System A.M. shut downs

[thinman]

O/S:
Win XP Pro w/SP2 and all updates

Hdwr:
MSI K8N Neo4 m/b
MSI NS6800GT 256MB DDR3
AMD Athlon 64 4000+
LinkSys Cable Modem
LinkSys Router w/8 port switch
APC SmartUPS 1000XL

Prior to 05-25-09, system has been running 24/7 since the purchase of the
motherboard/CPU with no problems of random shut downs.

On 05-24-09, I downloaded a trial version of ESET's NOD32 anti-virus
software and installed. The next morning (05-25), I found the system powered
off
so I rebooted and I get a screen with a message stating that Drive F needs
to
be checked for consistency and goes through a CHKDSK type scan. No
errors. It continued its' rebooted and XP loaded. Opened NOD32 and started
looking through the configuration settings for something that might trigger
the
shut down event. None. E-mailed ESET and they said it wasn't their products'
fault. Had to be hardware related. OK, lets see what happens tomorrow AM.
I opened a weather program which records data every 5 minutes to see when
the last entry was made: 7:39 a.m.

05-26, the system is shut down again. Powered on and the same "error
message"
came up about Drive F. Opened the weather program and same thing ; last
entry
at 7:39 a.m. Google'd for the error message and made note of possible cures.
Did not try any of the cures at this point. NOD32 was loaded on the C drive
by
the way. Drive F is populated with original download files and other data
files
only.

Opened up all other known programs that auto-update to see when they were
scheduled. None anywhere close to 7:39 a.m.

Uninstalled NOD32, rebooted and then opened "regedit" to see what was left
from the NOD32 uninstall. Plenty! . So, I spent the next several hours
deleting
entries for that program. Rebooted and left it alone.

Shut downs continued. 05-27: 7:39 a.m........05-28: 5:59 a.m.........
05-29: 7:40 a.m........05-30: no shutdown.........05-31: 7:39
a.m...........
06-01: 7:39 a.m...........06-02: 7:59 a.m.

This morning ( 06-02 ), I came up to watch and see what might be happening.
Started my vigil at 7:25 a.m. and by 7:55 a.m., nothing had happened. Left
and went back to sleep.

Yesterday, 06-01, I moved everything off the drive F to drive E and then
reformatted the drive (partition) F. This morning, 06-02, no error message
when I had to reboot.

So.....what program can I use to log shutdown events, as well as any other
events that are automatically started, which will give me plenty of details.
I need to find the problem.

Thanks
Ray

 

[Shenan Stanley]

O/S:
Win XP Pro w/SP2 and all updates

Hdwr:
MSI K8N Neo4 m/b
MSI NS6800GT 256MB DDR3
AMD Athlon 64 4000+
LinkSys Cable Modem
LinkSys Router w/8 port switch
APC SmartUPS 1000XL

Prior to 05-25-09, system has been running 24/7 since the purchase
of the motherboard/CPU with no problems of random shut downs.

On 05-24-09, I downloaded a trial version of ESET's NOD32 anti-virus
software and installed. The next morning (05-25), I found the
system powered off
so I rebooted and I get a screen with a message stating that Drive
F needs to
be checked for consistency and goes through a CHKDSK type scan. No
errors. It continued its' rebooted and XP loaded. Opened NOD32 and
started looking through the configuration settings for something
that might trigger the
shut down event. None. E-mailed ESET and they said it wasn't their
products' fault. Had to be hardware related. OK, lets see what
happens tomorrow AM. I opened a weather program which records data every 5
minutes to
see when the last entry was made: 7:39 a.m.

05-26, the system is shut down again. Powered on and the same "error
message"
came up about Drive F. Opened the weather program and same thing ;
last entry
at 7:39 a.m. Google'd for the error message and made note of
possible cures. Did not try any of the cures at this point. NOD32
was loaded on the C drive by
the way. Drive F is populated with original download files and
other data files
only.

Opened up all other known programs that auto-update to see when
they were scheduled. None anywhere close to 7:39 a.m.

Uninstalled NOD32, rebooted and then opened "regedit" to see what
was left from the NOD32 uninstall. Plenty! . So, I spent the next
several hours deleting
entries for that program. Rebooted and left it alone.

Shut downs continued. 05-27: 7:39 a.m........05-28: 5:59
a.m......... 05-29: 7:40 a.m........05-30: no
shutdown.........05-31: 7:39 a.m...........
06-01: 7:39 a.m...........06-02: 7:59 a.m.

