Skip to main content

Agent - Shutdown Unexpected

Summary​

This monitor will look for machines with event ID 6008. This Windows event is usually associated with an "Unexpected Shutdown."

Dependencies​

The machine must be a Windows-based device.
Automate must be gathering event logs into the database for this internal monitor to function.

Target​

Primarily, this monitor targets servers, but it will work properly for workstations if this data is of value to the MSP.
Servers - Should be run on servers
Windows Machines - Should be run on all Windows machines

Changelog​

2025-04-10​

  • Initial version of the document