Sign in with
Sign up | Sign in
Your question

Windows crash - Help with finding source please!

Last response: in Windows 2000/NT
Share
Anonymous
February 21, 2005 3:43:05 PM

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Hi there,

I'm running a windows 2000 advanced server webserver; this afternoon
it crashed, remaining unreachable over the internet (couldn't even
ping it) until I got my host to reboot.

I'm at a loss as to what might hve caused it, as the event logs are
showing loads of errors and warnings - I don't know where to start!

Would someone be able to have a look at these logs for me, and give me
a pointer? I've listed both application and system logs here - What
you see is the server closing down, and starting up again.

Many thanks in advance,

Paul


SYSTEM LOG
------------------------------------------------------------------------------------------------------

Event Type: Error
Event Source: TermServDevices
Event Category: None
Event ID: 1100
Date: 21/02/2005
Time: 12:21:52
User: N/A
Computer: REMOTE1
Description:
Initialization of Notify Failed.
Data:
0000: ff ff ff ff 5d 01 00 00 ÿÿÿÿ]...
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Removable Storage Service
Event Category: None
Event ID: 133
Date: 21/02/2005
Time: 16:17:25
User: N/A
Computer: REMOTE1
Description:
Refused request to hibernate/suspend.
One or more applications have active connections open to this service.
Close all applications that are using this service (including the
"Removable Storage Manager" MMC snap-in) before attempting to
hibernate/suspend the system.
------------------------------------------------------------------------------------------------------
Event Type: Warning
Event Source: Win32k
Event Category: None
Event ID: 240
Date: 21/02/2005
Time: 16:17:25
User: N/A
Computer: REMOTE1
Description:
A request to suspend power was denied by svchost.exe.
Data:
0000: 00 00 00 00 02 00 4e 00 ......N.
0008: 00 00 00 00 f0 00 00 80 ....ð..€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
------------------------------------------------------------------------------------------------------
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 21/02/2005
Time: 16:17:25
User: N/A
Computer: REMOTE1
Description:
Application popup: Removable Storage Management : Removable Storage
Manager refused the request to hibernate or suspend the system.


One or more applications have active connections open to this service.
Close all applications that are using this service (including the
"Removable Storage" MMC snap-in) before attempting to hibernate or
suspend the system.
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Removable Storage Service
Event Category: None
Event ID: 133
Date: 21/02/2005
Time: 16:17:38
User: N/A
Computer: REMOTE1
Description:
Refused request to hibernate/suspend.
One or more applications have active connections open to this service.
Close all applications that are using this service (including the
"Removable Storage Manager" MMC snap-in) before attempting to
hibernate/suspend the system.
------------------------------------------------------------------------------------------------------
Event Type: Warning
Event Source: Win32k
Event Category: None
Event ID: 240
Date: 21/02/2005
Time: 16:17:38
User: N/A
Computer: REMOTE1
Description:
A request to suspend power was denied by svchost.exe.
Data:
0000: 00 00 00 00 02 00 4e 00 ......N.
0008: 00 00 00 00 f0 00 00 80 ....ð..€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
------------------------------------------------------------------------------------------------------
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 21/02/2005
Time: 16:17:38
User: N/A
Computer: REMOTE1
Description:
Application popup: Removable Storage Management : Removable Storage
Manager refused the request to hibernate or suspend the system.


One or more applications have active connections open to this service.
Close all applications that are using this service (including the
"Removable Storage" MMC snap-in) before attempting to hibernate or
suspend the system.
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Removable Storage Service
Event Category: None
Event ID: 133
Date: 21/02/2005
Time: 16:18:01
User: N/A
Computer: REMOTE1
Description:
Refused request to hibernate/suspend.
One or more applications have active connections open to this service.
Close all applications that are using this service (including the
"Removable Storage Manager" MMC snap-in) before attempting to
hibernate/suspend the system.
------------------------------------------------------------------------------------------------------
Event Type: Warning
Event Source: Win32k
Event Category: None
Event ID: 240
Date: 21/02/2005
Time: 16:18:01
User: N/A
Computer: REMOTE1
Description:
A request to suspend power was denied by svchost.exe.
Data:
0000: 00 00 00 00 02 00 4e 00 ......N.
0008: 00 00 00 00 f0 00 00 80 ....ð..€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
------------------------------------------------------------------------------------------------------
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 21/02/2005
Time: 16:18:01
User: N/A
Computer: REMOTE1
Description:
Application popup: Removable Storage Management : Removable Storage
Manager refused the request to hibernate or suspend the system.


