Found all the Servers that were restart without the maintenance mode were actived ?

Question

Hi all
I was wondering if I can find a query about this request:
- Found all the Servers that were restart without the maintenance mode were actived ?
It's to make a Report To include in Reporting Services.
sorry for my English :)
Thank you very much and have a good day

Answer 1

Hi, first if the maintenance mode is activated no events are collected, then, as example, in default rules you can see the following
Collection Rule for Windows Restarted Events that collects eventid=6005
with eventsourcename=eventlog from System
log which is enabled by default.
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2&EvtID=6005&EvtSrc=EventLog&LCID=1033
So you can check Data warehouse DB for presence such event
select ComputerName, DateTime from Event.vEvent ev
inner join Event.vEventDetail evd on ev.eventoriginid = evd.eventoriginid
inner join Event.vEventParameter evp on ev.eventoriginid = evp.eventoriginid
inner join vEventLoggingComputer elc on elc.eventloggingcomputerrowid = ev.loggingcomputerrowid
where eventdisplaynumber = '6005' Order by ComputerName, Datetime
http://blogs.technet.com/b/kevinholman/archive/2007/10/18/useful-operations-manager-2007-sql-queries.aspx
So if you see this event it means the server was restarted and the maintenance mode was not activated.
Also keep in mind that there can be other event ids when computer is restarted, as example see the rule
Collection Rule for Windows Restart Events (restarted from bugcheck)