[SOLVED] Periodic Server Restarts, RAM Filling with Cached Files

[jozeftierney]

Our small business server running windows server 2016 Essentials has been periodically crashing about once a day. It could happen three or four times a day, could go a week without crashing but it averages about once a day.

System specs:
Intel Xeon 1230 V5
Windows server essentials 2016
16 gigs KVR24E17D8/16 kingston RAM
250W single power supply

Running through an APC UPS

I've been troubleshooting this for a while, no matter what I change I can't get it to save any minidump files or application crash logs, all I'm ever left with is Event id 6008 "The previous system shutdown at -- was unexpected" in the system tab of event viewer. I've spent hours combing through logs, analyzing the performance monitor and researching solutions but haven't found much.

Oddly, the crashes are almost always 20 minutes after the hour. Could be 1:20, 4:20, 7:20, etc... This schedule is also shared with the scheduled task "Software Protection Problem SvcRestartTask" which also runs once an hour, 20 mins after the hour.

My current investigation is dealing with RAM. Watching it in the resource monitor it usually looks normal, 20% of our 32GB of ram in use, 5% as standby cache. Every now and then though, our cached ram will continue to increase till there is no more "free" ram. I've used RAMMap to look further into it and it's all Metafiles and Mapped Files, when it's like this if I empty the cache it will reach full again in 30-60mins later.

The one time I was watching the resource monitor when it crashed the RAM was full of cached memory as 9:20 rolled around so I think the issue could be tied to that service running when the RAM is full but that's just a guess I haven't found anything else to back that up.

The server hosts our solidworks PDM applications, Quickbooks, SQL 2014 Express and some other small things.

 

[Ralston18]

Thinking out loud....

"Software Protection Problem SvcRestartTask" - something buggy here, what app?

Any known updates? If the problem just started the update may be buggy. Or there is just simply some file corruption involved.

And

"250W single power supply" - age, condition? Is the PSU losing its' ability to keep up with the load?

Especially if there is a lot of memory activity due to some buggy scheduled task that is misbehaving.

 

[jozeftierney]

Thinking out loud....

"Software Protection Problem SvcRestartTask" - something buggy here, what app?

Any known updates? If the problem just started the update may be buggy. Or there is just simply some file corruption involved.

And

"250W single power supply" - age, condition? Is the PSU losing its' ability to keep up with the load?

Especially if there is a lot of memory activity due to some buggy scheduled task that is misbehaving.

the software protection service seems to be related to to checking the windows license. I've disabled it's triggers and it still runs once an hour, if I disable the task something re-enables it on it's next run time.

The problem started around February and I've installed updates since then so that doesn't seem to be the case. The server was built last August, so it's not even a year old, I hadn't considered that the PSU couldn't keep up. Do you know of any way I could check that?

There's still the issue of the RAM increasing, is it normal for the RAM to fill up completely with cached files occasionally?