2-hour hibernate failure
in [Windows XP Basics]
|
Prev: modem & AVG
Next: Just-In-Time Debugging
From: John John - MVP on 15 Apr 2010 15:52 William B. Lurie wrote: > William B. Lurie wrote: >> John John - MVP wrote: >>> William B. Lurie wrote: >>>> John John - MVP wrote: >>>>> William B. Lurie wrote: >>>>>> William B. Lurie wrote: >>>>>> <snip> >>>>>>> I just finished what might be the most positive indicating >>>>>>> run yet. Same conditions as last run, except this time I did >>>>>>> >>>>>>> Clean Boot >>>>>>> Disabled Auto Live Update >>>>>>> Disabled WIA and started at 9:12 P.M. >>>>>>> >>>>>>> 2.5 hours later, it had not hibernated, but I think >>>>>>> there is just one reason clearly shown. I'll send you >>>>>>> the files in the morning to look at, John. >>>>>>> >>>>>>> What I see is just *one* event, but it happened at 10:35 ..... >>>>>>> Tcpip... Type 4201 ......."SCM" I think. >>>>>>> >>>>>>> Bill >>>>>> See these: >>>>>> >>>>>>> Type Date Time Source Category Event User >>>>>>> Computer >>>>>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate >>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>> >>>>>> Type Date >>>>>> Success Audit 4/14/2010 11:34:34 PM Security System >>>>>> Event 513 SYSTEM COMPAQ-2006 >>>>>> Success Audit 4/14/2010 11:34:28 PM Security >>>>>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006 >>>>>> Success Audit 4/14/2010 9:11:04 PM Security Privilege >>>>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>>>> Success Audit 4/14/2010 9:11:04 PM Security >>>>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>>>> Success Audit 4/14/2010 9:10:24 PM Security Privilege >>>>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>>>> Success Audit 4/14/2010 9:10:24 PM Security >>>>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>>>> Success Audit 4/14/2010 9:10:24 PM Security System >>>>>> Event 515 SYSTEM COMPAQ-2006 >>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>> >>>>>>> Type Date Time Source Cate >>>>>>> Information 4/14/2010 11:34:34 PM eventlog None >>>>>>> 6006 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 11:34:33 PM Service Control >>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 11:30:33 PM Tcpip None >>>>>>> 4201 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 10:35:53 PM Tcpip None >>>>>>> 4201 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7035 Compaq_Owner COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>> >>>>>>> Event Type: Information >>>>>>> Event Source: Tcpip >>>>>>> Event Category: None >>>>>>> Event ID: 4201 >>>>>>> Date: 4/14/2010 >>>>>>> Time: 10:35:53 PM >>>>>>> User: N/A >>>>>>> Computer: COMPAQ-2006 >>>>>>> Description: >>>>>>> The system detected that network adapter >>>>>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was >>>>>>> connected to the network, and has initiated normal operation over >>>>>>> the network adapter. >>>>>>> >>>>>>> For more information, see Help and Support Center at >>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>> Data: >>>>>>> 0000: 00 00 00 00 02 00 50 00 ......P. >>>>>>> 0008: 00 00 00 00 69 10 00 40 ....i..@ >>>>>>> 0010: 02 00 00 00 00 00 00 00 ........ >>>>>>> 0018: 00 00 00 00 00 00 00 00 ........ >>>>>>> 0020: 00 00 00 00 00 00 00 00 ........ >>>>>> >>>>>> I think that 10:35 PM event was the killer........ >>>>>> Our old friend Tcpip again. I have the feeling that, if I let it >>>>>> run on past 11:30. it would repeat every hour or so. >>>>>> >>>>>> I'm ready to clean out the Event Logs on the Clone >>>>>> system, and Clean Boot, and do whatever you tell me to, >>>>>> John, to track it down. I don't know what Network Adapter they're >>>>>> referring to in the Event Description..... >>>>> >>>>> Please do the clean boot. >>>>> >>>>> John >>>> That last run *was* from squeaky cleanest clean boot, >>>> John. I can clear out the ancient history just to make >>>> the Event Logs look smaller, but that isn't going to change anything. >>>> As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I >>>> expanded out and posted......and that needs blocking or whatever. >>> >>> Typically you should only be seeing one (if ever) Event 4201 from >>> TCPIP when the computer is booted, or when the adapter is disabled or >>> enabled. Have you always been getting multiple Events 4201? If yes >>> this might be indicative of faulty or failing network hardware, bad >>> cable, bad switch, bad router, bad NIC... Try disabling the network >>> adapter and see what happens, to disable the adapter go in "Network >>> Connections" and right click on the connection. On your previous >>> effort with a different clone, did you ever at any time successfully >>> hibernate at 2 hours? >>> >>> John >>> >> Now 1 PM, John, and a strange thing happened. After almost 2 hours, >> power-on light was flashing as usual, and 20 minutes later it had >> shut down. Symptomatic of having hibernated! I jiggled mouse, it did >> not come alive, as it should not, if it truly was in hibernation. So >> I pressed the power-on button, and my desktop came on, without first >> giving me a notice that it was coming out of hibernation. At least I >> think that's the way it was, but now, dammit, I have to repeat that >> run. But I did look at the log, and it showed nothing in the 2-hour >> period, just the DCOM implying (I think) that it recorder my bringing >> it to life. Only difference between this run and previous was that I >> disabled Network Connections. Your comments will be welcome, but I'm >> sorry to have to say that I have to confirm my story. >> Bill > Continuing on at 3:25, I confirmed that it really did hibernate, in > perfectly normal, proper manner, after 2 hours. Posting below a piece of > the event logs. > >> Type Date Time Source Category Event User Computer >> Error 4/15/2010 3:10:47 PM DCOM None 10005 >> Compaq_Owner COMPAQ-2006 >> Error 4/15/2010 3:10:47 PM DCOM None 10005 >> Compaq_Owner COMPAQ-2006 >> Information 4/15/2010 1:08:57 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 4/15/2010 1:08:57 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 4/15/2010 1:08:57 PM Service Control Manager >> None 7035 SYSTEM COMPAQ-2006 >> Information 4/15/2010 1:08:57 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 4/15/2010 1:08:57 PM Service Control Manager >> None 7035 SYSTEM COMPAQ-2006 >> Error 4/15/2010 1:08:57 PM Service Control Manager None >> 7001 N/A COMPAQ-2006 >> Error 4/15/2010 1:08:57 PM Service Control Manager None >> 7001 N/A COMPAQ-2006 >> Error 4/15/2010 1:07:39 PM DCOM None 10005 >> Compaq_Owner COMPAQ-2006 >> Error 4/15/2010 1:07:39 PM DCOM None 10005 >> Compaq_Owner COMPAQ-2006 >> Error 4/15/2010 1:07:37 PM DCOM None 10005 >> Compaq_Owner COMPAQ-2006 >> Information 4/15/2010 1:07:19 PM eventlog None 6005 >> N/A COMPAQ-2006 >> Information 4/15/2010 1:07:19 PM eventlog None 6009 >> N/A COMPAQ-2006 >> Information 4/15/2010 12:44:58 PM eventlog None 6006 >> N/A COMPAQ-2006 > >> Event Type: Error >> Event Source: DCOM >> Event Category: None >> Event ID: 10005 >> Date: 4/15/2010 >> Time: 3:10:47 PM >> User: COMPAQ-2006\Compaq_Owner >> Computer: COMPAQ-2006 >> Description: >> DCOM got error "The service cannot be started, either because it is >> disabled or because it has no enabled devices associated with it. " >> attempting to start the service netman with arguments "" in order to >> run the server: >> {BA126AE5-2166-11D1-B1D0-00805FC1270E} >> >> For more information, see Help and Support Center at >> http://go.microsoft.com/fwlink/events.asp. > > The noteworthy events are the *two* identical 10005s after the system > came out of hibernation, and the fact that nothing happened during the > 2 hour hibernation to inhibit it. I think the DCOMs are just part of > coming alive. The significant thing is that I can't put my finger on > anything defective in my system. Network Connections is what made it > work. It certainly isn't any kind of an intermittent, because it happens > the same every time. And I haven't changed anything, ever, since the > modem and cabling were installed 3+ years ago. It isn't a portable of > any kind, it's a big, klutzy, solid desktop lying peacefully on its > side in its own drawer, with all cabling tucked away behind. And I think > you asked if it ever did hibernate at 2 hours, and I can't honestly answer. > > What to do next? Start putting back into the clone what it needs to > operate? No, I really can't do that, because I don't think there's any > way to put the Norton AV back. Start with a new clone, and disable just > Network Connections, as a test? Simple to do....... > > Now I'm ready to listen, John. You can start with a new clone and give it a try with the network adapter disabled and see what happens. John
From: William B. Lurie on 15 Apr 2010 17:28 John John - MVP wrote: > William B. Lurie wrote: >> William B. Lurie wrote: >>> John John - MVP wrote: >>>> William B. Lurie wrote: >>>>> John John - MVP wrote: >>>>>> William B. Lurie wrote: >>>>>>> William B. Lurie wrote: >>>>>>> <snip> >>>>>>>> I just finished what might be the most positive indicating >>>>>>>> run yet. Same conditions as last run, except this time I did >>>>>>>> >>>>>>>> Clean Boot >>>>>>>> Disabled Auto Live Update >>>>>>>> Disabled WIA and started at 9:12 P.M. >>>>>>>> >>>>>>>> 2.5 hours later, it had not hibernated, but I think >>>>>>>> there is just one reason clearly shown. I'll send you >>>>>>>> the files in the morning to look at, John. >>>>>>>> >>>>>>>> What I see is just *one* event, but it happened at 10:35 ..... >>>>>>>> Tcpip... Type 4201 ......."SCM" I think. >>>>>>>> >>>>>>>> Bill >>>>>>> See these: >>>>>>> >>>>>>>> Type Date Time Source Category Event User >>>>>>>> Computer >>>>>>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate >>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>> >>>>>>> Type Date >>>>>>> Success Audit 4/14/2010 11:34:34 PM Security System >>>>>>> Event 513 SYSTEM COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 11:34:28 PM Security >>>>>>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 9:11:04 PM Security Privilege >>>>>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 9:11:04 PM Security >>>>>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 9:10:24 PM Security Privilege >>>>>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 9:10:24 PM Security >>>>>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 9:10:24 PM Security System >>>>>>> Event 515 SYSTEM COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>>> >>>>>>>> Type Date Time Source Cate >>>>>>>> Information 4/14/2010 11:34:34 PM eventlog None >>>>>>>> 6006 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 11:34:33 PM Service Control >>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 11:30:33 PM Tcpip None >>>>>>>> 4201 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 10:35:53 PM Tcpip None >>>>>>>> 4201 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7035 Compaq_Owner COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>> >>>>>>>> Event Type: Information >>>>>>>> Event Source: Tcpip >>>>>>>> Event Category: None >>>>>>>> Event ID: 4201 >>>>>>>> Date: 4/14/2010 >>>>>>>> Time: 10:35:53 PM >>>>>>>> User: N/A >>>>>>>> Computer: COMPAQ-2006 >>>>>>>> Description: >>>>>>>> The system detected that network adapter >>>>>>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was >>>>>>>> connected to the network, and has initiated normal operation >>>>>>>> over the network adapter. >>>>>>>> >>>>>>>> For more information, see Help and Support Center at >>>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>>> Data: >>>>>>>> 0000: 00 00 00 00 02 00 50 00 ......P. >>>>>>>> 0008: 00 00 00 00 69 10 00 40 ....i..