0

I mean, it's being awfully nice about it and all. Each and every time it seems like it's a graceful shutdown.

Windows 2003 R2 server. (SP2)
HP Proliant DL380 G4. (BIOS current as of 2007.)
Xeon dual-core proc (3.2 G)
4 GB RAM.
Running:
* Altiris NS and management server
* SQL Server 2000 SE (SP4)
* IIS

According to the security and system log, a domain service account with local admin privs is rebooting the box, with this entry in the log. (It even gives a reason, that nice little account! :)

(And not only that, but the only other account that's logged in/connected happens to.. ahem, be my admin account.)


Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 6/3/2009
Time: 11:34:48 AM
User: N/A
Computer: altiris-server
Description:
Application popup: System Shutdown : The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by mydomain\altiris-server-account. Shutdown will begin in 1 seconds. Shutdown message: Performing System Maintenance.


(WTF? `Performing System Maintenance'? What system maintenance would that be, little service account?)

The domain service account, (mydomain/altiris-server-account) is local admin on the box, and running the following Altiris services:

Altiris Client Message Dispatcher
Altiris Client Task Data Loader
Altiris Deployment Server Data Manager
Altiris Deployment Server DB Management
Altiris eXpress Server
Altiris NS Receiver
Altiris Object Host Service
Altiris PXE Manager
Altiris Service

...as well as the following SQL services:

MSSQLSERVER
SQLSERVERAGENT

I'm completely stymied. No scheduled tasks are performing any obvious reboots, nothing shows in displaying "at" on the local box.. Nothing else appears to be scheduled in an application, other than some Altiris stuff.

3 Answers 3

2

This sounds like you have an advertised job running that reboots the machine. Check within altiris itself to see if it has a job that would do this and if it might be advertised to the server on a recurring basis.

5
  • I agree. Regular, unknown reboots are typically not so graceful.
    – squillman
    Jun 3, 2009 at 22:12
  • I've turned this temporarily over to an altiris specialist in another part of our company who's going to do a detailed examination of all Altiris logs.. Will not forget about this, will post update in a while.. Jun 4, 2009 at 14:33
  • OK, just got the update from the altiris engineer. No Altiris job is causing this, nothing in NS, etc. He's backed it up with screenshots of the logs in question. That, and I trust the guy. He's smart and honest. Just to make completely sure, he's opening a ticket w/ Altiris support, just to completely rule out the app as the reboot cause. Was a good suggestion though... Jun 4, 2009 at 18:11
  • Good luck finding the cause. It certainly look like one of the services running at the Altiris Service Account is doing this (evidence in the event log message you quoted) Jun 4, 2009 at 18:29
  • Been working with Symantec/Altiris support on this.. Not the `best' experience in my lexicon of dealing with big-company support, but it could be going worse I suppose. Technician is reviewing logs now and hopefully soon we'll either be able to rule out Altiris overall or find the cause. Jun 10, 2009 at 19:48
1

Ah. After much gnashing of teeth and troubleshooting, it appeared that during a maintenance period when I ran a remote, "psshutdown" command on the server, it somehow held on to the temporary service that psshutdown creates and kept re-running it over and over. What confused me was the fact that when I would shut down for the day, it roughly corresponded to shutdown times on the server.

Weird.

Anyway, thanks to all for great answers, much appreciated..

0

Has someone possibly created a scheduled task under the service user account that tells the system to reboot? We were having major issues with IIS refusing to server up pages after a few days, so we created a scheduled task to restart IIS services every so often. I'm wondering if something similar is happening to you, except that it is set up to reboot the server.

1
  • Heya martianman... That's a good observation, and one of the first things that we checked, unfortunately nothing was scheduled or hiding in "at" :) Thanks tho. Jul 2, 2009 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .