Unexpected Reboot Server 2003 SP2. Event ID 6008

Hi there,

We have windows server 2003 SP2 which has restarted Twice in last two days.
Under system log it says :
Date: 7/04/2010 Source: EventLog Time  8:49:25 AM  Category: None
Type: Error   Event ID: 6008
Description : The previous system shutdown at 6:51:43 on 7/04/2010 was unexpected.

Last change i made to this server was about 3 weeks back(related to memory allocation in registry).
As we were having freezing issue with this server. I made changes mentioned in documents below:

We have not had any issues after this registry change. (Not sure if it is related to current issue)

Not sure what to do at this point.
Please help


Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

"Freezing" and rebooting are often related. Likely a hardware related issue. What exactly do you mean by "Freezing". Can you still Ctrl+alt+del? Or is it completely unresposive requiring a hard power off? What server hardware are you running?
it could be the power supply. have you had it tested or swap it out.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
B HCommented:
check your task scheduler and see if there's not some shutdown command scheduled there, i've seen it before.

are the reboots at the same time each day?

if a program or script calls for the server to forcibly reboot, the information isn't properly logged and you get what you pasted above.  there's a hotfix available that allows it to be logged with more detail, info here:
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

propertyozadminAuthor Commented:
Thank you for reply
- - - - ------- - - - - - - - - --  - - - - - - - - - - -  -
Explanation of freezing issue i had:
“Ping” request was always successful 100%
The way i knew something was wrong when users couldn't access folders on this server or when users got error with relation to this server
I could never get in through Network Neighbourhood. (When this issue occured)
Couldn't remote in or login directly to server.
The only one way to get sever back was physically restart.
After following steps on... http://support.microsoft.com/kb/312362 (which is related to memory management)..i didn't have any problem. (Till now)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - -
I have not had it tested yet... how i can get it tested?
This happened twice so for every morning:
6:34.45 am
6:51.43 am

I really don't think there is shutdown command scheduled. (as i have not made any changes and it just happened in last 2 days)
And the artical  http://support.microsoft.com/kb/326564  doesn't applies to 2003 Sever sp2

Help please
B HCommented:
being that close together, leads me to believe that something was told to do it... maybe a backup job that is set for 'shut down the system when done' or something?

is there an SBS server on the network somewhere, i've seen sbs freak out when it sees other servers, causing things to reboot

are there any success entries just before the reboot, which might indicate what is actively doing something at that time?

are the unexpected reboot entries logged because you forced the server off, or is it logged before you cycle it?
Typically I would think most scripts or scheduled tasks or RPC commands from other systems would perform a gracefull shutdown and would cause an "unexpected shutdown". However, I have seen many times servers get stuck in a half reboot stage and be pingable but almost nothing else. If you hard power off at that point it would cause a "unexpected shutdown". This doesn't seem to be the case here now. I am still leaning toward hardware and the power supply is a likely piece of hardware to fail and cause reboots. What server hardware are you running? Dell, HP and IMB have diagnostic utilities that may help you trobleshoot. Like Byron said, checjh the event log to see if you can see anything prior to the reboot. If it is a software error, there will typically be some clue there.
I meant, would not cause an "unexpected Shutdown" in the first sentence.
propertyozadminAuthor Commented:

Thanks Guys,

It was power supply/UPS issue. This server was connected to UPS. I got alert from UPS to change battery . Last night i plugged in server directly to power outlet(to test it out). Server didn't restart this morning. I think changing UPS battery/or UPS would be permanect fix.

Thank you again.
propertyozadminAuthor Commented:
No Additional Comments
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.