Notification

Icon
Error

RPC Error shutting down server

Posted: Tuesday, May 4, 2010 4:36:09 PM(UTC)
KHabershon

KHabershon

Premium Users Posts: 56
0
I'm getting RPC Endpoint Mapper service errors which are causing the server to restart the service which since recovery is set to restart the system immediately causes the server to reboot. This ONLY happens when the Lansweeper Service is running.
Handles attachments
Errorlog.txt (84kb) downloaded 49 time(s).
KHabershon
#1KHabershon Premium Users  
posted: 5/4/2010 8:12:51 PM(UTC)
Log Name: System
Source: Service Control Manager
Date: 5/4/2010 11:49:04 AM
Event ID: 7031
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: CNTPAAP27.corp.local
Description:
The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.


Log Name: System
Source: Service Control Manager
Date: 5/4/2010 11:49:04 AM
Event ID: 7031
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: CNTPAAP27.corp.local
Description:
The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

Log Name: System
Source: USER32
Date: 5/4/2010 11:49:04 AM
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: CNTPAAP27.corp.local
Description:
The process C:\Windows\system32\services.exe (CNTPAAP27) has initiated the restart of computer CNTPAAP27 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x30006
Shutdown Type: restart
Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
Lansweeper
#2Lansweeper Member Premium Users Administration  
posted: 5/4/2010 8:48:58 PM(UTC)
Could you post a list of any third party software installed on this machine please.

How many computers are affected by this problem?
KHabershon
#3KHabershon Premium Users  
posted: 5/4/2010 9:03:03 PM(UTC)
Lansweeper wrote:
Could you post a list of any third party software installed on this machine please.

How many computers are affected by this problem?



We only have 1 single scanning server.

System Configuration.
OS: Windows 2008 R2 Enterprise x64
SQL: SQL 2008 Standard SP1 (Full version not express)

Microsoft SQL Server Compact 3.5 SP1
Microsoft SQL Server 2008 Browser
Microsoft Visual Studio Tools for Applications 2.0 - ENU
Microsoft Silverlight
Microsoft SQL Server Compact 3.5 SP1 Query Tools English
Microsoft SQL Server 2008 Policies
Lansweeper 4.0
VMware Tools
SQL Server System CLR Types
Microsoft SQL Server 2008 Native Client
Microsoft SQL Server 2008 Setup Support Files
Microsoft SQL Server VSS Writer 10.1.2531.0
Microsoft SQL Server 2008 (64-bit)
KHabershon
#4KHabershon Premium Users  
posted: 5/5/2010 3:25:58 AM(UTC)
Looks like everything is working after a DB backup moved the file off the server and deleted the VM and recreated the VM.

Scans: 2515
Started: 5/4/2010 6:11:48 PM
Polled: 5/4/2010 8:22:25 PM


By now it would have rebooted, scans usually only lasted approximately an hour then rebooted.
KHabershon
#5KHabershon Premium Users  
posted: 5/5/2010 4:11:42 AM(UTC)
I do have a separate issue though. The date on the Last seen is incorrect. I've attached a screenshot for review. The clock in the lower right shows the right time along with the "polled" time/date shown in the console, however, the last seen is almost 1.5 hours behind.

And just now as a matter of fact, the Lansweeperservice stopped.


Log Name: System
Source: Service Control Manager
Date: 5/4/2010 8:56:26 PM
Event ID: 7034
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: CNTPAAP27.corp.local
Description:
The Lansweeper Server service terminated unexpectedly. It has done this 1 time(s).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7034</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2010-05-05T00:56:26.996653700Z" />
<EventRecordID>8081</EventRecordID>
<Correlation />
<Execution ProcessID="472" ThreadID="2032" />
<Channel>System</Channel>
<Computer>CNTPAAP27.corp.local</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Lansweeper Server</Data>
<Data Name="param2">1</Data>
</EventData>
</Event>
KHabershon attached the following image(s):
Image1.jpg
Lansweeper
#6Lansweeper Member Premium Users Administration  
posted: 5/5/2010 2:37:23 PM(UTC)
Are you sure that scans occurred in the last 2 hours?
KHabershon
#7KHabershon Premium Users  
posted: 5/5/2010 4:20:50 PM(UTC)
Per the Queue it was, and by that I mean http://<server>:9524 showed they were all being scanned.