This morning ( 06-02 ), I came up to watch and see what might be
happening. Started my vigil at 7:25 a.m. and by 7:55 a.m., nothing
had happened. Left and went back to sleep.

Yesterday, 06-01, I moved everything off the drive F to drive E and then
reformatted the drive (partition) F. This morning, 06-02,
no error message when I had to reboot.

So.....what program can I use to log shutdown events, as well as
any other events that are automatically started, which will give me
plenty of details. I need to find the problem.

Download the hard disk drive manufacturer's diagnostics and run them against
the drive.

 

[JS]

Have you checked the 'Event' log files
using Event Viewer?

 

[thinman]

JS......

Yes, and nothing there...zip....nada...
Checked firewall logs and nothing....zip...etc

thanks

ray

 

[JS]

Process Monitor to track the problem.
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Be aware it creates a large record of background activity
(you can filter out some of the activity if you like)
Also I have not tried/checked the log file options but its
worth a look.

 

[John Wunderlich]

O/S:
Win XP Pro w/SP2 and all updates

Hdwr:
MSI K8N Neo4 m/b
MSI NS6800GT 256MB DDR3
AMD Athlon 64 4000+
LinkSys Cable Modem
LinkSys Router w/8 port switch
APC SmartUPS 1000XL

Prior to 05-25-09, system has been running 24/7 since the purchase
of the motherboard/CPU with no problems of random shut downs.

On 05-24-09, I downloaded a trial version of ESET's NOD32
anti-virus software and installed. The next morning (05-25), I
found the system powered off
so I rebooted and I get a screen with a message stating that Drive
F needs to
be checked for consistency and goes through a CHKDSK type scan. No
errors. It continued its' rebooted and XP loaded. Opened NOD32 and
started looking through the configuration settings for something
that might trigger the
shut down event. None. E-mailed ESET and they said it wasn't their
products' fault. Had to be hardware related. OK, lets see what
happens tomorrow AM. I opened a weather program which records data
every 5 minutes to see when the last entry was made: 7:39 a.m.

05-26, the system is shut down again. Powered on and the same
"error message"
came up about Drive F. Opened the weather program and same thing ;
last entry
at 7:39 a.m. Google'd for the error message and made note of
possible cures. Did not try any of the cures at this point. NOD32
was loaded on the C drive by
the way. Drive F is populated with original download files and
other data files
only.

Opened up all other known programs that auto-update to see when
they were scheduled. None anywhere close to 7:39 a.m.

Uninstalled NOD32, rebooted and then opened "regedit" to see what
was left from the NOD32 uninstall. Plenty! . So, I spent the next
several hours deleting
entries for that program. Rebooted and left it alone.

Shut downs continued. 05-27: 7:39 a.m........05-28: 5:59
a.m......... 05-29: 7:40 a.m........05-30: no
shutdown.........05-31: 7:39 a.m...........
06-01: 7:39 a.m...........06-02: 7:59 a.m.

This morning ( 06-02 ), I came up to watch and see what might be
happening. Started my vigil at 7:25 a.m. and by 7:55 a.m., nothing
had happened. Left and went back to sleep.

Yesterday, 06-01, I moved everything off the drive F to drive E
and then reformatted the drive (partition) F. This morning,
06-02, no error message when I had to reboot.

So.....what program can I use to log shutdown events, as well as
any other events that are automatically started, which will give
me plenty of details. I need to find the problem.

Thanks
Ray

Two hardware things you might want to consider:

1 - Overheating. If the CPU gets too hot, the machine will shut down
rather quickly. Check for excess dust and verify the fans are all
working. There are programs that will report temperature readings.

2 - Power Supply. If a power supply were to fail and put out too much
voltage (e.g. voltage spike), most power supplies would detect that and
"crowbar" resulting in an immediate shutdown. When you replaced your
motherboard, did you verify your power supply was big enough to power
the new motherboard?

HTH,
John

 

[Jose]

JS......

Yes, and nothing there...zip....nada...
Checked firewall logs and nothing....zip...etc

thanks

ray

Nothing in the Event Logs? Wow.

If I shutdown my system gracefully, I do get things in the Event Log
and another place I see a graceful shutdown message is in the log for
the Task Scheduler: c:\windows\schedlgu.txt, (assuming yours is
running). These normal looking messages lead me to believe the
shutdown was not by accident. If I pull the plug, it looks different.

Is your UPS software in use on your computer (via the serial cable)?
Is there a log file for that? If the UPS felt like it, it could
command your system to shutdown if programmed to do so, or if it is
malfunctioning.

