Custom event not written to System Log when using shutdown.exe instead of GUI
I am writing an event to the System event log using eventcreate.exe in a shutdown script. The shutdown script runs whether I restart the server from GUI or shutdown.exe; however, the event entry is only written when I restart from the GUI, never when I use shutdown.exe. So far I've seen this behavior on Server 2003 SP2. It looks like when I use "shutdown.exe /r /t 1", the eventlog service is terminating before eventcreate.exe can write to the log. Any suggestions? Thank you!
March 30th, 2010 9:22pm

Hi, If I understand correctly, you want to create an event in the Event Viewer every time you restart the server. When you restart the server by either using the shutdown.exe command or via GUI, there should be an USER32 event 1074 logged in the system log, which is similar to the following events: *** restart by using the shutdown.exe command *** Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 12/4/2009 Time: 9:36:05 AM User: PARENT\Administrator Computer: PARENTDC Description: The process winlogon.exe has initiated the restart of computer PARENTDC on behalf of user PARENT\Administrator for the following reason: No title for this reason could be found Reason Code: 0x840000ff Shutdown Type: restart Comment: *** restart via GUI *** Event Type: Information Event Source: USER32 Event Category: None Event ID: 1074 Date: 3/31/2010 Time: 10:48:40 AM User: PARENT\Administrator Computer: PARENTDC Description: The process Explorer.EXE has initiated the restart of computer PARENTDC on behalf of user PARENT\Administrator for the following reason: Other (Planned) Reason Code: 0x85000000 Shutdown Type: restart Comment: testing For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00 00 00 85 Thanks.This posting is provided "AS IS" with no warranties, and confers no rights.
Free Windows Admin Tool Kit Click here and download it now
March 31st, 2010 7:20am

Thank you - you're right. This solution will work. As an aside, I am still curious why Event Log shuts down sooner with shutdown.exe than with the shutdown GUI.
April 5th, 2010 2:47am

Thank you - you're right. This solution will work. As an aside, I am still curious why Event Log shuts down sooner with shutdown.exe than with the shutdown GUI. Anybody ever found out why this behaviour takes place? I am experiencing the same. When I use shutdown.exe from the CLI, the event log service shuts down first and the next log visible, is the log after the reboot has taken place.
Free Windows Admin Tool Kit Click here and download it now
April 13th, 2010 12:56pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics