Mystery Reboots

[sechs]

My computer has recently taken to rebooting for no apparent reason while no one is there to see it happen. This inevitably happens either at night when everyone is asleep or while I am away. It doesn't seem to happen regularly and there is no apparent trigger.

After having replaced my motherboard for other purposes and shuffled other hardware about, I'm 98% sure that this is a software issue. I am , however, at a loss on how to troubleshoot an error where it's reproduced by going away and hoping that it happens.

Thoughts and ideas are appreciated....

 

[Handruin]

Windows update will reboot your machine if you happen to be running windows (and it is configured to apply patches automatically). This freaked me out a bit not too long ago because I had the same problem as you. The fix was to allow windows update to download the patch, but not apply until I say so (or don't let it download at all).

 

[Sol]

If it only happens when no one is around it may be related to power management. You could try making sure the system is set to be always on and not power down the hard drive or anything else.

 

[Pradeep]

Anything strange in the event viewer for apps/system?

 

[sechs]

WU is set to download but not install updates.

When plugged-in, power management is only set to turn off the monitor after five minutes. No disks spin down, no standby or hibernation.

There's nothing in the event logs. The system log be normal stuff and then suddenly show the start-up events.

 

[Explorer]

WU is set to download but not install updates...

Even though WU probably is not at fault, try setting Windows Update (Automatic Updates) to "Turn Off Automatic Updates" for a while -- just in case some glitch has wiggled into WU recently. Patch Tuesday is 12-Dec, so you can do that one manually (just like I always have).

If software is doing this rogue rebooting, it should leave a record of the event in the logs. If hardware (RAM, controller card, etc) is at fault, an unexpected reboot event would show up in the logs -- or sometimes nothing at all.

 

[Handruin]

I've found out that my UPS unit would cause me random power off's in the past, but not reboots because my machine is set to remain off in the event of a power loss (mine has a faulty plug I suspect).

Is your PC set to power back on in the event of a power outage? This would cause what seems like a reboot, but I would have suspected something might show in the event viewer.

 

[Bozo]

Try looking in the BIOS event recorder. I had a similar problem a couple of weeks ago and it was a bad stick of ECC memory. The faults showed up in the BIOS event recorder.

Bozo :joker:

 

[Stereodude]

Test your memory with GoldMemory and see what happens. In my experience 9 times out of 10 system instability is caused by memory.

 

[sechs]

Turned WU off.

Computer is set to stay off in case of power outage.

I don't know what a BIOS event recorder is.

I've previously tested all of the memory with Memtest with no errors. Also know that this is ECC/registered memory.

 

[Bozo]

I don't know what a BIOS event recorder is.

In Intel BIOS settings there is a 'Event Log'. I have found this useful when looking for problems.

Bozo :joker:

 

[sechs]

Intel tends to stay away from the BIOS on Opteron systems....

 

[Stereodude]

I've previously tested all of the memory with Memtest with no errors. Also know that this is ECC/registered memory.

In my experience Memtest doesn't find squat. Your memory could be worthless and it still will pass a Memtest

 

[ddrueding]

In my experience Memtest doesn't find squat. Your memory could be worthless and it still will pass a Memtest

Memtest will find errors eventually in my experience, but perhaps only after 24-36 hours of running it.

 

[P5-133XL]

I've actually had quite good luck finding memory errors using Memtest86+. My experiance is 1-2 passes but occasionally overnight is needed.

 

[Stereodude]

I found Goldmemory to be far more effective and useful.

 

[Buck]

This could be a power related issue. Any abnormalities with power variations from the power supply? Are there any devices in the system that could be drawing a disproportionate amount of power because of their own failure?

 

[sechs]

Actually, I recently ended up upgrading from a 500W to a 650W Seasonic supply (not by choice) because the older 500 wouldn't power the new motherboard. By the sensor readings, all voltages are relatively steady, within + or - 3%. While this particular board isn't known for it's great power regulation, these incidences happened before and after the motherboard change, before and after the power supply change. They're not likely culprits.

The memory, on the other hand, is the same, and, as such, as a possible source of issues. Is there some magical reasons that I should use this Goldmemory product, rather than tried and true Memtest?

 

[Bozo]

If you are running windows, right click on My Computer,click Properties, click Startup and Recovery. There you can uncheck Automatic Reboot. If it is software, you might be able to see whats causing it.

Bozo :joker:

 

[sechs]

That's one of the first things that I turn off when I install Windows. Checked, and it's still off.

