Jump to content
RESET Forums (homeservershow.com)
bondisdead

Intermittent remote access

Recommended Posts

bondisdead

Update! I take that back. The only other potential thing of interest is a System Warning from Source WAS with Event ID 5010. A process serving application pool 'RemoteAppPool' failed to respond to a ping. The process id was '9476'. I see these sporadically for about an hour (11:00, 11:06, 11:29, 11:53, 12:02, 12:06 and 12:13).

 

Oh, and the Audit Failure only occurs with task category Logon. Note that this Audit Failure may just be a McGuffin, and not the real problem.

Share this post


Link to post
Share on other sites
ikon

I was thinking 'maybe hard disk' because it appears the audit process was unable to read or write a particular file. That could happen if the file is on a weak or bad part of the drive. If that is the case, the system would try to read/write to the file over & over until it times out, which would tend to bog the system down.

Edited by ikon

Share this post


Link to post
Share on other sites
bondisdead

That actually makes alot of sense. Just don't understand what those Audit Success/Failure messages relating to 'Logon' would have to deal with a drive, unless it's accessing data on my System drive. It is in RAID1, so one of the drives could be shaky. Perhaps I can disconnect one of the drives, and see if things change. Not sure which one to remove, however! Seems like I could need to run chkdsk on each drive individually, outside of the RAID1, as windows only sees the one drive.

Share this post


Link to post
Share on other sites
ikon

IIRC, the error did mention something about trying to access a file, didn't it? If so, that would normally mean disk access.......

Edited by ikon

Share this post


Link to post
Share on other sites
bondisdead

I don't recall any of the log-files mentioning anyting about accessing a file. There are two types of messages that are occuring during the times of non-responsiveness:

  1. Windows Logs - Security: Audit Failure - Event ID 4625 Task Logon. Nothing in the details about file access
  2. Windows Logs - System: Warning - WAS - Event ID 5013. A process serving application pool 'Client_App' exceeded time limits during shut down. The process id is: xxxx
  3. Windows Logs - System: Warning - WAS - Event ID 5011. A process serving application pool 'RemoteAppPool' suffered a fatal communication error with the Windows Process Activation Service. The process id was xxxx. The data field containst he error number.

The second/third items seems more interesting. I don't know that the Client_App is. However, I notice issue 1) right around the time I notice slow responsiveness. Issue 2/3) is occuring outside of the non-responsive window. The computer will be non-responsive, and these messages may not appear. The same is true for the following error that pops up sporadically.

 

Windows Logs - System: Error - Filter Manager. Filter Manager failed to attach to volume '\Device\HarddiskVolume14'. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.

 

This occurs at random times, and on a bunch of different Volume#'s.

 

None of these messages may have anything to do with the problems I am having, unfortunately! But I like the idea of the hard-drives.

Share this post


Link to post
Share on other sites
ikon

I re-read the thread and you're right, it didn't specifically say anything about file access. But, I was able to recreate my thinking at the time. It was because the audit kept failing. My suspicion was that the audit was unable to easily access the file(s) it needs.

I decided to Bing the 4625 event. I found this thread: ultimatewindowssecurity.com. It seems to indicate that someone/something is trying to logon, but failing. Is it possible you have a service that can't start because of bad credentials? Have a look, see what you think.

Edited by ikon

Share this post


Link to post
Share on other sites
jmwills

Look in the Security Section of the Event Logs and the logs of the router.....

Share this post


Link to post
Share on other sites
bondisdead

There are just too many issues with this server installation, and I have had no success tracking anything down. While I would like to get down to the root cause of the problem, I'd just as soon have a stable installation, and the easiest way to do that would be a fresh install.

 

I have a spare motherboard with the same Intel H67 chipset as my current installation. I was thinking of just doing a fresh WHS 2011 install on the new motherboard. I would test that system, and see if things are better. I would copy over some data to my shares and install the same add-ins that I have now (AWIECO DriveInfo, AWIECO RemoteLauncher, AWIECO WakeOnLAN and MyMovies). I'd like to be able to recover my existing client backups, but not sure how I would do this. If have them all backed up to an external drive, but not sure how I would selectively do this. It's isn't as simple as using re-recreating the "Client Computer Backups" Server Folder, is it?

 

If everything is okay, I would then transfer over my RocketRAID 8-drive RAID-5 array. I believe this is simply a matter of moving over the card, and installing the drivers. I do have a RAID-1 array of two 2TB drives that is using the motherboard's RAID. It is my belief that as I have the identical chipset, I can just move over those drives to the new motherboard and the RAID will be maintained. This data is backed up, just in case, but the RocketRAID is *not* backed up.

 

Does this sound like a plan? I know, I'm giving up and taking the apparently easy way out!

Edited by bondisdead

Share this post


Link to post
Share on other sites
texasPI

I mean tomato on N routers. Wasn't aware there are any that can run Tomato.

 

I just checked the Asus site. This is fantastic. Thanks for posting about it. And I see Netgear has 1 open source router too: Rangemax 3500L. I have a use for these at work.

 

Yeah, I've been running Tomato on the 3500. I'm about ready to toss it out of a window as I've been having trouble with it for several months. It drops connections all the time now. I've owned it for about two years and was only trouble free for the first year. Even using it as a wireless access point only with Untangle as the router, it still has issues.

 

Sorry for the off topic...

Share this post


Link to post
Share on other sites
ikon

 

Yeah, I've been running Tomato on the 3500. I'm about ready to toss it out of a window as I've been having trouble with it for several months. It drops connections all the time now. I've owned it for about two years and was only trouble free for the first year. Even using it as a wireless access point only with Untangle as the router, it still has issues.

 

Sorry for the off topic...

Guess I won't buy one of those then....

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



×
×
  • Create New...