Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the past two nights we had a remote server shutdown unexpectedly. When rebooted we get the following message:

Event Type: Error Event
Source: EventLog Event
Category: None Event ID: 6008
Date: 16/02/2011 Time: 09:10:43
User: N/A Computer: WELPLAN-1
Description: The previous system
shutdown at 07:27:32 on 16/02/2011 was unexpected.

For more information, see Help and Support Center at
0000: db 07 02 00 03 00 10 00 Û.......
0008: 07 00 1b 00 20 00 42 02 .... .B.
0010: db 07 02 00 03 00 10 00 Û.......
0018: 07 00 1b 00 20 00 42 02 .... .B.

Obviously this message doesn't help much, but what does all the hexadecimal mean? Will it help me track down the problem? Any pointers as to where to look?

share|improve this question
what kind of hardware is this server on? – pablo Feb 16 '11 at 11:12
Intel(R) Core 2 CPU 6700@2.66GHz with 4GB of RAM – m.edmondson Feb 16 '11 at 11:16
sorry i should have clarified, is it dell/hp/white box? – pablo Feb 16 '11 at 11:38
I haven't the slightest - its hosted remotely but its our own dedicated server – m.edmondson Feb 16 '11 at 11:53

I'm assuming you've already checked for stop error (i.e. a bugcheck).

If event 6006 appears prior to the shutdown the machine stopped gracefully and Windows is misreporting it as a dirty shutdown.

If event 6006 is not present, it's likely the result of a hardware failure. Because you dont have direct access to manage the hardware, you'll need to open a ticket with your provider to investigate the hardware.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.