Author Topic: How can I find out what is restarting my PC automatically? (Read 77681 times)

mouser · « **Reply #25 on:** November 24, 2013, 06:08 PM »

Getting back to the original question, can someone summarize whether, if you walk into the room and find your computer has shutdown (or restarted), what tool can you run (if any) to tell you WHY it last shutdown/restarted?

4wd · « **Reply #26 on:** November 24, 2013, 06:13 PM »

Look at the Event Logs/Reliability History, the reason it shut down should be supplied along with the event. However, if it was a spontaneous event, (eg. power removal - non-UPS backup, catastrophic software failure, etc), then you'll probably never have an idea as the system dies before anything can be written.

eg.

2013-11-25 11_18_40-Computer Management.png

2013-11-25 11_18_40-Computer Management.png

If you want a filter for the Event Log for startup/shutdown events, see here.

mouser · « **Reply #27 on:** November 24, 2013, 06:22 PM »

Thanks, 4wd.

x16wda · « **Reply #28 on:** November 24, 2013, 06:39 PM »

Does Win 7 still record the 6008 event in the system event log? That would at least tell you if the shutdown was unexpected.

4wd · « **Reply #29 on:** November 24, 2013, 06:46 PM »

Does Win 7 still record the 6008 event in the system event log? That would at least tell you if the shutdown was unexpected.
-x16wda (November 24, 2013, 06:39 PM)

Event ID 6008 - Looks like it still does.

I'll tweak my filter a little and see if I can catch all shutdown/startup events.

Edit: Here we go, I don't know if it will catch software crashes but it should let you see that any event that says whether the system shutdown cleanly or not so you can search for other near-time events.

See here.

Stoic Joker · « **Reply #30 on:** November 25, 2013, 06:47 AM »

If you just want a quick list of shutdown events try uptime.exe with the /S switch.

It was originally for NT4, but still runs on Win7.

Oh yeah...this is a command line program, so there is no GUI.

dr_andus · « **Reply #31 on:** November 25, 2013, 07:32 AM »

Look at the Event Logs
-4wd (November 24, 2013, 06:13 PM)

Thanks for that. I found two unusual events (see screenshots below).

Firstly, in the ECEEventLog (whatever that is), for the last 5 days I have 743 events, and they all seem to relate to ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP, which seems to point to my ATI Radeon graphics card. Is that bad?

How can I find out what is restarting my PC automatically?

Secondly, under Administrative Events, I have 2374 errors (out of 2,445 errors in total) for the last 7 days, produced by Apple's Bonjour Service. I imagine this is for syncing with iCloud (which I don't really use), and checking whether I have the latest iTunes (which I don't really use). Is this something bad enough that it would be better for me to block this somehow?

How can I find out what is restarting my PC automatically?

4wd · « **Reply #32 on:** November 25, 2013, 04:28 PM »

If you just want a quick list of shutdown events try uptime.exe with the /S switch.
-Stoic Joker (November 25, 2013, 06:47 AM)

DOH! Forgot about that but I'm not sure that it's going to be 100% accurate, eg.

2013-11-26 00_16_05-Computer Management.png

The above Critical event is due to a power outage, when I ran uptime /s it crashed and terminated when it got that event:

2013-11-26 00_16_38-Administrator_ C__Windows_system32_cmd.exe.png

2013-11-26 00_16_38-Administrator_ C__Windows_system32_cmd.exe.png

And the time was way off, (~9 hours).

Of course, it could have crashed due to something it didn't like on my system but then again ...

Look at the Event Logs
-4wd (November 24, 2013, 06:13 PM)

Thanks for that. I found two unusual events (see screenshots below).
-dr_andus (November 25, 2013, 07:32 AM)

SJ suggested the Event logs originally

Firstly, in the ECEEventLog (whatever that is), for the last 5 days I have 743 events, and they all seem to relate to ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP, which seems to point to my ATI Radeon graphics card. Is that bad?

The ATI graphics driver restarts itself whenever it suffers a critical problem, IIRC.

