Announcement

Collapse
No announcement yet.

Unexplained server reboot causes Event 1074- Server reboot

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Unexplained server reboot causes Event 1074- Server reboot

    Our SQL guys were working on a SQL server, apparently rebuilding the indexes, when the server rebooted. The SQL guys are saying the server just rebooted in the middle of the rebuilds, but looking at the Event Log indicates that the server was rebooted manually:
    Event Type: Information
    Event Source: USER32
    Event Category: None
    Event ID: 1074
    Date: 17/04/2010
    Time: 5:03:54 PM
    User: SCL\ADDHarriso
    Computer: CLA-ALT
    Description:
    The process Explorer.EXE has initiated the restart of computer CLA-ALT on behalf of user SCL\ADDHarriso for the following reason: Other (Planned)
    Reason Code: 0x85000000
    Shutdown Type: restart
    Comment: .

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00 00 00 85 ...…
    Can anyone make sense of what happened with the server? There's nothing else in the log other than the following event, which is ocurring every ten seconds:
    Event Type: Error
    Event Source: Ntfs
    Event Category: Disk
    Event ID: 55
    Date: 19/04/2010
    Time: 10:35:20 AM
    User: N/A
    Computer: CLA-ALT
    Description:
    The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume F:.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 0d 00 04 00 02 00 52 00 ......R.
    0008: 02 00 00 00 37 00 04 c0 ....7..
    0010: 00 00 00 00 02 01 00 c0 .......
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........
    0028: 81 01 22 00 .".
    Thanks.
    |
    +-- JDMils
    |
    +-- Regional Systems Engineer, DotNet programmer & Jack of all trades
    |

  • #2
    Re: Unexplained server reboot causes Event 1074- Server reboot

    Is this an Small Business Server or should this be moved to another forum?
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    PhD, MSc, FIAP, MIITT
    IT Trainer / Consultant
    Ossian Ltd
    Scotland

    ** Remember to give credit where credit is due and leave reputation points where appropriate **

    Comment


    • #3
      Re: Unexplained server reboot causes Event 1074- Server reboot

      Looking at the Event log it certainly looks like the SQL tech restarted the server, with the reason of " . " to get past the reasoning. Normally if you use a batch file or script the reason will be a actuly code, rather then the "other" entry.

      My guess is, the SQL tech stuffed up, restarted the server in the middle of rebuilding a database, which would cause some major stuff ups on your hard drive and you would need to run check disk to repair the damage.

      A bit more evidence would be nice, and the easiest way to fine that is,
      A) Was the SQL tech logged in as SCL\ADDHarriso
      A1)Does SCL\ADDHarriso run any automated scripts
      B) Check this timeframe for the past month, are there any other restarts to look the same (same user, same error code, same comment?)
      C) Does the user have a good work history, is he known to make mistakes?
      D) ask more details about the Server "just restarting". Did it hang, did it bluescreen, was he working on the server when it died, or did he come back to it locked up. If he says it locked up, hung or bluescreen his lieing as none of these would leave that event log.

      Wofen
      Good to be back....

      Comment


      • #4
        Re: Unexplained server reboot causes Event 1074- Server reboot

        I'd just confront the person and say "well, the server didn't 'just reboot' and here's my proof - this was definitely a manual reboot"

        More accurately:

        Dear DBAS,

        I have completed my investigation of your reported random reboot of server XYZ. My investigations have determined that there was no hardware or software failure contributing to the reboot. I provide the following error log report, demonstrating that this server was manually and knowingly rebooted by operator "ADDHamilt" - in doing so, the standard reboot processes were bypassed, including completion of the reboot reason field.

        In order for further investigation, please contact user ADDHamilto and discuss with that user what the server was doing at the time the reboot occurred. There is no technical reason why this server rebooted, and as such will be closing the case. Please open a new case if required.
        Last edited by tehcamel; 19th April 2010, 15:47.
        Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

        Comment

        Working...
        X