server freezing every 7- 10 days

[billb]

can anyone help out my chum - symptoms:

Windows 2000 DC has been throwing a
wobbly (I think that's the correct technical term) every 7-10 days. It
slows down to a snails pace with disk activity lights (3 disk RAID5)
almost constantly on.
By the time we have managed to log on (takes about an hour from login
screen to desktop) the server has settled down to normal activity again.
All partitions have plenty of unused space. Carried out a chkdsk on the
volumes but no errors reported.
Apart from the usual grumbles couldn't find anything of significance in
the Events logs.
The only software installed is Sophos AV and Backup Execv9

thanks

[rlk500]

Set up a performance monitor capture on the server. Capture, things like memory usage, paging, disk I/O, processor utilisation, network traffic on the NIC's. After it has it's little strop, analyze the data, should tell you what's happening. I assume the event logs tell you nothing, and that you have checked it's not the AV tool pulling down updates.

[ThePassenger]

rlk500 said:

Set up a performance monitor capture on the server. Capture, things like memory usage, paging, disk I/O, processor utilisation, network traffic on the NIC's. After it has it's little strop, analyze the data, should tell you what's happening. I assume the event logs tell you nothing, and that you have checked it's not the AV tool pulling down updates.

Also check for the make/model of your SCSI controller and see if their is a newer firmware avaliable for it. Also check to see what the gotcha's for this newer firmware and your current revision is.

[sneakyneil]

Taking an hour to log on definatley sounds like a malfuction rather than some kind of scheduled behaviour. Is there any extra software you can install to give you extra info on what the raid controller's doing - some have their own event logs?

Also, how about leaving it logged in for a week with taskman/perfmon allready open?

[theboss]

Trash it and rebuild from scratch?

[BliarOut]

HP?

[rlk500]

theboss said:

Trash it and rebuild from scratch?

NO.....that's the sole reason why many Technology teams are slated. First sign of a problem..."Re-install". So the problem re-occurs 6 months later and you still don't know how to fix it.

If you have a mis-fire do you rebuild the engine.......

[sneakyneil]

rlk500 said:

theboss said:

Trash it and rebuild from scratch?

NO.....that's the sole reason why many Technology teams are slated. First sign of a problem..."Re-install". So the problem re-occurs 6 months later and you still don't know how to fix it.

You can't have spent much time being outsourced - that would be a new ticket + invoice right there so no worries from that angle

[nlldavies]

Had similar in the past and found the main reason to be a process consuming large amounts of memory rather than CPU.

Under the process tab in task manager does anything show high CPU or silly amounts of memory useage? If so, track them down and try and stop them loading.

In the case of a SVCHOST process showing large amounts of memory, display the PID column in taskmanager (View > Select Columns > PID). Start a command prompt (Start > run) and type TASKLIST /SVC. Match the PID number to the SVCHOST listed in the DOS window and it should then list all the services running in that process. To identify which service may be consuming memory you need to split each of the services from the affected SVCHOST one by one until you hit the one with the problem.

My bet is that it will be the SVCHOST with WUAUSERV in it, so I'd start there. If that is the case then a simple fix is to rename your "SoftwareDistribution" folder in the windows directory as this can become corrupt. You may have to unhide system folders to view it and you may also have to do it in Safe Mode.

Obvously easier if the machine was in front of me but it's another suggestion.

Nigel

[aranell]

BliarOut said:

HP?

Past experience Bliar? I love HP support. At least they are inventive with their excuses

Would second the above advice about perfmon. When I had a similar problem, I found it was one of the backup-related processes eating all our memory slowly but surely and killing the server.

[BliarOut]

aranell said:

BliarOut said:

HP?

Past experience Bliar? I love HP support. At least they are inventive with their excuses

Would second the above advice about perfmon. When I had a similar problem, I found it was one of the backup-related processes eating all our memory slowly but surely and killing the server.

HP and HDD replacement are synonymous in my experience.... Excellent kit generally, but the drives do seem to have a habit of going pop in a RAID array

[THEBOSS]

rlk500 said:

theboss said:

Trash it and rebuild from scratch?

NO.....that's the sole reason why many Technology teams are slated. First sign of a problem..."Re-install". So the problem re-occurs 6 months later and you still don't know how to fix it.

If you have a mis-fire do you rebuild the engine.......

It depends on your priorities doesn't it.

If you have all the time in the world to 'tinker' with it then fair enough - but in my experience when an important server starts playing up it's often quickest, most cost effective and the most sure fix to simply replace or rebuild it.

I see so many cases where the customer objects to this... and a week or two (and many thousands of pounds later) it ends up getting rebuild anyway, most often because it's old, antiquated and was poorly built and/or maintained to begin with.