adamt Posted November 30, 2010 Share Posted November 30, 2010 Dear knowledgeable MSFN-dwellers,I have a Win2k3 R2 x64 server which has on various occasions, suffered a crash of the DCOMLaucnch or RPCss services, causing the machine to reboot. It leaves an entry in the system log like this:Event Type: InformationEvent Source: USER32Event Category: NoneEvent ID: 1074Date: 21/11/2010Time: 00:32:28User: NT AUTHORITY\SYSTEMComputer: LON-SQL105aDescription:The process winlogon.exe has initiated the restart of computer LON-SQL105a on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found Reason Code: 0x30006 Shutdown Type: restart Comment: Windows must now restart because the DCOM Server Process Launcher service terminated unexpectedlyUnfortunately, there's no drwatson dump file generated (although Dr Watson is configured as the default debugger). How can I capture the details of the crash for analysis?There's no sign of malware on this server, and I'm a little puzzled as to what could cause these crashes.Thanks in advance,Adam. Link to comment Share on other sites More sharing options...
adamt Posted December 16, 2010 Author Share Posted December 16, 2010 Unfortunately, there's no drwatson dump file generated (although Dr Watson is configured as the default debugger). How can I capture the details of the crash for analysis?There's no sign of malware on this server, and I'm a little puzzled as to what could cause these crashes.Replying to my own post, in case anyone else is interested - I'm going to setup adplus to monitor the specific instances of svchost.exe which host DComLaunch and RPCss.If I find anything useful, I'll post the details back here. Link to comment Share on other sites More sharing options...
cluberti Posted December 21, 2010 Share Posted December 21, 2010 You might want to consider breaking those out into their own svchost.exe - attaching to a shared svchost can be a bad thing. Link to comment Share on other sites More sharing options...
adamt Posted December 29, 2010 Author Share Posted December 29, 2010 You might want to consider breaking those out into their own svchost.exe - attaching to a shared svchost can be a bad thing.Thanks for the suggestion.DComLaunch and RpcSs are actually already in their own svchost.exe processes. A quick straw poll around some Win2003 machines suggests this is the default for that OS (although I notice that on my XP laptop, DComLaunch shares a process with Terminal Services). Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now