Thursday, July 03, 2014

Event ID to identify a system shutdown, startup, reboot and System uptime

How many times that you are surprised by automated Windows patching task which restarts your database server in the middle of a job runs? Of course, you should discuss that with you system admin team to work out how to schedule and deal with Windows patching on database servers. To start a discussion like that, you always need to find if your server does restart in the first place and what time and by who/what.

So, what are you looking for? In the event viewer, you can filter the system logs with the following Event IDs as explain below:

Event ID Description
6005 / 6009 OS started
6006 OS shutdown
6013 OS daily update report. that's the OS has been running for more than a day, measure in seconds.
1074 This sweet event shows you which process and on behalf of which user a reboot was initiated.

No comments:

Post a Comment