Guest samizza Posted November 27, 2007 Posted November 27, 2007 This problem started two weeks ago and occurs after the server has run approx. 30 hours. The errors seem related and all seem to occur with a couple of minutes of each error. Once the errors occur, Event Viewer messages repeat every few minutes (for hours) until I reboot the server. After rebooting the server, it will run fine with no errors, Event Viewer, for another 30 hours or so, before repeating the same errors. The server is about 3 yrs. old. and up until now, I've never had any type of problem with this server. I haven't installed any new software on the server and its scans clean (AV and Spyware). The errors that occur, in Event Viewer, are Application error, System error, and DNS error. When the errors occur [below] the server drops all network connections, and the F: <network drive> drive cannot be accessed even from the server itself. Our sever: Windows 2003 server with SP2, TCP/IP, running DHCP, 20 users. The T1 and DNS are provided by our VOIP service provider. In the DNS server, the DNS entry is the server's IP address and the Forward-looking Primary/Secondary DNS is the DNS of our VOIP/T1 provider. This server is only used for office file storage/access, and IIS is not used or running.
Guest Pegasus \(MVP\) Posted November 27, 2007 Posted November 27, 2007 Re: Server error messages every 30 hours "samizza" <samizza@discussions.microsoft.com> wrote in message news:D4893844-4425-4E92-B04B-35593AD14CF2@microsoft.com... > This problem started two weeks ago and occurs after the server has run > approx. 30 hours. The errors seem related and all seem to occur with a > couple > of minutes of each error. Once the errors occur, Event Viewer messages > repeat > every few minutes (for hours) until I reboot the server. After rebooting > the > server, it will run fine with no errors, Event Viewer, for another 30 > hours > or so, before repeating the same errors. The server is about 3 yrs. old. > and > up until now, I've never had any type of problem with this server. I > haven't > installed any new software on the server and its scans clean (AV and > Spyware). > > The errors that occur, in Event Viewer, are Application error, System > error, > and DNS error. When the errors occur [below] the server drops all network > connections, and the F: <network drive> drive cannot be accessed even from > the server itself. > > Our sever: Windows 2003 server with SP2, TCP/IP, running DHCP, 20 users. > The T1 and DNS are provided by our VOIP service provider. In the DNS > server, > the DNS entry is the server's IP address and the Forward-looking > Primary/Secondary DNS is the DNS of our VOIP/T1 provider. This server is > only > used for office file storage/access, and IIS is not used or running. > Might be a good idea to post some of the error messages you see. Also: Since the problem occurs regularly every 30 hours, you might have a memory leak that causes the machine to run out of memory. A frequent look at the Task Manager would confirm this.
Guest samizza Posted November 27, 2007 Posted November 27, 2007 Re: Server error messages every 30 hours Might be a good idea to post some of the error messages you see. Also: Since the problem occurs regularly every 30 hours, you might have a memory leak that causes the machine to run out of memory. A frequent look at the Task Manager would confirm this. ----------------- The error messages below are the one that happen at approx. 30 hours of uptime, and all happen just about the same: =======//////// APPLICATION ERRORS Event Type: Error Event Source: Userenv Event ID: 1053 User: NT AUTHORITY\SYSTEM Computer: SERVER Description: Windows cannot determine the user or computer name. (Not enough storage is available to complete this operation. ). Group Policy processing aborted. Event Type: Error Event Source: Userenv Event ID: 1030 User: NT AUTHORITY\SYSTEM Computer: SERVER Description: Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this. =======//////// SYSTEM ERROR Event Type: Error Event Source: Srv Event Category: None Event ID: 2019 Computer: SERVER Description: The server was unable to allocate from the system nonpaged pool because the pool was empty. =======//////// DNS ERRORS Event Type: Error Event Source: DNS Event Category: None Event ID: 4000 Computer: SERVER Description: The DNS server was unable to open Active Directory. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code. Event Type: Error Event Source: DNS Event Category: None Event ID: 4015 Computer: SERVER Description: The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error. Event Type: Warning Event Source: DNS Event Category: None Event ID: 9999 Computer: SERVER Description: The DNS server has encountered numerous run-time events. To determine the initial cause of these run-time events, examine the DNS server event log entries that preceded these run-time events. The data is the number of events that have been suppressed in the last 60 minute interval.
