Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I mean, it's being awfully nice about it and all. Each and every time it seems like it's a graceful shutdown.

Windows 2003 R2 server. (SP2)
HP Proliant DL380 G4. (BIOS current as of 2007.)
Xeon dual-core proc (3.2 G)
4 GB RAM.
Running:
* Altiris NS and management server
* SQL Server 2000 SE (SP4)
* IIS

According to the security and system log, a domain service account with local admin privs is rebooting the box, with this entry in the log. (It even gives a reason, that nice little account! :)

(And not only that, but the only other account that's logged in/connected happens to.. ahem, be my admin account.)


Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 6/3/2009
Time: 11:34:48 AM
User: N/A
Computer: altiris-server
Description:
Application popup: System Shutdown : The system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by mydomain\altiris-server-account. Shutdown will begin in 1 seconds. Shutdown message: Performing System Maintenance.


(WTF? `Performing System Maintenance'? What system maintenance would that be, little service account?)

The domain service account, (mydomain/altiris-server-account) is local admin on the box, and running the following Altiris services:

Altiris Client Message Dispatcher
Altiris Client Task Data Loader
Altiris Deployment Server Data Manager
Altiris Deployment Server DB Management
Altiris eXpress Server
Altiris NS Receiver
Altiris Object Host Service
Altiris PXE Manager
Altiris Service

...as well as the following SQL services:

MSSQLSERVER
SQLSERVERAGENT

I'm completely stymied. No scheduled tasks are performing any obvious reboots, nothing shows in displaying "at" on the local box.. Nothing else appears to be scheduled in an application, other than some Altiris stuff.

share|improve this question

3 Answers 3

This sounds like you have an advertised job running that reboots the machine. Check within altiris itself to see if it has a job that would do this and if it might be advertised to the server on a recurring basis.

share|improve this answer
    
That's a good point, and thanks.. Checking now.. –  Greg Meehan Jun 3 '09 at 21:27
    
I agree. Regular, unknown reboots are typically not so graceful. –  squillman Jun 3 '09 at 22:12
    
I've turned this temporarily over to an altiris specialist in another part of our company who's going to do a detailed examination of all Altiris logs.. Will not forget about this, will post update in a while.. –  Greg Meehan Jun 4 '09 at 14:33
    
OK, just got the update from the altiris engineer. No Altiris job is causing this, nothing in NS, etc. He's backed it up with screenshots of the logs in question. That, and I trust the guy. He's smart and honest. Just to make completely sure, he's opening a ticket w/ Altiris support, just to completely rule out the app as the reboot cause. Was a good suggestion though... –  Greg Meehan Jun 4 '09 at 18:11
    
Good luck finding the cause. It certainly look like one of the services running at the Altiris Service Account is doing this (evidence in the event log message you quoted) –  Kevin Colby Jun 4 '09 at 18:29

Has someone possibly created a scheduled task under the service user account that tells the system to reboot? We were having major issues with IIS refusing to server up pages after a few days, so we created a scheduled task to restart IIS services every so often. I'm wondering if something similar is happening to you, except that it is set up to reboot the server.

share|improve this answer
    
Heya martianman... That's a good observation, and one of the first things that we checked, unfortunately nothing was scheduled or hiding in "at" :) Thanks tho. –  Greg Meehan Jul 2 '09 at 13:20
up vote 1 down vote accepted

Ah. After much gnashing of teeth and troubleshooting, it appeared that during a maintenance period when I ran a remote, "psshutdown" command on the server, it somehow held on to the temporary service that psshutdown creates and kept re-running it over and over. What confused me was the fact that when I would shut down for the day, it roughly corresponded to shutdown times on the server.

Weird.

Anyway, thanks to all for great answers, much appreciated..

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.