3 Replies Latest reply on Feb 10, 2009 6:00 AM by zman

    Random PCs Rebooting




      Recently we have been experincing Random PCs rebooting/shutting down for no obvious reason only giving users a 10 second LANDesk warning, we have checked all the standard places (vulscan logs, deployment packages, power management) with no results, can anyone advise where there maybe logs of when and why a machine rebooted/shutdown and more precisely if it was initated via the LANDesk console.


      Many thanks

        • 1. Re: Random PCs Rebooting
          phoffmann SupportEmployee

          If it was initiated via the 32-bit Console, there'd be an entry in the Core's/Console's RAXFER.LOG, but I assume that your folks have better things to do than randomly rebooting client PC's .


          You want to look at the SERVICEHOST.LOG on clients that did get the reboot -- see if there's a remote execute coming in or not.


          What *USUALLY* causes this actually is a WOL-enabled job.


          The problem in essence is this:

          1 - Job Starts.

          2 - Core tries to make the client discovery ... either clients are off, or Core can't reach them - either way they're marked up as "were powered down" for this job on the Core.


          3 - Job starts ... the client is either powered up (by the user) or this traffic is then allowed through firewalls (the initial discovery could be blocked) ... and does what ever it's suppoesd to install (again, SERVICEHOST.LOG will be your friend here).


          4 - The Core (on a WOL job) will check its list of devices that "were off to begin with" and will send them a shutdown command (returning them to the state they were in - erroneously so or true).


          This can be disabled via a registry key if needed (the "shutting clients down on a WOL job" part, that is).


          Do you run any WOL-enabled jobs is the usual question to answer first of all.


          Paul Hoffmann

          LANDesk EMEA Technical Lead

          • 2. Re: Random PCs Rebooting

            Thanks Paul


            I have double checked all my jobs and am confident that WOL is not enabled, also the servicehost.log files have been checked along with Vulscan logs.  I can't find any mention of Shutdown/Reboot in RAXFER.LOG, do you know how it is defined in log file, does it say "Shutdown/Reboot" or something else?

            • 3. Re: Random PCs Rebooting
              zman Master

              Paul has some very good points. I would approach this from first finding out when the machines rebooted (date/time). Several ways to do this, review event logs (system/application - filter on Event Source:    USER32 in system log), use uptime \\computername -s, etc... It is important to narrow your search.  Don't rely on users they are useless - yeah my machine rebooted yesterday.  After you know the exact date and time, it will allow for a much easier log file search since you know the date and time.  If an application install caused the reboot (msi), it may be written to the application event log.


              So other places to look - LANDesk local scheduled tasks, Windows AT scheduler, etc... See if any sdclient log, vulscan logs have entries within the time frame that the machine rebooted.




              Search page for reboot/restart