we have a strange problem with one of our servers today. Windows Server 2008 R2 with two IP adresses, onee NIC, restarted today morning for some app maintenance. After this restart, this is what happens:
1) IIS service running, app pools running, all sites NOT running. In the error log there is
The World Wide Web Publishing Service (WWW Service) did not register the URL prefix for site 5. The site has been disabled. The data field contains the error number.
For all sites.
2) Filezilla FTP running OK.
3) hMailServer service running, but in fact not doing anything. In the log there is
"ERROR" 2568 "Severity: 2 (High), Code: HM4316, Source: TCPServer::Run(), Description: Failed to bind to local port. Error: bind: The requested address is not valid in its context. Address: , Error code: 10049, Port: 25. This is often caused by another server listening on the same port.To determine which server is listening on the port, telnet your server on port 25. Make sure that no other email server is running and listening on this port, and then restart the hMailServer service."
This error is there four times ( ports 25, 110, 143, 587).
4) SSH server running and OK.
5) Apache server service binded to another IP adress failed too, with errror code
(OS 10049)The requested address is not valid in its context. : AH00072: make_sock: could not bind to address
So, it looks like all SERVICES are failing, but PROGRAMS (sshd, filezilla) are OK.
To fix everything, it is needed to start apache service manually, restart hMailServer service manually and start each web site in IIS manager manually. From that point, everything is behaving like it should, UNTIL NEXT RESTART HAPPENS. Then its all failing again.
So I was thinking that maybe for some strange reason the NIC does not get IP address "fast enough" and the services fail because of that. Filezilla and SSHD is starting few seconds later and they work OK. I tried to change apache, hMailServer and W3SVC service to "automatic - delayed start" but its not working somehow - after restart, i waited about 5 minutes but none of the services started yet.
Another idea is that there is "something" in the boot proccess binded to all needed ports (25, 80 and so on) but only for few seconds before system boots up. So apache, iis and mail server cannot bind there and fail. But how to check that ?
The NIC is set up for both static IP adresses.
I am not so much networking guy so I am lost. Any help would be much appreciated. Thank you.
So after some googling and comparing event viewer from previous restart with these problematic restarts I managed to push the problem forward little bit.
The first error which shows in the event log after the restart is this
Log Name: System Source: Microsoft-Windows-WinRM Date: 1/3/2017 08:14:18 Event ID: 10128 Task Category: None Level: Error Keywords: Classic User: N/A Computer: JSComputers Description: The WinRM service is not listening for HTTP requests because there was a failure binding to the URL (http://+:47001/wsman/) in HTTP.SYS.
No remote requests will be serviced on that URL.
User Action Please use "netsh http" to check if ACL for URL is set to Network Service.
Additional Data The error code received from HTTP.sys is 1214: %%1214 Event Xml: 10128 0 2 0 0 0x80000000000000 564035 System JSComputers 1214
So I followed this link https://wintelinterviewquestions.blogspot.cz/2016/03/the-winrm-service-is-not-listening-for.html and WinRM service is now running. This solved the problem with hMailServer and to some extend also with IIS - the service is running, app pools are alive, web sites are in IIS manager alive too, BUT it is not possible to connect to them from outside, connection timeout. I still need to restart W3SVC to make it alive.
In the event viewer is now only error, this:
Log Name: System Source: Microsoft-Windows-HttpEvent Date: 1/3/2017 08:54:16 Event ID: 15005 Task Category: None Level: Error Keywords: Classic User: N/A Computer: JSComputers Description: Unable to bind to the underlying transport for aaa.bbb.ccc.ddd:80. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number. Event Xml: 15005 0 2 0 0 0x80000000000000 564250 System JSComputers \Device\Http\ReqQueue aaa.bbb.ccc.ddd:80 0000040002003000000000009D3A00C0000000000000000000000000000000000000000000000000070200C0
Any help with that ?