Best Software To Log Sudden Shutdown In Windows 7 NVR

It has been the third time in 2 weeks that my customer had called me to report that he cannot connect to the PC-Based NVR. I told him that I blocked the VMS with a password, left the webserver running with the client software working OK, and locked it with a limited account so that no one could close the software while recording. I said to him: either an unauthorized person pushed the ON/OFF/Reset button on the NVR or they are having serious electricity under-voltages issues at their office. The customer ruled out the "unauthorized sabotage", so we are left with the electrical problems causing sudden shutdowns to the NVR. Even though "supposedly" the customer has a central UPS that is working fine.

I've audited the PC NVR's Windows 7 Events Log and what I found is a bunch of "cryptic" events that I barely understand, but no signs of a sudden shutdown in the log.

What is the best way to log (i.e.: having a text file with the date and time that you can audit afterwards) sudden shutdowns to the PC NVR ?? I´ve heard that maybe using an APC BackUPS communicating with their Powerchute software may work, but honestly I haven't tried it. Is there an easier software-only solution without buying another UPS battery to segregate it from the central UPS ?? Also, it would be good to prove the customer that their central UPS need maintenance coz it is not doing it's job properly.

We had similar issues with a PC that kept running windows updates and restarting automatically, check if you have disabled windows updates.

For monitorig power you could look at a 'mains fail" relay onto a plug point and wire this into a camera. Hopefullythe camera or vms can the power interuption log this event before shutting down.

This info should already be in your system event log (more or less). This link might help:

How to tell when your PC rebooted

The "how/when" is easy, it's the "why" that is often difficult to ascertain. Every time a server reboots, there will be a string of entries in the Window Event Logs as services start up. However, loss of power and many other causes often leave no clues as to the reason for unexpected shutdowns.

You might try getting the automatic mini dump file and analyzing it. Instructions are Here.

Unfortunately, even that is often useless. Certain types of crashes, especially loss of power, etc. don't even allow dump file creation and even if it is created, it is often ambiguous. There have been times when I just had to resort to continuously monitoring the system until the problem actually happened right in front of me.

For checking power, we use a Fluke VR1710.

Another more simpel solution is using a relay which feeds itself trough it's own contact. You start it by manually making the contact, it will then keep itself up. Then if you have a power dip, it will fall off and stay off. Always an easy and simple way to see if you had a power dip.

Edit: relay drawing

It is not clear from the post if the NVR is located inside a protected space or not but I am going on a limb here. As dumb as it may seem, make sure nobody is unplugging the PC NVR from the wall in order to use the outlet. I had such an incident at a customer's site where there was a centralized UPS solution. We went nuts troubleshooting mysterious shutdowns on a PC only to find out the cleaning crew was unplugging the unit from the wall in order to plug their vacuum cleaner. If you have a local UPS (Placed very inconveniently so they don't plug to the UPS) at least it would start beeping and may alert the offender that they just unplugged something critical, or so we hope.

There IS a way to tell the difference between a forced power off via Power Button and a hard power loss in the event log.

Open up the Kernal Power event...usually '41' and inspect the value for the powerbuttontimestamp.

A non zero value means a human was involved.

Here is an example.....

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Event ID: 41
Level: Critical
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

The Details tab shows the following information:

BugcheckCode 0
BugcheckParameter1 0x0
BugcheckParameter2 0x0
BugcheckParameter3 0x0
BugcheckParameter4 0x0
SleepInProgress true
PowerButtonTimestamp 129165039139928187

Are you just wanting to find out at what time the pc powered off? You could write a looping batch file that periodically appends the date and time to a text file. Then if it powers off you will be able to see the approximate time it happened by looking at the text file. A Google search will show you a few different ways you could do this with a batch file.
It's not unusual for a pc to shutdown if it overheats. Could be any part, processor, video card, hdd. If you know how to service pcs, you might want to open the case and see how dirty it is, carefully feel around to see if anything is too hot. There is pc temp monitoring software on or other location for free. If you feel someone is shutting it down how about adding a temporary camera to view just the pc?

Post the log file here mate, and we can identify the issue from it.

In the 'System' event log, Right near the Kernal-Power and kernal-General is one called EventLog.with an id of 6008.

It will have the time of the shutdown event. (note that the underlined EventLog is NOT the one that matches the detailed information. It is simply the closest one to the bottom when I grabbed the screen shot)

Unexpected Power Loss Time