2-hour hibernate failure
in [Windows XP Basics]
|
Prev: modem & AVG
Next: Just-In-Time Debugging
From: William B. Lurie on 15 Apr 2010 08:28 John John - MVP wrote: > William B. Lurie wrote: >> William B. Lurie wrote: >> <snip> >>> I just finished what might be the most positive indicating >>> run yet. Same conditions as last run, except this time I did >>> >>> Clean Boot >>> Disabled Auto Live Update >>> Disabled WIA and started at 9:12 P.M. >>> >>> 2.5 hours later, it had not hibernated, but I think >>> there is just one reason clearly shown. I'll send you >>> the files in the morning to look at, John. >>> >>> What I see is just *one* event, but it happened at 10:35 ..... >>> Tcpip... Type 4201 ......."SCM" I think. >>> >>> Bill >> See these: >> >>> Type Date Time Source Category Event User Computer >>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate >>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >> >> Type Date >> Success Audit 4/14/2010 11:34:34 PM Security System >> Event 513 SYSTEM COMPAQ-2006 >> Success Audit 4/14/2010 11:34:28 PM Security >> Logon/Logoff 551 Compaq_Owner COMPAQ-2006 >> Success Audit 4/14/2010 9:11:04 PM Security Privilege >> Use 576 NETWORK SERVICE COMPAQ-2006 >> Success Audit 4/14/2010 9:11:04 PM Security >> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >> Success Audit 4/14/2010 9:10:24 PM Security Privilege >> Use 576 NETWORK SERVICE COMPAQ-2006 >> Success Audit 4/14/2010 9:10:24 PM Security >> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >> Success Audit 4/14/2010 9:10:24 PM Security System >> Event 515 SYSTEM COMPAQ-2006 >> Success Audit 4/14/2010 9:10:22 PM Security Policy >> Change 850 SYSTEM COMPAQ-2006 >> Success Audit 4/14/2010 9:10:22 PM Security Policy >> Change 850 SYSTEM COMPAQ-2006 >> Success Audit 4/14/2010 9:10:22 PM Security Policy >> Change 850 SYSTEM COMPAQ-2006 >> >>> Type Date Time Source Cate >>> Information 4/14/2010 11:34:34 PM eventlog None >>> 6006 N/A COMPAQ-2006 >>> Information 4/14/2010 11:34:33 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/14/2010 11:30:33 PM Tcpip None 4201 >>> N/A COMPAQ-2006 >>> Information 4/14/2010 10:35:53 PM Tcpip None 4201 >>> N/A COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7035 Compaq_Owner COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 4/14/2010 9:11:40 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> >>> Event Type: Information >>> Event Source: Tcpip >>> Event Category: None >>> Event ID: 4201 >>> Date: 4/14/2010 >>> Time: 10:35:53 PM >>> User: N/A >>> Computer: COMPAQ-2006 >>> Description: >>> The system detected that network adapter >>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to >>> the network, and has initiated normal operation over the network >>> adapter. >>> >>> For more information, see Help and Support Center at >>> http://go.microsoft.com/fwlink/events.asp. >>> Data: >>> 0000: 00 00 00 00 02 00 50 00 ......P. >>> 0008: 00 00 00 00 69 10 00 40 ....i..@ >>> 0010: 02 00 00 00 00 00 00 00 ........ >>> 0018: 00 00 00 00 00 00 00 00 ........ >>> 0020: 00 00 00 00 00 00 00 00 ........ >> >> I think that 10:35 PM event was the killer........ >> Our old friend Tcpip again. I have the feeling that, if I let it >> run on past 11:30. it would repeat every hour or so. >> >> I'm ready to clean out the Event Logs on the Clone >> system, and Clean Boot, and do whatever you tell me to, >> John, to track it down. I don't know what Network Adapter they're >> referring to in the Event Description..... > > Please do the clean boot. > > John That last run *was* from squeaky cleanest clean boot, John. I can clear out the ancient history just to make the Event Logs look smaller, but that isn't going to change anything. As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I expanded out and posted......and that needs blocking or whatever. Bill
