Is there a new bug out for exchange 2003?

[FreshPrince]

my mail server keeps rebooting and I can't figure why :|

disabled symantec spam and antivirus thinking it's causing the problem...but it's not.

Anyone else seeing this recently?

-FP

 

[BeanDip]

Do you see anything in the eventlogs that might tell you why this happening?

How long does it stay up before it reboots again?

 

[FreshPrince]

event log just say unexpected shutdown...

it all differs in reboot times...

sometimes right away as soon as the ctrl-alt-del screen comes up, others after login.

I have also disabled task scheduler and AT. nothing in there.

 

[BeanDip]

Sorry if this seems like 20 questions:

I would suspect a hardware issue. Is it a brand-name server? If so the manufacturer might have a diag that could tell you what is going on.

Such as Dell's OpenManage software can tell you if a fan or component is not operating at the proper level.

Another question: Is there a firewall in between the server and the Internet? Or any type of NAT device that is only forwarding needed ports? If the server is live on the Internet then you could be being attack by a variety of things.

Is it 2000 or 2003 Server? You might go into safe mode and check the RUN key to make sure you don't have a virus or spyware.

Did this just start out of the blue? Or has any new software or hardware recently been installed?
Have you loaded Exchange 2003 SP1?

Another avenue is to suspect that maybe another PC on the network has a virus and is attacking it <shivers with memories of Welchia>.

I am responsible for numerous high-traffic clients who are on Exchange 2003 and none of them are having problems (knocking on wood).

 

[MulLa]

You may want to disable the auto reboot feature when an error is encountered. That way you will be able to see the actual blue screen message which should shead some light on this situation.

 

[FreshPrince]

Originally posted by: BeanDip
Sorry if this seems like 20 questions:

I would suspect a hardware issue. Is it a brand-name server? If so the manufacturer might have a diag that could tell you what is going on.

it's a dell, will check openmanage

Such as Dell's OpenManage software can tell you if a fan or component is not operating at the proper level.

Another question: Is there a firewall in between the server and the Internet? Or any type of NAT device that is only forwarding needed ports? If the server is live on the Internet then you could be being attack by a variety of things.

there's a firewall

Is it 2000 or 2003 Server? You might go into safe mode and check the RUN key to make sure you don't have a virus or spyware.

2003, and run is clean in registry

Did this just start out of the blue? Or has any new software or hardware recently been installed?
Have you loaded Exchange 2003 SP1?

just started, so we installed sp1, didn't help, installed all windows updates, no help

Another avenue is to suspect that maybe another PC on the network has a virus and is attacking it <shivers with memories of Welchia>.

suspected that...did virus sweep on all networks, nothing

I am responsible for numerous high-traffic clients who are on Exchange 2003 and none of them are having problems (knocking on wood).

Originally posted by: MulLa
You may want to disable the auto reboot feature when an error is encountered. That way you will be able to see the actual blue screen message which should shead some light on this situation.

it is disabled, and shutdown event tracker enabled. the reboot still happens and it does not go into blue screen. also, the event still says unexpected and nothing else. also, when in safe mode or network cable unplugged, the server stays up.

 

[MulLa]

You're saying network cable unplugged = no reboot? Tried updating NIC drivers? Or maybe disabling that NIC if it's onboard and installing a PCI NIC to try out?

 

[BeanDip]

Does it have the Intel or Broadcom NICs?

I have had some weird glitches with Windows 2003 and the Intel Proset program. On one server I had to completely remove Proset and use the minimum driver because if anything happened to cause the server to suddenly reboot it would not see the NIC until another reboot and then would redetect it as "Local Area Connection" +1 from the previous. It is currently at 9. Though this one is a test-bed server build from parts so it may not be the norm.

Also if you plug it into a different port on your switch does the same behavior happen? If it does then I would then try plugging it into a switch all by itself and seeing if it still happens. That way we can be certain that it is a problem on the server itself.

Check BIOS updates and make sure it is at the latest. If you are using RAID then you should check the firmware of the controller and driver and make sure they are the latest.

Use the Diagnostics CD and do the express tests (in particular the memory/mainboard components tests).

If nothing else call Dell and maybe they know about the problem (at the worse they can tell you is that it is a Microsoft problem).

 

[Darthkim]

The last time something similar happened to my exchange server (unexpected reboots, etc), it was the hard drive cage backplane in a proliant ML570.

 

[FreshPrince]

Originally posted by: Darthkim
The last time something similar happened to my exchange server (unexpected reboots, etc), it was the hard drive cage backplane in a proliant ML570.

I went ahead and updated all drivers in openmanage. Not enough users in the weekend to stress the mail server. guess we'll see on tuesday...

 

[BeanDip]

Did you ever figure out anything on this?

 

[FreshPrince]

I believe it came to one workstation....after we sniffed out the traffic.

so, we ran spybot, anti-virus, blew away outlook profile and recreated it.

so far server seems stable.