PDA

View Full Version : Server 2003 - No disk error on admin console



Chilling_Silence
14-09-2010, 09:48 AM
Good morning all,

We've got an error message appearing on a server, it seems to occur most mornings around 8AM (See attached) on a Server 2003 box here.

Did a bit of looking into it, apparently it may have been relating to a disc not being in a CD Drive or something along those lines? The annoying thing is it breaks our monitoring via SNMP until we login remotely to the admin console and clear the error message. Just clicking on "OK" and it disappears for the day, and SNMP resumes immediately.

It's a MSSQL server too, so if a disk was missing, we'd probably have users complaining pretty quickly that things weren't working.

Does anybody have any ideas on what may be causing this / how to resolve it?

Any suggestions much appreciated,

Cheers


Chill.

pctek
14-09-2010, 10:37 AM
Read this:?

http://www.consumingexperience.com/2007/11/windows-no-disk-exception-processing.html

Chilling_Silence
14-09-2010, 10:51 AM
Yes, it's the first Google result when you throw in half the error message ;)

I've done scans for malware / viruses
I've just tried putting in a floppy disk image into the machine also. I guess I should have mentioned it's a VM on ESXi, sorry for leaving that out.

Nice to meet you on the weekend too :)

pctek
14-09-2010, 11:48 AM
Ah well, I'm not a server guru......thought it worth a guess......
You know you look far too young to be out of school......

SolMiester
14-09-2010, 11:51 AM
Good morning all,

We've got an error message appearing on a server, it seems to occur most mornings around 8AM (See attached) on a Server 2003 box here.

Did a bit of looking into it, apparently it may have been relating to a disc not being in a CD Drive or something along those lines? The annoying thing is it breaks our monitoring via SNMP until we login remotely to the admin console and clear the error message. Just clicking on "OK" and it disappears for the day, and SNMP resumes immediately.

It's a MSSQL server too, so if a disk was missing, we'd probably have users complaining pretty quickly that things weren't working.

Does anybody have any ideas on what may be causing this / how to resolve it?

Any suggestions much appreciated,

Cheers




Chill.

Have you tried a cold boot?

Chilling_Silence
14-09-2010, 02:55 PM
You know you look far too young to be out of school......

Technically I was homeschooled, and finished high-school equivalents a decade ago now ... but thanks, I'll keep that in mind when I'm 40, might make me feel younger :D

We could do a cold-boot, but it's in-use 24/7 (Honestly is!) so any downtime is less than ideal.

Any other ideas?

Thanks :)


Chill.

nofam
14-09-2010, 03:14 PM
Technically I was homeschooled, and finished high-school equivalents a decade ago now ... but thanks, I'll keep that in mind when I'm 40, might make me feel younger :D

We could do a cold-boot, but it's in-use 24/7 (Honestly is!) so any downtime is less than ideal.

Any other ideas?

Thanks :)


Chill.

Off-topic I know, but are you replicating it if it's used that much?

pctek
14-09-2010, 06:35 PM
I'll keep that in mind when I'm 40, might make me feel younger :D

.

Your wife will hate you because you'll be one of those people that looks young even when old.......:D

SolMiester
14-09-2010, 10:33 PM
Technically I was homeschooled, and finished high-school equivalents a decade ago now ... but thanks, I'll keep that in mind when I'm 40, might make me feel younger :D

We could do a cold-boot, but it's in-use 24/7 (Honestly is!) so any downtime is less than ideal.

Any other ideas?

Thanks :)


Chill.
Doh, just remembered you said the server is a VM, can you not connect\disconnect the cd drive with esxi?

Deimos
14-09-2010, 11:03 PM
Does anything show up in the event logs?

gary67
15-09-2010, 07:45 AM
Your wife will hate you because you'll be one of those people that looks young even when old.......:D

Mine hates me for the same reason so she made me keep the beard after my 6 days out in the back blocks caving last Christmas

kahawai chaser
15-09-2010, 10:15 AM
I did advanced Google search using your keywords (and combo's), and this site pops up often: VMware Digest (http://blogs.vmware.com/kbdigest/). Might suggest issues with VMware. The site has dozens of articles, with mention of VMware tools.

