Re: 2-hour hibernate failure
Posted: 15 Apr 2010, 13:28
John John - MVP wrote:
> William B. Lurie wrote:
>> William B. Lurie wrote:
>> <snip>
>>> I just finished what might be the most positive indicating
>>> run yet. Same conditions as last run, except this time I did
>>>
>>> Clean Boot
>>> Disabled Auto Live Update
>>> Disabled WIA and started at 9:12 P.M.
>>>
>>> 2.5 hours later, it had not hibernated, but I think
>>> there is just one reason clearly shown. I'll send you
>>> the files in the morning to look at, John.
>>>
>>> What I see is just *one* event, but it happened at 10:35 .....
>>> Tcpip... Type 4201 ......."SCM" I think.
>>>
>>> Bill
>> See these:
>>
>>> Type Date Time Source Category Event User Computer
>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>
>> Type Date
>> Success Audit 4/14/2010 11:34:34 PM Security System
>> Event 513 SYSTEM COMPAQ-2006
>> Success Audit 4/14/2010 11:34:28 PM Security
>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006
>> Success Audit 4/14/2010 9:11:04 PM Security Privilege
>> Use 576 NETWORK SERVICE COMPAQ-2006
>> Success Audit 4/14/2010 9:11:04 PM Security
>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
>> Success Audit 4/14/2010 9:10:24 PM Security Privilege
>> Use 576 NETWORK SERVICE COMPAQ-2006
>> Success Audit 4/14/2010 9:10:24 PM Security
>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
>> Success Audit 4/14/2010 9:10:24 PM Security System
>> Event 515 SYSTEM COMPAQ-2006
>> Success Audit 4/14/2010 9:10:22 PM Security Policy
>> Change 850 SYSTEM COMPAQ-2006
>> Success Audit 4/14/2010 9:10:22 PM Security Policy
>> Change 850 SYSTEM COMPAQ-2006
>> Success Audit 4/14/2010 9:10:22 PM Security Policy
>> Change 850 SYSTEM COMPAQ-2006
>>
>>> Type Date Time Source Cate
>>> Information 4/14/2010 11:34:34 PM eventlog None
>>> 6006 N/A COMPAQ-2006
>>> Information 4/14/2010 11:34:33 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 11:30:33 PM Tcpip None 4201
>>> N/A COMPAQ-2006
>>> Information 4/14/2010 10:35:53 PM Tcpip None 4201
>>> N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7035 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7035 Compaq_Owner COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7035 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>>
>>> Event Type: Information
>>> Event Source: Tcpip
>>> Event Category: None
>>> Event ID: 4201
>>> Date: 4/14/2010
>>> Time: 10:35:53 PM
>>> User: N/A
>>> Computer: COMPAQ-2006
>>> Description:
>>> The system detected that network adapter
>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to
>>> the network, and has initiated normal operation over the network
>>> adapter.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> Data:
>>> 0000: 00 00 00 00 02 00 50 00 ......P.
>>> 0008: 00 00 00 00 69 10 00 40 ....i..@
>>> 0010: 02 00 00 00 00 00 00 00 ........
>>> 0018: 00 00 00 00 00 00 00 00 ........
>>> 0020: 00 00 00 00 00 00 00 00 ........
>>
>> I think that 10:35 PM event was the killer........
>> Our old friend Tcpip again. I have the feeling that, if I let it
>> run on past 11:30. it would repeat every hour or so.
>>
>> I'm ready to clean out the Event Logs on the Clone
>> system, and Clean Boot, and do whatever you tell me to,
>> John, to track it down. I don't know what Network Adapter they're
>> referring to in the Event Description.....
>
> Please do the clean boot.
>
> John
That last run *was* from squeaky cleanest clean boot,
John. I can clear out the ancient history just to make
the Event Logs look smaller, but that isn't going to change anything.
As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I
expanded out and posted......and that needs blocking or whatever.
