Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am pretty new to Windows Server 2008. On two separate events it shut itself down without any good reason. I would like to diagnose this, but don't know where to start. Where and what should I look for in the Event Viewer, and what else can I do to fix this problem? Also, is there an auto shutdown and startup scheduler in Server 2008? I Googled this, but found answers involving batch files which I don't have any experience with...

Thanks!

Edit:

Found this in the Log:

Log Name:      System
Source:        EventLog
Date:          29/09/2012 08:25:56
Event ID:      6008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      ericom
Description:
The previous system shutdown at 8:16:06 on ‎29/‎09/‎2012 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6008</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-09-29T01:25:56.000000000Z" />
    <EventRecordID>5675</EventRecordID>
    <Channel>System</Channel>
    <Computer>ericom</Computer>
    <Security />
  </System>
  <EventData>
    <Data>8:16:06</Data>
    <Data>‎29/‎09/‎2012</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>91172</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Binary>DC07090006001D000800100006006C00DC07090006001D000100100006006C003C0000003C000000000000000000000000000000000000000100000000000000</Binary>
  </EventData>
</Event>

I tried to find what happend at 8:16:06 but none of the log files shows anything. The logs skips from about 8:07 until I turned the server back on at 8:25. The last thing that is logged at 8:07 is

Name resolution for the name www.public-trust.com timed out after none of the configured DNS servers responded. 

I tried Googling that message, doesn't seem like it would cause a crash or shutdown, but I'm not sure. Which log file would log application crashes? My Applications and Services Logs is empty except for 7 Microsoft Office events.

Thank you

share|improve this question
    
Did the server restart on it's own? If so, you may want to disable the automatic restart option so that you can see what's happening when the server shuts down. If it's a BSOD then you'll see that on the console and can then use that information to diagnose the problem. –  joeqwerty Sep 29 '12 at 15:02
    
It did not restart on its own. I have to physically press the power button. But now that you mention it, where is the automatic restart option? I am actually looking for a scheduled shutdown and startup option. Is there such a thing? –  rabbid Sep 30 '12 at 3:03
add comment

3 Answers 3

First, are you SURE the system is shutting down and not crashing? Are you sure it's not a hardware issue or a power issue? Generally, easiest way to tell is that when Windows boots back up, it will tell you the previous shutdown was unexpected and give you a menu of boot options assuming that something went wrong and you want to troubleshoot it.

Make sure it's not a power issue - I've seen issues with UPS systems. Issues with cleaning people doing really silly things like unplugging the server to plug in a vacuum.

Make sure it's not a hardware issue. Make sure the UPS the system is on (it IS on a UPS, right?) is new(ish) and has a good battery. Make sure your settings on the UPS don't shut down the server on the first sign of a problem (if the UPS senses power is out for a second and you have it configured to immediately shutdown the server upon a power failure, even when the power comes back on, the server won't come up but will report a normal shutdown. Further, make sure all the fans in the system are working and it's not a heating issue. I had one workstation once that ran fine... until you did a little too much with it and the power supply shut off (because it was overheating under load). And the power supply may not report any kind of health information to the system (depending on the make/model of the server).

Finally, assuming you can eliminate external causes, check the event log tracker - see http://www.winvistatips.com/shutdown-event-tracker-logs-t552445.html (and this might be the first place to look UNLESS you're getting messages that the previous shutdown was unexpected - then this should likely be your last step).

share|improve this answer
    
Thanks for the reply. Actually it could be a crash, and actually when it booted back up it did say it was an unexpected shut down now that you mention it. So I should look for warnings and errors in the event viewer? Yes it is on a UPS and yes the UPS is new. However I should check the settings on the UPS. –  rabbid Sep 29 '12 at 5:30
    
More information in the original post –  rabbid Sep 29 '12 at 5:51
    
Look in the System log for an information type event, Event ID 1001 SourceName "SaveDump" - if you find one, then Windows is crashing and it MAY be because of hardware or may be because of software - at that point, you need to google the bugcheck (noted in the event entry) and find out probable causes. A dump file may also have been created that you might be able to analyze for even more detailed possibilities (should be noted in the event entry as well). If no such entries are found, then I'd say it's likely power related and you need to try different power supplies, outlets, etc. –  Multiverse IT Sep 29 '12 at 22:41
add comment

Check event viewer in genereal for a warning, but it is more likels this is hardware related. Check the hardware - can itbe an emergency shutdown due to heat?

share|improve this answer
    
Thanks for your reply. Where in the log file would that be indicated? I posted more information in the original post. Thanks –  rabbid Sep 29 '12 at 5:52
    
In your hardware meanagement subsystem possibly. if the CPU decides to shut down in emergency mode, NOTHING happens on the computer anymore. Just stop. –  TomTom Sep 29 '12 at 6:39
add comment

Check for memory dumps if you have those enabled. Usually in C:\Windows\Minidump. If you dont have a debugger installed to analyze. You can upload them to an online service such as http://www.osronline.com/page.cfm?name=analyze . These will help you pinpoint drivers or applications which caused a system to crash or throw a bluescreen etc.

http://support.microsoft.com/kb/315263

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.