Some Server 2019 VMs are reporting Event ID 6008 after installing the June security updates, even though the System log shows a planned restart. The updates succeed, the servers seem normal, and there are no dumps or reported bugchecks. Has anyone run into something similar, and what would you check?
Anyone seeing unexpected shutdown alerts after the June 2026 updates on Server 2019?
Asked by
e930!busroute_2
Answers
I'd treat 6008 as a reason to investigate, not proof of a crash. Compare it with Event ID 1074, the event log stop and start events 6006 and 6005, Kernel-Power 41, and servicing events around the same restart.
A planned 1074 with no dump or Kernel-Power 41 makes a reporting or shutdown bookkeeping issue plausible, but it doesn't establish the cause. Check whether the timestamps and shutdown sequence make sense before suppressing the alert.
Reply to this answer
Don't rule out a VM hanging during shutdown. A planned restart can be logged before a service gets stuck, and the virtualization platform might then force a restart. Check the host logs around the same time and look for services that are slow or failing to stop.
Reply to this answer
There can be false positives with 6008, including after an ordinary restart. Still, I wouldn't ignore every alert just because the update completed. Check the surrounding events and the VM host first, then decide whether the alert needs tuning.
Reply to this answer
Add your answer
Answers are reviewed before publication.
e930!busroute_2:
These are Hyper-V VMs, so checking the host logs sounds worthwhile. The affected machines don't seem to follow an obvious pattern so far.