server locks up

[iamnotageek]

A problem has developed on one of my client's servers that seems to be getting progressively worse, so I am looking for troubleshooting ideas. The server is about 3 years old, running RAID level 5 on 3 SCSI hard drives, 2 ghz P4, 1GB RAM and had been running well. The OS is Windows Server 2000 Small Business w/SP4. Active server applications include ISA server for web access/firewall via DSL, SQL (to run AIM property title management software), and Symantec Corporate edition antivirus. Other than that, it is used as a file and print server, with one HPLJ4250 connected via parallel port.

Earlier, the problem had been happening only if someone forgot to shut the server down over the weekend. It is normally left running overnight during the week. The lockup seems to be increasing in frequency, as it is now locking up several times a week, when left on overnight, and sometimes locks up in the morning, after it had been working well for a time.

The lockup is noticed by folks that are using the AIM/SQL application, as they will get an error message saying that the client can't communicate with the server. When someone walks over to the server, the console shows only the blue background, no icons or taskbar, or screen saver. When it is in this state, they cannot use remote desktop to access the server over the LAN - this is setup and works when the server is running ok.

In order to recover from this, they have to power off the server and when it comes up, they can communicate with it again. One wart that has been showing up after recent power off/boot is that the ISA firewall service times out when trying to start (default time out of 30000 ms). They then manually start the firewall service and all is well, until next time. The person that looks after the server also says that it seems to take a much longer time to boot, but I'm guessing that this could be due to additional housekeeping required after a reboot (?)

I've had a look at the event logs and don't see anything that jumps out at me. Is there any way of turning on some form of enhanced logging, that would hopefully show what is going on just before and during the lockup?

 

[longhair]

iamnotageek,
start -> settings -> control panel -> administrative tools -> performance. then choose what you want to log.
have you checked all the temp dir's and cleaned them out?
anything new running on startup?
what about disk space? page file size?
regards,
longhair

 

[iamnotageek]

Longhair,

I'm not quite sure what to log, but I'll give that a go. I'll also look at the temp dirs. There shouldn't be anything new running on startup, since nothing has been installed on the server lately (with the possible exception of Windows Updates), but I will look.

There is a few gig free on the OS partition and about 50 gig free on the data volume. I'll look at page file size.

 

[longhair]

iamnotageek,
there are many possibilities for logging. start small, maybe just monitor the cpu and some aspects of it (you'll see what i mean after you get into the perfomance console). the logs also can take up quite a bit of space.
i'd still check start up, does any one have access to the box and maybe went surfing? check out nav logs and the log dir. might need to be cleaned out.
any firewall logs that you can look at?
any sql logs to look at?
regards,
longhair

 

[iamnotageek]

Thanks for the ideas...