And we're back it shutting down again with RPC errors as stated before. Something isn't right.

Let me know what you need to troubleshoot.
KHabershon
#8KHabershon Premium Users  
posted: 5/5/2010 4:24:17 PM(UTC)
Interestingly, this is the same issue.

http://www.lansweeper.co...-Lansweeper-Service.aspx

Log Name: Application
Source: Application Error
Date: 5/5/2010 8:53:56 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: CNTPAAP27.corp.local
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x000000000004f2f1
Faulting process id: 0x294
Faulting application start time: 0x01caec4ad1bd5824
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 4369a9f5-5845-11df-b132-005056ba01b1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-05-05T12:53:56.000000000Z" />
<EventRecordID>1900</EventRecordID>
<Channel>Application</Channel>
<Computer>CNTPAAP27.corp.local</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5be02b</Data>
<Data>c0000005</Data>
<Data>000000000004f2f1</Data>
<Data>294</Data>
<Data>01caec4ad1bd5824</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>4369a9f5-5845-11df-b132-005056ba01b1</Data>
</EventData>
</Event>

Edited: by user Wednesday, May 5, 2010 4:27:58 PM(UTC) | Reason: Not specified

Lansweeper
#9Lansweeper Member Premium Users Administration  
posted: 5/5/2010 4:29:36 PM(UTC)
Could you post the errorlog.txt file from the last time the problem occurred.

Do you also have the svchost.exe craching like in the other post?
Lansweeper
#10Lansweeper Member Premium Users Administration  
posted: 5/5/2010 4:35:14 PM(UTC)
Could you check this link : http://support.microsoft.com/kb/977357/en-us
It looks like what you are experiencing.
KHabershon
#11KHabershon Premium Users  
posted: 5/5/2010 4:41:24 PM(UTC)
Hmm ok .. Server is rebooting now after hotfix install. I will report back findings
KHabershon
#12KHabershon Premium Users  
posted: 5/6/2010 12:08:48 AM(UTC)
Negative, did not fix. See attached error log and the event logs below: **Edit** I emailed the log to you. I cannot attach since the file is too big.

**2nd Edit**
I attached also a copy of the Install.log file .. Renamed to *.txt since log is restricted.

Log Name: Application
Source: Application Error
Date: 5/5/2010 1:55:57 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: CNTPAAP27.corp.local
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b
Exception code: 0xc0000005
Fault offset: 0x000000000004f2f1
Faulting process id: 0x298
Faulting application start time: 0x01caec58a2ee42a2
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 74d6e9a8-586f-11df-a7cf-005056ba01b1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-05-05T17:55:57.000000000Z" />
<EventRecordID>2040</EventRecordID>
<Channel>Application</Channel>
<Computer>CNTPAAP27.corp.local</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5be02b</Data>
<Data>c0000005</Data>
<Data>000000000004f2f1</Data>
<Data>298</Data>
<Data>01caec58a2ee42a2</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>74d6e9a8-586f-11df-a7cf-005056ba01b1</Data>
</EventData>
</Event>

