DC eventlog details

One of my domain controllers had a unexpected shutdown and it logged
it with eventid 6008. there isnt a whole lot of information in the
event. when I click on the details tab i have a bunch of data. is
there anyway to read this? these logs are essentially useless. all it
is telling me is the server rebooted but it doesnt tell me why.

Server 2008:

EventID 6008

General Tab:
The previous system shutdown at 6:04:55 PM on 12/26/2009 was
unexpected.

Details Tab:
- System

- Provider

[ Name] EventLog

- EventID 6008

[ Qualifiers] 32768

Level 2

Task 0

Keywords 0x80000000000000

- TimeCreated

[ SystemTime] 2009-12-26T23:08:43.000000000Z

EventRecordID 66714

Channel System

Computer server1.domain.com

Security


- EventData

6:04:55 PM
12/26/2009


140708



D9070C0006001A001200040037000E01D9070C0006001A001700040037000E013C0000003C00000000000000000000000000 0000000000000100000000000000


--------------------------------------------------------------------------------

Binary data:


In Words

0000: 000C07D9 001A0006 00040012 010E0037
0008: 000C07D9 001A0006 00040017 010E0037
0010: 0000003C 0000003C 00000000 00000000
0018: 00000000 00000000 00000001 00000000


In Bytes

0000: D9 07 0C 00 06 00 1A 00 Ù.......
0008: 12 00 04 00 37 00 0E 01 ....7...
0010: D9 07 0C 00 06 00 1A 00 Ù.......
0018: 17 00 04 00 37 00 0E 01 ....7...
0020: 3C 00 00 00 3C 00 00 00 <...<...
0028: 00 00 00 00 00 00 00 00 ........
0030: 00 00 00 00 00 00 00 00 ........
0038: 01 00 00 00 00 00 00 00 ........

Hi
Check if you've a dmp file that you can analyze with debug tools from MS
http://support.microsoft.com/kb/315263


--

I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MVP Directory Services

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.




"l3ytes" <l3ytes@gmail.com> wrote in message
news:f2b5280c-1134-4044-a78d-228eea873d94@s19g2000vbm.googlegroups.com...
> One of my domain controllers had a unexpected shutdown and it logged
> it with eventid 6008. there isnt a whole lot of information in the
> event. when I click on the details tab i have a bunch of data. is
> there anyway to read this? these logs are essentially useless. all it
> is telling me is the server rebooted but it doesnt tell me why.
>
> Server 2008:
>
> EventID 6008
>
> General Tab:
> The previous system shutdown at 6:04:55 PM on 12/26/2009 was
> unexpected.
>
> Details Tab:
> - System
>
> - Provider
>
> [ Name] EventLog
>
> - EventID 6008
>
> [ Qualifiers] 32768
>
> Level 2
>
> Task 0
>
> Keywords 0x80000000000000
>
> - TimeCreated
>
> [ SystemTime] 2009-12-26T23:08:43.000000000Z
>
> EventRecordID 66714
>
> Channel System
>
> Computer server1.domain.com
>
> Security
>
>
> - EventData
>
> 6:04:55 PM
> 12/26/2009
>
>
> 140708
>
>
>
> D9070C0006001A001200040037000E01D9070C0006001A001700040037000E013C0000003C00000000000000000000000000 0000000000000100000000000000
>
>
> --------------------------------------------------------------------------------
>
> Binary data:
>
>
> In Words
>
> 0000: 000C07D9 001A0006 00040012 010E0037
> 0008: 000C07D9 001A0006 00040017 010E0037
> 0010: 0000003C 0000003C 00000000 00000000
> 0018: 00000000 00000000 00000001 00000000
>
>
> In Bytes
>
> 0000: D9 07 0C 00 06 00 1A 00 Ù.......
> 0008: 12 00 04 00 37 00 0E 01 ....7...
> 0010: D9 07 0C 00 06 00 1A 00 Ù.......
> 0018: 17 00 04 00 37 00 0E 01 ....7...
> 0020: 3C 00 00 00 3C 00 00 00 <...<...
> 0028: 00 00 00 00 00 00 00 00 ........
> 0030: 00 00 00 00 00 00 00 00 ........
> 0038: 01 00 00 00 00 00 00 00 ........