Unexpected Restart of Windows Operating System is a matter of concern to technical person when it comes to be a server. Because impact is high.

Basic understanding is to have Event id 6008 will give me information about the time and details of Unexpected restart.

Before proceeding further We need to categories these 2 category , First one will be untill Windows 2008R2 and Second one will be after that .

Lets know few more facts about other relevant event ids with Event id 6008.

Windows 2016 Description
Eventid 6008 Event id 41 with BugCheck Code Event id 1001 Page file is properly configured (Custom or System) + Free space available + Complete Memory dump configured.  (Memory dump created properly)
Eventid 6008 Event id 41 with BugCheck Code Event id 1001 Event id 49 Page file set less size on other than boot partition (Custom) + Free space available + Complete Memory dump configured. (Bugcheck event 1001 generated & Mini Memory dump created)
Eventid 6008 Event id 41 with BugCheck Code Event id 1001 Event id 49 Page file set less size on boot partition (Custom) + Free space available + Complete Memory dump configured. (Bugcheck event 1001 generated & Mini Memory dump created)
Eventid 6008 Event id 41 with BugCheck Code Event id 46 Page file not set on any volume + Free space available + Complete Memory dump configured. (Memory dump not created & Bugcheck event 1001 also not generated)
Eventid 6008 Event id 41 with BugCheck Code Event id 12 Page file is properly configured (Custom or System) + Free space not available + Complete Memory dump configured. (Memory dump not created & Bugcheck event 1001 also not generated)

 

Windows 2008R2 Description
Eventid 6008 Event id 41 with BugCheck Code Event id 1001 Page file is properly configured (Custom or System) + Free space available + Complete Memory dump configured.  (Memory dump created properly)
Eventid 6008 Event id 41 with BugCheck Code Event id 46 Event id 49 Page file not set on any volume + Free space available + Complete Memory dump configured. (Memory dump not created & Bugcheck event 1001 also not generated)
Eventid 6008 Event id 41 with BugCheck Code Event id 46 Event id 49 Page file set less size on other than boot partition (Custom) + Free space available + Complete Memory dump configured. (Memory dump not created & Bugcheck event 1001 also not generated)
Eventid 6008 Event id 41 with BugCheck Code Event id 1001 Event id 49 Page file set less size on boot partition (Custom) + Free space available + Complete Memory dump configured. (Bugcheck event 1001 generated & Mini Memory dump created)
Eventid 6008 Event id 41 with BugCheck Code Event id 12 Page file is properly configured (Custom or System) + Free space not available + Complete Memory dump configured. (Memory dump not created & Bugcheck event 1001 also not generated)

 

Details of Event Ids

Event ID Log Name Source Level Description
6008 System EventLog Error The previous system shutdown at 2:12:52 AM on ‎3/‎30/‎2020 was unexpected.
41 System Microsoft-Windows-Kernel-Power Critical The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.Event Xml:<EventData><Data Name=”BugcheckCode”>0</Data><Data Name=”BugcheckParameter1″>0x0</Data><Data Name=”BugcheckParameter2″>0x0</Data>

<Data Name=”BugcheckParameter3″>0x0</Data>

<Data Name=”BugcheckParameter4″>0x0</Data>

<Data Name=”SleepInProgress”>false</Data>

<Data Name=”PowerButtonTimestamp”>0</Data>

</EventData>

</Event>

1001 System Microsoft-Windows-WER-SystemErrorReporting Error The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000003b (0x0000000080000003, 0xfffff880045e05db, 0xfffff880041a2cc0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 033020-45312-01.
12 System Microsoft-Windows-Subsys-SMSS Error The crash dump file could not be created due to a lack of free space on the destination drive. Increasing the amount of free space on the destination drive may help prevent this error.
49 System volmgr Error Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
46 System volmgr Error Crash dump initialization failed!

 

Special Thanks to Miraj Sane for his contribution in collating data for the ease of understanding and performing the research.