No blue screens or errors in the system log.

 

[sechs]

I ran Memtest86+ for over ten hours last night. Went through 10.78 passes with cache on and ECC off: no errors.

Any new ideas?

 

[Sol]

My next step would be either pulling out any not absolutely essential hardware (Optical drives, non-boot hard drives, sound cards, controllers for non-boot devices etc), or swapping bits if there wasn't any non-essentials (or if removing them didn't work)...
Not particularly insightful I know but I have seen, optical drives especially, cause some pretty unexpected behavior when they die...

 

[mubs]

I have sometimes found a bad memory module by swapping slots. In their original slots, they will pass memtest. When the mem modules are swapped with each other, an error will show up. It's a very long shot, but worth trying if you're despo.

 

[sechs]

unfortunately, I can't spend extended periods of time with the computer in a non-useable state. Particularly when I wouldn't even know if I had determined the source of a hardware issue.

Once again, I am quite positive that this is a software, not a hardware issue.

I would like to add that it seems, although it's impossible to prove, that rebooting pushes off occurrences.

 

[ddrueding]

Then I guess a place to start would be a list of processes that are running on the PC, including their rescource useage numbers, and how they are triggered (registry, start menu, device driver, service, etc.)

 

[P5-133XL]

First, why are you 98% sure that it is software; when you are never here when it happens and there are no signs of the cause? Have you been doing things with the software that is abnormal? Have there been any recent spyware or virus activity that would indicate damage to the software?

Without specific informations directing to look at software as the cause, it would be natural for a diagnostician to be looking at the MB, and PS as very likely causes. If there is any form of power interruption then obviously there will be a spontanous reboot. If the MB detects a serious problem, then one of the common solutions it has to deal with such is to reboot with the idea that that will hopefully reset everything and fix the issue. RAM is also indicated because a RAM failure can produce symptoms that the MB and the OS can interpret as very serious and they may reboot as their solution. Normally, if the issue is OS/Driver/Application there will be an event written into the event log if it is the source of the reboot.


OK, lets approach it as a software issue.

First, the most likely issue is with the OS. First, turn off any power/hibernation settings (Display Properties->Screen Saver->Power button). If that does not solve it, start dealing with anti-Virus/Spyware. No joy? Then try an inplace reinstall of the OS, followed by updating Windows via the internet.

Now, drivers as a cause: Can you operate your necessary applications from within safe mode? Did that get rid of the reboots? If so, then you can exclude the OS and its drivers and know that it is an application or and addon drivers. Really, the only thing you can do about drivers in the long run is to disable any unnecessary HW; do an inplace reinstall of the OS to replace any Windows drivers being used; and also reinstall all added drivers such as chipset/video.

Applications: MSConfig (Start->Run->MSconfig) is your friend. Goto the startup tab and disable everything. If your required applications still run, then you can slowly add startup items back one at a time till the reboots start happening again. The point is to ID the specific startup item that is causing your problems.

Last, BIOS: Please make sure that the power-savings section does not automaticly power down your machine at a set time. Turn off all power saving settings that turn off HW or force anything machine into a poweroff/suspend mode.

Hopefully, this will help you get started with the solving of your reboot problem.

 

[sechs]

Then I guess a place to start would be a list of processes that are running on the PC, including their rescource useage numbers, and how they are triggered (registry, start menu, device driver, service, etc.)

Here's a dump from Process Explorer which should have everything but triggers:

