SBS 2003 - IIS Websites quit working

[H. Hudson]

Hi,

We have a Windows 2003 SBS with SP2. We have been having problems with the
IIS websites since last Tuesday. They will run correctly for a few days and
then just stop. User's see the following message when they try to access the
websites:

"Internet Explorer cannot display the webpage"

The IIS websites will show up as "running" in IIS, and restarting the IIS
services doesn't help, but if the server is rebooted everything will come up
and work correctly for a few days.

There are not any errors in the application log, and the W3SVC1 log doesn't
show anything after the IIS websites stop working. The server also is up to
date with Microsoft updates.

The Windows firewall isn't turned on, AVG Business Edition is being used on
the server, but it doesn't have a firewall.

[Larry Struckmeyer[SBS-MVP]]

Hi:

I am currently tracking a SBS 2003 premium where the AVG service AVGCSRVX.exe
commits page faults around 60 Million (yes Million) times in less than a
week. Sometimes the server will just stop responding and have to be rebooted
in 3 days, sometimes longer. At that point the server does not respond
to RWW, does not send mail to forwards, and cannot be reached by mapped drives.
It is as if it goes to sleep.

How much memory in the SBS? How big, and where is the page file located?
Are there any events 330 or 2019 or 2020 in the event logs?

To view the faults of the various services, open task manager, click on the
processes tab, then View - Select columns. This might be nothing, it might
show you what you are need to know.

Aslo, run the SBS BPA and the IT Health Scanner

Microsoft Windows Small Business Server 2003 Best Practices Analyzer

http://www.microsoft.com/downloads/details.aspx?FamilyId=3874527A-DE19-49BB-800F-352F3B6F2922&displaylang=en

Microsoft IT Environment Health Scanner
http://www.microsoft.com/downloads/details.aspx?familyid=DD7A00DF-1A5B-4FB6-A8A6-657A7968BD11&displaylang=en

-
Larry
Please post the resolution to your
issue so others may benefit
-
Get Your SBS Health Check at
www.sbsbpa.com

[Susan Bradley]

So why are you still running AVG on the box when it is this harmful.

When's the last time it found a virus on the server? How often are you
rebooting this box for code that is now more harmful than a virus?

[Larry Struckmeyer[SBS-MVP]]

Susan....

In case you are referencing my post, I think you know that some decisions
about servers are made by their owners. We have instituted tracking, and
have invited AVG support into the server to see if AVG is indeed the cause,
and if there is a fix. In the meantime, the owner is somwhat nervous about
his server going bare.

In any case, most SBS servers get restarted weekly due to updates, at most
bi-weekly, so the number of restarts is not so much the issue as the inconvience
of the time/necessity of such.

My reply to H. Hudson was essentially to see if his issues in any way paralled
those of the server we are tracking, not to suggest that he pull the plug
on is AV.

-
Larry
Please post the resolution to your
issue so others may benefit
-
Get Your SBS Health Check at
www.sbsbpa.com

[Russ SBITS.Biz [SBS-MVP]]

In IIS does the Websites show up as Running or Stopped?
And I assume they start when you restart the server?
First set the notifications when IIS stops and have it email you.
Next how much memory are you using when it stops
and how much do you have installed on the server

Russ

--
Russell Grover - SBITS.Biz [SBS-MVP]
MCP, MCPS, MCNPS, SBSC
Small Business Server/Computer Support - www.SBITS.Biz
Question or Second Opinion - www.PersonalITConsultant.com
BPOS - Microsoft Online Services - www.Microsoft-Online-Services.com
http://www.twitter.com/RussellGrover

"H. Hudson" <HHu...@discussions.microsoft.com> wrote in message
news:9527423B-BDAD-4D60...@microsoft.com...

[Susan Bradley]

They do not get started weekly due to updates, they don't come out that
often.

The reality is that the viruses come in on the workstations, not on the
server unless you are doing something dumb up there in the first place.

[Russ SBITS.Biz [SBS-MVP]]

Susan I have to disagree with you on this.
It would be nice if that was true
however people still use the server as a workstation
or they grab a USB to put files on it or external Hard drive etc.

And yes we have ALL seen this!

or they bring a pc laptop in without av on it
and login to access files on the server.

(After all it's just one time, no harm no foul)
Then they don't find that there was a virus on the server
until weeks later. and then the data is ruined.

For $40 IMO it's cheap insurance
I'd not want to be the consultant to say
UH sorry, I didn't cover the Server because I didn't think it would need it.

