Critical Windows events
Event ID 6008: Unexpected system shutdown

Event ID 6008: Unexpected system shutdown

Symptoms

Event ID 6008 gets logged to the system event log when a system shuts down unexpectedly. You will see the message "The previous system shutdown at time on date was unexpected."

Remediation

Unexpected system shutdowns need to be investigated immediately when they happen to your critical servers as they can affect business continuity. The system shutdown might be caused by a hardware issue, such as overheating or power supply, but could also be a security threat .

Real-time alerts

1. Enhance security monitoring in EventLog Analyzer by setting up a custom alert profile for event ID 6008. Go to the Log360 console > SIEM > Alerts > Add Alert Profile > select Alert > select Event ID from the drop-down > select Equals and add 6008.
2. Add other details like the alert name, severity, and log sources. Include the device name, user account, and domain in the alert message and enable notifications.
3. The security admin getting the notifications can use the details in the alert message to check if this event was logged multiple times in the same system.