Chilling_Silence
15-09-2010, 11:35 AM
Does anything show up in the event logs?

There was, but the error popped up around the 7th of the month and we just did nothing about it for a week because we knew it wouldn't affect anything, until curiosity got the better of me and I had to investigate it further.
It's been going on for a wee while now, and it's not a critical error because everything's working while that error's on-screen, with the exception of SNMP monitoring.

Yes, we're backing it all up regularly. :banana

I tried making an empty disk image in linux and formatting it as FAT12, so I've mounted that disk image in vmware tools in a bid to see if it was trying to write to the floppy drive. We tried messing with the CDRom drive letter / connection / disconnection and it still kept coming up :(

So, this morning, no error on screen. I *thought* it was occurring daily so it may be that the floppy disk image has resolved it? Who knows ... Guess I'll just have to wait a few more days and see.

I'll look into the VMWare Digest site now and see what that brings up, in case it is vmware specific. Thing is we've got about 30 other VM's here, mostly Server 2003 / 2008r2, yet none of them have the issue :-/

Still, in the mean time, I'm all ears for any additional suggestions!

Thanks


Chill.

kahawai chaser
15-09-2010, 12:55 PM
Maybe check out here (http://communities.vmware.com/thread/265938), and the last post, where it was something to do with a shared folder having a missing directory within VMWare.

kahawai chaser
17-09-2010, 11:26 AM
Was the issue resolved - and if so, what was the cause? Thanks...

Chilling_Silence
17-09-2010, 11:51 AM
So far, by mounting the virtual disk image, things seem OK.

No idea why ... or what's causing it ... But yeah things seem OK now I've got that virtual floppy drive mounted.

Odd indeed!

Chilling_Silence
28-09-2010, 08:58 AM
Almost two weeks on now, and it appears as though mounting the virtual floppy image I create has solved the issue.

The question now:
What on earth on that machine was looking for something in the floppy drive?!

SolMiester
28-09-2010, 09:04 AM
A/V schedule?

Chilling_Silence
28-09-2010, 11:36 AM
Nope, no A/V scheduled scans. Updates daily at 9:30AM (The error was occuring around 7:45 -> 8AM).

Nothing in windows scheduled tasks either.

kahawai chaser
28-09-2010, 12:37 PM
You might find clues by reading the comments from the MS Article from pctek; Some seem to blame a USB drive not being removed properly (and then reinserted), which had triggered the error you receive - basically trying to find a drive that was present. Apparently ini files (I think) were copied over causing issues. Yet another says a bios type virus, and so on.

One person even blamed a USB mouse/software. Another traced by using Task manager (when pressing "try again"), and found a cyber link service and stopped by starting in msconfig.

Chilling_Silence
11-10-2010, 08:58 AM
So we've done a reboot over the weekend to install the latest windows updates on sunday when it was least utilized.

Machine didn't come back up initially, because we'd left the blank floppy image in the virtual host and it was trying to boot from it. So we unmounted it and told the VM Host to leave the floppy drive disconnected (So it shouldn't feel there is one).

It booted up happily, but we're back to having the same issue again now. We could put the virtual floppy image back in, but yeah ...

So we did a search of the registry for "A:" and nothing comes up with the exception of a reference to "WIA" and one in the Mounted Devices section (Which I believe is auto-generated)?
Because it's a live server, we didn't wanna go deleting the registry key in case it did something catastrophic and we had a lot of unhappy people.

Basically the server has McAfee on it for antivirus, no scheduled scans, and SQL Server. That's pretty much all there is on the server really...

So, there's no poorly removed thumbdrives, no BIOS virus, the same mouse software is used on all our machines (VMWare Tools).

Any other ideas on tracking down this sucker?

pctek
11-10-2010, 09:04 AM
[QUOTE=Chilling_Silence;956269]

Basically the server has McAfee on it for antivirus QUOTE]

Really? That's terrible. Why not use something decent. Maybe that's it's problem.

Chilling_Silence
11-10-2010, 09:17 AM
Really? That's terrible. Why not use something decent. Maybe that's it's problem.