Process	PID	CPU	Description	Company Name	Priority	Handles	Page Faults	Virtual Size	Working Set	Threads
System Idle Process	0				0	0	0	0 K	28 K	4
 Interrupts	n/a		Hardware Interrupts		0	0	0	0 K	0 K	0
 DPCs	n/a	1	Deferred Procedure Calls		0	0	0	0 K	0 K	0
 System	4	1			8	3,514	110,159	1,876 K	256 K	76
  smss.exe	1512		Windows NT Session Manager	Microsoft Corporation	11	21	216	3,804 K	408 K	3
   csrss.exe	1572		Client Server Runtime Process	Microsoft Corporation	13	966	30,822	49,660 K	4,640 K	13
   winlogon.exe	1608		Windows NT Logon Application	Microsoft Corporation	13	622	12,615	64,808 K	5,852 K	24
    services.exe	1652	    	Services and Controller app	Microsoft Corporation	9	361	5,886	37,208 K	3,480 K	16
     ati2evxx.exe	1852		ATI External Event Utility EXE Module	ATI Technologies Inc.	8	65	504	18,672 K	1,612 K	4
     svchost.exe	1868		Generic Host Process for Win32 Services	Microsoft Corporation	8	222	4,721	63,776 K	3,804 K	15
     svchost.exe	1924		Generic Host Process for Win32 Services	Microsoft Corporation	8	529	1,561	38,076 K	3,112 K	10
     svchost.exe	560		Generic Host Process for Win32 Services	Microsoft Corporation	8	1,522	103,581	103,440 K	17,180 K	66
      wscntfy.exe	2568		Windows Security Center Notification App	Microsoft Corporation	8	32	593	25,480 K	1,356 K	1
     svchost.exe	792		Generic Host Process for Win32 Services	Microsoft Corporation	8	101	25,631	34,136 K	2,956 K	5
     svchost.exe	964		Generic Host Process for Win32 Services	Microsoft Corporation	8	133	1,064	34,544 K	3,056 K	8
     ccEvtMgr.exe	1076		Symantec Event Manager Service	Symantec Corporation	8	549	265,487	55,320 K	6,660 K	32
     ccSetMgr.exe	1168		Symantec Settings Manager Service	Symantec Corporation	8	231	32,451	44,120 K	4,948 K	9
     ccProxy.exe	1336		Symantec Network Proxy Service	Symantec Corporation	8	518	421,937	83,096 K	8,412 K	20
     ISSVC.exe	1348		IS Service	Symantec Corporation	8	222	3,556	45,560 K	4,472 K	6
     SNDSrvc.exe	1388		Network Driver Service	Symantec Corporation	8	145	2,642	42,656 K	2,404 K	7
     SPBBCSvc.exe	1436		SPBBC Service	Symantec Corporation	8	268	11,600	65,552 K	3,524 K	14
     spoolsv.exe	236		Spooler SubSystem App	Microsoft Corporation	8	146	5,463	47,036 K	4,408 K	11
     DefWatch.exe	1100		Virus Definition Daemon	Symantec Corporation	8	61	2,092	41,152 K	3,440 K	5
     MDM.EXE	1136		Machine Debug Manager	Microsoft Corporation	8	100	1,051	34,316 K	2,676 K	4
     PDAgent.exe	1412		PDAgent Module	Raxco Software, Inc.	8	146	2,142	50,544 K	5,140 K	8
     svchost.exe	1092		Generic Host Process for Win32 Services	Microsoft Corporation	8	137	2,442	35,956 K	2,624 K	6
     Rtvscan.exe	324		Symantec AntiVirus	Symantec Corporation	8	644	3,295,153	169,664 K	47,892 K	55
     SymSPort.exe	508		SymSPort.exe	Symantec Corporation	8	251	30,908	52,752 K	5,840 K	9
     vmware-authd.exe	648		VMware Authorization Service	VMware, Inc.	8	137	2,133,758	31,888 K	2,996 K	5
     vmount2.exe	692		virtual disk mount service	VMware, Inc.	8	100	995	36,420 K	2,920 K	3
     vmnetdhcp.exe	420		VMware VMnet DHCP service	VMware, Inc.	8	30	422	13,504 K	1,220 K	2