More interesting:

Secondly, under Administrative Events, I have 2374 errors (out of 2,445 errors in total) for the last 7 days, produced by Apple's Bonjour Service. I imagine this is for syncing with iCloud (which I don't really use), and checking whether I have the latest iTunes (which I don't really use). Is this something bad enough that it would be better for me to block this somehow?

These events are happening one minute before the ATI driver has a hernia. Can you check to see if that trend is followed with prior events, (the sample on the captures is rather small) ?

The Bonjour service is used to discover any other Apple devices on the local network and setup communication with them, (IIRIR). If you don't use iTunes I'd be sorely tempted to remove it and every trace of it, including Bonjour.

dr_andus · « **Reply #33 on:** November 25, 2013, 05:42 PM »

These events are happening one minute before the ATI driver has a hernia. Can you check to see if that trend is followed with prior events, (the sample on the captures is rather small) ?
-4wd (November 25, 2013, 04:28 PM)

No. That seems to have been just a coincidence. But the ATI driver does seem to be crashing a lot then. It has given me 21 events only today (and I'm only counting the events occurring at different times, as I had 13 events at 23:29:40 alone), even though I haven't noticed anything unusual happening.

But I still need to clean the dust, if this could have something to do with overheating.

BTW, when I click on Event Log Online Help, I get the following message:

How can I find out what is restarting my PC automatically?

Then it takes me to an MS website which says "Results for: Microsoft Product: .NET Framework; Version: 2.0.50727.4927; Event ID: 0; Event Source: ACEEventLogSource; No results were found for your query."

So what has the .NET Framework got to do with all this (ATI driver crashes)?

Target · « **Reply #34 on:** November 25, 2013, 06:09 PM »

I had a browse through and didn't see this mentioned, so...

have you tried booting to safe mode? You probably wouldn't want to work there but as it loads a minimal amount of drivers etc it's a good way to (potentially) rule out a few candidates

4wd · « **Reply #35 on:** November 25, 2013, 06:19 PM »

^Oh yeah, that

No. That seems to have been just a coincidence. But the ATI driver does seem to be crashing a lot then. It has given me 21 events only today (and I'm only counting the events occurring at different times, as I had 13 events at 23:29:40 alone), even though I haven't noticed anything unusual happening.

So what has the .NET Framework got to do with all this (ATI driver crashes)?
-dr_andus (November 25, 2013, 05:42 PM)

The .NET Framework is used by the ATI CCC, (Catalyst Control Panel - or whatever it's called, it's changed name since then).

Aside from what Target mentioned, (trying Safe Mode), I'd be tempted to remove iTunes, the ATI drivers, and the .NET Framework.
Optional: Use Driver Sweeper to remove any trace of the ATI graphics drivers and the .NET Cleanup Tool.

Then reinstall .NET and the latest ATI drivers for the card and see how that goes for a while.

As before: Do a BACKUP before you do the above.

dr_andus · « **Reply #36 on:** November 25, 2013, 06:48 PM »

Aside from what Target mentioned, (trying Safe Mode), I'd be tempted to remove iTunes, the ATI drivers, and the .NET Framework.
Optional: Use Driver Sweeper to remove any trace of the ATI graphics drivers and the .NET Cleanup Tool.

Then reinstall .NET and the latest ATI drivers for the card and see how that goes for a while.

As before: Do a BACKUP before you do the above.
-4wd (November 25, 2013, 06:19 PM)

Wow, that sounds like a massive job.

I think I'll start with the dusting...

But many thanks for all the advice. I'll have to go and sort this out step-by-step. It will take a while...

Target · « **Reply #37 on:** November 25, 2013, 07:50 PM »

instead of uninstalling stuff I'd probably use something like Autoruns (portable version here) and disable all the non essential items - you can go back and reenable stuff selectively to narrow things down if this helps.

If and when you identify the culprit then you can uninstall and update/reinstall

x16wda · « **Reply #38 on:** November 25, 2013, 08:40 PM »

If you don't use iTunes I'd be sorely tempted to remove it and every trace of it, including Bonjour.
-4wd (November 25, 2013, 04:28 PM)

Yes, but that's almost pointless, because it seems like the next time you type the word "apple" that dratted Bonjour crap gets reinstalled. Same if you visit a web page with a picture of an apple on it. (Damn, there it is again... appwiz.cpl time again...)

