— After the server is restarted. It will create a memory dump file under C:\Windows.
— The Memory dump file will be called as “memory.dmp”.
— To analyze this file we can use ” WINDBGUtility”(windows debugger utility)
— If unable to analyze the file then we can take help with Microsoft but it’s comes under premium support.
Unexpected shutdown Source: USER21 Event ID:1076
Sudden Reboot Source: Eventlog Event ID: 6008
Automatic Reboot Source: USER32 Event ID:1074
Eventlog Stopped Source:Eventlog Event ID:6006
Eventlog Started Source: Eventlog Event ID: 6005