dell PowerEdge 2900

    4x4GB Memory.

    4x300GB SAS disks connected to Perc/6i onboard controller in RAID5+1 configuration.

    Software

    Windows Server 2008 SP2 fully patched (Security & Critical)

    Shadowprotect 5.1.5

    Labtech

    MYOB

    Thursday, June 19, 2014 10:30 AM

All replies

  • Hi Mark,

    I find this well described blog that elaborate and troubleshoot this concern respectively. Please checkout if you you find this helpful in your circumstance : http://www.zdnet.com/blog/datacenter/random-freeze-problem-chills-windows-server-2008-r2-windows-7/411

    Please also check this earlier discussed thread :https://forums.plex.tv/index.php/topic/47416-windows-server-2008-r2-freezing/


    Carlo

    Thursday, June 19, 2014 10:43 AM
  • Hi Mark,

    Any update?

    Just additional. Please check if a low memory condition occurred on the server. Meanwhile, please run sfc /scannow command to scan all protected system files and check if find issues.

    Regarding to Events, please refer to following articles and check if can help you.

    Information about Event ID 51

    Event ID: 51 Source: Disk

    Event ID: 6 Source: Microsoft-Windows-Kernel-General

    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    Hope this helps.

    Best regards,

    Justin Gu
    Monday, June 23, 2014 5:46 AM
    Moderator
  • No update yet. Have set a daily reboot schedule and no problems since. However this is not a solution, more a band aid. I have installed the LSI Megaraid Storage Manager software to try diagnose and disk/battery or card faults. There are some unexpected sense information messages but otherwise everything looks good. I shall read through the earlier responses now and see if there is any relevance. I notice that the links refer to 2008R2 and NOT 2008.
    Friday, June 27, 2014 11:05 AM
  • Situation to date.

    Reading some of the comments I did a sfc /scannow

    This found several errors in the system files and corrected them.

    I took the auto-reboot (at 7AM) off the server and waiting.

    On day 5 (whilst I was onsite) the server froze.

    I could see disk activity, I could ping the server. The console keyboard and mouse were frozen.

    I could not browse to the server or RDP.

    So now I'm back to the daily reboot.

    Any more suggestions?

    Thursday, July 17, 2014 12:43 PM
  • More info

    I believe that something happens which creates a deadlock stopping disk activity since the following errors all relate to disk activity.

    At the point of the freeze the following events were in the system event log

    Log Name:      System
    Source:        Microsoft-Windows-Kernel-General
    Date:          15/07/2014 11:59:39 AM
    Event ID:      6
    Task Category: None
    Level:         Error
    Keywords:     
    User:          SYSTEM
    Computer:      Server3.x.local
    Description:
    An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): '\SystemRoot\System32\Config\SOFTWARE'.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-General" Guid="{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}" />
        <EventID>6</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2014-07-15T01:59:39.080Z" />
        <EventRecordID>732195</EventRecordID>
        <Correlation />
        <Execution ProcessID="2520" ThreadID="12700" />
        <Channel>System</Channel>
        <Computer>Server3.X.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="FinalStatus">0xc000014d</Data>
        <Data Name="ExtraStringLength">36</Data>
        <Data Name="ExtraString">\SystemRoot\System32\Config\SOFTWARE</Data>
      </EventData>
    </Event>

    Log Name:      System
    Source:        Application Popup
    Date:          15/07/2014 12:00:39 PM
    Event ID:      26
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      Server3.x.local
    Description:
    Application popup: dsm_sa_datamgr64.exe - Application Error : The exception unknown software exception (0xc0000417) occurred in the application at location 0x743b0468.

    Click on OK to terminate the program
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Popup" />
        <EventID Qualifiers="16384">26</EventID>
        <Level>4</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-07-15T02:00:39.000Z" />
        <EventRecordID>732198</EventRecordID>
        <Channel>System</Channel>
        <Computer>Server3.x.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data>dsm_sa_datamgr64.exe - Application Error</Data>
        <Data>The exception unknown software exception (0xc0000417) occurred in the application at location 0x743b0468.

    Click on OK to terminate the program</Data>
      </EventData>
    </Event>

    Log Name:      System
    Source:        Service Control Manager
    Date:          15/07/2014 12:00:40 PM
    Event ID:      7034
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      Server3.x.local
    Description:
    The DSM SA Data Manager service terminated unexpectedly.  It has done this 1 time(s).
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />
        <EventID Qualifiers="49152">7034</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-07-15T02:00:40.000Z" />
        <EventRecordID>732201</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>Server3.x.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">DSM SA Data Manager</Data>
        <Data Name="param2">1</Data>
      </EventData>
    </Event>

    Log Name:      System
    Source:        Service Control Manager
    Date:          15/07/2014 12:00:44 PM
    Event ID:      7031
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      Server3.blairlogie-inc.local
    Description:
    The Microsoft Exchange Transport service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />
        <EventID Qualifiers="49152">7031</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-07-15T02:00:44.000Z" />
        <EventRecordID>732202</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>Server3.blairlogie-inc.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">Microsoft Exchange Transport</Data>
        <Data Name="param2">1</Data>
        <Data Name="param3">5000</Data>
        <Data Name="param4">1</Data>
        <Data Name="param5">Restart the service</Data>
      </EventData>
    </Event>

    Log Name:      System
    Source:        Service Control Manager
    Date:          15/07/2014 12:00:50 PM
    Event ID:      7000
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      Server3.x.local
    Description:
    The Microsoft Exchange Transport service failed to start due to the following error:
    Insufficient system resources exist to complete the requested service.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />
        <EventID Qualifiers="49152">7000</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-07-15T02:00:50.000Z" />
        <EventRecordID>732203</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>Server3.x.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">Microsoft Exchange Transport</Data>
        <Data Name="param2">%%1450</Data>
      </EventData>
    </Event>

    Log Name:      System
    Source:        srv
    Date:          15/07/2014 12:00:49 PM
    Event ID:      2019
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      Server3.x.local
    Description:
    The server was unable to allocate from the system nonpaged pool because the pool was empty.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="srv" />
        <EventID Qualifiers="49152">2019</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-07-15T02:00:49.440Z" />
        <EventRecordID>732204</EventRecordID>
        <Channel>System</Channel>
        <Computer>Server3.x.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data>\Device\LanmanServer</Data>
        <Binary>0000040001002C0000000000E30700C0000000009A0000C00000000000000000000000000000000002000000</Binary>
      </EventData>
    </Event>

    Log Name:      System
    Source:        disk
    Date:          15/07/2014 12:01:06 PM
    Event ID:      51
    Task Category: None
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      Server3.x.local
    Description:
    An error was detected on device \Device\Harddisk0\DR0 during a paging operation.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="disk" />
        <EventID Qualifiers="32772">51</EventID>
        <Level>3</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-07-15T02:01:06.117Z" />
        <EventRecordID>732208</EventRecordID>
        <Channel>System</Channel>
        <Computer>Server3.x.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data>\Device\Harddisk0\DR0</Data>
        <Binary>040080000100000000000000330004802D0100009A0000C00000000000000000000000000000000059F9D40100000000FFFFFFFF010000005800003000010000F0200A128203204000000500A0000000000005000000000078AF791180FAFFFF0000000000000000B0783BF482FAFFFF00000000000000009A0000C0000000002A003E2084F800028000000000000000000000000000000000000000000000000000000000000000</Binary>
      </EventData>
    </Event>

    Thursday, July 17, 2014 1:12 PM