From: John John - MVP on 15 Apr 2010 09:46 William B. Lurie wrote: > John John - MVP wrote: >> William B. Lurie wrote: >>> William B. Lurie wrote: >>> <snip> >>>> I just finished what might be the most positive indicating >>>> run yet. Same conditions as last run, except this time I did >>>> >>>> Clean Boot >>>> Disabled Auto Live Update >>>> Disabled WIA and started at 9:12 P.M. >>>> >>>> 2.5 hours later, it had not hibernated, but I think >>>> there is just one reason clearly shown. I'll send you >>>> the files in the morning to look at, John. >>>> >>>> What I see is just *one* event, but it happened at 10:35 ..... >>>> Tcpip... Type 4201 ......."SCM" I think. >>>> >>>> Bill >>> See these: >>> >>>> Type Date Time Source Category Event User Computer >>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate >>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>> >>> Type Date >>> Success Audit 4/14/2010 11:34:34 PM Security System >>> Event 513 SYSTEM COMPAQ-2006 >>> Success Audit 4/14/2010 11:34:28 PM Security >>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006 >>> Success Audit 4/14/2010 9:11:04 PM Security Privilege >>> Use 576 NETWORK SERVICE COMPAQ-2006 >>> Success Audit 4/14/2010 9:11:04 PM Security >>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>> Success Audit 4/14/2010 9:10:24 PM Security Privilege >>> Use 576 NETWORK SERVICE COMPAQ-2006 >>> Success Audit 4/14/2010 9:10:24 PM Security >>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>> Success Audit 4/14/2010 9:10:24 PM Security System >>> Event 515 SYSTEM COMPAQ-2006 >>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>> Change 850 SYSTEM COMPAQ-2006 >>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>> Change 850 SYSTEM COMPAQ-2006 >>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>> Change 850 SYSTEM COMPAQ-2006 >>> >>>> Type Date Time Source Cate >>>> Information 4/14/2010 11:34:34 PM eventlog None >>>> 6006 N/A COMPAQ-2006 >>>> Information 4/14/2010 11:34:33 PM Service Control >>>> Manager None 7036 N/A COMPAQ-2006 >>>> Information 4/14/2010 11:30:33 PM Tcpip None 4201 >>>> N/A COMPAQ-2006 >>>> Information 4/14/2010 10:35:53 PM Tcpip None 4201 >>>> N/A COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7035 SYSTEM COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7035 Compaq_Owner COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7035 SYSTEM COMPAQ-2006 >>>> Information 4/14/2010 9:11:40 PM Service Control Manager >>>> None 7036 N/A COMPAQ-2006 >>>> >>>> Event Type: Information >>>> Event Source: Tcpip >>>> Event Category: None >>>> Event ID: 4201 >>>> Date: 4/14/2010 >>>> Time: 10:35:53 PM >>>> User: N/A >>>> Computer: COMPAQ-2006 >>>> Description: >>>> The system detected that network adapter >>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected >>>> to the network, and has initiated normal operation over the network >>>> adapter. >>>> >>>> For more information, see Help and Support Center at >>>> http://go.microsoft.com/fwlink/events.asp. >>>> Data: >>>> 0000: 00 00 00 00 02 00 50 00 ......P. >>>> 0008: 00 00 00 00 69 10 00 40 ....i..@ >>>> 0010: 02 00 00 00 00 00 00 00 ........ >>>> 0018: 00 00 00 00 00 00 00 00 ........ >>>> 0020: 00 00 00 00 00 00 00 00 ........ >>> >>> I think that 10:35 PM event was the killer........ >>> Our old friend Tcpip again. I have the feeling that, if I let it >>> run on past 11:30. it would repeat every hour or so. >>> >>> I'm ready to clean out the Event Logs on the Clone >>> system, and Clean Boot, and do whatever you tell me to, >>> John, to track it down. I don't know what Network Adapter they're >>> referring to in the Event Description..... >> >> Please do the clean boot. >> >> John > That last run *was* from squeaky cleanest clean boot, > John. I can clear out the ancient history just to make > the Event Logs look smaller, but that isn't going to change anything. > As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I > expanded out and posted......and that needs blocking or whatever. Typically you should only be seeing one (if ever) Event 4201 from TCPIP when the computer is booted, or when the adapter is disabled or enabled. Have you always been getting multiple Events 4201? If yes this might be indicative of faulty or failing network hardware, bad cable, bad switch, bad router, bad NIC... Try disabling the network adapter and see what happens, to disable the adapter go in "Network Connections" and right click on the connection. On your previous effort with a different clone, did you ever at any time successfully hibernate at 2 hours? John
From: William B. Lurie on 15 Apr 2010 10:13 John John - MVP wrote: > William B. Lurie wrote: >> John John - MVP wrote: >>> William B. Lurie wrote: >>>> William B. Lurie wrote: >>>> <snip> >>>>> I just finished what might be the most positive indicating >>>>> run yet. Same conditions as last run, except this time I did >>>>> >>>>> Clean Boot >>>>> Disabled Auto Live Update >>>>> Disabled WIA and started at 9:12 P.M. >>>>> >>>>> 2.5 hours later, it had not hibernated, but I think >>>>> there is just one reason clearly shown. I'll send you >>>>> the files in the morning to look at, John. >>>>> >>>>> What I see is just *one* event, but it happened at 10:35 ..... >>>>> Tcpip... Type 4201 ......."SCM" I think. >>>>> >>>>> Bill >>>> See these: >>>> >>>>> Type Date Time Source Category Event User >>>>> Computer >>>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>> >>>> Type Date >>>> Success Audit 4/14/2010 11:34:34 PM Security System >>>> Event 513 SYSTEM COMPAQ-2006 >>>> Success Audit 4/14/2010 11:34:28 PM Security >>>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006 >>>> Success Audit 4/14/2010 9:11:04 PM Security Privilege >>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>> Success Audit 4/14/2010 9:11:04 PM Security >>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:24 PM Security Privilege >>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:24 PM Security >>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:24 PM Security System >>>> Event 515 SYSTEM COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>> Change 850 SYSTEM COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>> Change 850 SYSTEM COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>> Change 850 SYSTEM COMPAQ-2006 >>>> >>>>> Type Date Time Source Cate >>>>> Information 4/14/2010 11:34:34 PM eventlog None >>>>> 6006 N/A COMPAQ-2006 >>>>> Information 4/14/2010 11:34:33 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 11:30:33 PM Tcpip None 4201 >>>>> N/A COMPAQ-2006 >>>>> Information 4/14/2010 10:35:53 PM Tcpip None 4201 >>>>> N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7035 Compaq_Owner COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> >>>>> Event Type: Information >>>>> Event Source: Tcpip >>>>> Event Category: None >>>>> Event ID: 4201 >>>>> Date: 4/14/2010 >>>>> Time: 10:35:53 PM >>>>> User: N/A >>>>> Computer: COMPAQ-2006 >>>>> Description: >>>>> The system detected that network adapter >>>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected >>>>> to the network, and has initiated normal operation over the network >>>>> adapter. >>>>> >>>>> For more information, see Help and Support Center at >>>>> http://go.microsoft.com/fwlink/events.asp. >>>>> Data: >>>>> 0000: 00 00 00 00 02 00 50 00 ......P. >>>>> 0008: 00 00 00 00 69 10 00 40 ....i..@ >>>>> 0010: 02 00 00 00 00 00 00 00 ........ >>>>> 0018: 00 00 00 00 00 00 00 00 ........ >>>>> 0020: 00 00 00 00 00 00 00 00 ........ >>>> >>>> I think that 10:35 PM event was the killer........ >>>> Our old friend Tcpip again. I have the feeling that, if I let it >>>> run on past 11:30. it would repeat every hour or so. >>>> >>>> I'm ready to clean out the Event Logs on the Clone >>>> system, and Clean Boot, and do whatever you tell me to, >>>> John, to track it down. I don't know what Network Adapter they're >>>> referring to in the Event Description..... >>> >>> Please do the clean boot. >>> >>> John >> That last run *was* from squeaky cleanest clean boot, >> John. I can clear out the ancient history just to make >> the Event Logs look smaller, but that isn't going to change anything. >> As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I >> expanded out and posted......and that needs blocking or whatever. > > Typically you should only be seeing one (if ever) Event 4201 from TCPIP > when the computer is booted, or when the adapter is disabled or enabled. > Have you always been getting multiple Events 4201? If yes this might > be indicative of faulty or failing network hardware, bad cable, bad > switch, bad router, bad NIC... Try disabling the network adapter and > see what happens, to disable the adapter go in "Network Connections" and > right click on the connection. On your previous effort with a different > clone, did you ever at any time successfully hibernate at 2 hours? > > John > Can't say if I ever saw multiple 4201 from Tcpip, John. All I can do is watch for it as we make more runs. I can repeat last run exactly, in the clone, with Network Connections Disabled. As for ever seeing successful hibernate at 2 hours, 'ever' is getting to be a long time, and I really can't say if I ever saw it. I think yes, but really couldn't swear to it. I'll look at and disable now in the clone, but, remember, that system has no AV at all and I run it disconnected from the line. Back at 12:30.... Bill
