Thanks for the excellent input Ken and Bonnie.
I've been researching bugcheck codes and running diagnostics. Found some power
supply errors which I corrected and also had a ECC error on Bank 2 Dimm A,
first documented on 08/2006. Switched dimms around and immediately produced
multiple errors on the same bank. Removed that bank of dimms and had high hopes
that would correct the issue. BSOD 20 minutes later.Down loadingg Open Mange
now so I can attempt to clear errors and look deeper. Still no dmp files.
Plenty of room on the pagefile drive.
Not running the /3GB switch in the boot.ini.
Haven't heard a word from Trend or MS although I have open cases with them.
May try the reg hack Bonnie suggested. I have nothing to lose.
Example of screenscrees listed below. 0XF4 and 0X21A are the most common.
STOP: c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status
of 0X00000080 (0X00000000 0X00000000).
The system has been shut down.
A process or thread crucial to system operation has unexpectedly exited or been
terminated. Technical Information: *** STOP: 0X000000F4, (0X00000003,
0X89BFD7B0, 0X89BFD914 0X8094B734)
Saw the following ONCE:
KERNEL_STACK_INPAGE_ERROR
***STOP: 0X00000077 (0XC0000185, 0XC0000185, 0X00000000, 0X008C3000)
Thanks
Steve
From:
Ken Schaefer [EMAIL PROTECTED]
If dump files are not being generated then:
a) You have an issue with mass storage controller drivers or similar
Windows could be losing access to the underlying storage. Check the Bug Check
code *on the screen*
b) You do not have sufficient page file space on your boot drive (the one
that holds your pagefile). Dump information (except minidumps) are written to
pagefile.sys. When the machine next starts up, savedump.exe copies content out
of the pagefile.sys file and into memory.dmp
Cheers
Ken
-------------- Original message --------------
From: Miller Bonnie L. <[EMAIL PROTECTED]>
Ugh
the only other thing *like* this Ive seen with Trend (and A/V in general)
is usually kernel memory related. If your server has enough free memory, try
upping the pool amount available by adding the two reg entries from
http://support.microsoft.com/kb/312362/en-us.
Ive had to up these values on most of our systems that are a) file servers, b)
run file level A/V, c) run VSS, and sometimes d) also use quota software (FSRM
in our case). Basically its just a lot of stuff crammed into the kernel
memory space. The first symptom I usually see when the kernel memory starts to
run low is that Ill try to RDP to the server, but the interface just kicks me
back to the screen where you enter the server name, with no errors. If it goes
long enough, the console itself will become sluggish to unresponsive, and
eventually the server will crash altogether, sometimes giving me a BSOD and
other times not.
One other note, you cant be using the /3GB switch in your boot.ini either as
it limits the kernel memory space. I went through this one with Trend on
version 7.3, but it still applies to 8.x.
There is a good way to view your kernel memory usage with a combination of
using MS Sysinternals Process Explorer while having the MS debugger tools
loaded and pointing at the MS symbol server. I can share more on this if you
need a quick how-to, but I originally got this from Trend when troubleshooting
this same issue on 7.3, so I would hope they (and MS) would know how to check
for this sort of problem.
Good luck,
-Bonnie
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Thursday, June 05, 2008 6:20 AM
To: NT System Admin Issues
Subject: RE: Trend 8.0 server hang - revisiting
Two months. That's right, two $*#!!*$ months. Still getting a BSOD on my Trend
8.0 server without generating any .dmp files. I've spent probably 25 hours or
so with Trend and MS tech support. Webex sessions, specialists, conference
calls, tin foil hats, barking at the moon. Updated BIOS, Perc, Nic, video, RAID
drivers. UN-installed the Trend client from the server. Only Trend Service
running is the Master Service. Nothing else on the server except a print queue
that myself and one other person uses on a fairly limited basis. Any thoughts
or suggestions appreciated. In the interim, I'm going to go stick a pencil in
my eye. Thanks for letting me rant.
Steve
-------------- Forwarded Message: --------------
From: "Terry Dickson" <[EMAIL PROTECTED]>
To: "NT System Admin Issues" <ntsysadmin@lyris.sunbelt-software.com>
Subject: RE: Trend 8.0 server hang
Date: Thu, 10 Apr 2008 14:24:03 +0000
Good question, but also how do you have Windows Updates set, do you have
automatic updates turned on?
-----Original Message-----
From: Miller Bonnie L. [mailto:[EMAIL PROTECTED]
Sent: Thursday, April 10, 2008 9:00 AM
To: NT System Admin Issues
Subject: RE: Trend 8.0 server hang
Steve-when you say patched, do you mean the OSC server has been patched
with Trend's patch 2 or 3 (3 just came out yesterday), or are you
talking about Windows patches? There are some serious problems prior to
patch1.
If it is all patched up from Trend, make sure you have a utomatically
restart unchecked (control panel, system, advanced, startup and recovery
settings). That way if it is BSOD'ing, you can see the screen in the
morning.
One other thing I've seen with Trend (both 7.x and 8.x) is kernel memory
issues (again, mostly prior to the latest patches, but I haven't tried
patch3 yet). During the time your server is "hung", can you RDP to the
console session? If it kicks you back to the server name screen, or
gives you a strange error about session 0, I'd put money on a kernel
memory issue. We've found we pretty much can't use the /3GB switch in
the boot.ini when we see this happening, but it also can take some
registry tuning. Another way to troubleshoot on this is to try and
RDP-if it fails, connect remotely with computer management to the
server. Stop the Officescan realtime scanner service, and RDP will
generally start working. Still takes a reboot to clear the problem, b ut
that would also indicate the kernel mem issue. If you leave the system
long enough, it will eventually BSOD.
-Bonnie
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Thursday, April 10, 2008 6:46 AM
To: NT System Admin Issues
Subject: Trend 8.0 server hang
Fresh install of Office Scan 8.0 patched on a fresh W2K3 standard server
SP1. Serve reboots or hangs usually around 1-3 AM intermittantly. No
memory dumps, no event log info other than the reboot was unexpected.
This morning, server appeared to be up and running but could not get any
programs or desktop icons to respond. Hard reboot was needed. Event
viewer states unexpected reboot at 1:03 AM but server appeared to be up
and running. Any one else encountered anything like this? I will call
Trend (again) but my phone system coughed up a large hair ball overnight
so I thought I'd throw this out to the list. Thanks.
< BR>Steve
~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~
~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
