Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At first I always assumed this was the host applying updates or doing some maintenance. But after contacting the company, they assure me I would have received prior notice before any such event.

In finding the cause of the restarts, I really am not sure what I should be looking for.

They are seemingly random, sometimes 3-4 times a week, sometimes more or less.

Here's all the security log says. What's happening is I am logged in via RDP but I've been away for some hours and the server should be locked, when suddenly...

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff 
Event ID: 551
Date:  9/11/2010
Time:  1:33:08 PM
User:  VPS01\My_Username
Computer: VPS01
Description:
User initiated logoff:
  User Name: My_Username
  Domain:  VPS01
  Logon ID:  (0x0,0xSOME_ID)


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff 
Event ID: 538
Date:  9/11/2010
Time:  1:33:19 PM
User:  VPS01\My_Username
Computer: VPS01
Description:
User Logoff:
  User Name: My_Username
  Domain:  VPS01
  Logon ID:  (0x0,0xSOME_ID)
  Logon Type: 10


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Success Audit
Event Source: SECURITY
Event Category: System Event 
Event ID: 513
Date:  9/11/2010
Time:  1:33:23 PM
User:  N/A
Computer: VPS01
Description:
Windows is shutting down. All logon sessions will be terminated by this shutdown.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Success Audit
Event Source: Security
Event Category: System Event 
Event ID: 512
Date:  9/11/2010
Time:  1:37:49 PM
User:  NT AUTHORITY\SYSTEM
Computer: VPS01
Description:
Windows is starting up.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The server runs a webapp using IIS 6 and SQL Server 2008 R2 Standard. We're ready to get out of our beta, but this is really a big problem.

It was doing this since we were doing internal alpha testing (only allowing IIS to serve our IPs).

Thanks for any advice.

share|improve this question
    
Did the server restart or just your RDP connection ? –  bernd_k Dec 22 '10 at 13:31

2 Answers 2

up vote 1 down vote accepted

The server runs a webapp using IIS 6 and SQL Server 2008 R2 Standard. We're ready to get out of our beta, but this is really a big problem.

Really? You are still in beta? Why the heck did noone think of updating the operating system some point during development to one that is actually current? 2008 R2 is current, 2008 is already 3 years old. YOu di so with SQL Server - but not with the OS. BAD move.

That said: none of the items you showed from the event log give an indication, except that a shutdown was initiated (i.e. not a bluescreen or crash). There is no user assigned, so it looks like either the OS deciding (never seen) or that coming from a driver level (virtualization platform triggering it).

At the current state I would assume it is the host doing something. They may not eve nbe aware of it (though it would show a level of stupitidy) like doing it for a backup (instead of using a non-instrusive approach). I have seen scripts on Hyper-V doing a backup with a system save (hypernation) from the Hyper-V layer.

All I can say with the information provided.

share|improve this answer
    
Thanks, TomTom. –  Louis Sep 12 '10 at 7:38
    
The reason for sticking with 2003 is simply cost. Is kind of problem something that I shouldn't be surprised to have if I keep using Server 2003? At this point I'm auditing everything allowed in Local Policy, but there are no other events occurring in the other logs at the time of the shutdown. I'll mention that the host is GoDaddy and I have learned they are using Virtuozzo. –  Louis Sep 12 '10 at 7:45
    
I am surprised. SQL Server 2008, 2008 R2 cost not a single dime more than 2003. That is, if your CTO is sane enough to acutally use SPLA for this (note: service provider + purchasing licenses = stupid person making decision, SPLA is legal and cheaper and rented monthly). –  TomTom Sep 12 '10 at 8:49
    
We don't have a CTO! We are only two people. =) GoDaddy won't let us run Windows 2008 on their VPS's. The license cost is built into their VPS's but it's really very cheap. We would have to move to a dedicated machine if we were to use our own Windows 2008 license. The VPS has 2 CPUs. Their dedicated's only have one. This is why we're using SQL Standard. IIS6 didn't inhibit us from creating our webapp, so there was no apparent need for IIS7. Also, the VPS has been handling our load effortlessly. Is Server 2003 really so bad that we should get off of it even though we just need it to run IIS? –  Louis Sep 12 '10 at 9:09
    
Time to change to a better host then. "Really cheap" together with "outdated software" makes it a liability. Plus you have - i think - seroius problems understanding the diffeerences between virtual and physical CPU - a virtual CPU always has one core, a physical can have 8 to 12. 2003 is really that bad. IIS 7 was a HUGH step forward. A really big one. Never looking back. –  TomTom Sep 12 '10 at 9:15

This looks like a 'planned' shutdown, e.g. something is shutting down the computer rather than the computer just halting or crashing.

I assume you have double and triple checked that updates aren't being installed on your machine and that no code you don't know about is running on it that could be triggering this?

If so, I have to agree with TomTom, you need better support from the provider or you need to change provider... Because if you're certain that nothing internal to the system is causing this then the only thing that's left is the environment around it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.