Member Avatar for xlulux

Hey guys i have a windows 2000 server running raid 1 (mirror) that reboots erratically. The computer usually doesnt have a monitor, mouse, or keyboard attached so i dont believe it is due to a short out of any device like that.

Last week i hooked up a monitor to the computer and found out that the computer has been shutting down peacefully. Although this isnt bad news, it certaily doesnt stop it from happening all the same.

Ive checked for a virus, norton, random shutdown service, overheating, stopped fan, harddrive failure, etc etc. This all checks out. no aspect of the computer seems off except taht once in a while it shuts off on its own without warning.

Does anyone know how i could go about researching this problem further as it has me stumped. Please reply if you have any suggestions.

  • 2 Contributors
  • 2 Replies
  • 125 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by xlulux

Dani AI

Generated

Brief, prioritized checklist that builds on s thread and s prompt to check the Event Viewer. The goal is to gather reliable evidence (dump files, vendor logs, serial output) and to isolate hardware from software so the root cause can be proven instead of guessed.

Start with OS-level capture. Turn off automatic restart on system failure so a fault produces a visible error or a dump. Configure complete memory dumps and make sure the system pagefile is on the boot volume and big enough. After the next event, inspect the system and security logs for who/what initiated the shutdown and look for any created MEMORY.DMP or DrWatson-style logs on the server.

Expand hardware and firmware checks next. Pull RAID/controller event logs from the controller utility and controller BIOS at boot. Run SMART and vendor diagnostics on the drives and update controller firmware/drivers if they are out of date. Check UPS/BMC/IPMI logs and the server power supply rails; try a known-good PSU or boot with minimal devices to see if the problem follows the chassis or the OS. Run a full memory test (memtest86) and a CPU stress test to rule out intermittent faults.

Cover stealth causes and containment. If compromise is even a possibility, isolate the box from the network and scan from clean rescue media (rootkit-capable scanners). Search scheduled tasks, startup scripts and the Tasks folder for any calls to shutdown.exe or remote-management actions. If logs are missing or the system is suspected compromised, image the disk before extensive remediation.

If the above leaves gaps, add external logging: serial console capture, KVM recording, or network syslog agent that forwards pre-shutdown output. Those traces will show whether Windows itself requests shutdown or power is being removed at the hardware level.

Recommended Answers

All 2 Replies

Member Avatar for zelkea

Was there any useful information in the event viewer before the shutdown?

Member Avatar for xlulux

Hey guys i found that the anti virus that was in use to check for viruses was out of date, a more recent version from bitdefender found 4 viruses and i left it running.


I think the viruses were spotty performance at first then fine tuned ones. At first there were reports in the event log that the shutdowns were unexpected. now the computer shutsdown without a report, and completely silently, windows doesnt complain at all.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.