There really must be something in your Event Log when you do a
graceful shutdown - things get stopped. Compare the last few events
of a graceful shutdown to those prior to rebooting after finding the
system dead. I don't have any errors regarding shutdown, but a few
events.

This is starting to sound like an impending hardware failure issue or
heat problem caused my malfunctioining hardware or poor ventilation.

If it was me, I would pull the cover(s) and clean all by power supply
and CPU fans and ventilation ports and reseat any I/O cards, the RAM,
anything else that can come loose and go back without a struggle,
etc. Leave the covers off for a day. You said this used to run 24/7
- for months? Not a big problem in a data center, but might be in a
home environment. When you apply power with the covers off, do all
the fans run (like CPU, video card, etc). You can't tell for sure
with the cover on.

I am reminded of one person that had unexpected shutdowns after some
random amount of running time
and after a bit, the system would restart okay and run for a while
longer, but if she kept it off for several hours or overnight, it ran
for a very long time, but would shutdown eventually.

I don't really believe much in "cleanings" and "dust blow outs" ($25
around here), but you don't have anything to lose except a little
time. It sounds like your system is failing at least once a day, so
you would only have to wait a day after this process to see if things
improved or not.

You could know in about 24 hours.

 

[thinman]

Shenan......

Did that.....used SeaTools (latest version) and ran full
diagnostics...PASSED....

thanks
Ray

 

[thinman]

Jose.......

I should have been a bit more specific with reference to what was/was not in
the
the Event Viewer log. Nothing was logged ( 06-01 ) for the time frame of
4:29 a.m.
to 7:39 a.m., at which point it shut down. Upon my powering up, at/about
8:40 a.m.,
entries show thereafter until just before 8:42 a.m.; then during the 12:00 -
1:00
time frame; 17:30 - 17:31; etc. On 05-31, there was an entry at 3:28 a.m.
and the
next was around 12:45 p.m. when I discovered it was off and powered up
again.
Same for the other days ; nothing of note around/before the times of shut
down.

The UPS is strickly used for short power outages / brownouts. The house is
backed
up by a 25KW generator which starts within 20 seconds of losing power from
the
utility company. UPS is not connected via serial cable for shutting down.

As for the environment, the room temp stays at 74 degrees. The system has
filters
ahead of all fans (3) drawing air into the case and are cleaned on a regular
basis.
There are (2) exhaust fans; (1) in the Power Supply (PC Power & Cooling 510
Turbo Cool) and (1) below and to the left. Fan/Heatsink on the CPU are also
cleaned on a regular basis. These get cleaned also. System was built
on/about
April 2005 and has run 24/7 since then. All fans are running.

While the problem might be hardware related, I find it extremely hard to
believe
in that it has shut down exactly at the same time ( 7:39 a.m.) -5- times.
It appears
more likely to be software related. That's why I need a program that will
provide
a log detailing what is going on behind the scenes as well as the more
obvious.

Thanks for the suggestions.
Ray

JS......

Yes, and nothing there...zip....nada...
Checked firewall logs and nothing....zip...etc

thanks

ray

Nothing in the Event Logs? Wow.

If I shutdown my system gracefully, I do get things in the Event Log
and another place I see a graceful shutdown message is in the log for
the Task Scheduler: c:\windows\schedlgu.txt, (assuming yours is
running). These normal looking messages lead me to believe the
shutdown was not by accident. If I pull the plug, it looks different.

Is your UPS software in use on your computer (via the serial cable)?
Is there a log file for that? If the UPS felt like it, it could
command your system to shutdown if programmed to do so, or if it is
malfunctioning.

There really must be something in your Event Log when you do a
graceful shutdown - things get stopped. Compare the last few events
of a graceful shutdown to those prior to rebooting after finding the
system dead. I don't have any errors regarding shutdown, but a few
events.

This is starting to sound like an impending hardware failure issue or
heat problem caused my malfunctioining hardware or poor ventilation.

If it was me, I would pull the cover(s) and clean all by power supply
and CPU fans and ventilation ports and reseat any I/O cards, the RAM,
anything else that can come loose and go back without a struggle,
etc. Leave the covers off for a day. You said this used to run 24/7
- for months? Not a big problem in a data center, but might be in a
home environment. When you apply power with the covers off, do all
the fans run (like CPU, video card, etc). You can't tell for sure
with the cover on.

I am reminded of one person that had unexpected shutdowns after some
random amount of running time
and after a bit, the system would restart okay and run for a while
longer, but if she kept it off for several hours or overnight, it ran
for a very long time, but would shutdown eventually.