One or more applications have active connections open to this service.
Close all applications that are using this service (including the
"Removable Storage" MMC snap-in) before attempting to hibernate or
suspend the system.
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date: 21/02/2005
Time: 16:19:26
User: N/A
Computer: REMOTE1
Description:
The previous system shutdown at 16:15:14 on 21/02/2005 was unexpected.
Data:
0000: d5 07 02 00 01 00 15 00 Õ.......
0008: 10 00 0f 00 0e 00 57 01 ......W.
0010: d5 07 02 00 01 00 15 00 Õ.......
0018: 10 00 0f 00 0e 00 57 01 ......W.
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 21/02/2005
Time: 16:19:54
User: N/A
Computer: REMOTE1
Description:
The DNS Controller service failed to start due to the following error:
The system cannot find the file specified.
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 21/02/2005
Time: 16:20:34
User: N/A
Computer: REMOTE1
Description:
The Smart Card Updater service failed to start due to the following
error:
The system cannot find the file specified.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


APPLICATION LOG
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 1015
Date: 21/02/2005
Time: 11:08:37
User: N/A
Computer: REMOTE1
Description:
The timeout waiting for the performance data collection function
"PerfDisk" in the "C:\WINNT\System32\perfdisk.dll" Library to finish
has expired. There may be a problem with this extensible counter or
the service it is collecting data from or the system may have been
very busy when this call was attempted.
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: DM Analyzer
Event Category: None
Event ID: 0
Date: 21/02/2005
Time: 16:20:08
User: N/A
Computer: REMOTE1
Description:
The description for Event ID ( 0 ) in Source ( DM Analyzer ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event:

DM Analyzer: Could not open DataBase.
------------------------------------------------------------------------------------------------------
Event Type: Warning
Event Source: MSSQLServer
Event Category: (8)
Event ID: 19011
Date: 21/02/2005
Time: 16:20:18
User: N/A
Computer: REMOTE1
Description:
SuperSocket info: (SpnRegister) : Error 1355.
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: DM Maintenance
Event Category: None
Event ID: 0
Date: 21/02/2005
Time: 16:20:25
User: N/A
Computer: REMOTE1
Description:
Service cannot be started. LS.LSException: Config: DatabaseVersionGet:
Could not query Database Version
at LS.Stats.GetDatabaseVersionInfo()
at MaintenanceDaemon.maintenaceMain.Start()
at MaintenanceDaemon.Service1.OnStart(String[] args)
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: DM Analyzer
Event Category: None
Event ID: 0
Date: 21/02/2005
Time: 16:20:53
User: N/A
Computer: REMOTE1
Description:
The description for Event ID ( 0 ) in Source ( DM Analyzer ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event:

DM Analyzer: Could not open DataBase.
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: FTPCtrs
Event Category: None
Event ID: 1000
Date: 21/02/2005
Time: 16:21:40
User: N/A
Computer: REMOTE1
Description:
Unable to collect the FTP performance statistics. The error code
returned by the service is data DWORD 0.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.
Data:
0000: 26 04 00 00 &...
------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 2002
Date: 21/02/2005
Time: 16:22:11
User: N/A
Computer: REMOTE1
Description:
The open procedure for service "PerfDisk" in DLL
"C:\WINNT\system32\perfdisk.dll" has taken longer than the established
wait time to complete. There may be a problem with this extensible
counter or the service it is collecting data from or the system may
have been very busy when this call was attempted.
------------------------------------------------------------------------------------------------------
Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003
Date: 21/02/2005
Time: 16:24:30
User: N/A
Computer: REMOTE1
Description:
The configuration information of the performance library
"C:\WINNT\system32\ftpctrs2.dll" for the "MSFTPSVC" service does not
match the trusted performance library information stored in the
registry. The functions in this library will not be treated as
trusted.
------------------------------------------------------------------------------------------------------
Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003
Date: 21/02/2005
Time: 16:24:32
User: N/A
Computer: REMOTE1
Description:
The configuration information of the performance library
"C:\WINNT\system32\w3ctrs.dll" for the "W3SVC" service does not match
the trusted performance library information stored in the registry.
The functions in this library will not be treated as trusted.
February 25, 2005 8:20:03 PM