From: William B. Lurie on 15 Apr 2010 13:05 John John - MVP wrote: > William B. Lurie wrote: >> John John - MVP wrote: >>> William B. Lurie wrote: >>>> William B. Lurie wrote: >>>> <snip> >>>>> I just finished what might be the most positive indicating >>>>> run yet. Same conditions as last run, except this time I did >>>>> >>>>> Clean Boot >>>>> Disabled Auto Live Update >>>>> Disabled WIA and started at 9:12 P.M. >>>>> >>>>> 2.5 hours later, it had not hibernated, but I think >>>>> there is just one reason clearly shown. I'll send you >>>>> the files in the morning to look at, John. >>>>> >>>>> What I see is just *one* event, but it happened at 10:35 ..... >>>>> Tcpip... Type 4201 ......."SCM" I think. >>>>> >>>>> Bill >>>> See these: >>>> >>>>> Type Date Time Source Category Event User >>>>> Computer >>>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>> >>>> Type Date >>>> Success Audit 4/14/2010 11:34:34 PM Security System >>>> Event 513 SYSTEM COMPAQ-2006 >>>> Success Audit 4/14/2010 11:34:28 PM Security >>>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006 >>>> Success Audit 4/14/2010 9:11:04 PM Security Privilege >>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>> Success Audit 4/14/2010 9:11:04 PM Security >>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:24 PM Security Privilege >>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:24 PM Security >>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:24 PM Security System >>>> Event 515 SYSTEM COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>> Change 850 SYSTEM COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>> Change 850 SYSTEM COMPAQ-2006 >>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>> Change 850 SYSTEM COMPAQ-2006 >>>> >>>>> Type Date Time Source Cate >>>>> Information 4/14/2010 11:34:34 PM eventlog None >>>>> 6006 N/A COMPAQ-2006 >>>>> Information 4/14/2010 11:34:33 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 11:30:33 PM Tcpip None 4201 >>>>> N/A COMPAQ-2006 >>>>> Information 4/14/2010 10:35:53 PM Tcpip None 4201 >>>>> N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7035 Compaq_Owner COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>> Manager None 7036 N/A COMPAQ-2006 >>>>> >>>>> Event Type: Information >>>>> Event Source: Tcpip >>>>> Event Category: None >>>>> Event ID: 4201 >>>>> Date: 4/14/2010 >>>>> Time: 10:35:53 PM >>>>> User: N/A >>>>> Computer: COMPAQ-2006 >>>>> Description: >>>>> The system detected that network adapter >>>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected >>>>> to the network, and has initiated normal operation over the network >>>>> adapter. >>>>> >>>>> For more information, see Help and Support Center at >>>>> http://go.microsoft.com/fwlink/events.asp. >>>>> Data: >>>>> 0000: 00 00 00 00 02 00 50 00 ......P. >>>>> 0008: 00 00 00 00 69 10 00 40 ....i..@ >>>>> 0010: 02 00 00 00 00 00 00 00 ........ >>>>> 0018: 00 00 00 00 00 00 00 00 ........ >>>>> 0020: 00 00 00 00 00 00 00 00 ........ >>>> >>>> I think that 10:35 PM event was the killer........ >>>> Our old friend Tcpip again. I have the feeling that, if I let it >>>> run on past 11:30. it would repeat every hour or so. >>>> >>>> I'm ready to clean out the Event Logs on the Clone >>>> system, and Clean Boot, and do whatever you tell me to, >>>> John, to track it down. I don't know what Network Adapter they're >>>> referring to in the Event Description..... >>> >>> Please do the clean boot. >>> >>> John >> That last run *was* from squeaky cleanest clean boot, >> John. I can clear out the ancient history just to make >> the Event Logs look smaller, but that isn't going to change anything. >> As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I >> expanded out and posted......and that needs blocking or whatever. > > Typically you should only be seeing one (if ever) Event 4201 from TCPIP > when the computer is booted, or when the adapter is disabled or enabled. > Have you always been getting multiple Events 4201? If yes this might > be indicative of faulty or failing network hardware, bad cable, bad > switch, bad router, bad NIC... Try disabling the network adapter and > see what happens, to disable the adapter go in "Network Connections" and > right click on the connection. On your previous effort with a different > clone, did you ever at any time successfully hibernate at 2 hours? > > John > Now 1 PM, John, and a strange thing happened. After almost 2 hours, power-on light was flashing as usual, and 20 minutes later it had shut down. Symptomatic of having hibernated! I jiggled mouse, it did not come alive, as it should not, if it truly was in hibernation. So I pressed the power-on button, and my desktop came on, without first giving me a notice that it was coming out of hibernation. At least I think that's the way it was, but now, dammit, I have to repeat that run. But I did look at the log, and it showed nothing in the 2-hour period, just the DCOM implying (I think) that it recorder my bringing it to life. Only difference between this run and previous was that I disabled Network Connections. Your comments will be welcome, but I'm sorry to have to say that I have to confirm my story. Bill
