Event Id 6008 Windows Server 2003 Server Reboot
-
Friday, November 30, 2012 12:40 AM
Windows 2003 x86 SP2 installed on Dell Poweredge 6850. Server rebooted the other day with event id 6008;
Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date: 29/11/2012
Time: 12:15:48 PM
User: N/A
Computer: Server1
Description:
The previous system shutdown at 12:11:59 PM on 29/11/2012 was unexpected.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: dc 07 0b 00 04 00 1d 00 Ü.......
0008: 0c 00 0b 00 3b 00 2e 00 ....;...
0010: dc 07 0b 00 04 00 1d 00 Ü.......
0018: 01 00 0b 00 3b 00 2e 00 ....;...Why did the server reboot? What can I make out of this event log?
- Edited by strike3test Friday, November 30, 2012 12:40 AM
All Replies
-
Friday, November 30, 2012 2:04 AM
Hi,
Generally event ID 6008 generating in server for unexpected shutdown.The below steps we have to follow to know the root cause of server shutdown.
- First check the server whether it is configured for dump file or not. If configured check the path %systemroot%\mindump\ folder and find is there any *.dmp file located in there.
- If you find dump file analyze it with the help of win bebugtool to know root cause of server shutdown. steps to analyse a dmp file: http://blogs.technet.com/b/askcore/archive/2008/11/01/how-to-debug-kernel-mode-blue-screen-crashes-for-beginners.aspx#3476888 Win Debugging tools: for dump file analysis download windebuger SW and analyze the *.dmp file to know the cause of server shutdown.Links for the software: https://skydrive.live.com/#cid=63D5AB5243DB43E7&id=63D5AB5243DB43E7%21120 or http://www.windbg.org/
- Also to set minidump file path & disable automatically restart option as shown in screen shot.
Thank you and please let us know if you need any other help.
Regards, Ravikumar P
- Marked As Answer by strike3test Wednesday, December 05, 2012 12:17 AM
-
Friday, November 30, 2012 3:08 AMModerator
Hi,
Event 6008 may be caused by software or hardware issue. Have you installed latest drivers and firmwares from Dell? Is there any third-party service running or software conflict on this server? You can perform a clean boot on it to narrow down the issue as http://support.microsoft.com/kb/929135.
And read this article which listed possible reasons for event 6008:
http://www.chicagotech.net/troubleshooting/eventid6008.htmBelow are related KBs, also check them:
You may experience an abnormal shutdown on a Windows Server 2003-based computer after the Windows logon screen saver starts
http://support.microsoft.com/kb/916719Event ID 6008 is unexpectedly logged to the System event log after you shut down and restart your computer
http://support.microsoft.com/kb/326564Regards,
Cicely- Marked As Answer by Cicely FengMicrosoft Contingent Staff, Moderator Tuesday, December 04, 2012 8:25 AM
- Unmarked As Answer by strike3test Wednesday, December 05, 2012 12:17 AM
- Marked As Answer by strike3test Wednesday, December 05, 2012 12:18 AM
-
Friday, November 30, 2012 3:44 AM
Hello,
Does the system have this problem in safe mode? If yes, you may be looking at a hardware problem.
If no, try these troubleshooting steps:
Run system in selective startup, start services one by one until you get to the culprit.
Make sure that the server is free of malware and rootkits.
Run SFC /SCANNOW to check Win file integrity
Look at your Windows updates and uninstall any updates that were installed after the problem began if you syspect driver/soft error.
Install Dell Openmanage and run hardware system checks and look at the openmanage log after the unexpected shutdown.
Miguel Fra | Falcon IT Services, Miami, FL
www.falconitservices.com | www.falconits.com | Blog- Marked As Answer by Cicely FengMicrosoft Contingent Staff, Moderator Tuesday, December 04, 2012 8:25 AM
- Unmarked As Answer by strike3test Wednesday, December 05, 2012 12:17 AM
.png)
