How to find why a service has stopped
Hi all,
This is a general question. I would like to know how do you guys handle services error. Lets say the windows print spooler error has stopped unexpectatly.
I know the event ID does not return more information that this. Is there any way to search and digg a bit more and find what caused this service to stop?
I always rely on other events. But sometimes this is just not possible, as nothing seems to be related.
How do you deal with such situations?
Thanks
May 31st, 2012 7:53am
Hello,
There could be many reasons:
Conflict with other applicationsBug....
So, there is no specific troubleshooting steps. Generally, you have to investigate more on logged events to have more details. Also, your system should up-to-date since many services may fail if your system is not up-to-date. Example here: http://technet.microsoft.com/en-us/security/bulletin/ms08-067
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer
Free Windows Admin Tool Kit Click here and download it now
May 31st, 2012 8:13am
Hi there,
There are couple of ways for checking service's status.
In the event viewer, check the system logs and check for events by name Service Control manager (event ID 7035,7036 mostly). That will give you the ID what happened to which service. This event will only be generating if any service's status is changing,
like from start to stop or vice versa.
Start->run->services.msc. From there you can check the service current status.
"windows print spooler error has stopped unexpectatly". This means spooler service has crashed. Specific to this error, there could be many reasons. Any 3rd part printer driver,Print provider or print monitor can cause this issue. To find that
out we need to take the ADPlus dump during the time service is crashing. Here are the links to configure ADPlus Dump on a machine.
http://support.microsoft.com/kb/286350
http://blogs.msdn.com/b/cobold/archive/2010/03/01/collection-crash-dumps.aspx
By analysing the ADPlus, we would get the tag name which is causing service to crash. Based on that we can serch for the update of that .dll or .sys file.
This tool can be used for any application/service hang or crash problems.
Let me know if you need more information on Spooler crash.
Regards
Hetal
May 31st, 2012 9:38am
Thanks alot for all input. This replies to what I was looking for.
I am not familiar with it but I will get. This is now my homework. I think I was expecting a super tool to do this :P
Thanks.
Free Windows Admin Tool Kit Click here and download it now
May 31st, 2012 9:54am