@ >>>>>>>> 0010: 02 00 00 00 00 00 00 00 ........ >>>>>>>> 0018: 00 00 00 00 00 00 00 00 ........ >>>>>>>> 0020: 00 00 00 00 00 00 00 00 ........ >>>>>>> >>>>>>> I think that 10:35 PM event was the killer........ >>>>>>> Our old friend Tcpip again. I have the feeling that, if I let it >>>>>>> run on past 11:30. it would repeat every hour or so. >>>>>>> >>>>>>> I'm ready to clean out the Event Logs on the Clone >>>>>>> system, and Clean Boot, and do whatever you tell me to, >>>>>>> John, to track it down. I don't know what Network Adapter they're >>>>>>> referring to in the Event Description..... >>>>>> >>>>>> Please do the clean boot. >>>>>> >>>>>> John >>>>> That last run *was* from squeaky cleanest clean boot, >>>>> John. I can clear out the ancient history just to make >>>>> the Event Logs look smaller, but that isn't going to change anything. >>>>> As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I >>>>> expanded out and posted......and that needs blocking or whatever. >>>> >>>> Typically you should only be seeing one (if ever) Event 4201 from >>>> TCPIP when the computer is booted, or when the adapter is disabled >>>> or enabled. Have you always been getting multiple Events 4201? If >>>> yes this might be indicative of faulty or failing network hardware, >>>> bad cable, bad switch, bad router, bad NIC... Try disabling the >>>> network adapter and see what happens, to disable the adapter go in >>>> "Network Connections" and right click on the connection. On your >>>> previous effort with a different clone, did you ever at any time >>>> successfully hibernate at 2 hours? >>>> >>>> John >>>> >>> Now 1 PM, John, and a strange thing happened. After almost 2 hours, >>> power-on light was flashing as usual, and 20 minutes later it had >>> shut down. Symptomatic of having hibernated! I jiggled mouse, it did >>> not come alive, as it should not, if it truly was in hibernation. So >>> I pressed the power-on button, and my desktop came on, without first >>> giving me a notice that it was coming out of hibernation. At least I >>> think that's the way it was, but now, dammit, I have to repeat that >>> run. But I did look at the log, and it showed nothing in the 2-hour >>> period, just the DCOM implying (I think) that it recorder my bringing >>> it to life. Only difference between this run and previous was that I >>> disabled Network Connections. Your comments will be welcome, but I'm >>> sorry to have to say that I have to confirm my story. >>> Bill >> Continuing on at 3:25, I confirmed that it really did hibernate, in >> perfectly normal, proper manner, after 2 hours. Posting below a piece >> of the event logs. >> >>> Type Date Time Source Category Event User Computer >>> Error 4/15/2010 3:10:47 PM DCOM None 10005 >>> Compaq_Owner COMPAQ-2006 >>> Error 4/15/2010 3:10:47 PM DCOM None 10005 >>> Compaq_Owner COMPAQ-2006 >>> Information 4/15/2010 1:08:57 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/15/2010 1:08:57 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/15/2010 1:08:57 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 4/15/2010 1:08:57 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/15/2010 1:08:57 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Error 4/15/2010 1:08:57 PM Service Control Manager >>> None 7001 N/A COMPAQ-2006 >>> Error 4/15/2010 1:08:57 PM Service Control Manager >>> None 7001 N/A COMPAQ-2006 >>> Error 4/15/2010 1:07:39 PM DCOM None 10005 >>> Compaq_Owner COMPAQ-2006 >>> Error 4/15/2010 1:07:39 PM DCOM None 10005 >>> Compaq_Owner COMPAQ-2006 >>> Error 4/15/2010 1:07:37 PM DCOM None 10005 >>> Compaq_Owner COMPAQ-2006 >>> Information 4/15/2010 1:07:19 PM eventlog None 6005 >>> N/A COMPAQ-2006 >>> Information 4/15/2010 1:07:19 PM eventlog None 6009 >>> N/A COMPAQ-2006 >>> Information 4/15/2010 12:44:58 PM eventlog None >>> 6006 N/A COMPAQ-2006 >> >>> Event Type: Error >>> Event Source: DCOM >>> Event Category: None >>> Event ID: 10005 >>> Date: 4/15/2010 >>> Time: 3:10:47 PM >>> User: COMPAQ-2006\Compaq_Owner >>> Computer: COMPAQ-2006 >>> Description: >>> DCOM got error "The service cannot be started, either because it is >>> disabled or because it has no enabled devices associated with it. " >>> attempting to start the service netman with arguments "" in order to >>> run the server: >>> {BA126AE5-2166-11D1-B1D0-00805FC1270E} >>> >>> For more information, see Help and Support Center at >>> http://go.microsoft.com/fwlink/events.asp. >> >> The noteworthy events are the *two* identical 10005s after the system >> came out of hibernation, and the fact that nothing happened during the >> 2 hour hibernation to inhibit it. I think the DCOMs are just part of >> coming alive. The significant thing is that I can't put my finger on >> anything defective in my system. Network Connections is what made it >> work. It certainly isn't any kind of an intermittent, because it happens >> the same every time. And I haven't changed anything, ever, since the >> modem and cabling were installed 3+ years ago. It isn't a portable of >> any kind, it's a big, klutzy, solid desktop lying peacefully on its >> side in its own drawer, with all cabling tucked away behind. And I think >> you asked if it ever did hibernate at 2 hours, and I can't honestly >> answer. >> >> What to do next? Start putting back into the clone what it needs to >> operate? No, I really can't do that, because I don't think there's any >> way to put the Norton AV back. Start with a new clone, and disable >> just Network Connections, as a test? Simple to do....... >> >> Now I'm ready to listen, John. > > You can start with a new clone and give it a try with the network > adapter disabled and see what happens. > > John Yes, I thought that would be logical as a starting point. It will take a while, but 'can do'./Bill
From: Shenan Stanley on 15 Apr 2010 19:38 William B. Lurie wrote: > This is a new thread. See old stuff for history. Does everyone realize that at this point in the troubleshooting procedure - if time is money (and for many people it is) and even if it is not a *lot* of money (let's go with $1.00 / hour - U.S.) that this problem has gone on long enough now to afford a replacement computer with likely more CPU power, more hard drive space and a better video device without all the current trouble by now, eh? ;-) I mean - really - this computer could be defective. Just throwing that out there... *grin* -- Shenan Stanley MS-MVP -- How To Ask Questions The Smart Way http://www.catb.org/~esr/faqs/smart-questions.html
From: William B. Lurie on 15 Apr 2010 20:59 William B. Lurie wrote: > John John - MVP wrote: >> William B. Lurie wrote: >>> William B. Lurie wrote: >>>> John John - MVP wrote: >>>>> William B. Lurie wrote: >>>>>> John John - MVP wrote: >>>>>>> William B. Lurie wrote: >>>>>>>> William B. Lurie wrote: >>>>>>>> <snip> >>>>>>>>> I just finished what might be the most positive indicating >>>>>>>>> run yet. Same conditions as last run, except this time I did >>>>>>>>> >>>>>>>>> Clean Boot >>>>>>>>> Disabled Auto Live Update >>>>>>>>> Disabled WIA and started at 9:12 P.M. >>>>>>>>> >>>>>>>>> 2.5 hours later, it had not hibernated, but I think >>>>>>>>> there is just one reason clearly shown. I'll send you >>>>>>>>> the files in the morning to look at, John. >>>>>>>>> >>>>>>>>> What I see is just *one* event, but it happened at 10:35 ..... >>>>>>>>> Tcpip... Type 4201 ......."SCM" I think. >>>>>>>>> >>>>>>>>> Bill >>>>>>>> See these: >>>>>>>> >>>>>>>>> Type Date Time Source Category Event User >>>>>>>>> Computer >>>>>>>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate >>>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>>>> >>>>>>>> Type Date >>>>>>>> Success Audit 4/14/2010 11:34:34 PM Security System >>>>>>>> Event 513 SYSTEM COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 