The previous system shutdown at xxxx was unexpected

Question

For the past two nights we had a remote server shutdown unexpectedly. When rebooted we get the following message:

Event Type: Error Event
Source: EventLog Event
Category: None Event ID: 6008
Date: 16/02/2011 Time: 09:10:43
User: N/A Computer: WELPLAN-1
Description: The previous system
shutdown at 07:27:32 on 16/02/2011 was unexpected.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: db 07 02 00 03 00 10 00 Û.......
0008: 07 00 1b 00 20 00 42 02 .... .B.
0010: db 07 02 00 03 00 10 00 Û.......
0018: 07 00 1b 00 20 00 42 02 .... .B.

Obviously this message doesn't help much, but what does all the hexadecimal mean? Will it help me track down the problem? Any pointers as to where to look?

Answer 1

I'm assuming you've already checked for stop error (i.e. a bugcheck).

If event 6006 appears prior to the shutdown the machine stopped gracefully and Windows is misreporting it as a dirty shutdown.

If event 6006 is not present, it's likely the result of a hardware failure. Because you dont have direct access to manage the hardware, you'll need to open a ticket with your provider to investigate the hardware.