Subscriber Discussion

Best Software To Log Sudden Shutdown In Windows 7 NVR

UI
Undisclosed Integrator #1
Nov 23, 2014

It has been the third time in 2 weeks that my customer had called me to report that he cannot connect to the PC-Based NVR. I told him that I blocked the VMS with a password, left the webserver running with the client software working OK, and locked it with a limited account so that no one could close the software while recording. I said to him: either an unauthorized person pushed the ON/OFF/Reset button on the NVR or they are having serious electricity under-voltages issues at their office. The customer ruled out the "unauthorized sabotage", so we are left with the electrical problems causing sudden shutdowns to the NVR. Even though "supposedly" the customer has a central UPS that is working fine.

I've audited the PC NVR's Windows 7 Events Log and what I found is a bunch of "cryptic" events that I barely understand, but no signs of a sudden shutdown in the log.

What is the best way to log (i.e.: having a text file with the date and time that you can audit afterwards) sudden shutdowns to the PC NVR ?? I´ve heard that maybe using an APC BackUPS communicating with their Powerchute software may work, but honestly I haven't tried it. Is there an easier software-only solution without buying another UPS battery to segregate it from the central UPS ?? Also, it would be good to prove the customer that their central UPS need maintenance coz it is not doing it's job properly.

UI
Undisclosed Integrator #2
Nov 23, 2014

We had similar issues with a PC that kept running windows updates and restarting automatically, check if you have disabled windows updates.

For monitorig power you could look at a 'mains fail" relay onto a plug point and wire this into a camera. Hopefullythe camera or vms can the power interuption log this event before shutting down.

U
Undisclosed #3
Nov 23, 2014

This info should already be in your system event log (more or less). This link might help:

How to tell when your PC rebooted

(2)
Avatar
Carl Lindgren
Nov 23, 2014

The "how/when" is easy, it's the "why" that is often difficult to ascertain. Every time a server reboots, there will be a string of entries in the Window Event Logs as services start up. However, loss of power and many other causes often leave no clues as to the reason for unexpected shutdowns.

You might try getting the automatic mini dump file and analyzing it. Instructions are Here.

Unfortunately, even that is often useless. Certain types of crashes, especially loss of power, etc. don't even allow dump file creation and even if it is created, it is often ambiguous. There have been times when I just had to resort to continuously monitoring the system until the problem actually happened right in front of me.

Rv
Rogier van der Heide
Nov 24, 2014

For checking power, we use a Fluke VR1710.

Another more simpel solution is using a relay which feeds itself trough it's own contact. You start it by manually making the contact, it will then keep itself up. Then if you have a power dip, it will fall off and stay off. Always an easy and simple way to see if you had a power dip.

Edit: relay drawing

MF
Mario Fernandez
Nov 24, 2014

It is not clear from the post if the NVR is located inside a protected space or not but I am going on a limb here. As dumb as it may seem, make sure nobody is unplugging the PC NVR from the wall in order to use the outlet. I had such an incident at a customer's site where there was a centralized UPS solution. We went nuts troubleshooting mysterious shutdowns on a PC only to find out the cleaning crew was unplugging the unit from the wall in order to plug their vacuum cleaner. If you have a local UPS (Placed very inconveniently so they don't plug to the UPS) at least it would start beeping and may alert the offender that they just unplugged something critical, or so we hope.

Avatar
Mike Dotson
Nov 24, 2014
Formerly of Seneca • IPVMU Certified

There IS a way to tell the difference between a forced power off via Power Button and a hard power loss in the event log.

Open up the Kernal Power event...usually '41' and inspect the value for the powerbuttontimestamp.

A non zero value means a human was involved.

Here is an example.....

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Event ID: 41
Level: Critical
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.


The Details tab shows the following information:

EventData
BugcheckCode 0
BugcheckParameter1 0x0
BugcheckParameter2 0x0
BugcheckParameter3 0x0
BugcheckParameter4 0x0
SleepInProgress true
PowerButtonTimestamp 129165039139928187

UM
Undisclosed Manufacturer #4
Nov 24, 2014
Are you just wanting to find out at what time the pc powered off? You could write a looping batch file that periodically appends the date and time to a text file. Then if it powers off you will be able to see the approximate time it happened by looking at the text file. A Google search will show you a few different ways you could do this with a batch file.
EN
EJ Nemec
Nov 24, 2014
It's not unusual for a pc to shutdown if it overheats. Could be any part, processor, video card, hdd. If you know how to service pcs, you might want to open the case and see how dirty it is, carefully feel around to see if anything is too hot. There is pc temp monitoring software on cnet.com or other location for free. If you feel someone is shutting it down how about adding a temporary camera to view just the pc?
HR
Haroon Rehman
Nov 24, 2014
IPVMU Certified

Post the log file here mate, and we can identify the issue from it.

Avatar
Mike Dotson
Nov 24, 2014
Formerly of Seneca • IPVMU Certified

In the 'System' event log, Right near the Kernal-Power and kernal-General is one called EventLog.with an id of 6008.

It will have the time of the shutdown event. (note that the underlined EventLog is NOT the one that matches the detailed information. It is simply the closest one to the bottom when I grabbed the screen shot)

Unexpected Power Loss Time

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions