Catching Hard Reboot Event Log Events

jricha34 · Post by **jricha34** » Tue Oct 08, 2002 11:04 am

Attempting to use NT Event Log test to capture a hard reboot or power reset of a server. Event that is generated on W2K machine is

Source: EventLog
Type: Error
EventID: 6008

Using the following test to try and capture:

; ------- Test #07 -------

Method = NTLog
;--- Common properties ---
Title = HARD REBOOT: Server1
Comment = HARD REBOOT: Server1
RelatedURL =
ScheduleMode= Regular
Schedule =
Interval = 3600
Alerts = EMAIL
ReverseAlert= Yes
UnknownIsBad= No
UseCommonLog= Yes
PrivLogMode = Default
SyncCounters= Yes
SyncAlerts = No
MasterTest-Alive = Server-PING
;--- Test specific properties ---
Computer = \server1
Log = System
Source = eventlog
EventType = error
EventID = 6008

Currently running HostMon in a interactive way with an ID that can definitely read the event log.

KS-Soft · Post by **KS-Soft** » Tue Oct 08, 2002 11:34 am

So, do you have some problems? Or its just good example for other users?
BTW it looks like you use HM 3.30. I think its good to download this patch http://www.ks-soft.net/download/hm331.zip
On this week will be available HM 3.32

Regards
Alex

jricha34 · Post by **jricha34** » Tue Oct 08, 2002 3:37 pm

Oh sorry, got distracted when writing that. Yes, having a problem. That configuration does not appear to be capturing and reporting the 6008 event, is there something obviously wrong?

KS-Soft · Post by **KS-Soft** » Tue Oct 08, 2002 6:28 pm

What the status of the test? Always "Ok"? Or "Unknown"? Do you have the same system time on remote and local system?

Regards
Alex

jricha34 · Post by **jricha34** » Wed Oct 09, 2002 11:01 am

For these test systems the system time is the same though once production this will be for machines around the world.

Status is ok

KS-Soft · Post by **KS-Soft** » Thu Oct 10, 2002 6:50 pm

Sorry for delay. I did not find any error in HostMonitor's code. Are you sure you have this event in the Event Log? I know Windows has this event ID but I did not find it on our systems, even when I cut power on my testing machine.

Regards
Alex

jricha34 · Post by **jricha34** » Fri Oct 11, 2002 11:35 am

Yep definitely have those events

7/11/2001 3:46:56 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 3:38:28 PM on 7/11/2001 was unexpected.
7/11/2001 4:06:39 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 3:58:04 PM on 7/11/2001 was unexpected.
7/11/2001 4:20:35 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 4:11:38 PM on 7/11/2001 was unexpected.
7/11/2001 4:35:12 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 4:25:34 PM on 7/11/2001 was unexpected.
7/11/2001 4:51:09 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 4:45:12 PM on 7/11/2001 was unexpected.
7/11/2001 5:06:02 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 4:56:08 PM on 7/11/2001 was unexpected.
7/18/2001 6:32:41 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 6:26:25 PM on 7/18/2001 was unexpected.
8/6/2001 11:51:49 AM 1 0 6008 EventLog N/A server1 The previous system shutdown at 11:46:56 AM on 8/6/2001 was unexpected.
8/7/2001 12:36:14 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 12:28:24 PM on 8/7/2001 was unexpected.
8/7/2001 12:52:19 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 12:46:19 PM on 8/7/2001 was unexpected.
8/7/2001 1:06:34 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 12:57:19 PM on 8/7/2001 was unexpected.
8/7/2001 1:21:56 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 1:16:35 PM on 8/7/2001 was unexpected.
8/7/2001 1:36:02 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 1:26:56 PM on 8/7/2001 was unexpected.
8/7/2001 1:51:14 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 1:41:02 PM on 8/7/2001 was unexpected.
8/7/2001 2:06:52 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 2:01:14 PM on 8/7/2001 was unexpected.
8/7/2001 2:22:33 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 2:16:52 PM on 8/7/2001 was unexpected.
8/7/2001 2:35:36 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 2:27:33 PM on 8/7/2001 was unexpected.
8/7/2001 2:50:42 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 2:40:36 PM on 8/7/2001 was unexpected.
8/7/2001 3:05:28 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 2:55:42 PM on 8/7/2001 was unexpected.
8/7/2001 3:22:22 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 3:15:28 PM on 8/7/2001 was unexpected.
2/6/2002 6:35:18 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 5:28:42 PM on 2/6/2002 was unexpected.
4/10/2002 12:07:32 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 12:02:44 PM on 4/10/2002 was unexpected.
6/7/2002 6:45:42 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 6:39:30 PM on 6/7/2002 was unexpected.
10/8/2002 12:50:49 PM 1 0 6008 EventLog N/A server1 The previous system shutdown at 12:44:32 PM on 10/8/2002 was unexpected.