Over the weekend, I had one server (out of 11 in the office) shut itself off sometime early Saturday morning. This is a virtual server (running SQL, our production database, naturally), running on a physical host that itself did not shut down, alongside three other virtual servers that did not shut down.
This runs Server 2012R2, and is a Hyper-V VM running on a Server 2012R2 host alongside three other VMs (2x 2012R2, 1x 2019).
Combing through the Event Viewer, all I can come up with is a single entry in the System log by User32 for what appears to be a graceful shutdown with code 1074. There is no apparent application, scheduled task, or update-related reason for this to have happened. The only other oddity I found was from the day prior, approximately nine hours previous, where Disks 2 and 3 "were removed" – warnings, but weird because this machine does not have a Disk 2 or 3 (just 0 and 1, OS and Data respectively).
Evidently, 1074 is what you'd expect to see in the log if someone just gracefully shut the machine down – but it's a locked up office at 3AM.
The text of the entry is:
The process C:\Windows\System32\svchost.exe (THESQLSERVER) has
initiated the shutdown of computer THESQLSERVER on behalf of user NT
AUTHORITY\SYSTEM for the following reason: Other (Planned) Reason
Code: 0x80000000 Shutdown Type: shutdown Comment:
Looking around online, there's not much to go on – basically check for scheduled tasks, make sure the system's power settings aren't shutting it down, or to make sure there's no scripts that were run. In my case, none of these applied.
The only other possible clue I found was an entry in the PowerChute management console for the UPS – about three minutes after the log wrote the 1074 entry, it said that "Communication Stopped", and seven minutes later communication was re-established. Looking at other local VMs and the host, though, none of them seemed to have shut down or had any thing of note at all. This may just be weird timing.
Has anyone encountered this before and actually come up with a root cause? I see other people have looked into it, but so far their experiences do not seem to match mine.
What sort of tools could one use to dig further into this?
Best Answer
That's a planned shutdown initiated by an operating system process. Perhaps an update has been installed automatically? That would have triggered a reboot (if the system is configured to automatically install updates); 3 AM is also the default reboot time when auto installing updates, which points even more in this direction. You can check the history of installed updates (and/or the Setup event log) to confirm if this was the case.