11:34:28 PM Security >>>>>>>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 9:11:04 PM Security >>>>>>>> Privilege Use 576 NETWORK SERVICE COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 9:11:04 PM Security >>>>>>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 9:10:24 PM Security >>>>>>>> Privilege Use 576 NETWORK SERVICE COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 9:10:24 PM Security >>>>>>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 9:10:24 PM Security System >>>>>>>> Event 515 SYSTEM COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>>>>> Change 850 SYSTEM COMPAQ-2006 >>>>>>>> >>>>>>>>> Type Date Time Source Cate >>>>>>>>> Information 4/14/2010 11:34:34 PM eventlog None >>>>>>>>> 6006 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 11:34:33 PM Service Control >>>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 11:30:33 PM Tcpip None >>>>>>>>> 4201 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 10:35:53 PM Tcpip None >>>>>>>>> 4201 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7035 Compaq_Owner COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>>>>> >>>>>>>>> Event Type: Information >>>>>>>>> Event Source: Tcpip >>>>>>>>> Event Category: None >>>>>>>>> Event ID: 4201 >>>>>>>>> Date: 4/14/2010 >>>>>>>>> Time: 10:35:53 PM >>>>>>>>> User: N/A >>>>>>>>> Computer: COMPAQ-2006 >>>>>>>>> Description: >>>>>>>>> The system detected that network adapter >>>>>>>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was >>>>>>>>> connected to the network, and has initiated normal operation >>>>>>>>> over the network adapter. >>>>>>>>> >>>>>>>>> For more information, see Help and Support Center at >>>>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>>>> Data: >>>>>>>>> 0000: 00 00 00 00 02 00 50 00 ......P. >>>>>>>>> 0008: 00 00 00 00 69 10 00 40 ....i..@ >>>>>>>>> 0010: 02 00 00 00 00 00 00 00 ........ >>>>>>>>> 0018: 00 00 00 00 00 00 00 00 ........ >>>>>>>>> 0020: 00 00 00 00 00 00 00 00 ........ >>>>>>>> >>>>>>>> I think that 10:35 PM event was the killer........ >>>>>>>> Our old friend Tcpip again. I have the feeling that, if I let it >>>>>>>> run on past 11:30. it would repeat every hour or so. >>>>>>>> >>>>>>>> I'm ready to clean out the Event Logs on the Clone >>>>>>>> system, and Clean Boot, and do whatever you tell me to, >>>>>>>> John, to track it down. I don't know what Network Adapter they're >>>>>>>> referring to in the Event Description..... >>>>>>> >>>>>>> Please do the clean boot. >>>>>>> >>>>>>> John >>>>>> That last run *was* from squeaky cleanest clean boot, >>>>>> John. I can clear out the ancient history just to make >>>>>> the Event Logs look smaller, but that isn't going to change anything. >>>>>> As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I >>>>>> expanded out and posted......and that needs blocking or whatever. >>>>> >>>>> Typically you should only be seeing one (if ever) Event 4201 from >>>>> TCPIP when the computer is booted, or when the adapter is disabled >>>>> or enabled. Have you always been getting multiple Events 4201? If >>>>> yes this might be indicative of faulty or failing network hardware, >>>>> bad cable, bad switch, bad router, bad NIC... Try disabling the >>>>> network adapter and see what happens, to disable the adapter go in >>>>> "Network Connections" and right click on the connection. On your >>>>> previous effort with a different clone, did you ever at any time >>>>> successfully hibernate at 2 hours? >>>>> >>>>> John >>>>> >>>> Now 1 PM, John, and a strange thing happened. After almost 2 hours, >>>> power-on light was flashing as usual, and 20 minutes later it had >>>> shut down. Symptomatic of having hibernated! I jiggled mouse, it did >>>> not come alive, as it should not, if it truly was in hibernation. So >>>> I pressed the power-on button, and my desktop came on, without first >>>> giving me a notice that