⚑ Deus Ex Machina ➽ Eventlog Lookup

Deus Ex Machina » Eventlog » Event 6008 - EventLog

EventLog - 6008


Description »
The previous system shutdown at 01:33:47 on 03/06/2011 was unexpected.
Data formatted as » WORDS
0000: 000607db 00030005 00210001 032e002f
0010: 000607db 00030005 00210000 032e002f

This event tells you that the EventLog service detected that the computer was shutdown unexpectedly (ie, before it logged its event with ID 6006 when shutting down).

If you are seeing this appear erroneously on Windows 2003, you may need to apply the hotfix from MS KB950323. For Windows 2000, there is a similar issue which is fixed in hotfix MS KB326564.

If you see a very short gap between the time that the Eventlog reports the unexpected shutdown, and the timestamp fof the acual log entry, the odds are that you've experienced a power or hardware failure. For Virtual machines, check the vmware.log and VSphere activity (eg was the server moved between hosts at the time of the shutdown?). For physical servers, check the hardware and power suppy. Test redundant power supplies are working. Also, check OOB management interfaces (eg iLO) to see if anyone power-cycled the server in this way. If you're using HP hardware, check the Integrated Management Log (IML) to see if the Automatic Server Recovery (ASR) feature is what reset the server. If that is what happened, you should enable NMICrashDump and disable ASR - so that next time the server hangs, you can get a memory dump to analyse.

If there is a very long gap between the time that the Eventlog reports the unexpected shutdown happened, and the time of the eventlog entry being written, you're probably dealing with a server hang. Configure performance counter logging for this server, and enable NMI Crash Dumps.