script for checking graceful and unexpected reboot in windows server

[saumen]

Hi,

Can anybody provide me the script (VBscript) to check the windows server reboot type, i.e whether the last reboot was a graceful or unexpected.

The script may trap the value (Event ID:6008 = unexpected and Event ID:6006= graceful) from system eventlog and flash the msg. (ref: below)

Or if there is any registry key from where it can be checked, then fine.


Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date: 20/05/2010
Time: 08:30:53
User: N/A
Computer: ABC
Description:
The previous system shutdown at 19:01:39 on 19/05/2010 was unexpected.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6006
Date: 20/05/2010
Time: 04:15:13
User: N/A
Computer: ABC
Description:
The Event log service was stopped.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

[JAMES_911]

If you can type "gpedit.msc" in run dialog box and going to local computer setting> Computer Configuration > Windows Settings > Scripts start-up/shutdown, then you can see all the batch files here and then you can add your files, otherwise use the below script.

iEventID1 = "'20142'"
iEventID2 = "'20189'"

Set objWMIService = GetObject("winmgmts:{(Security)}\\.\root\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("Select * from __InstanceCreationEvent Where " _
& "TargetInstance ISA 'Win32_NTLogEvent' " _
& "and (TargetInstance.EventCode = " & iEventID1 _
& "or TargetInstance.EventCode = " & iEventID2 & ")")

Do
Set objLatestEvent = colMonitoredEvents.NextEvent
SendMessage objLatestEvent.TargetInstance.Message, objLatestEvent.TargetInstance.EventCode
Loop

[saumen]

James,

Thanks for reply. But the script is not working. It keeps on executing, without any msg. I just need to check only the last reboot type (planned or unexpected) through VB script.

Please clarify what is iEventID1 = "'20142'" and iEventID2 = "'20189'".

Please assist.