From: William B. Lurie on 15 Apr 2010 15:37
William B. Lurie wrote: > John John - MVP wrote: >> William B. Lurie wrote: >>> John John - MVP wrote: >>>> William B. Lurie wrote: >>>>> William B. Lurie wrote: >>>>> <snip> >>>>>> I just finished what might be the most positive indicating >>>>>> run yet. Same conditions as last run, except this time I did >>>>>> >>>>>> Clean Boot >>>>>> Disabled Auto Live Update >>>>>> Disabled WIA and started at 9:12 P.M. >>>>>> >>>>>> 2.5 hours later, it had not hibernated, but I think >>>>>> there is just one reason clearly shown. I'll send you >>>>>> the files in the morning to look at, John. >>>>>> >>>>>> What I see is just *one* event, but it happened at 10:35 ..... >>>>>> Tcpip... Type 4201 ......."SCM" I think. >>>>>> >>>>>> Bill >>>>> See these: >>>>> >>>>>> Type Date Time Source Category Event User >>>>>> Computer >>>>>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate >>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate >>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate >>>>>> Scheduler Devices 101 SYSTEM COMPAQ-2006 >>>>> >>>>> Type Date >>>>> Success Audit 4/14/2010 11:34:34 PM Security System >>>>> Event 513 SYSTEM COMPAQ-2006 >>>>> Success Audit 4/14/2010 11:34:28 PM Security >>>>> Logon/Logoff 551 Compaq_Owner COMPAQ-2006 >>>>> Success Audit 4/14/2010 9:11:04 PM Security Privilege >>>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>>> Success Audit 4/14/2010 9:11:04 PM Security >>>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>>> Success Audit 4/14/2010 9:10:24 PM Security Privilege >>>>> Use 576 NETWORK SERVICE COMPAQ-2006 >>>>> Success Audit 4/14/2010 9:10:24 PM Security >>>>> Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006 >>>>> Success Audit 4/14/2010 9:10:24 PM Security System >>>>> Event 515 SYSTEM COMPAQ-2006 >>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>> Change 850 SYSTEM COMPAQ-2006 >>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>> Change 850 SYSTEM COMPAQ-2006 >>>>> Success Audit 4/14/2010 9:10:22 PM Security Policy >>>>> Change 850 SYSTEM COMPAQ-2006 >>>>> >>>>>> Type Date Time Source Cate >>>>>> Information 4/14/2010 11:34:34 PM eventlog None >>>>>> 6006 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 11:34:33 PM Service Control >>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 11:30:33 PM Tcpip None >>>>>> 4201 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 10:35:53 PM Tcpip None >>>>>> 4201 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7035 Compaq_Owner COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7035 SYSTEM COMPAQ-2006 >>>>>> Information 4/14/2010 9:11:40 PM Service Control >>>>>> Manager None 7036 N/A COMPAQ-2006 >>>>>> >>>>>> Event Type: Information >>>>>> Event Source: Tcpip >>>>>> Event Category: None >>>>>> Event ID: 4201 >>>>>> Date: 4/14/2010 >>>>>> Time: 10:35:53 PM >>>>>> User: N/A >>>>>> Computer: COMPAQ-2006 >>>>>> Description: >>>>>> The system detected that network adapter >>>>>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected >>>>>> to the network, and has initiated normal operation over the >>>>>> network adapter. >>>>>> >>>>>> For more information, see Help and Support Center at >>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>> Data: >>>>>> 0000: 00 00 00 00 02 00 50 00 ......P. >>>>>> 0008: 00 00 00 00 69 10 00 40 ....i..@ >>>>>> 0010: 02 00 00 00 00 00 00 00 ........ >>>>>> 0018: 00 00 00 00 00 00 00 00 ........ >>>>>> 0020: 00 00 00 00 00 00 00 00 ........ >>>>> >>>>> I think that 10:35 PM event was the killer........ >>>>> Our old friend Tcpip again. I have the feeling that, if I let it >>>>> run on past 11:30. it would repeat every hour or so. >>>>> >>>>> I'm ready to clean out the Event Logs on the Clone >>>>> system, and Clean Boot, and do whatever you tell me to, >>>>> John, to track it down. I don't know what Network Adapter they're >>>>> referring to in the Event Description..... >>>> >>>> Please do the clean boot. >>>> >>>> John >>> That last run *was* from squeaky cleanest clean boot, >>> John. I can clear out the ancient history just to make >>> the Event Logs look smaller, but that isn't going to change anything. >>> As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I >>> expanded out and posted......and that needs blocking or whatever. >> >> Typically you should only be seeing one (if ever) Event 4201 from >> TCPIP when the computer is booted, or when the adapter is disabled or >> enabled. Have you always been getting multiple Events 4201? If yes >> this might be indicative of faulty or failing network hardware, bad >> cable, bad switch, bad router, bad NIC... Try disabling the network >> adapter and see what happens, to disable the adapter go in "Network >> Connections" and right click on the connection. On your previous >> effort with a different clone, did you ever at any time successfully >> hibernate at 2 hours? >> >> John >> > Now 1 PM, John, and a strange thing happened. After almost 2 hours, > power-on light was flashing as usual, and 20 minutes later it had > shut down. Symptomatic of having hibernated! I jiggled mouse, it did > not come alive, as it should not, if it truly was in hibernation. So > I pressed the power-on button, and my desktop came on, without first > giving me a notice that it was coming out of hibernation. At least I > think that's the way it was, but now, dammit, I have to repeat that > run. But I did look at the log, and it showed nothing in the 2-hour > period, just the DCOM implying (I think) that it recorder my bringing > it to life. Only difference between this run and previous was that I > disabled Network Connections. Your comments will be welcome, but I'm > sorry to have to say that I have to confirm my story. > Bill Continuing on at 3:25, I confirmed that it really did hibernate, in perfectly normal, proper manner, after 2 hours. Posting below a piece of the event logs. > Type Date Time Source Category Event User Computer > Error 4/15/2010 3:10:47 PM DCOM None 10005 Compaq_Owner COMPAQ-2006 > Error 4/15/2010 3:10:47 PM DCOM None 10005 Compaq_Owner COMPAQ-2006 > Information 4/15/2010 1:08:57 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 4/15/2010 1:08:57 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 4/15/2010 1:08:57 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006 > Information 4/15/2010 1:08:57 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 4/15/2010 1:08:57 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006 > Error 4/15/2010 1:08:57 PM Service Control Manager None 7001 N/A COMPAQ-2006 > Error 4/15/2010 1:08:57 PM Service Control Manager None 7001 N/A COMPAQ-2006 > Error 4/15/2010 1:07:39 PM DCOM None 10005 Compaq_Owner COMPAQ-2006 > Error 4/15/2010 1:07:39 PM DCOM None 10005 Compaq_Owner COMPAQ-2006 > Error 4/15/2010 1:07:37 PM DCOM None 10005 Compaq_Owner COMPAQ-2006 > Information 4/15/2010 1:07:19 PM eventlog None 6005 N/A COMPAQ-2006 > Information 4/15/2010 1:07:19 PM eventlog None 6009 N/A COMPAQ-2006 > Information 4/15/2010 12:44:58 PM eventlog None 6006 N/A COMPAQ-2006 > Event Type: Error > Event Source: DCOM > Event Category: None > Event ID: 10005 > Date: 4/15/2010 > Time: 3:10:47 PM > User: COMPAQ-2006\Compaq_Owner > Computer: COMPAQ-2006 > Description: > DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service netman with arguments "" in order to run the server: > {BA126AE5-2166-11D1-B1D0-00805FC1270E} > > For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. The noteworthy events are the *two* identical 10005s after the system came out of hibernation, and the fact that nothing happened during the 2 hour hibernation to inhibit it. I think the DCOMs are just part of coming alive. The significant thing is that I can't put my finger on anything defective in my system. Network Connections is what made it work. It certainly isn't any kind of an intermittent, because it happens the same every time. And I haven't changed anything, ever, since the modem and cabling were installed 3+ years ago. It isn't a portable of any kind, it's a big, klutzy, solid desktop lying peacefully on its side in its own drawer, with all cabling tucked away behind. And I think you asked if it ever did hibernate at 2 hours, and I can't honestly answer. What to do next? Start putting back into the clone what it needs to operate? No, I really can't do that, because I don't think there's any way to put the Norton AV back. Start with a new clone, and disable just Network Connections, as a test? Simple to do....... Now I'm ready to listen, John. |