I don't really believe much in "cleanings" and "dust blow outs" ($25
around here), but you don't have anything to lose except a little
time. It sounds like your system is failing at least once a day, so
you would only have to wait a day after this process to see if things
improved or not.

You could know in about 24 hours.

 

[thinman]

Jose.......

I should have been a bit more specific with reference to what was/was not in
the Event Viewer log. Nothing was logged ( 06-01 ) for the time frame of
4:29 a.m. to 7:39 a.m., at which point it shut down. Upon my powering up,
at/about
8:40 a.m., entries show thereafter until just before 8:42 a.m.; then during
the 12:00 -
1:00 pm time frame; 17:30 - 17:31; etc. On 05-31, there was an entry at
3:28 a.m.
and the next was around 12:45 p.m. when I discovered it was off and powered
up
again. Same for the other days ; nothing of note around/before the times of
shut
down.

The UPS is strickly used for short power outages / brownouts. The house is
backed up by a 25KW generator which starts within 20 seconds of losing power
from
the utility company. UPS is not connected via serial cable for shutting
down.

As for the environment, the room temp stays at 74 degrees. The system has
filters ahead of all fans (3) drawing air into the case and are cleaned on a
regular
basis. There are (2) exhaust fans; (1) in the Power Supply (PC Power &
Cooling 510
Turbo Cool) and (1) below and to the left. Fan/Heatsink on the CPU are also
cleaned on a regular basis. These get cleaned also. System was built
on/about
April 2005 and has run 24/7 since then. All fans are running.

While the problem might be hardware related, I find it extremely hard to
believe in that it has shut down exactly at the same time ( 7:39 a.m.) -5-
times.
It appears more likely to be software related. That's why I need a program
that will
provide a log detailing what is going on behind the scenes as well as the
more
obvious.

Thanks for the suggestions.
Ray

JS......

Yes, and nothing there...zip....nada...
Checked firewall logs and nothing....zip...etc

thanks

ray

Nothing in the Event Logs? Wow.

If I shutdown my system gracefully, I do get things in the Event Log
and another place I see a graceful shutdown message is in the log for
the Task Scheduler: c:\windows\schedlgu.txt, (assuming yours is
running). These normal looking messages lead me to believe the
shutdown was not by accident. If I pull the plug, it looks different.

Is your UPS software in use on your computer (via the serial cable)?
Is there a log file for that? If the UPS felt like it, it could
command your system to shutdown if programmed to do so, or if it is
malfunctioning.

There really must be something in your Event Log when you do a
graceful shutdown - things get stopped. Compare the last few events
of a graceful shutdown to those prior to rebooting after finding the
system dead. I don't have any errors regarding shutdown, but a few
events.

This is starting to sound like an impending hardware failure issue or
heat problem caused my malfunctioining hardware or poor ventilation.

If it was me, I would pull the cover(s) and clean all by power supply
and CPU fans and ventilation ports and reseat any I/O cards, the RAM,
anything else that can come loose and go back without a struggle,
etc. Leave the covers off for a day. You said this used to run 24/7
- for months? Not a big problem in a data center, but might be in a
home environment. When you apply power with the covers off, do all
the fans run (like CPU, video card, etc). You can't tell for sure
with the cover on.

I am reminded of one person that had unexpected shutdowns after some
random amount of running time
and after a bit, the system would restart okay and run for a while
longer, but if she kept it off for several hours or overnight, it ran
for a very long time, but would shutdown eventually.

I don't really believe much in "cleanings" and "dust blow outs" ($25
around here), but you don't have anything to lose except a little
time. It sounds like your system is failing at least once a day, so
you would only have to wait a day after this process to see if things
improved or not.

You could know in about 24 hours.

 

[thinman]

Jose.......

I should have been a bit more specific with reference to what was/was not in
the Event Viewer log. Nothing was logged ( 06-01 ) for the time frame of
4:29 a.m. to 7:39 a.m., at which point it shut down. Upon my powering up,
at/about
8:40 a.m., entries show thereafter until just before 8:42 a.m.; then during
the 12:00 -
1:00 pm time frame; 17:30 - 17:31; etc. On 05-31, there was an entry at
3:28 a.m.
and the next was around 12:45 p.m. when I discovered it was off and powered
up
again. Same for the other days ; nothing of note around/before the times of
shut
down.

The UPS is strickly used for short power outages / brownouts. The house is
backed up by a 25KW generator which starts within 20 seconds of losing power
from
the utility company. UPS is not connected via serial cable for shutting
down.