Stoic Joker · « **Reply #39 on:** November 26, 2013, 07:02 AM »

I don't know that anybody hates Bonjour more than I do, but I can't see it doing this. So I'd stay focused on the video angle for now.

@4wd - Yes uptime.exe had developed a crashing problem awhile back (it is an NT4 utility...), but I was thinking it was only for network connections...not LM too (oops!). Also IIRC it reports in UTC so the disparity should match your time zone offset.

dr_andus · « **Reply #40 on:** November 26, 2013, 07:22 AM »

I don't know that anybody hates Bonjour more than I do, but I can't see it doing this. So I'd stay focused on the video angle for now.
-Stoic Joker (November 26, 2013, 07:02 AM)

I have disabled Bonjour (using WinPatrol Pro), but the ATI errors keep happening. They seem to be more varied now, but they all seem to have something to do with Catalyst Control Center. E.g.

Exception <UpdateJumpLists>: A valid active Window is needed to update the Taskbar
Exception Called by: ATI.ACE.CLI.Component.Dashboard.DBFavouritesSectionVMController::DoSetTree

Could not load file or assembly 'file:///C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResourcesNet4.dll' or one of its dependencies. The system cannot find the file specified.
Error Called by: System.RuntimeTypeHandle::CreateInstance

Failed to retrieve Fuel shared caste
Error Called by: ATI.ACE.CCC.Implementation.CCC_Main::CCCNewThreadBegin

Could not find Type [ATI.ACE.CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard.DB_TutorialInfoCentre] from [CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard] in assembly [CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard]
Error Called by: ATI.ACE.CLI.Component.Client.Shared.Private.BaseCaste::ProcessAspects

Exception <Load>: Could not load file or assembly 'CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard' or one of its dependencies. The system cannot find the file specified.
Exception Called by: ATI.ACE.CLI.Component.Client.Shared.Private.BaseCaste::LoadAspects

Failed to subscrive to HKCU;software\wow6432node\ati\ace\settings\aem
Error Called by: System.Threading.ExecutionContext::runTryCode

FAILED: ADL.ADL.ADL_DFP_AllowOnlyCETimings_Get
Error Called by: ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP::NotifyeeValueUpdated

IDEMDeviceDFP2Settings_0812.GetDFP2ITCFlag failed with status 7
Error Called by: ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP::NotifyeeValueUpdated

iDEMDeviceDFP2Settings.GetDFP2DVIReduceBlankingInfo failed with status 7
Error Called by: ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP::NotifyeeValueUpdated

These all occured within a minute or two (and the list goes on).

Reliability History also tells me that I had a "critical event" yesterday: Video hardware error.

In the meantime I'd cleaned out the dust from the PC, using a fine brush

, but that didn't seem to make a difference.

dr_andus · « **Reply #41 on:** November 26, 2013, 08:41 AM »

I'd just realised that there was a stupid option in Catalyst Control Center (CCC) that says "Allow Web content," which hid the links to "Check for driver updates." It turned out that I didn't have the latest driver, so I downloaded the installer.

It took well over an hour to install everything. It installed the new driver, removed .NET 4.0 and installed .NET 4.5, MS Visual C++ 2012 x86, and a new version of AMD CCC.

But the error reports in the ACEEventLog continue, looking very similar to the ones above.

How worried should I be about these? The original automatic re-boot problem seems to have stopped, and all 3 of my monitors work fine. This is not affecting my work currently in any way.

4wd · « **Reply #42 on:** November 26, 2013, 09:28 PM »

How worried should I be about these? The original automatic re-boot problem seems to have stopped, and all 3 of my monitors work fine. This is not affecting my work currently in any way.
-dr_andus (November 26, 2013, 08:41 AM)

I guess that depends on how reliable you perceive your computer to be.

They seem to be Information events, (which I didn't notice before) - you can generally ignore them.

I have tons of Information alerts coming from the AMD drivers in the ACEEventLog.

