Martijn FrickelIn addition to event 6008 we also monitor on event 1003 (source: system error)
This way we also get alarmed when a system had a BSOD
Martijn FrickelOn other OS's the 6008 event also regularely shows after scheduled reboots.
Martijn FrickelJust looked into the log of a 2008 sbs server that had a scheduled reboot yesterday.
The event 6008 logged is an error, not informatical, implicating the reboot was unexpected.
We also set the monitoring to only look at error and warning