it was coming out of hibernation. At least I >>>> think that's the way it was, but now, dammit, I have to repeat that >>>> run. But I did look at the log, and it showed nothing in the 2-hour >>>> period, just the DCOM implying (I think) that it recorder my bringing >>>> it to life. Only difference between this run and previous was that I >>>> disabled Network Connections. Your comments will be welcome, but I'm >>>> sorry to have to say that I have to confirm my story. >>>> Bill >>> Continuing on at 3:25, I confirmed that it really did hibernate, in >>> perfectly normal, proper manner, after 2 hours. Posting below a piece >>> of the event logs. >>> >>>> Type Date Time Source Category Event User Computer >>>> Error 4/15/2010 3:10:47 PM DCOM None 10005 >>>> Compaq_Owner COMPAQ-2006 >>>> Error 4/15/2010 3:10:47 PM DCOM None 10005 >>>> Compaq_Owner COMPAQ-2006 >>>> Information 4/15/2010 1:08:57 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> Information 4/15/2010 1:08:57 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> Information 4/15/2010 1:08:57 PM Service Control Manager >>>> None 7035 SYSTEM COMPAQ-2006 >>>> Information 4/15/2010 1:08:57 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> Information 4/15/2010 1:08:57 PM Service Control Manager >>>> None 7035 SYSTEM COMPAQ-2006 >>>> Error 4/15/2010 1:08:57 PM Service Control Manager >>>> None 7001 N/A COMPAQ-2006 >>>> Error 4/15/2010 1:08:57 PM Service Control Manager >>>> None 7001 N/A COMPAQ-2006 >>>> Error 4/15/2010 1:07:39 PM DCOM None 10005 >>>> Compaq_Owner COMPAQ-2006 >>>> Error 4/15/2010 1:07:39 PM DCOM None 10005 >>>> Compaq_Owner COMPAQ-2006 >>>> Error 4/15/2010 1:07:37 PM DCOM None 10005 >>>> Compaq_Owner COMPAQ-2006 >>>> Information 4/15/2010 1:07:19 PM eventlog None >>>> 6005 N/A COMPAQ-2006 >>>> Information 4/15/2010 1:07:19 PM eventlog None >>>> 6009 N/A COMPAQ-2006 >>>> Information 4/15/2010 12:44:58 PM eventlog None >>>> 6006 N/A COMPAQ-2006 >>> >>>> Event Type: Error >>>> Event Source: DCOM >>>> Event Category: None >>>> Event ID: 10005 >>>> Date: 4/15/2010 >>>> Time: 3:10:47 PM >>>> User: COMPAQ-2006\Compaq_Owner >>>> Computer: COMPAQ-2006 >>>> Description: >>>> DCOM got error "The service cannot be started, either because it is >>>> disabled or because it has no enabled devices associated with it. " >>>> attempting to start the service netman with arguments "" in order to >>>> run the server: >>>> {BA126AE5-2166-11D1-B1D0-00805FC1270E} >>>> >>>> For more information, see Help and Support Center at >>>> http://go.microsoft.com/fwlink/events.asp. >>> >>> The noteworthy events are the *two* identical 10005s after the system >>> came out of hibernation, and the fact that nothing happened during the >>> 2 hour hibernation to inhibit it. I think the DCOMs are just part of >>> coming alive. The significant thing is that I can't put my finger on >>> anything defective in my system. Network Connections is what made it >>> work. It certainly isn't any kind of an intermittent, because it happens >>> the same every time. And I haven't changed anything, ever, since the >>> modem and cabling were installed 3+ years ago. It isn't a portable of >>> any kind, it's a big, klutzy, solid desktop lying peacefully on its >>> side in its own drawer, with all cabling tucked away behind. And I think >>> you asked if it ever did hibernate at 2 hours, and I can't honestly >>> answer. >>> >>> What to do next? Start putting back into the clone what it needs to >>> operate? No, I really can't do that, because I don't think there's >>> any way to put the Norton AV back. Start with a new clone, and >>> disable just Network Connections, as a test? Simple to do....... >>> >>> Now I'm ready to listen, John. >> >> You can start with a new clone and give it a try with the network >> adapter disabled and see what happens. >> >> John > Yes, I thought that would be logical as a starting