+1

We're reviewing anti-virus now. Still, like you, I'm just starting out at this company, so can't fix everything overnight ;)

Naturally I'm going to be pushing for NOD32 + Eset Remote Administrator etc, but we've gotta make sure it's going to be cost-effective...

mikebartnz
11-10-2010, 10:31 AM
Seeing as it is a VM it's not a shared folder that you have removed and not removed the mapping.

SolMiester
11-10-2010, 10:46 AM
Is it looking for a floppy disk or the drive period?, is this ESX, ESXi or VMWare server?

Chilling_Silence
11-10-2010, 10:58 AM
Not a shared folder. We tried having a floppy drive connected with nothing in it, same error.

VMWare ESX I believe, but not 100%, I didn't set it up ....

SolMiester
11-10-2010, 11:11 AM
Not a shared folder. We tried having a floppy drive connected with nothing in it, same error.

VMWare ESX I believe, but not 100%, I didn't set it up ....
So you have something trying to access the floppy drive?, a/v schedule?, defrag? indexing?...was this happening at same time every day?

Chilling_Silence
11-10-2010, 01:14 PM
Yeah it was happening at 8AM, now it's happening at midnight.

No A/V schedule, no defrag, no scandisk, and I don't *think* there's any indexing though that's worth me double-checking. Thanks :)

kahawai chaser
11-10-2010, 01:37 PM
Unless it's something to do with SNMP configuration and it's environment if using WMI provider, or some other add on Microsoft set up example here (http://support.microsoft.com/kb/324263). Any clues in event viewer or logs?

SolMiester
11-10-2010, 02:18 PM
Yeah it was happening at 8AM, now it's happening at midnight.

No A/V schedule, no defrag, no scandisk, and I don't *think* there's any indexing though that's worth me double-checking. Thanks :)

Just thought, you're not running shadow copies are you, that would explain why it works with an image with nothing on it and it runs to a schedule!

Chilling_Silence
11-10-2010, 02:46 PM
I'll double-check our SNMP setup, but they were basically all setup identically.

No shadow copies either, though I like your train of thinking! :D

Just confirmed that yes, it is running on ESX.

SolMiester
11-10-2010, 02:55 PM
I'll double-check our SNMP setup, but they were basically all setup identically.

No shadow copies either, though I like your train of thinking! :D

Just confirmed that yes, it is running on ESX.

Is A: shared?

SolMiester
11-10-2010, 02:59 PM
I'll double-check our SNMP setup, but they were basically all setup identically.

No shadow copies either, though I like your train of thinking! :D

Just confirmed that yes, it is running on ESX.

Just thought, are you using virtual centre to control the hosts or just the client to each host. I have found that sometimes I have to use the client as VM amendments dont take when using the VC...ie: adding storage or storage controllers.

Also...when the floppy was attached, it could well of been to a client floppy rather than the host floppy which could account for the error!

Chilling_Silence
11-10-2010, 03:15 PM
Changes are being made from within the VMWare vSphere Client.

A: Is not shared.

When the floppy was attached, it was to a .img file that I SCP'd across to the VMWare host. Does that help narrow it down at all?

Chilling_Silence
11-10-2010, 03:17 PM
Also, indexing service is only running on c:\System Volume Information and c:\inetpub


:)

SolMiester
11-10-2010, 03:24 PM
Changes are being made from within the VMWare vSphere Client.

A: Is not shared.

When the floppy was attached, it was to a .img file that I SCP'd across to the VMWare host. Does that help narrow it down at all?

More details on this! the floppy was a .img that you SCP to where on the host? , a datastore? What was the image?, an install? Are you not able to re-connect?

Chilling_Silence
11-10-2010, 03:40 PM
I used DD on a linux machine to make an empty 1.44MB file. I then mounted it as a loopback device and formatted it with FAT12.

That was then SCP'd into a directory on the host where all the other CD Images and Floppy images are stored by default, I can't remember off the top of my head.

We could re-connect it, it was temporarily fixed while that was connected, but obviously when we then went to reboot the virtual server it tried to boot off the floppy, so we unmounted the virtual floppy and told VMWare to "deconnect" the drive.

Let me know if I can clarify that further :) I'll find where on the host we SCP'd the image to.