Because I don't want Egg on my face, I always have AV on the server.
My Opinion :)
Russ

--
Russell Grover - SBITS.Biz [SBS-MVP]
MCP, MCPS, MCNPS, SBSC
Small Business Server/Computer Support - www.SBITS.Biz
Question or Second Opinion - www.PersonalITConsultant.com
BPOS - Microsoft Online Services - www.Microsoft-Online-Services.com

Twitter http://www.twitter.com/SBITSdotBiz

"Susan Bradley" <sbra...@pacbell.net> wrote in message
news:eHI#NWVyKH...@TK2MSFTNGP06.phx.gbl...

[SuperGumby [SBS MVP]]

NO RUSS. Even at my most humble installs EVERYONE knows I'm the only person
who 'logs on' to the server.

At no site, at no time, for no reason, does ANYBODY (but me) log on to the
server.

This is a basic reason why I disagree with USB drives as a backup medium. To
properly disconnect a USB drive one must 'log on' to the server. DOESN'T
HAPPEN. (note: That's a FULL STOP)

"Russ SBITS.Biz [SBS-MVP]" <ru...@REMOVETHIS.sbits.biz> wrote in message
news:ECA9BD18-AE9E-4666...@microsoft.com...

[Russ SBITS.Biz [SBS-MVP]]

You must be lucky
Some of the "IT Professionals" that I've had call me
are the ones doing these WRONG things to begin with.

This is why I use a global Statement
AV on the server regardless...

If all IT Consultants KNEW Common sense I would say
Sure leave the AV off the server
Problem is, the real world,, they don't...
Any time you leave the human element in, it is the part that FAILS
:(
Russ

--
Russell Grover - SBITS.Biz [SBS-MVP]
MCP, MCPS, MCNPS, SBSC
Small Business Server/Computer Support - www.SBITS.Biz
Question or Second Opinion - www.PersonalITConsultant.com
BPOS - Microsoft Online Services - www.Microsoft-Online-Services.com
Twitter http://www.twitter.com/SBITSdotBiz

"SuperGumby [SBS MVP]" <n...@your.nellie> wrote in message
news:#bbKjsXy...@TK2MSFTNGP05.phx.gbl...

[SuperGumby [SBS MVP]]

but seriously Russ, it was only the other day (less than 48hrs) that a
client (company CEO) rang and asked me for credentials to 'logon to the
server'. My response was WHY??? I also responded that I would gladly tell
him the details the he requested however, knowing his use of the system, and
his capabilities, I really didn't think it was a good idea.

He trusted me and now knows the credentials necessary to logon to his
server, however didn't need to do such.

"Russ SBITS.Biz [SBS-MVP]" <ru...@REMOVETHIS.sbits.biz> wrote in message

news:efFV11Xy...@TK2MSFTNGP06.phx.gbl...

[Russ SBITS.Biz [SBS-MVP]]

Problem is
I not only support End Clients
I also support a lot of IT people, who support clients
Second and Third level support.
So they are the ones messing up servers, not the CEO.

Which is why it's a pet Peeve of mine of a messed up SBS box from a
"Professional" there is no reason for it, assuming they can read.

We are getting off topic, I have Clients, IT people that don't follow
practices
yes in a perfect world it would be great
Unfortunately I don't live in the perfect world.
Sorry
Russ

--
Russell Grover - SBITS.Biz [SBS-MVP]
MCP, MCPS, MCNPS, SBSC
Small Business Server/Computer Support - www.SBITS.Biz
Question or Second Opinion - www.PersonalITConsultant.com
BPOS - Microsoft Online Services - www.Microsoft-Online-Services.com
Twitter http://www.twitter.com/SBITSdotBiz

"SuperGumby [SBS MVP]" <n...@your.nellie> wrote in message

news:eI3tq9Xy...@TK2MSFTNGP06.phx.gbl...

[H. Hudson]

Hi,

Thanks for the reply.

The SBS has 4 GB of RAM, 4 GB pagefile on the C drive. I just adjusted the
page file to 6 GB.

Generally the server will go 3-5 days before the websites stop working,
nothing else seems to be affected by this. They also do file sharing &
printing off that server. I'm also not seeing 330, 2019 or 2020 in the event
log.

As another interesting note, we have a 2nd customer with a SBS 2003 that
started doing the same thing this week. It has 2 GB RAM, 4 GB page file on
the C drive. They also have AVG installed on the server.

