Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My server rebooted and I am not sure why. Is there a way to find out, e.g. perhaps someone did it manually, or as a result of a windows update or a blue screen?

I've looked in the Event Viewer, but I am not sure what to look for - there are million items there.

share|improve this question
    
Every event has a related Event ID. In the future, all you need to do is search the web for the ID of the event in question (in this case, a shutdown), and filter the log for that ID. –  MDMarra Dec 16 '11 at 20:11

1 Answer 1

You want to filter for Event ID 1074 in the System logs. That's the ID for shutdown.

If it wasn't a clean shutdown, you're going to have to sort through the memory dumps.

share|improve this answer
    
A nice tool to view the dump files: nirsoft.net/utils/blue_screen_view.html –  James Jun 17 at 15:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.