Bill
> William B. Lurie wrote:
>> William B. Lurie wrote:
>> <snip>
>>> I just finished what might be the most positive indicating
>>> run yet. Same conditions as last run, except this time I did
>>>
>>> Clean Boot
>>> Disabled Auto Live Update
>>> Disabled WIA and started at 9:12 P.M.
>>>
>>> 2.5 hours later, it had not hibernated, but I think
>>> there is just one reason clearly shown. I'll send you
>>> the files in the morning to look at, John.
>>>
>>> What I see is just *one* event, but it happened at 10:35 .....
>>> Tcpip... Type 4201 ......."SCM" I think.
>>>
>>> Bill
>> See these:
>>
>>> Type Date Time Source Category Event User Computer
>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
>>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>>
>> Type Date
>> Success Audit 4/14/2010 11:34:34 PM Security System
>> Event 513 SYSTEM COMPAQ-2006
>> Success Audit 4/14/2010 11:34:28 PM Security
>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006
>> Success Audit 4/14/2010 9:11:04 PM Security Privilege
>> Use 576 NETWORK SERVICE COMPAQ-2006
>> Success Audit 4/14/2010 9:11:04 PM Security
>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
>> Success Audit 4/14/2010 9:10:24 PM Security Privilege
>> Use 576 NETWORK SERVICE COMPAQ-2006
>> Success Audit 4/14/2010 9:10:24 PM Security
>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
>> Success Audit 4/14/2010 9:10:24 PM Security System
>> Event 515 SYSTEM COMPAQ-2006
>> Success Audit 4/14/2010 9:10:22 PM Security Policy
>> Change 850 SYSTEM COMPAQ-2006
>> Success Audit 4/14/2010 9:10:22 PM Security Policy
>> Change 850 SYSTEM COMPAQ-2006
>> Success Audit 4/14/2010 9:10:22 PM Security Policy
>> Change 850 SYSTEM COMPAQ-2006
>>
>>> Type Date Time Source Cate
>>> Information 4/14/2010 11:34:34 PM eventlog None
>>> 6006 N/A COMPAQ-2006
>>> Information 4/14/2010 11:34:33 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 11:30:33 PM Tcpip None 4201
>>> N/A COMPAQ-2006
>>> Information 4/14/2010 10:35:53 PM Tcpip None 4201
>>> N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7035 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7035 Compaq_Owner COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7035 SYSTEM COMPAQ-2006
>>> Information 4/14/2010 9:11:40 PM Service Control Manager
>>> None 7036 N/A COMPAQ-2006
>>>
>>> Event Type: Information
>>> Event Source: Tcpip
>>> Event Category: None
>>> Event ID: 4201
>>> Date: 4/14/2010
>>> Time: 10:35:53 PM
>>> User: N/A
>>> Computer: COMPAQ-2006
>>> Description:
>>> The system detected that network adapter
>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to
>>> the network, and has initiated normal operation over the network
>>> adapter.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> Data:
>>> 0000: 00 00 00 00 02 00 50 00 ......P.
>>> 0008: 00 00 00 00 69 10 00 40 ....i..@
>>> 0010: 02 00 00 00 00 00 00 00 ........
>>> 0018: 00 00 00 00 00 00 00 00 ........
>>> 0020: 00 00 00 00 00 00 00 00 ........
>>
>> I think that 10:35 PM event was the killer........
>> Our old friend Tcpip again. I have the feeling that, if I let it
>> run on past 11:30. it would repeat every hour or so.
>>
>> I'm ready to clean out the Event Logs on the Clone
>> system, and Clean Boot, and do whatever you tell me to,
>> John, to track it down. I don't know what Network Adapter they're
>> referring to in the Event Description.....
>
> Please do the clean boot.
>
> John
That last run *was* from squeaky cleanest clean boot,
John. I can clear out the ancient history just to make
the Event Logs look smaller, but that isn't going to change anything.
As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I
expanded out and posted......and that needs blocking or whatever.
Bill