Windows Server 2003

[Soteria]

Hi all,

We had a power outage about two weeks ago and our server went offline. We did not have a UPS (I know, terrible fault on our part 🙁).

Immediately after the power outage, we began experiencing a problem with our network. Basically, after about an hour of operation, all work stations would lose connection with the server. The server didn't crash our anything, the work stations just lose connection.

When we check the server, an error message stating:
"generic host process for Win32 Services encountered a problem and needed to close". When I click on the "details" tab, it lists "svchost.exe" as having a problem. In my very limited knowledge, I know that svchost is an executable that runs for numerous programs. If I'm wrong, please let me know.

We've updated the server to Service Pack 2, but we're still losing connection every hour or so. We end up having to restart to re-establish the network. We've tried mapping, but that doesn't work either. Virus scanners have picked up nothing as well.

I'm at a loss here and if anyone can offer any suggestions, we'd greatly appreciate it!

Thanks!

 

[prince_vegeta]

First 2 things i would try would be a chkdsk, and then SFC /scannow
after outages you may find some files have been corrupted or sectors on your hdd screwed. So chkdsk to check that the hdd is allll good, and the SFC to check that all the important OS files are correct
give that a burl, and go from there
mick

 

[Soteria]

Thanks! By the way, what's SFC stand for?

 

[prince_vegeta]

SFC is system file checker.
Bung your windows 2003 CD into the server CD drive, and open up CMD, and type sfc /scannow
This site will give you a run down of SFC.
Let me know how you go
mick

 

[fattony]

first of all, you should not be installing sp2 which is currently in beta phase testing release candidate on your production server, so remove it, and pray it won't break a whole lot more on that box

on to the main issue, you need to capture a crash dump of svchost.exe, svchost.exe processes have multiple instances, these things are containers and hold many other services within them

tough part is if it's not always the same svchost crashing with the same processor ID (pid), you won't know what to track down and what's running under it, in order to find out what's being loaded under the particular svchost.exe which is crashing, you need to use a tool from microsoft.com called process explorer, but again, how will you know which svchost it is which will be crashing to do this in the first place?

you should try to find a trend in the svchost#1, #2, etc... to see if you can pinpoint if it's always the same #n crashing, maybe even with the same PID everytime

ultimately, you need to dump svchost.exe, microsoft has an application for this, user mode process dump 8.1 on their site, it will monitor any images which crash with the name of svchost.exe if you set it up correctly

then that dump needs to be analyzed by using microsoft's debugging tools for windows, i hope you know someone who's a good debugger, they can try to find out which module within svchost faulted

then you have have that process run on its own outside of an svchost.exe container, maybe srvany will do this, not sure, see if crashes, if it does, same process again, dump it out and have it analyzed to see which .exe or .dll is causing it to go down

honestly, i'd either rebuild that server, or call microsoft to have them debug it and gather the dumps or whatever, also, check your event viewer, it might list a module or some more info on what's involved during the crash

i would also try updating all the drivers on the machine, use msconfig to disable all the third party startups and services for a few days to see if it still goes down, have the latest windows updates to make sure svchost.exe and its components are fully up to date

some info on this:

http://support.microsoft.com/kb/314056

http://support.microsoft.com/kb/910666

 

[prince_vegeta]

you can get SP2 beta! sweeeet, mite go install that on the servers here on site! hahahaah
I just thought when he said SP2, he ment that R2. if its R2 (which i don't no if you can get that in a update..) then it SHOULD be all good. cause the win2k3 cd that we used to install our DC had it, and its running like a champ.
but yeah, don't be installing beta sp's on a server. your asking for trouble
mick

 

[Soteria]

FatTony and Prince Vegeta, thanks! You've been a great help.

After installing a mass of other updates to the server (which hasn't been updated in any way since 2004), the error no longer pops up. Since everything seems OK at this point, I'm very hesitant about removing the SP2 we installed.

Should I still remove it?

 

[prince_vegeta]

no probs champ.
look, at the end of the day if its working fine, leave it how it is! if you start messing with it more your gunna end up with more problems IMHO
thats what id do. unless you like the challenge of problems, so ppl do, in that case by all means remove away champ
luck anyways
mick

 

[fattony]

glad the windows update suggestion worked out

yeah i'd say leave it on for now...you could if you want take a full system state backup of that server, roll back sp2, do another full round of windows updates and see if any issues come up, you can always restore your backup if somethin' hits the fan