locked
unexpected shutdown RRS feed

  • Question

  • We are running a Lenovo ThinkServer RD240 with Server 2008r2.  We are running HyperV (server 2003 r2) and Active Directory.  Some times, over a weekend, the system will freeze and will need a hard restart come Monday morning.  I get an "unexpected system shutdown ID 6008" error in the system log.  The freeze will happen every other weekend or so.  The only other event in the system log leading up to it is a a KDC certificate warning.  I am assuming there is a hardware error of some sorts?  Here is the event log details.  Any suggestions on how to pinpoint this would be greatly appreciated.  

     

    - System 

     

      - Provider 

     

       [ Name]  EventLog 

     

      - EventID 6008 

     

       [ Qualifiers]  32768 

     

       Level 2 

     

       Task 0 

     

       Keywords 0x80000000000000 

     

      - TimeCreated 

     

       [ SystemTime]  2011-09-26T12:43:06.000000000Z 

     

       EventRecordID 302102 

     

       Channel System 

     

       Computer xxxxxxx

     

       Security 

     

     

    - EventData 

     

       5:56:02 PM 

       ‎9/‎23/‎2011 

     

     

       199867 

     

     

       DB070900050017001100380002000C00DB070900050017001600380002000C003C0000003C000000000000000000000000000000000000000100000000000000 

     

     

    --------------------------------------------------------------------------------

     

    Binary data:

     

     

    In Words

     

    0000: 000907DB 00170005 00380011 000C0002 

    0008: 000907DB 00170005 00380016 000C0002 

    0010: 0000003C 0000003C 00000000 00000000 

    0018: 00000000 00000000 00000001 00000000 

     

     

    In Bytes

     

    0000: DB 07 09 00 05 00 17 00   Û.......

    0008: 11 00 38 00 02 00 0C 00   ..8.....

    0010: DB 07 09 00 05 00 17 00   Û.......

    0018: 16 00 38 00 02 00 0C 00   ..8.....

    0020: 3C 00 00 00 3C 00 00 00   <...<...

    0028: 00 00 00 00 00 00 00 00   ........

    0030: 00 00 00 00 00 00 00 00   ........

    0038: 01 00 00 00 00 00 00 00   ........

     

     


    • Edited by sublime8mm Monday, September 26, 2011 1:50 PM
    Monday, September 26, 2011 1:49 PM

Answers

  • Hi,

     

    According to my search, this issue mostly can be caused by the third party software.

     

    I would like to confirm what antivirus program is installed? Please temporary uninstall it to test the issue. If you have any third party is not necessary for the business, please also disable them from startup to check the result.

     

    In addition, please launch System Information by running Msinfo32 and navigate to System Summary\Software Environment\Windows Error Reporting. Do you see any clue?

     

    Regards,


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, October 3, 2011 2:11 AM

All replies

  • Hello,

    is there dump files that are created under c:\windows\minidumps?

    If yes then you had BSODs.

    In this case, please use Microsoft Skydrive to upload them and then post a link here.

    You can also contact Microsoft CSS.


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator

    Monday, September 26, 2011 2:05 PM
  • I did a search and could not find any DMP files on the system.  under the startup and recovery system settings the debug info is set to write the "kernel memory dump" info to %systemRoot%\MEMORY.DMP.  There is no file on my system called MEMORY.DMP.  
    Monday, September 26, 2011 2:59 PM
  • You can try disabling automatic restart on system failure under startup and recovery.  The memory dump is initially written to the page file and if that file cannot be accessed for some reason, no memory dump will be created.   At least you could then see the bsod to see what happened. 
    Monday, September 26, 2011 4:06 PM
  • Thanks Chris, I will give that a try.  

    The system doesn't auto restart when this happens.  It just sites there frozen.  The mouse and keyboard are completely unresponsive.  No blue screen or error message or anything.  Maybe disabling the auto restart will output the blue screen error message to the screen but its almost like somebody just pulled all the RAM out of it or disconnected the raid controller in the middle of it running.  I would normally think it was a hardware issue but it consistently only happens over the weekend.    

    Monday, September 26, 2011 4:21 PM
  • Hi,

     

    I would like to confirm that which system encountered the unexpected shutdown, Windows Server 2003 R2 or Windows Server 2008 R2?

     

    If the operation system is Windows Server 2003 R2, you may refer to the following Microsoft KB article to check if the hotfix can be helpful.

     

    Event ID 6008 is logged in the System log even though the Windows Server 2003-based computer shuts down successfully

    http://support.microsoft.com/kb/950323

     

    In addition, you may also consider to test the issue in Clean Boot in weekends to narrow down the possible third party software conflict. For the detailed steps, please refer to the following Microsoft KB article:

     

    How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

    http://support.microsoft.com/kb/929135

     

    Regards,


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Thursday, September 29, 2011 6:14 AM
  • It was the 2008 R2 system that had the unexpected shutdown.  The clean boot test won't really work for us because the freeze only happens randomly after the server has been running for several days.  I can't limit the features for that long to determine the cause of the problem.  
    Thursday, September 29, 2011 2:54 PM
  • Hi,

     

    According to my search, this issue mostly can be caused by the third party software.

     

    I would like to confirm what antivirus program is installed? Please temporary uninstall it to test the issue. If you have any third party is not necessary for the business, please also disable them from startup to check the result.

     

    In addition, please launch System Information by running Msinfo32 and navigate to System Summary\Software Environment\Windows Error Reporting. Do you see any clue?

     

    Regards,


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, October 3, 2011 2:11 AM
  • Is this still happening?  That is strange behavior.  Is there a schedule task or backup that runs only on the weekend.  How many weekends has this happened and has it ever happened during the week?  Have you tried configuring crash on control scroll?  Is it possible that someone is turning the A/C off on the weekend and it is getting very hot?
    Friday, October 14, 2011 1:48 AM