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

"Bluze" <paul@remote.uk.com> wrote in message
news:125dded9.0502211243.5a74cbb2@posting.google.com...
> Hi there,
>
> I'm running a windows 2000 advanced server webserver; this afternoon
> it crashed, remaining unreachable over the internet (couldn't even
> ping it) until I got my host to reboot.
>
> I'm at a loss as to what might hve caused it, as the event logs are
> showing loads of errors and warnings - I don't know where to start!
>
> Would someone be able to have a look at these logs for me, and give me
> a pointer? I've listed both application and system logs here - What
> you see is the server closing down, and starting up again.
>
> Many thanks in advance,
>
> Paul
>
>
> SYSTEM LOG
> --------------------------------------------------------------------------
----------------------------
>
> Event Type: Error
> Event Source: TermServDevices
> Event Category: None
> Event ID: 1100
> Date: 21/02/2005
> Time: 12:21:52
> User: N/A
> Computer: REMOTE1
> Description:
> Initialization of Notify Failed.
> Data:
> 0000: ff ff ff ff 5d 01 00 00 ÿÿÿÿ]...
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: Removable Storage Service
> Event Category: None
> Event ID: 133
> Date: 21/02/2005
> Time: 16:17:25
> User: N/A
> Computer: REMOTE1
> Description:
> Refused request to hibernate/suspend.
> One or more applications have active connections open to this service.
> Close all applications that are using this service (including the
> "Removable Storage Manager" MMC snap-in) before attempting to
> hibernate/suspend the system.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Warning
> Event Source: Win32k
> Event Category: None
> Event ID: 240
> Date: 21/02/2005
> Time: 16:17:25
> User: N/A
> Computer: REMOTE1
> Description:
> A request to suspend power was denied by svchost.exe.
> Data:
> 0000: 00 00 00 00 02 00 4e 00 ......N.
> 0008: 00 00 00 00 f0 00 00 80 ....ð..€
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
> --------------------------------------------------------------------------
----------------------------
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 21/02/2005
> Time: 16:17:25
> User: N/A
> Computer: REMOTE1
> Description:
> Application popup: Removable Storage Management : Removable Storage
> Manager refused the request to hibernate or suspend the system.
>
>
> One or more applications have active connections open to this service.
> Close all applications that are using this service (including the
> "Removable Storage" MMC snap-in) before attempting to hibernate or
> suspend the system.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: Removable Storage Service
> Event Category: None
> Event ID: 133
> Date: 21/02/2005
> Time: 16:17:38
> User: N/A
> Computer: REMOTE1
> Description:
> Refused request to hibernate/suspend.
> One or more applications have active connections open to this service.
> Close all applications that are using this service (including the
> "Removable Storage Manager" MMC snap-in) before attempting to
> hibernate/suspend the system.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Warning
> Event Source: Win32k
> Event Category: None
> Event ID: 240
> Date: 21/02/2005
> Time: 16:17:38
> User: N/A
> Computer: REMOTE1
> Description:
> A request to suspend power was denied by svchost.exe.
> Data:
> 0000: 00 00 00 00 02 00 4e 00 ......N.
> 0008: 00 00 00 00 f0 00 00 80 ....ð..€
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
> --------------------------------------------------------------------------
----------------------------
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 21/02/2005
> Time: 16:17:38
> User: N/A
> Computer: REMOTE1
> Description:
> Application popup: Removable Storage Management : Removable Storage
> Manager refused the request to hibernate or suspend the system.
>
>
> One or more applications have active connections open to this service.
> Close all applications that are using this service (including the
> "Removable Storage" MMC snap-in) before attempting to hibernate or
> suspend the system.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: Removable Storage Service
> Event Category: None
> Event ID: 133
> Date: 21/02/2005
> Time: 16:18:01
> User: N/A
> Computer: REMOTE1
> Description:
> Refused request to hibernate/suspend.
> One or more applications have active connections open to this service.
> Close all applications that are using this service (including the
> "Removable Storage Manager" MMC snap-in) before attempting to
> hibernate/suspend the system.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Warning
> Event Source: Win32k
> Event Category: None
> Event ID: 240
> Date: 21/02/2005
> Time: 16:18:01
> User: N/A
> Computer: REMOTE1
> Description:
> A request to suspend power was denied by svchost.exe.
> Data:
> 0000: 00 00 00 00 02 00 4e 00 ......N.
> 0008: 00 00 00 00 f0 00 00 80 ....ð..€
> 0010: 00 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
> --------------------------------------------------------------------------
----------------------------
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 21/02/2005
> Time: 16:18:01
> User: N/A
> Computer: REMOTE1
> Description:
> Application popup: Removable Storage Management : Removable Storage
> Manager refused the request to hibernate or suspend the system.
>
>
> One or more applications have active connections open to this service.
> Close all applications that are using this service (including the
> "Removable Storage" MMC snap-in) before attempting to hibernate or
