Look at the Event Logs/Reliability History, the reason it shut down should be supplied along with the event.  However, if it was a spontaneous event, (eg. power removal - non-UPS backup, catastrophic software failure, etc), then you'll probably never have an idea as the system dies before anything can be written.

eg.



If you want a filter for the Event Log for startup/shutdown events, see here.

Does Win 7 still record the 6008 event in the system event log? That would at least tell you if the shutdown was unexpected.

If you just want a quick list of shutdown events try uptime.exe with the /S switch.

It was originally for NT4, but still runs on Win7.

Oh yeah...this is a command line program, so there is no GUI.

If you just want a quick list of shutdown events try uptime.exe with the /S switch.

DOH!  Forgot about that but I'm not sure that it's going to be 100% accurate, eg.



The above Critical event is due to a power outage, when I ran uptime /s it crashed and terminated when it got that event:



And the time was way off, (~9 hours).

Of course, it could have crashed due to something it didn't like on my system but then again ...

Quote from: 4wd on November 25, 2013, 12:13 AM

Look at the Event Logs

Thanks for that. I found two unusual events (see screenshots below).

SJ suggested the Event logs originally  

Firstly, in the ECEEventLog (whatever that is), for the last 5 days I have 743 events, and they all seem to relate to  ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP, which seems to point to my ATI Radeon graphics card. Is that bad?

The ATI graphics driver restarts itself whenever it suffers a critical problem, IIRC.

More interesting:

Secondly, under Administrative Events, I have 2374 errors (out of 2,445 errors in total) for the last 7 days, produced by Apple's Bonjour Service. I imagine this is for syncing with iCloud (which I don't really use), and checking whether I have the latest iTunes (which I don't really use). Is this something bad enough that it would be better for me to block this somehow?

These events are happening one minute before the ATI driver has a hernia.  Can you check to see if that trend is followed with prior events, (the sample on the captures is rather small) ?

The Bonjour service is used to discover any other Apple devices on the local network and setup communication with them, (IIRIR).  If you don't use iTunes I'd be sorely tempted to remove it and every trace of it, including Bonjour.

I had a browse through and didn't see this mentioned, so...

have you tried booting to safe mode?  You probably wouldn't want to work there but as it loads a minimal amount of drivers etc it's a good way to (potentially) rule out a few candidates

Aside from what Target mentioned, (trying Safe Mode), I'd be tempted to remove iTunes, the ATI drivers, and the .NET Framework.
Optional: Use Driver Sweeper to remove any trace of the ATI graphics drivers and the .NET Cleanup Tool.

Then reinstall .NET and the latest ATI drivers for the card and see how that goes for a while.

As before: Do a BACKUP before you do the above.

Wow, that sounds like a massive job.    I think I'll start with the dusting...

But many thanks for all the advice. I'll have to go and sort this out step-by-step. It will take a while...

If you don't use iTunes I'd be sorely tempted to remove it and every trace of it, including Bonjour.

Yes, but that's almost pointless, because it seems like the next time you type the word "apple" that dratted Bonjour crap gets reinstalled.  Same if you visit a web page with a picture of an apple on it.  (Damn, there it is again... appwiz.cpl time again...) 

I don't know that anybody hates Bonjour more than I do, but I can't see it doing this. So I'd stay focused on the video angle for now.

I have disabled Bonjour (using WinPatrol Pro), but the ATI errors keep happening. They seem to be more varied now, but they all seem to have something to do with Catalyst Control Center. E.g.

