A Win2k3 box crashed earlier and now it is back up. You want to know the exact minute it went down. Where do you look? Event viewer? What are you looking for exactly?
4 Answers
System Event Log, event ID 6008.
Sample event looks like:
Source: EventLog Event ID: 6008 Description: The previous system shutdown at H:MM:SS PM on DD/MM/YYYY was unexpected.
-
1
-
1That event depends on a heartbeat setting that is on by default in server machines from 2000 onward. Newer clients (Vista and 7) also have this setting.– dmoisanAug 20, 2009 at 19:59
I usually look for the messages that show up when the system starts. Then simply backtrack a bit. Depending on how the system crashed
For example a good one to look for is from the source eventlog with an id of 6005 (The event log service was started). The eventlog service usually only starts/stops when the system starts.
The most reliable Event ID to look for is a 6005, which notifies when the Event Log started (after the restart). Then look back to the previous handful of events to determine the time the server stopped, and started. There will usually (in the case of physical boxes) be a gap in the time of events logged.
Although technically the 6008 event is a more accurate event for a genuine hard-reboot/crash, it isn't logged in the case that some software restarted the server (an admin logged in and clicked Yes when the software requested a reboot) or when an admin accidentally rebooted the machine. The latter happens here occasionally, and the rest of us are left thinking "oh, the server crashed..."