Unresponsive Server - System Event ID 2020

[bleachlpb]

I have a Dell PowerEdge 2600 that I migrated our existing AD to back in May. Everything went OK with the migration. The server is running SP3, in addition to being our AD DC server, it is also our file and print server.

3 times since May, this server has become unresponsive. Users were not able to do anything on the network, and I was unable to contact the server over the network, except for pings. Each time, I found Srv Event ID 2020 in the system event log. I found some info on this error on a few places on the net, including a thread here a few months ago, and article 312362 at Microsoft. This problem occurred at peak hours each time.

The most recent time this happened, I got the Srv Event ID 2020, followed by hundreds of Srv Event ID 2000 errors - they almost filled my log. About 40 of these errors were being generated each second. I am trying to determine if these errors are being caused by the initial problem, or if they are the reason for the problem in the first case.

I suspect a memory leak as indicated in 312363 - but I'm not totally convinced yet. I plan to use the poolsnap utility to watch the paged pool, and I am gathering data on the size of the paged pool if it gets close to 343mb. Before the recent crash - I noticed the paged pool was close to this limit. I also plan to update to SP4.

Also, about the time this happened, the server had approx. 400 files open. Most of these files were from users attached to a Goldmine database that is located on this server.

Has anyone else had this problem? I want to be sure that the actions I take to resolve the problem fix it. This is an extremely frustrating situation due to how fickle this problem is. I'm still not 100% sure it is a memory leak.

Thanks,
BleachLPB

 

[ReddLefty]

In certain conditions, this may be caused by Symantec's Norton AntiVirus Corporate Edition software (see Q272568)

The problem can also be caused by a Memory Leak in the Dell server management tools.




"In space, nobody can hear you click..."

 

[bleachlpb]

Thanks for your quick reply! Both cases exist - however I am running Symantec Corporate Edition v8.0 - and not the problem versions indicated in the article. Besides, we ran 8.0 on our old server and never had problems.

But the Dell server management tools.... An initial check on Dell's site turned up nothing, but I found some posts on their support forums that this was some problem they "tucked under the carpet", and quietly released an update that I'll try this evening.

Thanks again,
BleachLPB

 

[quell]

Did you ever find a fix for this? I have the same problem. I am running w2k server with the latest updates and with Symantec Corporate Edition v8.0 on a dell 2600. I noticed this problem only occurs when I do a backup (30g) I also noticed this only started happeneing when I moved some of the page file off the c: drive (needed more disk space). The page file on the c: drive is 150mgs. The page file on the d: drive is 1.5 gig. This has been happening once a week. When the backup occurs. I'm out of ideas on what to try next. Please let me know what you came up with.
Thank you

 

[JimmyMcFelch]

I don't know if this is of any help, but I recently started getting this event allthough the 2020 errors only appeared three or four times before we were locked out. It turned out to a virus - backdoor.coreflood which was hitting the server 50 times a second and stopping anything else using it!

 

[xmsre]

A leak is a possibly, and in that event filter drivers would certainly be prime suspects. Poolsnaps over time should indicate which process is the culprit.

The backup tie in may point to another cause however; Q304101. I'd start with a chkdsk in read only mode. It may simply be a single crosslinked file of file with a bad size. After verifying the integrity of the file system, I'd try the registry change in the article. If that doesn't provide some relief, then I'd go with the poolsnaps to pin it down.

John
MOSMWNMTK

 

[quell]

Thanx for everyones help. I already did what was recommened in Q304101. Still the same problem. I'm going to try and increase the page file that is on the C: drive (150mg to 300mg). Hopefully that will help. This problem started after I moved the majority of the page file to a different partition. I will let you know how it turns out.

 

[bleachlpb]

Thank you for everyone's help. I believe I have figured out the problem.

Last May/June I migrated our old AD server onto a new server - and approx. 90 days ago, I downed the old server. Apparently, I omitted the Terminal Services License server that was running on that old server.

Well - since we are all w2k and XPpro, this does not seem to be a problem. From my understanding, the TS Licenses are only needed for clients connecting with 98/Me machines or lower. My affected user yesterday happens to be running 98.

Michael Pare

 

[bleachlpb]

Crap - that last post was supposed to go in a citrix-related thread.

As per the 2020 errors - I tracked the leak using poolmon, and traced the leaking tag to Antivirus Corp. Edition. I had just received the newest version of the software a few weeks before and applied it, and this resolved the problem.

Never found anything on Symantec's site acknowledging the problem with our specific version - but I fixed the problem with the new version install before a call to Symantec was necessary.

 

[quell]

bleachlpb: What version of Symantec?

 

[quell]

Well I walked in this morning and no one could connect to the server. So increasing the page file on the c: drive did not help. I also upgraded Symantec to 8.1. Anyone have any ideas on this? It only seems to happen when transfering large amount of files (backups) I have tried what was mentioned in Q304101. I have a DC, Dell 2600 with W2K w/ latest updates and sp. We are using retrospect for our backups to a NAS. Using Symantec client 8.1 I'm not for sure what else to mention here but any help would be greatly appreciated.
Thanx