1

I have two linked virtual servers running Windows Server 2012:

  1. A database server with Microsoft SQL Server Express
  2. An applications server running Tomcat and a relatively lightweight application.

Both servers are 4GB.

They both mysteriously restart with Event ID 41, without creating a MiniDump file. The restarts happens approximately once every two weeks and only happen at random times in the night. It is unusual for our users to be using the application at night, and the only fixed thing that happens at night is the Backup of the database at 5am, (and most restarts happen before this)

The cloud company opened an investigation and couldn't find anything amiss. They updated the VMWare. Their only suggestion is to increase resources of the servers.

They also claim that the problem cannot be the hardware, firstly because it is a cloud based system, and secondly because no other clients are complaining.

In Virtual Machine server restarts mysteriously a suggestion is made that the installation is corrupted. However I would suggest that this might not be a reason in our case. (1) for both servers to have the same problem would be a bit coincidental - unless of course they were both installed wrongly (2) it does not explain why the restart happens at night.

Any ideas?

UPDATE

  1. One server is not connected to the Internet, so DDOS issues are not relevant.
  2. The crashes happen at completely random times, but always at night

  3. I posted a sample System Events Log at http://textuploader.com/d9opz - nothing interesting happened before 2am. The crash happened at around 2:17 am.

  4. I do not know of any particular scheduled tasks that happen at night.

  5. Moving the VM's around is not an option at the moment, although here is a little bit more information: They are running on VMWARE, and are virtual servers running on separate VLAN's.

  6. We have a virtual test server which runs both the application server and the DB server (and has a very similar setup) which does not seem to have any problems.

3
  • 1
    I understand you're seeing Event ID 41 after the reset, but what happens before? Any events show up consistently in the time before the reset? How consistent are the restart times? Are there scheduled tasks that kick off at or before the times of the restarts? Don't forge to look at earlier scheduled tasks set to wait for idle time. Also, do the perfmon thing as suggested below. If your server is public facing, you could be feeling result of a DDOS. If your host also hosts game servers, the chances of DDOS are greatly increased.
    – Jeter-work
    May 11, 2017 at 23:00
  • Thanks @Xalarous - I updated my question referencing most of your points
    – gordon613
    May 14, 2017 at 18:15
  • #6 - is the test server on the same virtual host? I'm starting to think they're restarting the host. Check your service level agreement. How are you updating? Check to see if you've got update allowed to restart the system. This type of operation is typically scheduled for off-peak. 0200 is pretty much off-peak unless you're running a porn site :) But seriously, if you're using auto update, wsus, or even sccm, there are settings that you can use to control restarts. If your systems are set to restart automatically during an idle time, that would explain all of this.
    – Jeter-work
    May 19, 2017 at 21:22

2 Answers 2

1

I would first start with creating a performance monitor task based around CPU/RAM and HD usage. This might help rule out Memory Leaks, CPU spikes (maybe bi-weekly log dumps or the like), or Disk write errors.

Also, you can maybe try checking out BlueScreenView to see if it's BSODing.

1
  • With regard to your second suggestion, BlueScreenView needs the MiniDumps, and even though MiniDump has been configured, there are no MiniDumps created.
    – gordon613
    May 11, 2017 at 16:02
1

A cloud based system is just a system that runs on someone else's hardware. There could still be a hardware based problem on the host running the VM.

If for example, the host has a single bad block of memory, these two hosts could be hitting that block constantly. Especially since one of the servers is a database.

Do you have other vm's on that same host? If not, can you move one over there temporarily and move these two to a different host? This may help you isolate the issue. The host should also be creating logs if possible. Check with the company to ensure they are monitoring it from the host and creating logs.

1
  • Thanks @CrypticSage - I updated my question a little bit based on your points. I am not a hardware expert but as far as I understand hardware failures are taken care off automatically on a VMWare system
    – gordon613
    May 14, 2017 at 18:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .