Server Shutdown?

[Steve Grosz]

I came into work, and found out that my webserver was shutdown. As I am
the only one who uses this machine, and does any admin, nobody would
have the access to shut it down via a TS session, that I'm aware of.

Is there somewhere in the event log where it would show me why the
server shut down? Also, I'm getting messages such as :

Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 6/20/2004
Time: 8:44:56 PM
User: N/A
Computer: WEB-SERVER
Description:
The browser service has failed to retrieve the backup list too many
times on transport
\Device\NetBT_Tcpip_{C3D61F20-4DC7-40B7-9FDB-D8EC8B949B66}. The backup
browser is stopping.
Data:
0000: 35 00 00 00 5...


Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 6/20/2004
Time: 6:05:59 AM
User: N/A
Computer: WEB-SERVER
Description:
The browser service has failed to retrieve the backup list too many
times on transport
\Device\NetBT_Tcpip_{C3D61F20-4DC7-40B7-9FDB-D8EC8B949B66}. The backup
browser is stopping.
Data:
0000: 35 00 00 00 5...

What are these from?

Steve

 

[Pegasus \(MVP\)]

I came into work, and found out that my webserver was shutdown. As I am
the only one who uses this machine, and does any admin, nobody would
have the access to shut it down via a TS session, that I'm aware of.

Is there somewhere in the event log where it would show me why the
server shut down? Also, I'm getting messages such as :

Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 6/20/2004
Time: 8:44:56 PM
User: N/A
Computer: WEB-SERVER
Description:
The browser service has failed to retrieve the backup list too many
times on transport
\Device\NetBT_Tcpip_{C3D61F20-4DC7-40B7-9FDB-D8EC8B949B66}. The backup
browser is stopping.
Data:
0000: 35 00 00 00 5...


Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 6/20/2004
Time: 6:05:59 AM
User: N/A
Computer: WEB-SERVER
Description:
The browser service has failed to retrieve the backup list too many
times on transport
\Device\NetBT_Tcpip_{C3D61F20-4DC7-40B7-9FDB-D8EC8B949B66}. The backup
browser is stopping.
Data:
0000: 35 00 00 00 5...

What are these from?

Steve

You can ignore the events you noticed. They are irrelevant.

Your server might have crashed, or you might have suffered a power
glitch. You could run a script at shut-down time (and at startup time!)
so that you always know if a given shutdown was operator-initiated
or not. A simple line like so would do:

@echo off
if not exist c:\Logs md c:\Logs
echo %date% %time% Operator-initiated shutdown >> c:\Logs\%ComputerName%.log

Now run gpedit.msc and enter the name of your batch file in
the box under "Scripts (startup/shutdown)".

Create a similar script for your startup. In future, if you
ever find a startup log line without a shutdown log line then
your server suffered a crash.

You can nail things down even further: Use the Task Scheduler
to run a task once every 10 minutes. Get it to write a line
similar to the above line to the log file, and you will have a
simple yet effective heartbeat monitor.