Exchange Server 2003 is running on a Windows Server 2003 machine, and has been for a year plus with zero problems. No recent changes made anywhere in system. Recently the WS has been shutting down in early morning hours, usually 2-2:30 AM. Nothing in Event Log except after-the-fact noitce that server had an unexpected shutdown at a certain time and a dialog box on login after restart to note the problem. Problem was happening occasionally then began every nighit. Last couple of days we've stopped all Exchange services when we go home, and server has been still running in the morning; that's why we think it is Exchange. Other than this system and Exchange seem fine. Norm D

Exchange itself is unlikely to have been exploding the box. Focus on A/V or Backup stuff. You know when the thing died, is there anything that was scheduled to run around that time? "Norm D" wrote in message news:e054daba-48a6-4a4e-8cea-304d506cea1f... Exchange Server 2003 is running on a Windows Server 2003 machine, and has been for a year plus with zero problems. No recent changes made anywhere in system. Recently the WS has been shutting down in early morning hours, usually 2-2:30 AM. Nothing in Event Log except after-the-fact noitce that server had an unexpected shutdown at a certain time and a dialog box on login after restart to note the problem. Problem was happening occasionally then began every nighit. Last couple of days we've stopped all Exchange services when we go home, and server has been still running in the morning; that's why we think it is Exchange. Other than this system and Exchange seem fine. Norm DMark Arnold, Exchange MVP.

Thanks for responding and your thoughts, Mark. Backup is not running. AV is but I have it set to do its signature update around 12 noon because of this problem. The reason I point at Exchange is now that we're stopping all running Exchange services at the end of the day (5 PM or so) the server has remained up. In any case nothing's been changed on the server. No new software added, nothing removed. Only way I know when it happened is Event Log entry after restarting about unexpected shutdown. Nothing I can see in logs in timeframe of when it went down to show anything, certainly nothing out of the ordinary; I'd think that the server would be dumping all sorts of warnings and errors before shutting down. The shutdown is not a graceful one, either. Aren't there things Exchange does at "night" for housecleaning? Can the times for these be 1) examined and 2) set? In our system Exchange is not getting mail from the outside world; that comes through the various Outlook cliients, so there is nothing going on re e-mail at this time of night. Would you know if there is stuff I can force on in Event log to show more?Norm D

Windows shoudl reflect event is system log for events like 6008,6009 etc which would indicate the likehood of failure. also some applications might be failing.. Also please initaite a dump by slecting computer properties, as this will dump memory when the unexpected restart occurs.

On Fri, 22 Oct 2010 16:03:13 +0000, Norm D wrote: > > >Thanks for responding and your thoughts, Mark. > >Backup is not running. AV is but I have it set to do its signature update around 12 noon because of this problem. > >The reason I point at Exchange is now that we're stopping all running Exchange services at the end of the day (5 PM or so) the server has remained up. Considering the time of the failure it's likely to be doing a LOT of disk I/O during the scheduled on-line defrag. If the event log doesn't record the reason for the system dying it's probably hardware related -- overheating, disk controller failure, powersupply problems, etc. >In any case nothing's been changed on the server. .. . . except the server's older. >No new software added, nothing removed. Only way I know when it happened is Event Log entry after restarting about unexpected shutdown. Okay, so the software's not crashing. Definitely time to start looking at hardware and environmentals. >Nothing I can see in logs in timeframe of when it went down to show anything, certainly nothing out of the ordinary; I'd think that the server would be dumping all sorts of warnings and errors before shutting down. The shutdown is not a graceful one, either. > >Aren't there things Exchange does at "night" for housecleaning? See above. >Can the times for these be 1) examined and 2) set? Yes, but they aren't the cause of the problem. They may be what's running at the time, but a server shouldn't be affected by the activity. >In our system Exchange is not getting mail from the outside world; that comes through the various Outlook cliients, so there is nothing going on re e-mail at this time of night. > >Would you know if there is stuff I can force on in Event log to show more? Doesn't the hardware vendor supply monitoring/managment software? Perhaps the reason for your server failing is stored in the BIOS and that software would tell you what it was. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

I do not believe it is hardware. With Exchange services stoped the server stays up. During the day is has - until today! - been fine. The physical driver are mirrored anad that software reports no problem. Today the server has shut down twice! It is ONLY when Exchange is running; when we stop the Exchange services at the end of the day, the server stays up. Leave them on and next morning the server is own. We've tried this several times. Re the defrag mentioned above, is this something I can force on when I want so I can observe what happens? Thanks for your various suggestions, folks! Regards, Norm D.Norm D

On Mon, 25 Oct 2010 20:02:16 +0000, Norm D wrote: > > >I do not believe it is hardware. With Exchange services stoped the server stays up. During the day is has - until today! - been fine. The physical driver are mirrored anad that software reports no problem. > >Today the server has shut down twice! > >It is ONLY when Exchange is running; when we stop the Exchange services at the end of the day, the server stays up. Leave them on and next morning the server is own. We've tried this several times. > >Re the defrag mentioned above, is this something I can force on when I want so I can observe what happens? > >Thanks for your various suggestions, folks! Exchanger is a "user". It doesn't run in the system address space and has no device drivers. Whatever is causing your problem isn't Excahgne. Exchange is just driving whatever is failing to the point where it fails. When you examine the System and Application logs, are there any indications as to what may be happening? What's the OEM for the hardware? It's not HP, is it? Running ILO? --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Machine is not HP; Tyan MB, AMD processor, 2 GB RAM, hardware mirroring of 2 HDDs. Primary use of machine is Exchange, AD and occasional backup with Backup Exec (it was not running when any of these crashed happened). I changed the time of day when Exchange defrag runs to 10 AM and machine made it through the night. Now that I see it apparently happens during defrag I will look at Application Log in Events to see what I can find. Exchange may not be causing the crash but is related to what is. Thanks again for your various suggestions and comments!Norm D

