What event ID should you look for in Windows Logs - System to determine if your server has been shut down?

What event ID should you look for in Windows Logs - System to determine if your server has been shut down?

• 44
• 41
• 12
• 13 

EXPLANATION

The kernel power event ID 41 error occurs when the computer is shut down, or it restarts unexpectedly. When a computer that is running Windows starts, a check is performed to determine whether the computer was shut down cleanly. If the computer was not shut down cleanly, a Kernel Power Event 41 message is generated.

An event 41 is used to report that something unexpected happened that prevented Windows from shutting down correctly. There may be insufficient information to explicitly define what happened. To determine what may have happened and to identify a potential resolution, it is important to know what the computer was doing at the time just before the event occurred.

If event 41 is logged because power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. An underpowered or failing power supply may cause this behavior. For example, if you added RAM or additional devices or hard disks when this problem began, the power supply may cause the problem.


An event 41 can occur in the following scenarios.

Scenario 1: The computer restarts, and there is a Stop error BugcheckCode in the event data

When a Stop error occurs, the Stop error data is written in Event ID 41 as part of the additional event data. There may be the instances in which the Stop error code information cannot be written before the computer restarts or shuts down. Such instances are covered in scenario 3.

 Note
The BugcheckCode data in the event is written in decimal format instead of a more typical hexadecimal format. Therefore, the decimal value should be converted to a hexadecimal value.

If the Stop error BugcheckCode entry in the event ID data is not zero, you should convert the BugcheckCode value from decimal to hexadecimal. Most documentation on Stop error codes reference the code as a hexadecimal value instead of a decimal value. To do this, follow these steps:

1. Click Start, and then type calc in the Search box.
2. Click View, and then click Programmer.
3. Make sure that the Dec option button is selected on the left side of calculator.
4. Use the keyboard to enter the decimal value from the BugcheckCode value.
5. Click the Hex option button on the left side of the calculator.