     alg.exe	2576		Application Layer Gateway Service	Microsoft Corporation	8	111	923	32,840 K	2,596 K	5
    lsass.exe	1664		LSA Shell (Export Version)	Microsoft Corporation	9	409	103,943	41,916 K	1,456 K	21
    ati2evxx.exe	380		ATI External Event Utility EXE Module	ATI Technologies Inc.	8	78	1,846	24,476 K	2,996 K	5
explorer.exe	664		Windows Explorer	Microsoft Corporation	8	2,146	2,637,981	164,236 K	11,212 K	22
 Azureus.exe	2864	2		Aelitis	8	11,913	6,096,501	925,360 K	211,140 K	168
 Pd7tPan.exe	3780				8	90	1,942	37,104 K	5,208 K	2
 CLI.exe	3892		CLI Application (Command Line Interface)	ATI Technologies Inc.	8	567	111,165	159,804 K	5,052 K	10
  CLI.exe	3736		CLI Application (Command Line Interface)	ATI Technologies Inc.	8	257	54,485	138,292 K	3,240 K	9
  CLI.exe	3856		CLI Application (Command Line Interface)	ATI Technologies Inc.	8	390	41,308	182,876 K	4,840 K	9
 iTouch.exe	3916		iTouch Application	Logitech Inc.	8	114	1,646	41,044 K	4,308 K	3
 nsl.exe	3928	    			8	149	14,504	38,756 K	4,980 K	3
 boincmgr.exe	3424		BOINC Manager for Windows	Space Sciences Laboratory, U.C. Berkeley	8	140	2,265	39,568 K	7,252 K	2
  boinc.exe	3148		BOINC client	truXoft (original by Space Sciences Laboratory)	8	148	547,681	39,396 K	6,128 K	1
   SaH_5.15_KWSN_SSE2_generic_Ben-Joe_2.0_B.exe	1532	25	Initial Release	Lunatics, Inc.	4	31	229,439	54,548 K	29,000 K	3
   SaH_5.15_KWSN_SSE2_generic_Ben-Joe_2.0_B.exe	5288	22	Initial Release	Lunatics, Inc.	4	31	130,811	54,116 K	28,580 K	3
   SaH_5.15_KWSN_SSE2_generic_Ben-Joe_2.0_B.exe	2408	25	Initial Release	Lunatics, Inc.	4	31	119,120	54,548 K	28,988 K	3
   SaH_5.15_KWSN_SSE2_generic_Ben-Joe_2.0_B.exe	2880	19	Initial Release	Lunatics, Inc.	4	31	48,915	54,120 K	28,584 K	3
 trillian.exe	3260		Trillian	Cerulean Studios	8	906	1,841,876	106,376 K	11,244 K	16
 acrotray.exe	4028		AcroTray	Adobe Systems Inc.	8	125	1,548	33,224 K	3,184 K	2
 ccApp.exe	4040		Symantec User Session	Symantec Corporation	8	483	89,250	84,200 K	22,676 K	23
 VPTray.exe	2964		Symantec AntiVirus	Symantec Corporation	8	285	109,809	51,196 K	7,324 K	6
 atidtct.exe	1004		ATI Device Detection Application	ATI Technologies Inc.	8	114	1,793	38,024 K	5,076 K	1
 ctfmon.exe	940		CTF Loader	Microsoft Corporation	8	209	18,404	33,072 K	3,812 K	1
 taskmgr.exe	2856		Windows TaskManager	Microsoft Corporation	13	82	5,093	33,772 K	2,388 K	3
 firefox.exe	2284	    	Firefox	Mozilla Corporation	8	1,195	21,729,009	644,460 K	293,272 K	31
 Eudora.exe	872		EUDORA	QUALCOMM Incorporated	8	1,674	3,820,218	193,876 K	17,916 K	17
 notepad.exe	4448		Notepad	Microsoft Corporation	8	43	3,298	31,008 K	420 K	1
 speedfan.exe	5552			Almico Software (www.almico.com)	8	199	4,837	45,656 K	2,704 K	4
 googleearth.exe	1996		Google Earth	Google	8	486	242,537	860,832 K	15,752 K	13
 procexp.exe	7740	1	Sysinternals Process Explorer	Sysinternals	13	384	429,457	72,200 K	26,384 K	6
EM_EXEC.EXE	3832		Logitech Events Handler Application	Logitech Inc.	8	92	2,167	35,676 K	3,208 K	2
MediaMonkey (non-skinned).exe	1772	3	MediaMonkey - Audio Librar	Ventis Media Inc	8	1,012	5,348,520	245,644 K	49,112 K	16

