Nailing down the cause of a hard freeze

[HCHTech]

It is running Exchange. What is happening to the mail during the "down" time? Are you 100% certain that it is locked up? Network shares drop and so on?

Just to answer all of the questions - no, I'm not 100% certain. I should have checked a workstation before I rebooted the server. good suggestion.

 

[putz]

SBS is notoriously slow if you do not configure the disks correctly. Its not enough to install it on a single raid5 VD. You literally need multiple physical arrays to get it to run smoothly. With all the junk that runs on it, it will suck up as much memory as it can and hammer the disk IO until performance moves to a crawl. We still have a customer running an older sbs dell box and it literally takes about 15 mins sometimes to run an incremental backup that should only take about 2 minutes to complete.

During 1am and 5am the exchange mailbox maintenance runs, so certainly could be something with performance during that time if their mailbox database is on the larger side. I would also suspect memory, especially if its not ECC memory, but you would want to double check any other scheduled tasks or software tasks during that time since it sounds like it occurs around the same time each time it happens. Do you run a regular consistency check on the VD? Might be something worth doing. You may want to investigate the windows event logs to see what is running after midnight or around the time it happens.

You may also want to Google something like "SBS performance" and look for articles on what services you can disable. Typically there is an sbsmonitoring service that is really heavy on resources. Disabling that tends to help as well as the corresponding SQL databases. Also go into sql management and set memory limits on the instances you leave enabled. Doing some of those tweaks might be enough to get you buy until they replace the server.

 

[HCHTech]

Just an update. Because of the random time between freezes, I could not stick to the scientific method and change only one thing at a time to identify the exact culprit. Last weekend, I replaced the power supply, ran an 10-hour memtest (no errors), and tested all of the hard drives (all good). BTW, the motherboard uses all solid caps, so no way to tell good or bad there. I didn't take apart the old power supply, so no help there, either. Then, I severely throttled the memory caps assigned to Sharepoint, WSUS and SBSMonitoring. I gave Sharepoint 1GB, SBSMonitoring 1GB & WSUS 2GB. They were all previously at their default settings (take as much as you want). It's been a week now without a freeze, so I'm cautiously optimistic. I'll split the points between @nlinecomputers and @putz . I appreciate the help guys.

 

[YeOldeStonecat]

With 16 gigs shouldn't be that. I have lots of SBS installs out there without those bandaid tricks done. Yes default services in SBS can be memory hogs, but...the vast majority of servers out there run fine on default settings.

What antivirus is on it?
Are alllll the proper exclusions done in real time file protection, as well as file extensions to exclude? You don't just install antivirus on a domain controller (nor Exchange server) with default settings and walk away, without doing lots and LOTS of exclusions of various active directory folders and files. I have an old thread deep in these forums somewhere listing alllll of those settings to do.

 

[HCHTech]

Are alllll the proper exclusions done in real time file protection, as well as file extensions to exclude?

Yes, thanks for the reminder. I turned that 2012 post into one of our technotes when I first came across it. It's SOP. In this case, I installed the MAX managed AV (Bit Defender) on this server back in January when we first took over the client, and most of those exclusions are built into the standard server AV policy. There always seems to be additions, so we usually create a client-specific policy based on the standard.

I suppose it's possible something changed with the AV after an update, but I haven't had this problem with other clients on the same AV...

BTW, here is the text from the notes on the BitDefender default policy:
------------
Bitdefender partners with Microsoft to create smart exclusions based on Microsoft recommendations. These smart exclusions are automatically included in the background for each Protection Policy (so do not appear in the Exclusions list) and are applied by the Bitdefender engine depending on the scanned device’s Operating System.
-----------

That link points to exactly the same source as one of the commenters of your original post.


Edit: to clarify and provide linkage