Friday, November 30, 2012 12:40 AM
Windows 2003 x86 SP2 installed on Dell Poweredge 6850. Server rebooted the other day with event id 6008;
Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Time: 12:15:48 PM
The previous system shutdown at 12:11:59 PM on 29/11/2012 was unexpected.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0000: dc 07 0b 00 04 00 1d 00 Ü.......
0008: 0c 00 0b 00 3b 00 2e 00 ....;...
0010: dc 07 0b 00 04 00 1d 00 Ü.......
0018: 01 00 0b 00 3b 00 2e 00 ....;...
Why did the server reboot? What can I make out of this event log?
- Edited by strike3test Friday, November 30, 2012 12:40 AM
Friday, November 30, 2012 2:04 AM
Generally event ID 6008 generating in server for unexpected shutdown.The below steps we have to follow to know the root cause of server shutdown.
- First check the server whether it is configured for dump file or not. If configured check the path %systemroot%\mindump\ folder and find is there any *.dmp file located in there.
- If you find dump file analyze it with the help of win bebugtool to know root cause of server shutdown. steps to analyse a dmp file: http://blogs.technet.com/b/askcore/archive/2008/11/01/how-to-debug-kernel-mode-blue-screen-crashes-for-beginners.aspx#3476888 Win Debugging tools: for dump file analysis download windebuger SW and analyze the *.dmp file to know the cause of server shutdown.Links for the software: https://skydrive.live.com/#cid=63D5AB5243DB43E7&id=63D5AB5243DB43E7%21120 or http://www.windbg.org/
- Also to set minidump file path & disable automatically restart option as shown in screen shot.
Thank you and please let us know if you need any other help.
Regards, Ravikumar P
- Marked As Answer by strike3test Wednesday, December 05, 2012 12:17 AM
Friday, November 30, 2012 3:08 AMModerator
Event 6008 may be caused by software or hardware issue. Have you installed latest drivers and firmwares from Dell? Is there any third-party service running or software conflict on this server? You can perform a clean boot on it to narrow down the issue as http://support.microsoft.com/kb/929135.
And read this article which listed possible reasons for event 6008:
Below are related KBs, also check them:
You may experience an abnormal shutdown on a Windows Server 2003-based computer after the Windows logon screen saver starts
Event ID 6008 is unexpectedly logged to the System event log after you shut down and restart your computer
Friday, November 30, 2012 3:44 AM
Does the system have this problem in safe mode? If yes, you may be looking at a hardware problem.
If no, try these troubleshooting steps:
Run system in selective startup, start services one by one until you get to the culprit.
Make sure that the server is free of malware and rootkits.
Run SFC /SCANNOW to check Win file integrity
Look at your Windows updates and uninstall any updates that were installed after the problem began if you syspect driver/soft error.
Install Dell Openmanage and run hardware system checks and look at the openmanage log after the unexpected shutdown.