Process: <Non-existent Process> Pid: -2

Type	Name

This is after about three days of up time.

Applications which I have running pretty much all of the time: SCS, ATi CLI, tray app for my sound card, BOINC/Seti, Trillian, MediaMonkey, Azureus, NetStat, Fx, Eudora, the task manager, and a number of Explorer windows. There will also be VMware, PerfectDisk, Logitech iTouch and Mouseware, and Acrobat related processes running on a usual basis.

Google Earth and Notepad do not usually run and haven't been running during a reboot episode.

I'm trying to figure out if there's an easy way to get the startup information from msconfig into a text file.

 

[Bozo]

How do you have the BIOS set when the power goes off? Auto restart, stay off??
Might be interesting to change the setting. You could have a bad plug, wall outlet, power strip, or UPS. If the BIOS is set to restart, the computer will look like it rebooted; which it did but because of a power failure of some kind.

Bozo :joker:

 

[ddrueding]

Sechs,

That is a lot of stuff. No wonder you suspect it to be software!

The first thing I would do is kill off BOINC and get your CPU useage down to something normal. I run Speedfan myself, but have known it to be unstable in the past; it's the first thing I kill when instability arises. Start there, as it won't affect your ability to use the machine, then I'd continue on with Azureus, NetStat, and Trillian.

The ideal would be to kill all non-vital processes and see if it happens, but I understand you want to continue to use the machine.

 

[Mercutio]

People actually use Mouseware?

 

[Bozo]

Could this be a heat related issue. CPU getting too toasty??

Bozo :joker:

 

[sechs]

How do you have the BIOS set when the power goes off? Auto restart, stay off??
Might be interesting to change the setting. You could have a bad plug, wall outlet, power strip, or UPS. If the BIOS is set to restart, the computer will look like it rebooted; which it did but because of a power failure of some kind.

The BIOS is set to leave the computer off in case of failure. I have accidentally tested this before, and it does stay off. The computer is now the only device on this particular UPS, which has run well for some years.

 

[sechs]

The first thing I would do is kill off BOINC and get your CPU useage down to something normal. I run Speedfan myself, but have known it to be unstable in the past; it's the first thing I kill when instability arises. Start there, as it won't affect your ability to use the machine, then I'd continue on with Azureus, NetStat, and Trillian.

The ideal would be to kill all non-vital processes and see if it happens, but I understand you want to continue to use the machine.

I'm not going to be able to do that now, but that's certainly a good idea.

I only started running Speedfan regularly, as it can spit up the on-die temperature of my processors, as well as the motherboard sensor, harddrives, and fan speeds. Previously, I would run HardwareDoctor, Iwill's own software, intermittently. In both cases, the software was not set to start on boot, so it certainly wouldn't account for the one time when the machine rebooted twice without user interaction; or the last time that a reboot occurred, about five weeks ago, when I know that neither was running.

 

[sechs]

People actually use Mouseware?

Generally, I wouldn't use it except that it allows me to remap the buttons on my mouse (particularly the thumb button, which I map to <shift>) and, less importantly, allows me to check the battery level.

What is annoying is that Microsoft Update will automatically install Microsoft's mouse software, which is completely useless, as far as I can tell.

 

[sechs]

Could this be a heat related issue. CPU getting too toasty??

I don't heat my house, so the ambient is actually quite cool.

Right now:
ambient 20C
sys 50C (the sensor is between the AGP slot and the DIMM slots for CPU1)
CPU0 sensor: 44C
CPU0 core0: 46C
CPU0 core1: 44C
CPU1 sensor: 37C
CPU1 core0: 47C
CPU1 core1: 48C
CPU1 heatsink: 33C (sensor is taped to heatsink)
case: 32C (sensor is taped to case just above motherboard)
HD cage: 31C (sensor is taped to cage)
HD1: 31C
HD2: 29C
HD3: 35C

Last time a reboot occurred, the ambient was probably about 2 or 3C higher than it is now.

 

[jtr1962]

I'm periodically experiencing the exact same thing on the new PC I set up about a year ago. I think it might be video card related since it occurred very infrequently only after I purchased a new card (it's an EVGA 128 MB Geforce 6200). It mainly occurs when playing 3D games after a few minutes or more. It also occurred a few times when web surfing and more often when editing graphics files.

Any ideas on a fix (I've already tried upgrading video drivers and underclocking the card)?

 

[Buck]

(I've already tried upgrading video drivers and underclocking the card)?

When you under-clocked the card, did you lower voltage or just change the GPU frequency?

 

[jtr1962]

When you under-clocked the card, did you lower voltage or just change the GPU frequency?

I only changed the GPU frequency. The card voltage was already at 1.5V in the BIOS and that was the lowest setting.

It's not heat-related, BTW. The GPU temperature is at most 70°C. The limit is 145°C and the card will automatically clock down as it approaches this. On another strange note, after the system is up for a few days my maximum frame rates will be locked at 32 fps until I reboot.

 

[sechs]

An update:

I left the computer running with Azureus and BOINC, as well the standard suite of "system" software while I was on vacation. Up for 26 days and counting. Obviously this didn't involve a lot of user interaction, but daily defragmenting runs and weekly AV checks ran with no issue. There are no substantive errors in the system logs.

The system *seems* to be stable since I started this thread, and, so, I wonder if, as bizarre as it seems, Windows Update was the culprit. I'll keep running as-is for the moment and see if the mystery reboots return.

Thanks