Hi to u all,
My Boss want to find when server (2000) goes down.
wich event should I looking for ?
Thanks
Didi

Whenever the server is shutdown normally you'll see (in the system log)
Event ID: 6006 Source: EventLog

If it blue screens then you'll see Event ID: 1001 Source: Save Dump

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Did" wrote:
| Hi to u all,
| My Boss want to find when server (2000) goes down.
| wich event should I looking for ?
| Thanks
| Didi
|

Thanks
Didi


Dave Patrick wrote:
> Whenever the server is shutdown normally you'll see (in the system log)
> Event ID: 6006 Source: EventLog
>
> If it blue screens then you'll see Event ID: 1001 Source: Save Dump
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "Did" wrote:
> | Hi to u all,
> | My Boss want to find when server (2000) goes down.
> | wich event should I looking for ?
> | Thanks
> | Didi
> |

I think you meant

6008 - Previous shutdown was unexpected.

Regards,
Hank Arnold

Dave Patrick wrote:
> Whenever the server is shutdown normally you'll see (in the system log)
> Event ID: 6006 Source: EventLog
>
> If it blue screens then you'll see Event ID: 1001 Source: Save Dump
>

That one would be for cord unplugged.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Hank Arnold" wrote:
|I think you meant
|
| 6008 - Previous shutdown was unexpected.
|
| Regards,
| Hank Arnold

You're welcome.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Did" wrote:
| Thanks
| Didi

???

When I see 6008 in the event logs, it's always:

"The previous system shutdown at <time> on <date> was unexpected."

Doesn't have to be a power rest (or cord unplugged). More often was due
to blue screen hardware or software trap/dump.....


According to http://eventid.net, 6007 is an Exchange
(MSExchangeTransport) error.

Regards,
Hank Arnold

Dave Patrick wrote:
> That one would be for cord unplugged.
>

I'm corn-fused.... where did 6007 and 6008 come from? I didn't mention
either.

If it BSOD's you should always at least get a Event ID: 1001 Source: Save
Dump


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Hank Arnold" wrote:
| ???
|
| When I see 6008 in the event logs, it's always:
|
| "The previous system shutdown at <time> on <date> was unexpected."
|
| Doesn't have to be a power rest (or cord unplugged). More often was due
| to blue screen hardware or software trap/dump.....
|
|
| According to http://eventid.net, 6007 is an Exchange
| (MSExchangeTransport) error.
|
| Regards,
| Hank Arnold

Misread the word "normally" in your original post

Sorry for the confusion............. :-(

Regards,
Hank Arnold

Dave Patrick wrote:
> I'm corn-fused.... where did 6007 and 6008 come from? I didn't mention
> either.
>
> If it BSOD's you should always at least get a Event ID: 1001 Source: Save
> Dump
>
>

No problem. :)

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Hank Arnold" wrote:
| Misread the word "normally" in your original post
|
| Sorry for the confusion............. :-(
|
| Regards,
| Hank Arnold