> suspend the system.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: EventLog
> Event Category: None
> Event ID: 6008
> Date: 21/02/2005
> Time: 16:19:26
> User: N/A
> Computer: REMOTE1
> Description:
> The previous system shutdown at 16:15:14 on 21/02/2005 was unexpected.
> Data:
> 0000: d5 07 02 00 01 00 15 00 Õ.......
> 0008: 10 00 0f 00 0e 00 57 01 ......W.
> 0010: d5 07 02 00 01 00 15 00 Õ.......
> 0018: 10 00 0f 00 0e 00 57 01 ......W.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7000
> Date: 21/02/2005
> Time: 16:19:54
> User: N/A
> Computer: REMOTE1
> Description:
> The DNS Controller service failed to start due to the following error:
> The system cannot find the file specified.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7000
> Date: 21/02/2005
> Time: 16:20:34
> User: N/A
> Computer: REMOTE1
> Description:
> The Smart Card Updater service failed to start due to the following
> error:
> The system cannot find the file specified.
>
> --------------------------------------------------------------------------
----------------------------------------------------------------------------
-----------------------------
>
>
> APPLICATION LOG
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: Perflib
> Event Category: None
> Event ID: 1015
> Date: 21/02/2005
> Time: 11:08:37
> User: N/A
> Computer: REMOTE1
> Description:
> The timeout waiting for the performance data collection function
> "PerfDisk" in the "C:\WINNT\System32\perfdisk.dll" Library to finish
> has expired. There may be a problem with this extensible counter or
> the service it is collecting data from or the system may have been
> very busy when this call was attempted.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: DM Analyzer
> Event Category: None
> Event ID: 0
> Date: 21/02/2005
> Time: 16:20:08
> User: N/A
> Computer: REMOTE1
> Description:
> The description for Event ID ( 0 ) in Source ( DM Analyzer ) cannot be
> found. The local computer may not have the necessary registry
> information or message DLL files to display messages from a remote
> computer. The following information is part of the event:
>
> DM Analyzer: Could not open DataBase.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Warning
> Event Source: MSSQLServer
> Event Category: (8)
> Event ID: 19011
> Date: 21/02/2005
> Time: 16:20:18
> User: N/A
> Computer: REMOTE1
> Description:
> SuperSocket info: (SpnRegister) : Error 1355.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: DM Maintenance
> Event Category: None
> Event ID: 0
> Date: 21/02/2005
> Time: 16:20:25
> User: N/A
> Computer: REMOTE1
> Description:
> Service cannot be started. LS.LSException: Config: DatabaseVersionGet:
> Could not query Database Version
> at LS.Stats.GetDatabaseVersionInfo()
> at MaintenanceDaemon.maintenaceMain.Start()
> at MaintenanceDaemon.Service1.OnStart(String[] args)
> at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
> state)
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: DM Analyzer
> Event Category: None
> Event ID: 0
> Date: 21/02/2005
> Time: 16:20:53
> User: N/A
> Computer: REMOTE1
> Description:
> The description for Event ID ( 0 ) in Source ( DM Analyzer ) cannot be
> found. The local computer may not have the necessary registry
> information or message DLL files to display messages from a remote
> computer. The following information is part of the event:
>
> DM Analyzer: Could not open DataBase.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: FTPCtrs
> Event Category: None
> Event ID: 1000
> Date: 21/02/2005
> Time: 16:21:40
> User: N/A
> Computer: REMOTE1
> Description:
> Unable to collect the FTP performance statistics. The error code
> returned by the service is data DWORD 0.
> For additional information specific to this message please visit the
> Microsoft Online Support site located at:
> http://www.microsoft.com/contentredirect.asp.
> Data:
> 0000: 26 04 00 00 &...
> --------------------------------------------------------------------------
----------------------------
> Event Type: Error
> Event Source: Perflib
> Event Category: None
> Event ID: 2002
> Date: 21/02/2005
> Time: 16:22:11
> User: N/A
> Computer: REMOTE1
> Description:
> The open procedure for service "PerfDisk" in DLL
> "C:\WINNT\system32\perfdisk.dll" has taken longer than the established
> wait time to complete. There may be a problem with this extensible
> counter or the service it is collecting data from or the system may
> have been very busy when this call was attempted.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Warning
> Event Source: Perflib
> Event Category: None
> Event ID: 2003
> Date: 21/02/2005
> Time: 16:24:30
> User: N/A
> Computer: REMOTE1
> Description:
> The configuration information of the performance library
> "C:\WINNT\system32\ftpctrs2.dll" for the "MSFTPSVC" service does not
> match the trusted performance library information stored in the
> registry. The functions in this library will not be treated as
> trusted.
> --------------------------------------------------------------------------
----------------------------
> Event Type: Warning
> Event Source: Perflib
> Event Category: None
> Event ID: 2003
> Date: 21/02/2005
> Time: 16:24:32
> User: N/A
> Computer: REMOTE1
> Description:
> The configuration information of the performance library
> "C:\WINNT\system32\w3ctrs.dll" for the "W3SVC" service does not match
> the trusted performance library information stored in the registry.
> The functions in this library will not be treated as trusted.

Have you tried to lookup what the event id's are?
www.eventid.net/search.asp
!