4

A Win2k3 box crashed earlier and now it is back up. You want to know the exact minute it went down. Where do you look? Event viewer? What are you looking for exactly?

Improve this question

4 Answers 4

Reset to default
3

System Event Log, event ID 6008.

Sample event looks like:

Source: EventLog Event ID: 6008 Description: The previous system shutdown at H:MM:SS PM on DD/MM/YYYY was unexpected.

Improve this answer
2
  • 1
    6008 isn't always logged
    – Izzy
    Aug 20, 2009 at 18:27
  • 1
    That event depends on a heartbeat setting that is on by default in server machines from 2000 onward. Newer clients (Vista and 7) also have this setting.
    – dmoisan
    Aug 20, 2009 at 19:59
2

I usually look for the messages that show up when the system starts. Then simply backtrack a bit. Depending on how the system crashed

For example a good one to look for is from the source eventlog with an id of 6005 (The event log service was started). The eventlog service usually only starts/stops when the system starts.

Improve this answer
1

Have a look in the System log for event ID 1000 with source "Save Dump".

Improve this answer
1

The most reliable Event ID to look for is a 6005, which notifies when the Event Log started (after the restart). Then look back to the previous handful of events to determine the time the server stopped, and started. There will usually (in the case of physical boxes) be a gap in the time of events logged.

Although technically the 6008 event is a more accurate event for a genuine hard-reboot/crash, it isn't logged in the case that some software restarted the server (an admin logged in and clicked Yes when the software requested a reboot) or when an admin accidentally rebooted the machine. The latter happens here occasionally, and the rest of us are left thinking "oh, the server crashed..."

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .