0

I have this older HP ProLiant server that needs to be lifecycled, but there are still some services that are apparently running on it. There are only a few workstations that are being serviced by this particular server, but it not a DC, DNS or DHCP and whenever I shut this thing down, I get calls stating the workstations are bogged down to the point where users cannot even utilize the system whatsoever. So, I turn the server back on and the workstations are back to normal. It is the strangest damn thing I have ever seen. How would I go about troubleshooting this issue? Thanks

2
  • 2
    Well what is running on it?!?
    – EEAA
    Jan 3, 2013 at 23:21
  • 13
    I have this thing that does stuff and when I turn it off other stuff doesn't work.
    – joeqwerty
    Jan 3, 2013 at 23:31

3 Answers 3

2

I would bet real money the workstations that are hanging are experiencing RPC call issues with the now missing services being hosted on the HP. You were given good advice earlier to perform a port scan but your next step either in lieu of or immediately after the port scan will be to identify the processes behind those IP services.

From your question, it sounds like a windows applications server since you spent alot of your question describing what the box ISN'T, it isn't a Domain Controller, it isn't a DNS directory or DHCP pool.

Download tcpview from Microsoft Sysinternals at http://technet.microsoft.com/en-us/sysinternals/bb897437

Use the web to glean explanation about port roles or read Microsofts included cheat sheet about TCP ports.

notepad.exe %systemroot%\system32\drivers\etc\services

This opens the Unix like config file Windows uses to assign ports to port numbers and protocol types and is the same config used when reassigning standard services to non standard ports.

Then when you've verified which services are still truly necessary, take the stripped down box while still physical and optimize it up and even resize the partition if possible and use disk2vhd.exe or similar and convert that antique into a virtual machine for either immediate usage or archive it off in case you learn months later and several weeks after the drives were wiped and box was sold... we need that server back. You can resurrect the server as a VM as quickly as you want.

2
  • Yeah I have the Sysinternals suite and will run the TCPView as you suggest and see what I can find. Jan 4, 2013 at 1:50
  • Sorry to get back so late. The issue was Microsoft Office 2003 on some older workstations calling a template location on this old server. So when it would shutdown, Office would make repetitive calls that would hog the bandwidth. Anyway, this issue has now been resolved by simply updating Office on those systems or simply lifecycling them. Thanks for all your help. Feb 8, 2013 at 21:58
5

I would setup a capture with wireshark or something. Identify what is actually being sent over the network. Shut the machine down, and temporarily assign the IP address to a Linux machine, and run tcpdump and see what requests are being sent to the machine.

Another option would be to make sure you stop every service running on the machine one at a time, kill every process accessing the network. You may find that something was still running.

My guess is that you clients still have a setting to use this machine for something, and when they try to connect they are getting a nice immediate REJECT for the request. When the machine is offline, they are having to wait for the timeout for whatever service/protocol. Wireshark would identify these rejections very easily.

1
  • I ran Wireshark, TCPView yada yada and come to find out the culprit was Microsoft Office system files on workstations were somehow trying to make contact with this server. The issue has now been resolved. Thanks everyone except joeqwerty whose a punkass bitch. Feb 8, 2013 at 19:35
1

Run a scan against the system. Perhaps an external nmap or port scan against the system to see what it's listening on. If you have credentials to the system, you can run netstat to see what services are online and the related ports:connections.

Is this a Windows server? Which version of the OS?

1
  • yes this is a Windows server running Server 2003 and I have ran netstat in the past on it to find something but to no avail. I can try again. Jan 4, 2013 at 1:48

Not the answer you're looking for? Browse other questions tagged .