Martijn FrickelIn addition to event 6008 we also monitor on event 1003 (source: system error) This way we also get alarmed when a system had a BSOD
Martijn FrickelOn other OS's the 6008 event also regularely shows after scheduled reboots.
Martijn FrickelJust looked into the log of a 2008 sbs server that had a scheduled reboot yesterday. The event 6008 logged is an error, not informatical, implicating the reboot was unexpected. We also set the monitoring to only look at error and warning