Microsoft® Windows® servers might shut down as the result of a user action or a system event. You
can identify the cause by searching the Event Viewer for the following associated Event IDs located
in the System Event Viewer logs:
- Event ID 41: The system rebooted without cleanly shutting down first. This error occurs when the
system stopped responding, crashed, or lost power unexpectedly.
- Event ID 1074: Logged when an app (such as Windows Update) causes the system
to restart, or when a user initiates a restart or shutdown.
- Event ID 6006: Logged as a clean shutdown. It gives the message, "The Event log service was stopped."
- Event ID 6008: Logged as a dirty shutdown. It gives the message, "The previous system shutdown at
time on date was unexpected."
Use the following steps to open the Event Viewer:
Press the Windows Start button and the R key at the same time to open the
eventvwrand press Enter.
You can also open the Event Viewer by using the Control Panel. Navigate to
Control Panel->All Control Panel Items->Administrative Tools->Event Viewer.
Use the following steps to search for shutdown events in the Event Viewer:
Expand the Windows Folder and right-click the System log.
Select Filter Current Log.
41, 1074, 6006, 6008in the search field to search all four shutdown conditions
and press Enter.
You can use the timestamp to correlate other events and identify the root cause for an
Event 6008 shutdown.
Refer to the following articles for additional help:
Updated 26 days ago