Exception <UpdateJumpLists>: A valid active Window is needed to update the Taskbar
Exception  Called by: ATI.ACE.CLI.Component.Dashboard.DBFavouritesSectionVMController::DoSetTree 

Could not load file or assembly 'file:///C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResourcesNet4.dll' or one of its dependencies. The system cannot find the file specified.
Error      Called by: System.RuntimeTypeHandle::CreateInstance

Failed to retrieve Fuel shared caste
Error      Called by: ATI.ACE.CCC.Implementation.CCC_Main::CCCNewThreadBegin     

Could not find Type [ATI.ACE.CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard.DB_TutorialInfoCentre] from [CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard] in assembly [CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard]
Error      Called by: ATI.ACE.CLI.Component.Client.Shared.Private.BaseCaste::ProcessAspects   

Exception <Load>: Could not load file or assembly 'CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard' or one of its dependencies. The system cannot find the file specified.
Exception  Called by: ATI.ACE.CLI.Component.Client.Shared.Private.BaseCaste::LoadAspects     

Failed to subscrive to HKCU;software\wow6432node\ati\ace\settings\aem
Error      Called by: System.Threading.ExecutionContext::runTryCode       

FAILED: ADL.ADL.ADL_DFP_AllowOnlyCETimings_Get
Error      Called by: ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP::NotifyeeValueUpdated                         

IDEMDeviceDFP2Settings_0812.GetDFP2ITCFlag failed with status 7
Error      Called by: ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP::NotifyeeValueUpdated

iDEMDeviceDFP2Settings.GetDFP2DVIReduceBlankingInfo failed with status 7
Error      Called by: ATI.ACE.CLI.Aspect.DeviceDFP.Graphics.Runtime.RT_DeviceDFP::NotifyeeValueUpdated     

These all occured within a minute or two (and the list goes on).

Reliability History also tells me that I had a "critical event" yesterday: Video hardware error.

In the meantime I'd cleaned out the dust from the PC, using a fine brush  , but that didn't seem to make a difference.
           

How worried should I be about these? The original automatic re-boot problem seems to have stopped, and all 3 of my monitors work fine. This is not affecting my work currently in any way.

I guess that depends on how reliable you perceive your computer to be.  

They seem to be Information events, (which I didn't notice before) - you can generally ignore them.

I have tons of Information alerts coming from the AMD drivers in the ACEEventLog.

Given that the computer is no longer restarting I'll throw in with SJ and say it was video related.  Probably some recent update not interacting well with the old drivers.

One thing you could have done while dusting out the computer was remove the video card and then plug it back in again - ensures it's firmly seated and hasn't "crept" in the socket.

All-in-all, if it can survive the week without either the original or a new fault occurring, then I'd chalk it up to the drivers.

I may have spoken too soon, as after having put it to sleep last night, this morning when I woke the PC, it was in a rebooted state, asking me to log on.

Now there is one (to me) curious aspect to this: how can a PC reboot itself while it is sleeping? I don't hear any noise whatsoever... No fans, no disks, nothing. Or does it happen while it's pretending to go to sleep? Granted, the time it is taking to go to sleep has gotten longer in recent weeks, and it can take from 30 sec up to a minute.

Here is the second curious thing. When I checked the Reliability Monitor this morning, it told me I had 27 Microsoft .NET Framework 4.5 updates, security updates, and application reconfigurations between 03:08 and 03:25. Now, both me and my PC were fast asleep then. So, how could it have been doing all these installations during that time? Could it be then Microsoft that has rebooted my machine overnight to finish the update?

If so, I'd really like to (un)check some box somewhere to make it ask me first before it reboots my PC...

Do you have the system set to auto-update, (default is 3am everyday)?

This isn't going to turn out to be something as simple as this all along is it? 

Thanks!    You were right. Having said that, nowhere does it say that you also give them the permission to restart your PC. I usually have quite a few applications open with work-in-progress, so I don't like the idea of those being shut down. But can MS still do the updates while the PC is not actually running?

In any case, many thanks for educating me about the Reliability Monitor and the Event Viewer. It helped me discover that there are some problems with either my ATI card, or with CCC, or with .NET Framework (or with all of them). In fact in the last 24 hrs I've received 12 SideBySide errors, which also seems to be .NET related. But I have just been sent a .NET 4.5.1 update, so hopefully that will fix things. Cheerio...

Don't turn in the badge yet... If anything, this was a very helpful discussion. I got a lot less dust in my PC for a start.  Not to mention all the updated drivers and software. Many thanks for all the help. (I did change the settings, so I'll wait and see if the reboots stop as well.)