Unexpected system shutdown

Windows 2003 WSUS, which is hosted on Windows 2012 H-V server, reboots every day at the same time.

Event Type:      Error
Event Source:      EventLog
Event Category:      None
Event ID:      6008
Date:            4/4/2014
Time:            5:17:42 AM
User:            N/A
Computer:      WSUS
Description:
The previous system shutdown at 5:14:21 AM on 4/4/2014 was unexpected.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: de 07 04 00 05 00 04 00   Þ.......
0008: 05 00 0e 00 15 00 56 01   ......V.
0010: de 07 04 00 05 00 04 00   Þ.......
0018: 0c 00 0e 00 15 00 56 01   ......V.

Any clue, suggestion, ideas..?
Thank you.
cohhelpAsked:
Who is Participating?
 
MaheshConnect With a Mentor ArchitectCommented:
You can stop AV scan at morning on affected server and check if it works

If it works then you can check AV logs what could be the wrong
0
 
pablito70Commented:
Have you some processes or scheduled taksk that run around time server reboots ?

Did you check on Event Viewer if there are warnings or errors related to hardware failure ?

At first looks seems RAM or Mainboard not function properly but if the server reboots daily at same time may be other issues.

HTH
0
 
Michael KnightCommented:
I'd like to see more than one example from event viewer just to verify the timestamp each day.
0
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
MaheshArchitectCommented:
How many VMs do you have on Hyper-V physical host ?

Any other VM also getting same issue ?
0
 
cohhelpAuthor Commented:
1. The H-V hosts 10 VMs, no one is getting same issue.

2. At 5:15:00 AM everyday on all servers runs scheduled Sophos AV am scan, a pm scan - runs at 5:15:00 PM
0
 
cohhelpAuthor Commented:
Event Type:      Error
Event Source:      EventLog
Event Category:      None
Event ID:      6008
Date:            4/3/2014
Time:            5:17:24 AM
User:            N/A
Computer:      WSUS
Description:
The previous system shutdown at 5:14:26 AM on 4/3/2014 was unexpected.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: de 07 04 00 05 00 04 00   Þ.......
0008: 05 00 0e 00 15 00 56 01   ......V.
0010: de 07 04 00 05 00 04 00   Þ.......
0018: 0c 00 0e 00 15 00 56 01   ......V.
0
 
cohhelpAuthor Commented:
Disabled the AM scan.
0
 
cohhelpAuthor Commented:
48 hours later the scan was enabled, no shutdowns so far.
Thank you
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.