question

manbon-0989 avatar image
1 Vote"
manbon-0989 asked manbon-0989 answered

Windows Server 2016 freezes shared drive access every few days for 5-7 mins.

Hello!

Our Windows Server 2016 Standard Version 1607 Build 14393.3986 freezes it´s workgroup shared drive access every few days for 5-7 mins. Then it continues to run normally and all shared drives are functional again. The windows application protocol contains the following relevant events and I attached the Report.wer ReportQueue files. There´s no other AV-application than Windows Defender on the machine. Any suggestions?

Thanks a lot in advance!

  • <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">;

  • <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2020-10-28T13:53:45.950443000Z" />
    <EventRecordID>41512</EventRecordID>
    <Channel>Application</Channel>
    <Computer>...FQDN noted here...</Computer>
    <Security />
    </System>

  • <EventData>
    <Data />
    <Data>0</Data>
    <Data>MpTelemetry</Data>
    <Data>Nicht verfügbar</Data>
    <Data>0</Data>
    <Data>Windows Defender (77BDAF73-B396-481F-9042-AD358843EC24)</Data>
    <Data>4.18.2009.7</Data>
    <Data>TimeOut</Data>
    <Data>1.1.17500.4</Data>
    <Data>fixed</Data>
    <Data>20 / 2049+</Data>
    <Data>5 / not boot</Data>
    <Data />
    <Data />
    <Data />
    <Data />
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Windows Defender_cc678d78e1242a582bce78945585e337973a535_00000000_3d223b95</Data>
    <Data />
    <Data>0</Data>
    <Data>feab9a17-1924-11eb-8b9b-4cd98f41e2df</Data>
    <Data>4</Data>
    <Data />
    </EventData>
    </Event>

  • <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">;

  • <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2020-10-28T13:54:17.201917500Z" />
    <EventRecordID>41513</EventRecordID>
    <Channel>Application</Channel>
    <Computer>...FQDN noted here...</Computer>
    <Security />
    </System>

  • <EventData>
    <Data>1676191237278690084</Data>
    <Data>5</Data>
    <Data>MpTelemetry</Data>
    <Data>Nicht verfügbar</Data>
    <Data>0</Data>
    <Data>Windows Defender (77BDAF73-B396-481F-9042-AD358843EC24)</Data>
    <Data>4.18.2009.7</Data>
    <Data>TimeOut</Data>
    <Data>1.1.17500.4</Data>
    <Data>fixed</Data>
    <Data>20 / 2049+</Data>
    <Data>5 / not boot</Data>
    <Data />
    <Data />
    <Data />
    <Data />
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Windows Defender_cc678d78e1242a582bce78945585e337973a535_00000000_3d223b95</Data>
    <Data />
    <Data>0</Data>
    <Data>feab9a17-1924-11eb-8b9b-4cd98f41e2df</Data>
    <Data>0</Data>
    <Data>11e144065651fa18a743070ca99e6b24</Data>
    </EventData>
    </Event>

35989-report-0wer.txt
35909-report-1wer.txt
36025-report-2wer.txt
35946-report-3wer.txt
35947-report-4wer.txt
35910-report-5wer.txt
36041-report-6wer.txt
35956-report-7wer.txt
36026-report-8wer.txt


windows-server-2016
report-0wer.txt (2.2 KiB)
report-1wer.txt (2.2 KiB)
report-2wer.txt (2.6 KiB)
report-3wer.txt (2.6 KiB)
report-4wer.txt (2.2 KiB)
report-5wer.txt (2.2 KiB)
report-6wer.txt (2.6 KiB)
report-7wer.txt (2.6 KiB)
report-8wer.txt (2.2 KiB)
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

2 Answers

yagmoth555 avatar image
0 Votes"
yagmoth555 answered

Hi

Can you elaborate on your RAID settings ? as usually if the server just freeze, and nothing move and the server wake up after it's almost always a faulty hard disk that badly spin.

Can you validate when it freeze if the screen is responding to mouse or other device,

It can happen in a RAID 5 too, if the SCSI controller didnt flagged the disk as dead yet, and still use it. It happen sometime.

I would make sure you have a good backup, and watch for physical fail soon if the screen is not responding.

If the screen still respond but only the fileshare freeze, then check to make sure no network error happen (ping in exemple), to rule out a bad switch between the server and the clients

Hope it help

5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

manbon-0989 avatar image
0 Votes"
manbon-0989 answered

Hello yagmoth555,

thanks a lot! The server is quite new and freshly patched but I agree to check the RAID 5. I can connect via RDP and the server desktop works as usual. Solely drive access is blocked (locally and shared).

Additionally there´s an external USB 3.0 disk connected to the server used for Windows server backup. We´ve just had the freezing symptom again but this time the event logs are totally different:

ID 157 Disk Der Datenträger "1" wurde überraschend entfernt" (Disk 1 suddenly disconnected).
ID 98 Ntfs Volume "\\?\Volume{5af77432-0740-4f1e-aa9d-9efae7f4cb01}" (\Device\HarddiskVolume342) ist fehlerfrei. Es ist keine Aktion erforderlich. (Volume is error-free. No action necessary).

Couldn´t this be rather a problem with the external USB disk? But could a faulty external USB disk block the access to an internal RAID?
Maybe I´ll disconnect that device for some days. It´s rather historic and not essential - user data is backed up by other means.

Thanks a lot!

5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.