Given that the computer is no longer restarting I'll throw in with SJ and say it was video related. Probably some recent update not interacting well with the old drivers.

One thing you could have done while dusting out the computer was remove the video card and then plug it back in again - ensures it's firmly seated and hasn't "crept" in the socket.

All-in-all, if it can survive the week without either the original or a new fault occurring, then I'd chalk it up to the drivers.

clk4suport · « **Reply #43 on:** November 26, 2013, 11:43 PM »

HI,

Sorry to hear that about your computer.
In my opinion, you have take it at service center because as you know PC's are very delicate items so, if any thing goes out of track then its definitely not good for you. So, you have to go.

dr_andus · « **Reply #44 on:** November 27, 2013, 04:54 AM »

I may have spoken too soon, as after having put it to sleep last night, this morning when I woke the PC, it was in a rebooted state, asking me to log on.

Now there is one (to me) curious aspect to this: how can a PC reboot itself while it is sleeping? I don't hear any noise whatsoever... No fans, no disks, nothing. Or does it happen while it's pretending to go to sleep? Granted, the time it is taking to go to sleep has gotten longer in recent weeks, and it can take from 30 sec up to a minute.

Here is the second curious thing. When I checked the Reliability Monitor this morning, it told me I had 27 Microsoft .NET Framework 4.5 updates, security updates, and application reconfigurations between 03:08 and 03:25. Now, both me and my PC were fast asleep then. So, how could it have been doing all these installations during that time? Could it be then Microsoft that has rebooted my machine overnight to finish the update?

If so, I'd really like to (un)check some box somewhere to make it ask me first before it reboots my PC...

4wd · « **Reply #45 on:** November 27, 2013, 05:00 AM »

How can I find out what is restarting my PC automatically?

Do you have the system set to auto-update, (default is 3am everyday)?

This isn't going to turn out to be something as simple as this all along is it? $:-\$

dr_andus · « **Reply #46 on:** November 27, 2013, 05:23 AM »

Do you have the system set to auto-update, (default is 3am everyday)?

This isn't going to turn out to be something as simple as this all along is it? $:-\$
-4wd (November 27, 2013, 05:00 AM)

Thanks!

You were right. Having said that, nowhere does it say that you also give them the permission to restart your PC. I usually have quite a few applications open with work-in-progress, so I don't like the idea of those being shut down. But can MS still do the updates while the PC is not actually running?

In any case, many thanks for educating me about the Reliability Monitor and the Event Viewer. It helped me discover that there are some problems with either my ATI card, or with CCC, or with .NET Framework (or with all of them). In fact in the last 24 hrs I've received 12 SideBySide errors, which also seems to be .NET related. But I have just been sent a .NET 4.5.1 update, so hopefully that will fix things. Cheerio...

4wd · « **Reply #47 on:** November 27, 2013, 05:53 AM »

But can MS still do the updates while the PC is not actually running?
-dr_andus (November 27, 2013, 05:23 AM)

The auto-update creates a task that'll wake the computer to do the update check, and restart it to complete installation of any updates if required.

If you don't want it to do it, select one of the 3 other options - as you can see I just have it set to notify me of any updates.

Time to turn in my tech badge, too much over-thinking ...

However, I did manage to resurrect a DELL XPS730 by replacing some motherboard capacitors in the last day or so ... so maybe I'll keep my badge

dr_andus · « **Reply #48 on:** November 27, 2013, 06:35 AM »

Don't turn in the badge yet... If anything, this was a very helpful discussion. I got a lot less dust in my PC for a start.

Not to mention all the updated drivers and software. Many thanks for all the help. (I did change the settings, so I'll wait and see if the reboots stop as well.)

Stoic Joker · « **Reply #49 on:** November 27, 2013, 07:03 AM »

Time to turn in my tech badge, too much over-thinking ...
-4wd (November 27, 2013, 05:53 AM)

Nope, that just the downside of trying to work something blind. We tend to assume too much about the environment in question, and sometimes miss the obvious...or something that would have been obvious - because we'd have reflexively checked it a long time ago - had we been sitting in front of the machine.

As long as it's fixed...that's the important part.