Windows Forum

Ask something
Discussion Locked

EventLog Service

0 helpful
3 replies

by gregory.sewbalak

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi There,
I am troubled with the following:
On my Windows Nt Server 4.0 SP6a the EventLog service automatically stops (EventID: 6006) and starts (EventID: 6005). After a period of 5-30 miutes the service again stops and then starts. Who knows whatis going on? I can not find the problem/cause myself.

(If the server was rebooting because of an abnormal shutdown "EventID: 6008" is shown in the log. But this not the case...)

3 replies

by sanboitran

Windows NT 4.0 Service Pack 4 records the system startup and shutdown times and logs them in the event log with the following Event IDs:

Event 6005 is logged at boot time noting that the Event Log service was started. It gives the message "TheEvent log service was started".
Event 6006 is logged as a clean shutdown. It gives the message "The Event log service was stopped".
Event 6008 is logged as a dirty shutdown. It gives the message "The previous system shutdown at time on date was unexpected".
Event 6009 is logged during every boot and indicates the operating system version, build number, service pack level, and other pertinent information about the system. Depending on your current configuration, it gives a message similar to:"Microsoft (R) Windows NT 4.0 1381 Service Pack 6 Multiprocessor free".

It's something that Windows NT 4.0 SP4 and latest SP records. There is no fix for it.

by gregory.sewbalak

Thanks for your effort, but this was already clear to me. What puzzles me is why the Eventlog service suddenly after a certain period stops and starts again. Why does this happens?

by gregory.sewbalak

An Example of the output after running "UPTIME /a /d:":
-----
6-12-2002 13:12:34 Boot
Prior downtime:0d 0h:4m:28s

6-12-2002 13:29:26 Shutdown
Prior uptime:0d 0h:16m:52s

6-12-2002 13:32:39 Boot
Prior downtime:0d 0h:3m:13s

6-12-2002 14:00:39 Shutdown
Prior uptime:0d 0h:28m:0s

6-12-2002 14:03:53 Boot
Prior downtime:0d 0h:3m:14s
-----
As you can see the Eventlog service shuts down after apporx. 30 minutes and then comes up after approx. 10 minutes. This is what puzzles me. How is this possible?

This discussion is closed to new replies.