As for the environment, the room temp stays at 74 degrees. The system has
filters ahead of all fans (3) drawing air into the case and are cleaned on a
regular
basis. There are (2) exhaust fans; (1) in the Power Supply (PC Power &
Cooling 510
Turbo Cool) and (1) below and to the left. Fan/Heatsink on the CPU are also
cleaned on a regular basis. These get cleaned also. System was built
on/about
April 2005 and has run 24/7 since then. All fans are running.

While the problem might be hardware related, I find it extremely hard to
believe in that it has shut down exactly at the same time ( 7:39 a.m.) -5-
times.
It appears more likely to be software related. That's why I need a program
that will
provide a log detailing what is going on behind the scenes as well as the
more
obvious.

Thanks for the suggestions.
Ray

JS......

Yes, and nothing there...zip....nada...
Checked firewall logs and nothing....zip...etc

thanks

ray

Nothing in the Event Logs? Wow.

If I shutdown my system gracefully, I do get things in the Event Log
and another place I see a graceful shutdown message is in the log for
the Task Scheduler: c:\windows\schedlgu.txt, (assuming yours is
running). These normal looking messages lead me to believe the
shutdown was not by accident. If I pull the plug, it looks different.

Is your UPS software in use on your computer (via the serial cable)?
Is there a log file for that? If the UPS felt like it, it could
command your system to shutdown if programmed to do so, or if it is
malfunctioning.

There really must be something in your Event Log when you do a
graceful shutdown - things get stopped. Compare the last few events
of a graceful shutdown to those prior to rebooting after finding the
system dead. I don't have any errors regarding shutdown, but a few
events.

This is starting to sound like an impending hardware failure issue or
heat problem caused my malfunctioining hardware or poor ventilation.

If it was me, I would pull the cover(s) and clean all by power supply
and CPU fans and ventilation ports and reseat any I/O cards, the RAM,
anything else that can come loose and go back without a struggle,
etc. Leave the covers off for a day. You said this used to run 24/7
- for months? Not a big problem in a data center, but might be in a
home environment. When you apply power with the covers off, do all
the fans run (like CPU, video card, etc). You can't tell for sure
with the cover on.

I am reminded of one person that had unexpected shutdowns after some
random amount of running time
and after a bit, the system would restart okay and run for a while
longer, but if she kept it off for several hours or overnight, it ran
for a very long time, but would shutdown eventually.

I don't really believe much in "cleanings" and "dust blow outs" ($25
around here), but you don't have anything to lose except a little
time. It sounds like your system is failing at least once a day, so
you would only have to wait a day after this process to see if things
improved or not.

You could know in about 24 hours.

JS......

Yes, and nothing there...zip....nada...
Checked firewall logs and nothing....zip...etc

thanks

ray

..

 

[thinman]

John.....

See the reply to Jose above.... yes, made sure the power supply was
of a rated amperage to handle what it was going to have to provide
power to.

Thanks
ray

 

[JS]

1) Any scheduled tasks that start at that time?

2) Disconnect the PC from the Internet and see if it still happens.

 

[Jose]

John.....

See the reply to Jose above.... yes, made sure the power supply was
of a rated amperage to handle what it was going to have to provide
power to.

Thanks
ray

JS said scheduled tasks - my next guess since the time seems a factor.

Look in Control Panel at any scheduled tasks and also in c:\windows
\tasks (where they are stored).

You can also look at the scheduled tasks log, but to delete all the
trash that might be in there, you have to stop the service first,
delete the c:\windows\schedlgu.txt file, restart the service and get a
fresh log. You might spot something useful from the last few
occurrences before deleting.

If you are not using scheduled tasks, turn off the service for a day.

 

[thinman]

JS.....

No scheduled tasks that I can find; however, there must be something being
initiated. That's why I'm looking for some program to log everything that
starts and stops. Will be loading the Process Monitor program tonight
and see what it shows.

Disconnecting it from the LAN/WAN will be another step. Trying to do
one thing at a time to discover the cause.

Thanks
Ray

 

[thinman]

JS.....

Should have stated in my first reply that there are no scheduled tasks
that I could find --- at that time of day. There are some but are
scheduled between midnight and 3:00 a.m.; and they in fact were
run at those times.

Thanks
Ray

 

[thinman]

Well, it's past 7:39 a.m. on 06-03 and the system has not shut down....as of
yet.

Will post back if the problem comes back to life.

Thanks to Shenan, JS , Jose and John for your input !!

Ray