Detecting Windows Server Shutdown Events

Question: “How can i detect Windows Servers shutting down in ArcSight. Are there any specific process shutdown events that i can use to create a rule for windows shutdown”

Answer: You need to be gathering the System Event Logs from the hosts in question.

Have a look if you can see eventID 1074 in your logs prior to a graceful shutdown (see below). you should see that event prior to the host going down,

pastedImage 3 - Detecting Windows Server Shutdown Events

However, keep in mind it wont be there for an unplanned shutdown and if you have a busy Windows Connector (ArcSight WUC / WINC) there is a chance that the server will reboot before the connector cycles back round to the next batch of logs from that host – so in that instance you will only get the events when it has rebooted. Snare agents should manage to send the event before a reboot.

Use this in combination with critical device monitoring as a backup – i.e. critical device has not sent events in XX minutes may indicate a shutdown or other failure that needs investigation

Source: Source: User32 Event ID: 1074 (Windows Operating System 5.2) – Technet Events And Errors Message Center: Message Details

Product:Windows Operating System
Event ID:1074
Source:User32
Version:5.2
Symbolic Name:STATUS_SHUTDOWN_CLEAN
Message:The process %1 has initiated the %5 of computer %2 on behalf of user %7 for the following reason: %3
Reason Code: %4
Shutdown Type: %5
Comment: %6
Explanation
This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down. This event is written to the system log only when the Shutdown Event Tracker group policy setting is enabled or not configured on a computer running a Windows Server 2003 operating system.

Other Event ID’s that are required to monitor the shutdown/restart status:

  • 6005: Windows start-up

pastedImage 11 - Detecting Windows Server Shutdown Events

  • 6006: Windows shutdown (properly)

pastedImage 12 - Detecting Windows Server Shutdown Events

  • 6008: Windows shutdown (unexpectedly)

pastedImage 8 - Detecting Windows Server Shutdown Events

  • 1074: Type of shutdown.

pastedImage 3 - Detecting Windows Server Shutdown Events

Here’s the description for the same:

  • Event 6005 is logged at boot time noting that the Event Log service was started. It gives the message “The Event log service was started”.
  • Event 6006 is logged as a clean shutdown. It gives the message “The Event log service was stopped”.
  • Event 6008 is logged as a dirty shutdown. It gives the message “The previous system shutdown at time on date was unexpected”.
  • Event 1074 is generated when an application causes the system to restart, or when the user initiates a restart or shutdown

More info: http://arnavsharma.net/windows-clients/track-windows-shutdown-using-event-logs