SYSTEM registry keeps corrupting on server - help!

  • Thread starter Thread starter Kremlar
  • Start date Start date
K

Kremlar

A few months back, our server booted up and gave the 'Windows could not
start because the following file is missing or corrupted,
c:\winnt\system32\config\system'.

Tried a bunch of things, but ended up having to go back to an older copy of
my SYSTEM registry. The file that went bad was 6,025,216 bytes, the one I
restored was more like 5,900,000. I had to reinstall/reconfigure some
applications, but the server came up OK.

Everything was fine for almost a month, and the server went down again and
came up with that error. I logged in and restored a copy of the SYSTEM
registry from a couple days before and everything seemed good. The 2nd bad
file was almost the exact same same size as the original bad file, but
slightly larger, maybe 20,000 bytles larger.

Yesterday, a week after the 2nd restore, we lost power and I did a graceful
shutdown of the server. When it came back up, surprise surprise, I had the
SAME error. I restored a copy of the SYSTEM registry file that I used a
week before, and everything seemed good again. The 3rd bad file was the
exact same size as the first, 6,025,216.

After this crash, I went through and updated all the drivers I could think
of. I specifically updated the driver for our RAID controller, I also
checked the configuration of our RAID controller to be sure WRITE CACHE was
disabled, and I also checked the device manager properties of the array in
Windows to be sure WRITE CACHE was disabled - it was in both places. I also
ran Microsoft's RegClean utility for the heck of it. I also verified that
the Maximum Registry Size in the SYSTEM control panel was set high - I moved
it from a 91MB limit to a 120MB limit. The current size is about 30MB. I
moved our swap file to D: to be sure we have plenty of space on the C:
drive.

This morning we came in and that same error is on the screen again. I'm in
the process of copying over a good version of that file again, but obviously
something is mucked up. The 4th bad file was again the exact same size as
the first, 6,025,216.

The system is a Compaq ProLiant dual processer P3 server, 1GB RAM, Exchange
2000, Symantec Anti-Virus 10.0, running all the latest patches.

At this point, I'm at a loss. I would normally suspect bad RAM, but I would
think the crashes would be more random and not always related to the SYSTEM
registry. I also find it extremely suspicious that the file size was
exactly the same 3 out of 4 times it crashed, but I can't think of any
reason it would be maxing out at that size.

Does anyone have any suggestions on this? I'm at a loss.
 
it from a 91MB limit to a 120MB limit. The current size is about 30MB. I
Click to expand...

YeeeGaaaaddsss. Set it to just over the registry size after you replace the
file. If the Reg size is 30, then set the limit to 31. I personally don't
think I have even seen one over 25.

Try Johns suggestion for compacting it,...check the size ater and set the
limit to just slightly over the new size.


Phil
 
A few months back, our server booted up and gave the 'Windows
could not start because the following file is missing or
corrupted, c:\winnt\system32\config\system'. [...]Everything was
fine for almost a month, and the server went down again and came
up with that error. I logged in and restored a copy of the SYSTEM
registry from a couple days before and everything seemed good.
[...] Yesterday, a week after the 2nd restore, we lost power and I
did a graceful shutdown of the server. When it came back up,
surprise surprise, I had the SAME error. I restored [...] This
morning we came in and that same error is on the screen again.
I'm in the process of copying over a good version of that file
again, but obviously something is mucked up. [...] At this point,
I'm at a loss. I would normally suspect bad RAM, but I would
think the crashes would be more random and not always related to
the SYSTEM registry. I also find it extremely suspicious that the
file size was exactly the same 3 out of 4 times it crashed, but I
can't think of any reason it would be maxing out at that size. >
Does anyone have any suggestions on this? I'm at a loss.
Click to expand...

I once had a problem quite similar to yours. In the end it turned
out to be a disk drive going bad. The disk would "remember" the file
for short periods of time but would "forget" overnight. The registry
is probably the most written area of the disk and the first area to
be noticed when your drive goes bad.

One test you could make for this condition would be to restore your
registry from a good backup. At this time the entire registry is
freshly re-written. Then shutdown and, after a minute or two,
restart your machine. It will probably boot up OK. Now shut it down
and let it sit overnight and reboot -- if it exhibits this problem
again, I would strongly suspect a worn hard drive. Get a good backup
program and start looking for good prices on replacement drives.

HTH,
John
 
Thanks for the help, that seems to have been the problem. I've never run
across this before!

Past people had setup incredibly huge printer names, port names, and share
names for the printers. I dumped the ones I didn't need, cleaned up a bunch
of other things, and ran a utility I found called NTREGOPT and got the
SYSTEM file down to 4MB. Hopefully I'm good now!
 
You're welcome, thanks for the follow up. The system hive size deal has
been around since the early NT days and all the the little NT kids
inherited it from the grand daddy. But apparently with a bit of gene
therapy it has been fixed with Server 2003.

If you find that the problem keeps reappearing keep in mind what John
Wunderlich said about the possibility of the hard drive going bad.

John
 
Back
Top