On Tue, 26 Oct 2010 18:15:39 +0000, Norm D wrote: >Machine is not HP; Tyan MB, AMD processor, 2 GB RAM, hardware mirroring of 2 HDDs. Ahhhh . . . one you built yourself? No diagnostic codes stored in the BIOS to record any hardware errors? >Primary use of machine is Exchange, AD and occasional backup with Backup Exec (it was not running when any of these crashed happened). So, does the machine "black screen" when it fails, or does it "blue screen"? Is it set to restart after a failure? If it is, change that so you have a chance to look at what's on the monitor. Is there a memory dump file? If not it's probably (but not certainly) the disk subsystem that's the problem. >I changed the time of day when Exchange defrag runs to 10 AM and machine made it through the night. > >Now that I see it apparently happens during defrag I will look at Application Log in Events to see what I can find. Exchange may not be causing the crash but is related to what is. Sure. Motherboard, disk controllers, memory, powersupply, overheating, etc. The same stuff I mentioned before. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks for sticking with me, Rich. Re BSOD, etc., I've not been around when it has died, principally because I try to be asleep at 2:30 AM. What we see when we come in is the machine is off, as in if you'd pressed the power button. Nothing on the monitor. The PS is still switched on, of course, the computer is still. To date I've not seen any messages in Events to indicate any sort of shutdown starting. Just the normal events up to a point, then the next is when we restart; then we get an event about the machine having shut down earlier. You got me thinking about hardware, specifically heat. We have another machine, same MB, CPU, memory, that suddenly died last year when the plastic mount for the CPU heat sink and fan broke a tab and the heat sink fell off! Machine didn't run very well then! Anyway, I checked the problem machine and all is well. All fans are turning, no sign of overtemps. When I build servers I actually use a cabinet fan blowing across the drives to remove heat. I don;t know how BIOS is set for restart on loss of popwer; will check this weekend or next time it goes down. I moved the defrag times to 6 and 7 PM for the public and private stores. It has stayed up for two days since doing that. More to follow.Norm D

On Wed, 27 Oct 2010 14:37:57 +0000, Norm D wrote: >Thanks for sticking with me, Rich. > >Re BSOD, etc., I've not been around when it has died, principally because I try to be asleep at 2:30 AM. What we see when we come in is the machine is off, as in if you'd pressed the power button. Well, then it isn't a software system crash that's causing the problem. >Nothing on the monitor. The PS is still switched on, of course, the computer is still. To date I've not seen any messages in Events to indicate any sort of shutdown starting. Just the normal events up to a point, then the next is when we restart; then we get an event about the machine having shut down earlier. Is the BIOS configured to start the machine after power is returned after a power loss? >You got me thinking about hardware, specifically heat. We have another machine, same MB, CPU, memory, that suddenly died last year when the plastic mount for the CPU heat sink and fan broke a tab and the heat sink fell off! Machine didn't run very well then! Anyway, I checked the problem machine and all is well. All fans are turning, no sign of overtemps. When I build servers I actually use a cabinet fan blowing across the drives to remove heat. > >I don;t know how BIOS is set for restart on loss of popwer; will check this weekend or next time it goes down. I should have read further before asking the question above. :-) >I moved the defrag times to 6 and 7 PM for the public and private stores. It has stayed up for two days since doing that. Do you have the machine on a UPS? Is it recording power sags, losses, or spikes around that time? --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

However it is shutting down, it strikes me as NOT graceful! Windows must feel the same way because of the "unexpected shutdown" message when we restart it. I do need to check the BIOS setting for how it handles a shutdown. Will check it this weekend. There IS power to the MB after it shuts down, but the "start" button has to be pressed to get it to boot. It (as are all of our machines, even workstations) is on a dedicated UPS with monitoring software. UPS is not making it shut down and there have been no power anomalies on any of our systems. Since moving the defrag times as stared above it has been okay, but a couple of days isn't a trend! Regards, Norm D. (Years ago - I've been working with computers for over 40 - there was a cover of a "data processing" magazine I got as a poster. Cartoon had a guy sitting at a PC - they were new then - with it in pieces, blackened, smoke coming out, and soot on his face. Ballon above his head had him thinking "Its never done that before." Re my server and this behaviour, "Its never done that before.")Norm D

On Thu, 28 Oct 2010 19:57:17 +0000, Norm D wrote: [ snip ] >(Years ago - I've been working with computers for over 40 I started out with IBM 402s in the mid 1960's. Then 1401s. Then Univac 1004s (kind of a backward step). So, yeah, I'm with ya (and then some). :-) > - there was a cover of a "data processing" magazine I got as a poster. Cartoon had a guy sitting at a PC - they were new then - with it in pieces, blackened, smoke coming out, and soot on his face. Ballon above his head had him thinking "Its never done that before." Re my server and this behaviour, "Its never done that before.") Computers run on smoke. You'll notice that whenever the smoke escapes they stop working. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Not to get off topic (I still will be looking at the BIOS settings this weekend), but I loved the smoke comment. By that metric a lot of things run on smoke! Undergrad experience: IBM 1620, machine language and FORTRAN II in 1963. Added a UNIVAC 1105 a year later when I started working (student) in a research lab. (In the event you don't know, that was a vacuum tube machine.) Occasional IBM 7000-series machines via service bureau for modeling work at lab. They added a 360/40. Used (once) a CDC 6600 for a big model. I think my cell phone has more horsepower now than any of these did! At work they don't let me program any more because FORTRAN (IV) ruined my thought processes (but I was a REALLY good FORTRAN programmer!). I'll let you know the results of the weekend experiment.Norm D