SolMiester
11-10-2010, 03:51 PM
I used DD on a linux machine to make an empty 1.44MB file. I then mounted it as a loopback device and formatted it with FAT12.

That was then SCP'd into a directory on the host where all the other CD Images and Floppy images are stored by default, I can't remember off the top of my head.

We could re-connect it, it was temporarily fixed while that was connected, but obviously when we then went to reboot the virtual server it tried to boot off the floppy, so we unmounted the virtual floppy and told VMWare to "deconnect" the drive.

Let me know if I can clarify that further :) I'll find where on the host we SCP'd the image to.

Well, of course the fix is to remove the floppy from the bootable devices and re-attach the image etc, but that isnt solving the issue. I am curious as to what is trying to access the floppy at the scheduled times....we need a program to monitor disk assess!? We have covered A/V, indexing, shadow copies, defrag, sharing, program install, runonce?, run at startup?....snapshot? (do you use veeam?) or shadow protect?

Chilling_Silence
11-10-2010, 04:00 PM
Well, of course the fix is to remove the floppy from the bootable devices and re-attach the image etc, but that isnt solving the issue.
Yes, we know this, but like you I'm not keen on applying a bandaid fix, I wanna know the real cause :D curiousity...


I am curious as to what is trying to access the floppy at the scheduled times....we need a program to monitor disk assess!? We have covered A/V, indexing, shadow copies, defrag, sharing, program install, runonce?, run at startup?....snapshot? (do you use veeam?) or shadow protect?
No, no Veeam, no shadow protect
See attached :)

Thanks again for your persistent help, it's very much appreciated!

Chilling_Silence
11-10-2010, 04:03 PM
Do you have any suggestions on an application that will monitor processes reading / writing to the disk ?

SolMiester
11-10-2010, 04:28 PM
Just system internal process something, however unless it has an event log, you may have to be watching it at the appropriate time...

Chilling_Silence
11-10-2010, 06:50 PM
...midnight :(

mikebartnz
11-10-2010, 09:04 PM
Just came across this (http://www.unixmen.com/linux-tutorials/1228-icinga-an-advanced-opensource-monitoring-tool) Chill.

Chilling_Silence
11-10-2010, 10:17 PM
Hey nice :D

Chilling_Silence
12-10-2010, 09:03 AM
Well it apparently happened again at 3:25PM yesterday (When the Cacti graphs stop), which was before I made the post about the Shadow Copies, but I was logged in to the admin console via RDP and the error message never actually came up which was odd.

Restarting the SNMP service kicked things in to life again. Still doesn't help narrow down the issue :(

Usually there would be the error message on the screen of the admin console, but it wasn't there this time. Odd indeed...

SolMiester
12-10-2010, 09:19 AM
Did you say this box is www and SQL, what SQL agents and maintenance plans do you have running?

Chilling_Silence
12-10-2010, 12:43 PM
Just SQL.

There are SQL agents, but they're purely copied over from our older (And much slower, but operating perfectly) DB server. There are no additional ones, and our older server never had this kind of issue.

Do you think it could be something like that?

SolMiester
13-10-2010, 09:38 AM
Just SQL.

There are SQL agents, but they're purely copied over from our older (And much slower, but operating perfectly) DB server. There are no additional ones, and our older server never had this kind of issue.

Do you think it could be something like that?

I was just covering bases....SQL agents can be setup to do anything!...however the schedule seems to have changed now, so Im a bit lost!
Does the error come up if the MMC console isnt opened?

Have you done a cold boot yet? Im sure that will clear the error.

Chilling_Silence
13-10-2010, 09:47 AM
Yeah it was coming up on the admin console (mstsc ip.address /admin) even if nobody was logged in.

However, the last two days (Since Monday arvo), it no longer seems to be coming up with the error message, but still exhibits the same symptoms :(

I'm thrown too ....

SolMiester
13-10-2010, 09:55 AM
You should do a cold boot, its a VM, it will only be down for 2min max!, no RAID arrays etc to wait on etc.....
An install\update\copy has been run and the CD\Floppy disk removed before the operation or explorer windows closed hence the request for the disk!
A cold boot will reset the system state....although I must admit the regular request has me confused....