 |
Spontaneous Shutdown: Win 2000 Pro, Apache server |
|
|
|
Anonymous Poster
December 24, 2004
11:01 PM
|
Spontaneous Shutdown: Win 2000 Pro, Apache server |
| Once in a random while, our Apache server seems to shut down by itself and reboot. I have to manually ctrl-alt-del to log in and manually launch our custom application. I used to think it was due to a power glitch and that our PC was just more sensitive than other devices in this room. However, ... The other day I noticed a small pop up on the monitor. (I should have written things down, but) I think the topmost (blue) window bar said "System Shutdown". The message was along the lines of 'due to a security problem ... the system will shut down in 45 seconds. To save your work, close open apps ...' I did write down "error 128" and "NT Admin\Shutdown". I can't find a folder called "NT <anything>". I can't find an app called "System Shutdown". I do have something called C:\Program Files\ j2sdk_nb\ netbeans3.5.1\ tomcat486\bin\ shutdown AND C:\Program Files\ j2sdk_nb\ netbeans3.5.1\ tomcat486\bin\ shutdown.sh. (The served app is java based.) Can I get some pointers to what might be happening, the location of the "shutdown" app and any log files it creates? Thank you (and have a Happy Holiday!). |
![]()
Sahil Tandon
December 26, 2004
06:02:11 PM
|
Response to pontaneous Shutdown: Win 2000 Pro |
There's nothing telling in the Apache logs, right? This is a stretch: scan the box
for the Sasser worm. Your symptoms sounds familiar.
|
![]()
Anonymous Poster
December 27, 2004
06:02:14 AM
|
Response to Spontaneous Shutdown: Win 2000 Pro, Apache server |
| The Apache Error log is almost entirely "File Not Found" errors. Nothing around the time of the crash jumps out at me as odd. The Apache Access log shows many "GET /<nonexistentfile name> HTTP 1.0/ ## ##" accesses, including some around the time of the crash but there are probably thousands of those in this log file from a wide variety of IP addresses (including 129.64.99.100): robots.txt, NessusTest###.html, etc. Strangely, some of the IP addresses that look for non-existent files proceed to make proper use of the real files (tutorials, headers, reo.jar, etc.). I don't think these are hackers, but maybe their computers are infected? But most of those are NOT causing crashes anyway. My Symantec AV is up to date (Dec 17) and I did a manual scan just a couple of days before the crash. Where should I look next? Thank you.
|
![]()
Igor Pedan
January 3, 2005
02:43:39 PM
|
If you end certain services on Windows prematurely, Windows may interpret it as a security problem. For instance, I managed to end task on the lsass.exe once and it popped up the 45 second warning till shutdown. The Sasser wrom used to cause this, as mentioned earlier (I think subsequent Welchia variants also did). I am hesitant to say its that though because those were pretty consistent in terms of crashing almost as soon as a stable internet connection was established--though its been sometime since it was that rampant. I think what happens is that your whole computer is rebooting and not the server just shutting. Which means the problem isn't necessarily with your server, but with the computer. The server maybe triggering something that either ends or causes to crash one of Windows' required components. Try seeing if there is something in the windows event logger. I am not sure off hand where it is as I don't have access to a Windows box at the moment.
|
Post A Response
|
|
