Has anyone else seen an unexpected shutdown reported in the Windows Event log of a server after using the reboot step in an agent procedure?
I have one server that is reporting an unexpected shutdown (event 6008) after every scripted reboot. The odd thing is the event for the planned reboot is listed as well. I am only seeing this on one Windows 2008 terminal server. I was hoping someone else may have seen this and could suggest how to correct it.
Thanks in advance.
One of my Colleges tracked this down. It was also happening when we scheduled tasks in event scheduler. This was his findings:
I think I’ve identified the cause of Total Protection alerts for event ID 6008 “unexpected shutdown,” which gets ticketed and investigated.
Instead of using “Shutdown –R”
You need the reason code for a server. Otherwise the server is force rebooted, causing the “This server shutdown unexpectedly.” This generates an alert, which technicians are sometimes ticketed for.
Reason code Examples
Shutdown.exe /R –c “Planned in Total Protection” /d P:2:4
Is the code for a planned operating system reconfiguration
Shutdown.exe /R -c “Planned in Total Protection” /d P:1:4
is the code for planned application maintenance
This is best done in task scheduler.
See the KB explanation below
/d [p:|u:]xx:yy = This records a reason for the restart or shut down. The p option indicates a planned restart or shut down and the u a user defined one. The xx and yy options specify major and minor reasons for the shut down or restart, respectively, a list of which you can view by executing the shutdown command without options. If neither p nor u are defined, the shut down or restart will be recorded as unplanned.
/c "comment" = This shutdown command option allows you to leave a comment describing the reason for the shut down or restart. You must include quotes around the comment. The maximum length of the comment is 512 characters.
We ended up creating our own reboot script and used that one instead. It had the correct flags.