Thanks

"Larry Struckmeyer[SBS-MVP]" wrote:

> .
>

[Larry Struckmeyer[SBS-MVP]]

We may be at the start (or possibly the end) of a pattern here.

BTW, afaik, any swap file over 4 GB on one partition is largely wasted and
may be detrimental. I remember Super Gumby did an exhaustive test of this,
and I am probably mistaken. I believe it is nap time in AU now, so it may
be some time before he responds.

I routinely do set mutiple page files on separate partitions (separate spindles
is better) becuase I read in my MCSE study days that Windows was smart enough
to use the least active.

-
Larry
Please post the resolution to your
issue so others may benefit
-
Get Your SBS Health Check at
www.sbsbpa.com

> Hi,
>

[SuperGumby [SBS MVP]]

NAH, I didn't do exhaustive testing, I listened to an MS engineer (someone
involved in memory management design at one time IIRC).

Still shaking the sleep out o' m' head and the caffeine is yet to kick in
(mistakenly buying decaf the other day certainly doesn't help on that score,
mixing it with real coffee).

The basic deal is that no Windows 32 bit system will effectively (or was it
efficiently) use >4GB of swap. Also, but not from the same source, the 'rule
of thumb' that a swapfile be set to 1.5 times RAM is a) just that, a rule of
thumb, not a law, and b) impossible if you have >(4/1.5) GB RAM unless the
system is 200x SPy(2003 SP2 maybe, actually, likely), OR a large memory
model system (those rare 32 bit beasts that allow >4GB RAM, ie. NOT SBS).

Yes, if you have multiple spindle sets it is worthwhile putting a PF on each
set. There's an algorithm in memory management that opportunistically uses
the PF from the least busy spindles. My read is that the size increase gives
very little benefit, the 'least busy' bit can have significant impact.

and as I recall more, the MS guy may have suggested something along the
lines 'if true PF use indicates that a 32 bit Windows system requires both
4GB of RAM and >4GB PF, you shouldn't be using a 32 bit version of Windows'.

The true required size of your PF is not a mystery. There is nothing magical
about it. There are a set of performance counters that can be inspected.
There is a degree of 'art' and 'speculation' to it in that you 1st take a
'best guess' and then allow the system to operate for a while, adjust
accordingly, repeat. This process is well documented at both MS.com and a
great number of 'personal websites'.

SO, on an SBS03 with the full complement of RAM and Windows SP2 installed
I'd run a PF of 4.1GB on the root/boot partition (to allow a full memory
dump, should it be necessary) _and_ a PF on any additional spindle set,
maybe 2GB each because it is extremely unlikely the system will utilise more
than that.

There was also something mentioned about oversized PFs exhausting system
resources (particularly PTEs?), IIRC. The problem here being that if _ANY_
PF is large enough to require the large pointers (ie. >4095MB) the system is
subject to such exhaustion.

and here we go into wonderland with my unholy opinion: It would seem that
though SBS03 is capable of supporting 4GB RAM it is better to limit it to
about 3.9GB, so the root/boot PF that allows full memory dump be under
4095MB, and you have at least one additional spindle set so that you can set
another PF on it (size no greater than 4095MB).

If you only have a single spindle set you need to partition it OR use an
again well documented process to create multiple PF's under 4095MB each.

in the world according to SG :-)

"Larry Struckmeyer[SBS-MVP]" <lstruc...@mis-wizards.com> wrote in message
news:4e683515de618...@news.microsoft.com...

[Larry Struckmeyer[SBS-MVP]]

We appear to have an answer for the AVG lockup issue, and we are tentatively
"promised" a fix by Monday. I for one am going to install the work around
and wait for others to prove the fix.

The work around appears to be to turn off a caching feature or to exclude
the cache folder from scans:

To turn the caching feature off, open AVG Admin, click Tools, Shared Settings
for Stations, click Cache Server, and uncheck the first checkbox.

You can also exclude the cache server folder from Resident Shield:

On Server 2000, or Server 2003:

C:\Documents and Settings\All Users\Application Data\AVG9\CHJW

On Server 2008:
C:\Program Data\AVG9\CHJW

-
Larry
Please post the resolution to your
issue so others may benefit
-
Get Your SBS Health Check at
www.sbsbpa.com

> Hi,
>

[H. Hudson]

That's good to hear. I ended up uninstalling AVG 9 from both of the affected
servers and installing AVG 8.5. The problem cleared up completely with that.

"Larry Struckmeyer[SBS-MVP]" wrote:

> .
>