I have a Windows Server 2003 Small Business Server that has begun crashing more and more often. The machine does not physically power off(so I don't think it is a power supply issue), but it does not respond to any network activity. When I force a restart by holding down the power button(at 11:43:20 AM), the only relevant Event Log entry says "The previous system shutdown at 3:45:11 AM on 7/21/2009 was unexpected."
This first started about a year ago, when the machine would do this once every 3 or 4 months. Over the last month, it has started occurring more and more frequently, twice in 4 weeks, then twice in 2 weeks.
So, two questions: 1) Any idea what would cause crashes like this to occur? and 2) Are there any ways to get more detailed Event Log entries from within Windows?
I have full current backups of all the data on the server, so I am not worried about data loss. I have regularly updated and scanned Symantec Virus protection managed by the domain.
[edit] Forgot to mention, the server is Service Pack 1.[/edit]
Here is the event log entry, in case it is useful.
Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date: 7/21/2009
Time: 11:43:20 AM
User: N/A
Computer: <MyComputerName>
Description:
The previous system shutdown at 3:45:11 AM on 7/21/2009 was unexpected.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: d9 07 07 00 02 00 15 00 Ù.......
0008: 03 00 2d 00 0b 00 90 02 ..-....
0010: d9 07 07 00 02 00 15 00 Ù.......
0018: 07 00 2d 00 0b 00 90 02 ..-....
It could be a million things from a faulty driver down to hardware problems.
I would say before going any further, the best thing to try would be to go to system properties (right click on computer and click properties) then go to the advanced tab, click startup and recovery and untick the Automatically restart button and choose to keel a kernel memory dump.
Next time this occurs, you should be able to see if the problem is related to memory, hardware or driver based on what it says on the BSOD. If the BSOD does not help, You should have a kernel dump that you can diagnose (if you can be bothered!)
Of course, it is possible that it won't even reach a Blue screen of death, and if this is the case, it most likly means a hardware fault such as power.
It can be a power supply issue, even if it doesn't power down. Unstable +12V can be hell for computers.
I'd burn a CD with memtest86+ and run it for a while to make sure the RAM isn't faulty. If the RAM checks out fine, I'd try to replace the PSU.
Others mentioned faulty drivers, but drivers doesn't work fine one day and crash the other (I'm guessing that the server ran just fine pre-1-year ago).
Edit: Didn't see the part about you not having a monitor attached. If it bluescreens, try my suggestions above. If it's just networking missing, replace NIC/cable/switch etc..
Forcing a shutdown because your network is no longer responding isn't a smart thing to do, what's worse is that you can't diagnose the problem.
I don't think your server is locking up or crashing.
Sounds like your have problems with your network configuration or network card, or even possibly your switch. See if you can get some out of band management! Pluging in a kb/mouse is a good start, You need to get in front of the server physically next time it happens.
If the server has another NIC spare on it, configure that & plug it into another server /computer (cross-over may be required) with some static IP's & see if its still accessible via that network time it crashes.