What happened? Did my server reboot?

What happened? Did my server reboot?

Sometimes we receive calls from Monitoring Centers that cannot process or receive their alarm signal traffic from their Alarm Receivers.  We're focused on getting the life safety system back up and online as quickly as possible.  If it looks like a hardware problem or OS problem it may be a little troublesome to diagnose.  

You can search the Windows Event logs for specific Event ID's that will give you some clues about what might have happened.  

Run the Event Viewer, Open the Windows Logs and highlight the System event log , right click on it and select Filter Current Log selection.  

Look for the line that should contain the following <All Event IDs>, on this machine it was about half way down the form and it followed a description of 'Includes/Excludes Event IDs: Enter ID numbers and/or ranges separated by commas. To Exclude criteria, type a minus sign first. For example 1,3,5-99,-76'

Enter any of these events in place of the <All Event IDs> label to search for them in the logs or enter the entire list  41,1074,1076,6005,6006,6008 - click OK to have the event Log filtered by your selection.  

Event ID 
 Description of Event
41
 Computer shut down or restarted unexpectedly 
1074
 The system as shut down properly by a user or process
1076
 This event is written to the log when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.   You should also see a Event 6008 in the  log prior to this event.
6005
 The event Logging Service was started up, this happens when a computer system is started up.
6006
 The Event Logging Service was stopped, usually from a proper system shutdown
6008
 This event is written to the log and indicates that there was an unexpected shutdown



You can also see how long the system has been up with Event ID 6013, this event seems to be written to the log after startup and every day at 12:00pm, it is recorded in seconds.

Another sometimes useful Event ID number 6009 which is written to the log after the system is started up will show you the Windows Version of the computer.  

    • Related Articles

    • Cluster Failover Procedure (MKSCluster.exe)

      Cluster Fail-over Procedure and Recovery When the system is operating normally the servers should be running the following applications. Primary Server (the server actively running the SQL Anywhere Server - database server engine), and Signal ...
    • Modem Events

      Modem Format Standard Events Below are the Modem codes and their description: EVENT CODE DESCRIPTION EVENT CODE DESCRIPTION EVENT CODE DESCRIPTION * AUDIO IN ND14 REBOOT SI STATUS DOOR OPEN [ ERROR ND18 RELAY RESET SL LOG OVERFLOW \ CANCEL ND19 RELAY ...
    • OpenVPN Client Update/Install (For Customers)

      Customers are responsible for the following: Backup of their config and installation files for OpenVPN Updating the OpenVPN client when necessary The files that you will need for this are the following: OpenVPN Installer: ...
    • Operator placing accounts on Test in MKMSCS

      It's often been asked - why is the start time when an operator presses F5 1 hour prior to the actual time?   In the image above, the time of the computer and the time of the virtual machine is reflected by the red circle to the bottom right of the ...
    • How to setup ODBC Driver/Connection 64 bit

      How to setup your ODBC? Search your Start Menu in Windows for ODBC Select Add Select SQL Anywhere 17 (If not listed please select the next SQL Anywhere available) Select ODBC Tab: Data Source Name: Your Database Name (MKMSDEFAULT) Check Microsoft ...