Unexpected Reboot Server 2003 SP2. Event ID 6008

Posted on 2010-04-06
Medium Priority
Last Modified: 2013-11-10
Hi there,

We have windows server 2003 SP2 which has restarted Twice in last two days.
Under system log it says :
Date: 7/04/2010 Source: EventLog Time  8:49:25 AM  Category: None
Type: Error   Event ID: 6008
Description : The previous system shutdown at 6:51:43 on 7/04/2010 was unexpected.

Last change i made to this server was about 3 weeks back(related to memory allocation in registry).
As we were having freezing issue with this server. I made changes mentioned in documents below:

We have not had any issues after this registry change. (Not sure if it is related to current issue)

Not sure what to do at this point.
Please help


Question by:propertyozadmin
  • 3
  • 3
  • 2
  • +1
LVL 10

Expert Comment

ID: 29966726
"Freezing" and rebooting are often related. Likely a hardware related issue. What exactly do you mean by "Freezing". Can you still Ctrl+alt+del? Or is it completely unresposive requiring a hard power off? What server hardware are you running?

Accepted Solution

tjguy earned 1000 total points
ID: 29966938
it could be the power supply. have you had it tested or swap it out.
LVL 24

Expert Comment

by:B H
ID: 29969053
check your task scheduler and see if there's not some shutdown command scheduled there, i've seen it before.

are the reboots at the same time each day?

if a program or script calls for the server to forcibly reboot, the information isn't properly logged and you get what you pasted above.  there's a hotfix available that allows it to be logged with more detail, info here:
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.


Author Comment

ID: 29970643
Thank you for reply
- - - - ------- - - - - - - - - --  - - - - - - - - - - -  -
Explanation of freezing issue i had:
“Ping” request was always successful 100%
The way i knew something was wrong when users couldn't access folders on this server or when users got error with relation to this server
I could never get in through Network Neighbourhood. (When this issue occured)
Couldn't remote in or login directly to server.
The only one way to get sever back was physically restart.
After following steps on... http://support.microsoft.com/kb/312362 (which is related to memory management)..i didn't have any problem. (Till now)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - -
I have not had it tested yet... how i can get it tested?
This happened twice so for every morning:
6:34.45 am
6:51.43 am

I really don't think there is shutdown command scheduled. (as i have not made any changes and it just happened in last 2 days)
And the artical  http://support.microsoft.com/kb/326564  doesn't applies to 2003 Sever sp2

Help please
LVL 24

Expert Comment

by:B H
ID: 29971609
being that close together, leads me to believe that something was told to do it... maybe a backup job that is set for 'shut down the system when done' or something?

is there an SBS server on the network somewhere, i've seen sbs freak out when it sees other servers, causing things to reboot

are there any success entries just before the reboot, which might indicate what is actively doing something at that time?

are the unexpected reboot entries logged because you forced the server off, or is it logged before you cycle it?
LVL 10

Expert Comment

ID: 30023198
Typically I would think most scripts or scheduled tasks or RPC commands from other systems would perform a gracefull shutdown and would cause an "unexpected shutdown". However, I have seen many times servers get stuck in a half reboot stage and be pingable but almost nothing else. If you hard power off at that point it would cause a "unexpected shutdown". This doesn't seem to be the case here now. I am still leaning toward hardware and the power supply is a likely piece of hardware to fail and cause reboots. What server hardware are you running? Dell, HP and IMB have diagnostic utilities that may help you trobleshoot. Like Byron said, checjh the event log to see if you can see anything prior to the reboot. If it is a software error, there will typically be some clue there.
LVL 10

Expert Comment

ID: 30023411
I meant, would not cause an "unexpected Shutdown" in the first sentence.

Author Comment

ID: 30067316

Thanks Guys,

It was power supply/UPS issue. This server was connected to UPS. I got alert from UPS to change battery . Last night i plugged in server directly to power outlet(to test it out). Server didn't restart this morning. I think changing UPS battery/or UPS would be permanect fix.

Thank you again.

Author Closing Comment

ID: 31711619
No Additional Comments

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
Take advantage of one of the most useful technologies available - virtualization!
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

600 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question