Guest Hank Arnold (MVP) Posted December 3, 2007 Posted December 3, 2007 Re: Server error messages every 30 hours samizza wrote: > Might be a good idea to post some of the error messages you see. > Also: Since the problem occurs regularly every 30 hours, you might > have a memory leak that causes the machine to run out of memory. > A frequent look at the Task Manager would confirm this. > ----------------- > > The error messages below are the one that happen at approx. 30 hours of > uptime, and all happen just about the same: > > =======//////// APPLICATION ERRORS > > Event Type: Error > Event Source: Userenv > Event ID: 1053 > User: NT AUTHORITY\SYSTEM > Computer: SERVER > Description: Windows cannot determine the user or computer name. (Not enough > storage is available to complete this operation. ). Group Policy processing > aborted. > > Event Type: Error > Event Source: Userenv > Event ID: 1030 > User: NT AUTHORITY\SYSTEM > Computer: SERVER > Description: Windows cannot query for the list of Group Policy objects. > Check the event log for possible messages previously logged by the policy > engine that describes the reason for this. > > =======//////// SYSTEM ERROR > > Event Type: Error > Event Source: Srv > Event Category: None > Event ID: 2019 > Computer: SERVER > Description: The server was unable to allocate from the system nonpaged pool > because the pool was empty. > > =======//////// DNS ERRORS > > Event Type: Error > Event Source: DNS > Event Category: None > Event ID: 4000 > Computer: SERVER > Description: The DNS server was unable to open Active Directory. This DNS > server is configured to obtain and use information from the directory for > this zone and is unable to load the zone without it. Check that the Active > Directory is functioning properly and reload the zone. The event data is the > error code. > > Event Type: Error > Event Source: DNS > Event Category: None > Event ID: 4015 > Computer: SERVER > Description: The DNS server has encountered a critical error from the Active > Directory. Check that the Active Directory is functioning properly. The > extended error debug information (which may be empty) is "". The event data > contains the error. > > Event Type: Warning > Event Source: DNS > Event Category: None > Event ID: 9999 > Computer: SERVER > Description: The DNS server has encountered numerous run-time events. To > determine the initial cause of these run-time events, examine the DNS server > event log entries that preceded these run-time events. The data is the number > of events that have been suppressed in the last 60 minute interval. > > http://eventid.net is your friend..... =========================================== http://eventid.net/display.asp?eventid=1053&eventno=1584&source=Userenv&phase=1 http://eventid.net/display.asp?eventid=1030&eventno=1542&source=Userenv&phase=1 http://eventid.net/display.asp?eventid=2019&eventno=661&source=Srv&phase=1 http://eventid.net/display.asp?eventid=4000&eventno=296&source=DNS&phase=1 http://eventid.net/display.asp?eventid=4015&eventno=333&source=DNS&phase=1 http://eventid.net/display.asp?eventid=9999&eventno=281&source=DNS&phase=1 -- Regards, Hank Arnold Microsoft MVP Windows Server - Directory Services
Guest samizza Posted December 3, 2007 Posted December 3, 2007 Re: Server error messages every 30 hours Thanks Hank. I've been through a lot of the information on EventID, but this seems to be more than a group of unrelated error messages. They all occur at almost exactly at 29 hours & 30 minutes after rebooting. I was watching it this weekend when it occured. It's not like the server resources dwindle down to nothing and then error out. It's like everything is running fine, with no errors at all in Event Viewer, and then the whole system just runs off a cliff and then the multiple errors occur. The errors that happened this time at 29 hours/30min: Event Type: Error Event Source: Userenv Event ID: 1058 Date: 12/1/2007 Time: 1:04:27 AM Computer: SERVER Description: Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F- 00C04FB984F9},CN=Policies,CN=System,DC=acb,DC=local. The file must be present at the location <\\acb.local\sysvol\acb.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Configuration information could not be read from the domain controller, either because the machine Event Type: Error Event Source: DNS Event ID: 4015 Date: 12/1/2007 Time: 1:07:23 AM Computer: SERVER Description: The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". Event Type: Error Event Source: DNS Event Category: None Event ID: 4004 Date: 12/1/2007 Time: 1:07:23 AM Computer: SERVER Description: The DNS server was unable to complete directory service enumeration of zone .. This DNS server is configured to use information obtained from Active Directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and repeat enumeration of the zone. The extended error debug information (which may be empty) is "". The event data contains the error. Event Type: Error Event Source: DNS Event Category: None Event ID: 4000 Date: 12/1/2007 Time: 1:13:23 AM User: N/A Computer: SERVER Description: The DNS server was unable to open Active Directory. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code. THEN LATER THESE 2 ERRORS: Event Type: Error Event Source: Userenv Event Category: None Event ID: 1053 Date: 12/1/2007 Time: 1:41:04 AM User: NT AUTHORITY\SYSTEM Computer: SERVER Description: Windows cannot determine the user or computer name. (Not enough storage is available to complete this operation. ). Group Policy processing aborted. Event Type: Warning Event Source: DNS Event Category: None Event ID: 3000 Date: 12/1/2007 Time: 1:49:23 AM User: N/A Computer: SERVER Description: The DNS server has encountered numerous run-time events. To determine the initial cause of these run-time events, examine the DNS server event log entries that precede this event. To prevent the DNS server from filling the event log too quickly, subsequent events with Event IDs higher than 3000 will be suppressed until events are no longer being generated at a high rate. Event Type: Warning Event Source: W32Time Event Category: None Event ID: 36 Date: 11/30/2007 Time: 7:27:31 PM Computer: SERVER Description: The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. Monitor the system events displayed in the Event Viewer to make sure that a more serious problem does not exist. Thanks, any help appreciated.
Guest Pegasus \(MVP\) Posted December 3, 2007 Posted December 3, 2007 Re: Server error messages every 30 hours "samizza" <samizza@discussions.microsoft.com> wrote in message news:B2F205AF-19B5-43FF-B87D-237C8BA52DAB@microsoft.com... > Thanks Hank. I've been through a lot of the information on EventID, but > this > seems to be more than a group of unrelated error messages. They all occur > at > almost exactly at 29 hours & 30 minutes after rebooting. I was watching it > this weekend when it occured. It's not like the server resources dwindle > down > to nothing and then error out. It's like everything is running fine, with > no > errors at all in Event Viewer, and then the whole system just runs off a > cliff and then the multiple errors occur. > > The errors that happened this time at 29 hours/30min: > > Thanks, any help appreciated. What happens if you reboot the server after 15 hours? Will you get these messages 15 hours 30 minutes later, or 29 hours 30 minutes later?
Guest samizza Posted December 3, 2007 Posted December 3, 2007 Re: Server error messages every 30 hours "Pegasus (MVP)" wrote: Q: What happens if you reboot the server after 15 hours? Will you get these messages 15 hours 30 minutes later, or 29 hours 30 minutes later? A: If I reboot reboot the server after 15 hours, the errors won't appear until 29 hours 30 minutes later after rebooting. It's like rebooting resets 29 hour 30 minute clock.
Guest Pegasus \(MVP\) Posted December 4, 2007 Posted December 4, 2007 Re: Server error messages every 30 hours "samizza" <samizza@discussions.microsoft.com> wrote in message news:67432311-4E56-47BC-AA20-FE6FD96ADE92@microsoft.com... > "Pegasus (MVP)" wrote: > > Q: What happens if you reboot the server after 15 hours? Will you get > these messages 15 hours 30 minutes later, or 29 hours 30 minutes > later? > > A: If I reboot reboot the server after 15 hours, the errors won't appear > until 29 hours 30 minutes later after rebooting. It's like rebooting > resets > 29 hour 30 minute clock. I suspect a rogue program. If this was my machine then I would look at the "Services" tab in msconfig.msc and hide all Microsoft services. I would then disable all of those that were not obviously legitimate. I would also disable the virus scanner and third-party firewall (if you have one) over a weekend when the server can be disconnected from the network and from the Internet. Virus scanners are very intrusive and can have disastrous effects on a machine.
Recommended Posts