Log Name: System
Source: USER32
Date: 5/5/2010 1:56:01 PM
Event ID: 1074
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: CNTPAAP27.corp.local
Description:
The process C:\Windows\system32\services.exe (CNTPAAP27) has initiated the restart of computer CNTPAAP27 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
Reason Code: 0x30006
Shutdown Type: restart
Comment: Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="USER32" />
<EventID Qualifiers="32768">1074</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-05-05T17:56:01.000000000Z" />
<EventRecordID>18719</EventRecordID>
<Channel>System</Channel>
<Computer>CNTPAAP27.corp.local</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>C:\Windows\system32\services.exe (CNTPAAP27)</Data>
<Data>CNTPAAP27</Data>
<Data>No title for this reason could be found</Data>
<Data>0x30006</Data>
<Data>restart</Data>
<Data>Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly</Data>
<Data>NT AUTHORITY\SYSTEM</Data>
<Binary>06000300000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 5/5/2010 1:56:00 PM
Event ID: 7031
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: CNTPAAP27.corp.local
Description:
The RPC Endpoint Mapper service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7031</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2010-05-05T17:56:00.952167900Z" />
<EventRecordID>18720</EventRecordID>
<Correlation />
<Execution ProcessID="464" ThreadID="2376" />
<Channel>System</Channel>
<Computer>CNTPAAP27.corp.local</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">RPC Endpoint Mapper</Data>
<Data Name="param2">1</Data>
<Data Name="param3">120000</Data>
<Data Name="param4">1</Data>
<Data Name="param5">Restart the service</Data>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 5/5/2010 1:56:00 PM
Event ID: 7031
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: CNTPAAP27.corp.local
Description:
The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7031</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2010-05-05T17:56:00.952167900Z" />
<EventRecordID>18721</EventRecordID>
<Correlation />
<Execution ProcessID="464" ThreadID="2376" />
<Channel>System</Channel>
<Computer>CNTPAAP27.corp.local</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Remote Procedure Call (RPC)</Data>
<Data Name="param2">1</Data>
<Data Name="param3">60000</Data>
<Data Name="param4">2</Data>
<Data Name="param5">Reboot the machine</Data>
</EventData>
</Event>

Edited: by user Thursday, May 6, 2010 12:57:06 AM(UTC) | Reason: Not specified

Handles attachments
Install - Copy.txt (287kb) downloaded 17 time(s).
Lansweeper
#13Lansweeper Member Premium Users Administration  
posted: 1/31/2012 10:18:59 AM(UTC)
Please make sure service pack 1 for windows 2008 R2 is installed. (if you have windows 2008 R2)

Apply patch: http://support.microsoft.com/kb/2401588 on the scanning server.

Top Rated

1 Lansweeper List of Devices matching list of MAC addresses
by  atkinsjd  
Go to last post Go to first unread
Last post: 9/10/2013 11:36:51 PM(UTC)
2 Lansweeper Looking for customers in the US using LanSweeper
by  WbstDev  
Go to last post Go to first unread
Last post: 12/4/2013 10:30:34 PM(UTC)
4 Lansweeper Seperate logins
by  akosters  
Go to last post Go to first unread
Last post: 1/10/2014 6:20:40 AM(UTC)
5 Lansweeper 5.1 Lansweeper Error- Adding New Assets
by  Mlacombe  
Go to last post Go to first unread
Last post: 1/13/2014 5:41:35 PM(UTC)
6 Lansweeper Number of CPU cores and one result per server
by  jaekob  
Go to last post Go to first unread
Last post: 10/20/2014 3:31:46 PM(UTC)
8 Lansweeper Lansweeper Report
by  dlaporte  
Go to last post Go to first unread
Last post: 10/30/2013 8:16:40 PM(UTC)

Active Discussions

Lansweeper Cheap Fitted Kitchens
by  tupperware   Go to last post Go to first unread
Last post: Today at 3:50:50 AM(UTC)
Lansweeper Default Package Share username permissions
by  Susan.A  
Go to last post Go to first unread
Last post: 11/22/2014 1:30:01 AM(UTC)
Lansweeper Is it possible to link a web page to an asset?
by  Susan.A   Go to last post Go to first unread
Last post: 11/22/2014 1:24:10 AM(UTC)
Lansweeper LS v5.2 silentupgrade
by  MDGraves  
Go to last post Go to first unread
Last post: 11/21/2014 2:45:43 PM(UTC)
Lansweeper Query Assets in Multiple Groups
by  Susan.A  
Go to last post Go to first unread
Last post: 11/21/2014 2:18:06 PM(UTC)
Lansweeper Scanner Model Report
by  Susan.A   Go to last post Go to first unread
Last post: 11/21/2014 2:00:09 PM(UTC)
Lansweeper relations between assets and users
by  Susan.A  
Go to last post Go to first unread
Last post: 11/21/2014 1:04:13 PM(UTC)