point. It > will take a while, but 'can do'./Bill Okay, it's close to 9 PM and I made a clean new clone and Disabled Network connections, unplugged the line, forgot to kill screen saver (but that didn't hurt anything). Unplugged printer and camera. It failed to hibernate but a valid reason popped up. When I re-energized the system after 2 hours, it said "Norton is performing background task", so I'll have to prevent that on next run. See attached fairly clean Event Logs, and comment, please. > Type Date Time Source Category Event User Computer > Success Audit 4/15/2010 7:17:44 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006 > Success Audit 4/15/2010 7:17:44 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 > Success Audit 4/15/2010 6:27:40 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006 > Success Audit 4/15/2010 6:27:40 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 > Success Audit 4/15/2010 6:27:40 PM Security Privilege Use 576 LOCAL SERVICE COMPAQ-2006 > Success Audit 4/15/2010 6:27:40 PM Security Logon/Logoff 528 LOCAL SERVICE COMPAQ-2006 > Success Audit 4/15/2010 6:26:09 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006 > Success Audit 4/15/2010 6:26:09 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 > Success Audit 4/15/2010 6:26:09 PM Security Policy Change 850 SYSTEM COMPAQ-2006 > Success Audit 4/15/2010 6:26:09 PM Security Policy Change 850 SYSTEM COMPAQ-2006 > Success Audit 4/15/2010 6:26:09 PM Security Policy Change 850 SYSTEM COMPAQ-2006 > Success Audit 4/15/2010 6:26:09 PM Security Policy Change 850 SYSTEM COMPAQ-2006 Note the events clocked at 50 minutes into the run....... > Type Date Time Source Category Event User Computer > Information 4/15/2010 8:41:05 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 4/15/2010 8:41:03 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006 > Information 4/15/2010 6:33:22 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 4/15/2010 6:33:22 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006 > Information 4/15/2010 6:27:41 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 4/15/2010 6:27:37 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006 > Information 4/15/2010 6:27:37 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006 > Information 4/15/2010 6:27:30 PM SRTSP None 2003 N/A COMPAQ-2006 > Information 4/15/2010 6:26:27 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 4/15/2010 6:26:27 PM Service Control Manager None 7036 N/A COMPAQ-2006 Notice, no events until I restarted. I'll just start another test, trying to disable Norton this time, since it specifically did something.......I should look at the 7:17 events, too.
From: William B. Lurie on 16 Apr 2010 07:26
Shenan Stanley wrote: > William B. Lurie wrote: >> This is a new thread. See old stuff for history. > > Does everyone realize that at this point in the troubleshooting procedure - > if time is money (and for many people it is) and even if it is not a *lot* > of money (let's go with $1.00 / hour - U.S.) that this problem has gone on > long enough now to afford a replacement computer with likely more CPU power, > more hard drive space and a better video device without all the current > trouble by now, eh? ;-) > > I mean - really - this computer could be defective. > > Just throwing that out there... *grin* > You are 99-44/100 percent right, but the other 0.56% is the spirit of the scientist who wants to know *why*. I would be willing to drop the issue any time John wants to throw in the towel, and I will thank him a thousand-fold for his invaluable assistance, perseverance, and resourcefulness. Meanwhile, we are quite close to the solution, as my posting later this morning will indicate. Getting the Network thing and also the ever-intrusive Norton background scans out of the way has given me, overnight, two runs which ran two hours before going into hibernation. |