System Status
Buy Now
  • Email & Apps
  • Office 365
Login
  • MyRackspace Portal
  • Cloud Control Panel
  • Rackspace Webmail Login
  • Cloud Office Control Panel
  • Support Home
  • How-To
  • Developer Documentation
  •  Blogs 
    • Expert Insights Tech Blog
    • Rackspace Blog
    • Solve: Thought Leadership

Support Network

End-to-End Multicloud Solutions.   Solving Together.™   Learn more at Rackspace.com

How–To Home

Cloud Servers

  • Introduction
  • FAQ
  • All Articles

Troubleshoot Windows server shutdowns

Last updated on:  2020-05-06

Authored by:  Dave Myers


Overview

Microsoft® Windows® servers might shut down as the result of a user action or a system event. You can identify the cause by searching the Event Viewer for the following associated Event IDs located in the System Event Viewer logs:

  • Event ID 41: The system rebooted without cleanly shutting down first. This error occurs when the system stopped responding, crashed, or lost power unexpectedly.
  • Event ID 1074: Logged when an app (such as Windows Update) causes the system to restart, or when a user initiates a restart or shutdown.
  • Event ID 6006: Logged as a clean shutdown. It gives the message, “The Event log service was stopped.”
  • Event ID 6008: Logged as a dirty shutdown. It gives the message, “The previous system shutdown at time on date was unexpected.”

Search for shutdown events in the Event Viewer

Use the following steps to open the Event Viewer:

  1. Press the Windows Start button and the R key at the same time to open the Run dialog.

  2. Type eventvwr and press Enter.

You can also open the Event Viewer by using the Control Panel. Navigate to Control Panel->All Control Panel Items->Administrative Tools->Event Viewer.

Use the following steps to search for shutdown events in the Event Viewer:

  1. Expand the Windows Folder and right-click the System log.

  2. Select Filter Current Log.

  3. Enter 41, 1074, 6006, 6008 in the search field to search all four shutdown conditions and press Enter.

You can use the timestamp to correlate other events and identify the root cause for an Event 6008 shutdown.

Related articles

Refer to the following articles for additional help:

How can you find the cause of unexpected shutdown after you put your computer to sleep?

Event ID 6008 is unexpectedly logged to the System event log after you shut down and restart your computer

Share this information:

©2020 Rackspace US, Inc.

Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License

See license specifics and DISCLAIMER

About Rackspace
  • About
  • Customer Stories
  • Events
  • Programs
Blogs
  • The Rackspace Blog
  • Expert Insights Tech Blog
  • Solve: Thought Leadership
  • News
  • Contact Information
  • Legal
  • Careers
Site Information
  • Style Guide for Technical Content
  • Trademarks
  • Privacy Statement
  • Website Terms
Support Network
  • Support Network Home
  • Rackspace How-To
  • API Documentation
  • Developer Center
  • ©2020 Rackspace US, Inc.