Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A Win2k3 box crashed earlier and now it is back up. You want to know the exact minute it went down. Where do you look? Event viewer? What are you looking for exactly?

share|improve this question
add comment

4 Answers 4

System Event Log, event ID 6008.

Sample event looks like:

Source: EventLog Event ID: 6008 Description: The previous system shutdown at H:MM:SS PM on DD/MM/YYYY was unexpected.

share|improve this answer
1  
6008 isn't always logged –  Izzy Aug 20 '09 at 18:27
1  
That event depends on a heartbeat setting that is on by default in server machines from 2000 onward. Newer clients (Vista and 7) also have this setting. –  dmoisan Aug 20 '09 at 19:59
add comment

I usually look for the messages that show up when the system starts. Then simply backtrack a bit. Depending on how the system crashed

For example a good one to look for is from the source eventlog with an id of 6005 (The event log service was started). The eventlog service usually only starts/stops when the system starts.

share|improve this answer
add comment

Have a look in the System log for event ID 1000 with source "Save Dump".

share|improve this answer
add comment

The most reliable Event ID to look for is a 6005, which notifies when the Event Log started (after the restart). Then look back to the previous handful of events to determine the time the server stopped, and started. There will usually (in the case of physical boxes) be a gap in the time of events logged.

Although technically the 6008 event is a more accurate event for a genuine hard-reboot/crash, it isn't logged in the case that some software restarted the server (an admin logged in and clicked Yes when the software requested a reboot) or when an admin accidentally rebooted the machine. The latter happens here occasionally, and the rest of us are left thinking "oh, the server crashed..."

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.