locked
Attempting to determine what might be causing a SharePoint 2007 server to stop responding RRS feed

  • Question

  • Several times in the past few months, users attempting to access our MOSS 2007 server have found that during the early morning hours on Sunday, they are unable to access their data. Each time, they report the problems to the server hardware group, who reboot the machine and the access is restored.

    I am not certain how to best determine what might be going on at that time and at no other time.

    We have made no changes to the configuration of the SharePoint instance. The regular sysadmin no longer works here, and I am trying to teach myself as we go along. 

    In the event logs, we see

    Event Type: Warning

    Event Source: LSASRV

    Event Category: SPNEGO (Negotiator)

    Event ID: 40960

    Date: 1/30/2011

    Time: 12:14:58 AM

    User: N/A

    Computer: oursp2007

    Description:

    The Security System detected an authentication error for the server MSSQLSvc/SQLPS0001.our.domain.net:3822. The failure code from authentication protocol Kerberos was "The specified user does not exist.

    (0xc0000064)".

    I am uncertain where to look within SharePoint to track down what this mirght be as well. I have not been able to confirm whether these two problems are related or not.  The failure to login only occurs on Sunday am from what I can tell.

    Does anyone have a pointer to something I can read or some place I can get some help figuring out what is going on with our system?

    Thank you very much.

     

    Monday, February 28, 2011 12:31 PM

All replies

  • Hi,

    Please refer 

    http://www.eventid.net/display.asp?eventid=40960&eventno=8508&source=LSASRV&phase=1

    http://support.microsoft.com/kb/824217 


    Regards, Pratik Vyas | SharePoint Consultant | http://sharepointpratik.blogspot.com/
    Monday, February 28, 2011 1:44 PM
  • I read the above items, but I am not certain how they apply to my situation.  I do note in the support article the sentenct:

     

    In order to obtain this information, auditing for User Logon Failures must be enabled.In order to obtain this information, auditing for User Logon Failures must be enabled.In order to obtain this information, auditing for User Logon Failures must be enabled.

     In order to obtain this information, auditing for User Logon Failures must be enabled.

    but I do not know what it means to enable the auditing for user logon failures.

    I have been told by the database admins that at the time the above errors appear on the sharepoint site, there is an attempt, from the sharepoint machine, to log into the sql server 2005 machine by a user of '' - that is, an empty string.

    I have not been able to find anything useful in the 12 hive logs that tell me what might be going on during that time. I have restarted the timer service to hopefully begin getting a bit more useful information - all I was getting was wsstracing statements in the logs.

    I have been attempting to locate information to teach me more about how to identify what specific sharepoint tasks might be running at the time in question but so far ...

    Monday, February 28, 2011 2:14 PM