0

At first I always assumed this was the host applying updates or doing some maintenance. But after contacting the company, they assure me I would have received prior notice before any such event.

In finding the cause of the restarts, I really am not sure what I should be looking for.

They are seemingly random, sometimes 3-4 times a week, sometimes more or less.

Here's all the security log says. What's happening is I am logged in via RDP but I've been away for some hours and the server should be locked, when suddenly...

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff 
Event ID: 551
Date:  9/11/2010
Time:  1:33:08 PM
User:  VPS01\My_Username
Computer: VPS01
Description:
User initiated logoff:
  User Name: My_Username
  Domain:  VPS01
  Logon ID:  (0x0,0xSOME_ID)


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff 
Event ID: 538
Date:  9/11/2010
Time:  1:33:19 PM
User:  VPS01\My_Username
Computer: VPS01
Description:
User Logoff:
  User Name: My_Username
  Domain:  VPS01
  Logon ID:  (0x0,0xSOME_ID)
  Logon Type: 10


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Success Audit
Event Source: SECURITY
Event Category: System Event 
Event ID: 513
Date:  9/11/2010
Time:  1:33:23 PM
User:  N/A
Computer: VPS01
Description:
Windows is shutting down. All logon sessions will be terminated by this shutdown.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Success Audit
Event Source: Security
Event Category: System Event 
Event ID: 512
Date:  9/11/2010
Time:  1:37:49 PM
User:  NT AUTHORITY\SYSTEM
Computer: VPS01
Description:
Windows is starting up.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The server runs a webapp using IIS 6 and SQL Server 2008 R2 Standard. We're ready to get out of our beta, but this is really a big problem.

It was doing this since we were doing internal alpha testing (only allowing IIS to serve our IPs).

Thanks for any advice.

Louis Waweru
  • 755
  • 1
  • 9
  • 29

2 Answers2

1

The server runs a webapp using IIS 6 and SQL Server 2008 R2 Standard. We're ready to get out of our beta, but this is really a big problem.

Really? You are still in beta? Why the heck did noone think of updating the operating system some point during development to one that is actually current? 2008 R2 is current, 2008 is already 3 years old. YOu di so with SQL Server - but not with the OS. BAD move.

That said: none of the items you showed from the event log give an indication, except that a shutdown was initiated (i.e. not a bluescreen or crash). There is no user assigned, so it looks like either the OS deciding (never seen) or that coming from a driver level (virtualization platform triggering it).

At the current state I would assume it is the host doing something. They may not eve nbe aware of it (though it would show a level of stupitidy) like doing it for a backup (instead of using a non-instrusive approach). I have seen scripts on Hyper-V doing a backup with a system save (hypernation) from the Hyper-V layer.

All I can say with the information provided.

TomTom
  • 51,649
  • 7
  • 54
  • 136
  • The reason for sticking with 2003 is simply cost. Is kind of problem something that I shouldn't be surprised to have if I keep using Server 2003? At this point I'm auditing everything allowed in Local Policy, but there are no other events occurring in the other logs at the time of the shutdown. I'll mention that the host is GoDaddy and I have learned they are using Virtuozzo. – Louis Waweru Sep 12 '10 at 07:45
  • I am surprised. SQL Server 2008, 2008 R2 cost not a single dime more than 2003. That is, if your CTO is sane enough to acutally use SPLA for this (note: service provider + purchasing licenses = stupid person making decision, SPLA is legal and cheaper and rented monthly). – TomTom Sep 12 '10 at 08:49
  • We don't have a CTO! We are only two people. =) GoDaddy won't let us run Windows 2008 on their VPS's. The license cost is built into their VPS's but it's really very cheap. We would have to move to a dedicated machine if we were to use our own Windows 2008 license. The VPS has 2 CPUs. Their dedicated's only have one. This is why we're using SQL Standard. IIS6 didn't inhibit us from creating our webapp, so there was no apparent need for IIS7. Also, the VPS has been handling our load effortlessly. Is Server 2003 really so bad that we should get off of it even though we just need it to run IIS? – Louis Waweru Sep 12 '10 at 09:09
  • Time to change to a better host then. "Really cheap" together with "outdated software" makes it a liability. Plus you have - i think - seroius problems understanding the diffeerences between virtual and physical CPU - a virtual CPU always has one core, a physical can have 8 to 12. 2003 is really that bad. IIS 7 was a HUGH step forward. A really big one. Never looking back. – TomTom Sep 12 '10 at 09:15
  • Alright, I understand your feelings about moving to Microsoft's current technologies. That will definitely happen if our application can operate in the black. BTW, I'm confused about the CPUs. Windows and SQL Server both show two physical CPUs with a total of 8 cores (two quads). At first we were using SQL Express, which used 4 cores (two on each CPU), but after upgrading to Standard it's using all 8. The VPS is very fast...and unreliable. If I can figure out this restart issue it would be our ideal solution while we're operating in the red. I appreciate your advice, but I want this VPS workin – Louis Waweru Sep 12 '10 at 09:37
  • Change the hoster. Point. Seriously. I am using Hyper-V on my own servers and NEVER had a VM just restart. If they are not cooperative (as tehy should be) you simply have no way to know what happened. You simply have not enough information for anyone here to help you. Hoster support is the only access way you have. – TomTom Sep 12 '10 at 11:47
0

This looks like a 'planned' shutdown, e.g. something is shutting down the computer rather than the computer just halting or crashing.

I assume you have double and triple checked that updates aren't being installed on your machine and that no code you don't know about is running on it that could be triggering this?

If so, I have to agree with TomTom, you need better support from the provider or you need to change provider... Because if you're certain that nothing internal to the system is causing this then the only thing that's left is the environment around it.

Rob Moir
  • 31,884
  • 6
  • 58
  • 89