A machine, that is dedicated to running an IVR application, is supposed to be available to take customer telephone inquiries 24/7. Sometimes the computer reboots itself, without taking a dump. The problem is to prove to the commercial IVR application developer that their SKU is responsible for the reboot. As Windows neglects to log such events, I'm in a quandary. The IVR application also doesn't log its attempts to reboot the computer. We are running ProcMon, which may catch somebody in the act.  So far there hasn't been the lucky coincidence of ProcMon running and a reb

Hi,

Generally speaking, Event Viewer would record system shutdown events, you can follow the path below to check it:

Windows Logs -> System log

In System log, using filter to search event ID 6006, which indicates that the event log service was shut downone of the last things that happens before a reboot.

I believe what you say is true.  Anytime the system shuts down the Event Log records a shutdown event.  The problem is how to distinguish between a shutdown that was requested by an end-user at a keyboard and a shutdown that was requested by the IVR application.

Hi,

There should be a description about this in Event log, you can follow the shutdown trace in event log to find it.

If there is any difficult with reading Event log, you can export the log file and upload it to your OneDrive, then post the sharing link here.

Here is the content of an event log that seems pertinent:

The process C:\WINDOWS\system32\winlogon.exe (P15) has initiated the restart of computer P15 on behalf of user P15\Ugen for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: restart
 Comment:

Well, that's pretty disappointing.  It names some operating system process that is instrumental in the restart.  It tells what computer is being restarted.  It tells what user logon account apparently initiated the restart, but not which application.  And it fails to interpret the Reason Code which is "I don't know what."  Presumably a BSOD wouldn't look much like this.  I wish the writers of this dreck would face facts and state the obvious.  No pussyfooting around.  If application X with logon id Y asks for a reboot then say so.