# Event ID 6008 shows wrong time



## maits103 (Mar 7, 2010)

Hello,
We a 2003 Server R2 SP1 Standard Edition. This is our SQL server. This server has been in production for over 4 years and running great. Recently in the past week we had 4 occasions were the server would freeze. We could not softly shutdown the server. We finally would have to push the power button to restart it. In Event viewer there would be Even ID 6008. The date and time would be correct; however the time in the description was wrong. It has been any where from 30 minutes to an hour off. Example, the actual shutdown time could be 2:00pm and the description would say 1:15pm. The actual time of the unexpected shutdown was 2:00pm and the server was running great at 1:15pm. The shutdown was not even initiated till 2:00pm. The date and time is correct on the server and always has been. There are no scheduled shutdowns/restarts configured. We have a feeling the time is causing the freeze up, but only the time in the description in event viewer is wrong. 
Any ideas?
Thanks


----------



## 2xg (Aug 5, 2009)

Hello and welcome to TSF!

You might find your resolutions here.


----------



## TheOutcaste (Mar 19, 2009)

This may duplicate some info from the link 2xgrump provided above, I didn't read though all of the articles it links to. Better to hear it twice than not at all though.

From http://technet.microsoft.com/en-us/library/cc778526(WS.10).aspx


> * The Event Log service writes the Shutdown Event Tracker heartbeat to the registry and then deletes it just before a normal shutdown occurs. On restart it verifies whether the heartbeat is present and, if so, writes the DirtyShutdown key to the registry.
> 
> Note
> 
> * Used in this context, heartbeat is a defined as a time stamp interval, written once a minute, that tells the registry, and therefore the system, that Shutdown Event Tracker is still enabled.


If the Event Log service gets stopped, the time in the registry won't get updated, though the system may run for quite a while after the Event Log service gets stopped, so the time may not match the time when the Server actually stopped responding.

Have you checked the shutdown log files?
*%windir%\system32\LogFiles\Shutdown\ *

Make sure the *Report unplanned shutdown events* policy setting is *not configured*, or *enabled*.
GPEdit.msc
*Computer Configuration | Administrative Templates | System | Error Reporting | Advanced Error Reporting settings*
If not Enabled, make sure this setting is enabled:
*Control Panel | System | Advanced ->Error Reporting*
Select *Enable Error Reporting* and check *Unplanned machine shutdowns*

Might find some helpful info here:
How Shutdown Event Tracker Works


----------

