Read Shutdown Logs in Event Viewer in Windows  

    Read Shutdown Logs in Event Viewer in Windows

    Read Shutdown Logs in Event Viewer in Windows

    How to Read Shutdown and Restart Event Logs in Windows
    Published by Category: Performance & Maintenance
    11 Apr 2024
    Designer Media Ltd

    How to Read Shutdown and Restart Event Logs in Windows


    You can use Event Viewer to view the date, time, and user details of all shutdown events caused by a shut down (power off) or restart.

    The event ID's below will show you these details.

    Event ID Description
    41 The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
    1074 Logged when an app (ex: Windows Update) causes the system to restart, or when a user initiates a restart or shutdown.
    6006 Logged as a clean shutdown. It gives the message "The Event log service was stopped".
    6008 Logged as a dirty shutdown. It gives the message "The previous system shutdown at time on date was unexpected".

    This tutorial will show you how to view the date, time, and user details of all shutdown and restart event logs in Windows 7, Windows 8, Windows 10, and Windows 11.



    Here's How:

    1 Press the Win + R keys to open Run, type eventvwr.msc into Run, and click/tap on OK to open Event Viewer.

    2 In the left pane of Event Viewer, open Windows Logs and System, right click or press and hold on System, and click/tap on Filter Current Log. (see screenshot below)

    If you have already filtered this log, click/tap on Clear Filter first and then click/tap on Filter Current Log to start over fresh.

    Read Shutdown Logs in Event Viewer in Windows-shutdown_event_logs-1.png

    3 Enter the event ID's below into the <All Event IDs> field, and click/tap on OK. (see screenshot below)

    41, 1074, 6006, 6008

    Read Shutdown Logs in Event Viewer in Windows-shutdown_event_logs-2.png

    4 You can now view the details of these shutdown event logs filtered by these event IDs. (see screenshots below)

    Read Shutdown Logs in Event Viewer in Windows-event_id_1074_power-off.png
    Read Shutdown Logs in Event Viewer in Windows-event_id_1074_restart.png
    Read Shutdown Logs in Event Viewer in Windows-event_id_6006.png
    Read Shutdown Logs in Event Viewer in Windows-event_id_6008.png

    5 When finished viewing log details, you can close Event Viewer if you like.


    That's it,
    Shawn Brink






  1. Posts : 41,715
    windows 10 professional version 1607 build 14393.969 64 bit
       #1

    An additional event seen with crashes is 41: (lost power unexpectedly)

    Code:
    Event:
      Log Name: System
      Source: Microsoft-Windows-Kernel-Power
      Date: 
      Event ID: 41
      Task: N/A
      Level: Critical
      Opcode: Info
      Keyword: 
      User: 
      User Name: 
      Computer: 
      Description: 
    The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
      My Computer


  2. Posts : 69,982
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #2

    zbook said:
    An additional event seen with crashes is 41: (lost power unexpectedly)
    Thank you. Now added to tutorial.
      My Computers


  3. Posts : 27
    Windows 10 Pro
       #3

    You can also create a custom filter to filter the various different types such as a poweroff event explicitly like so. Otherwise there's no other way to do so with a basic filter.

    I needed this write this query when I was trying to create a Task Scheduler to run a program to turn off my NAS when the PC was shutting down.

    Code:
    <QueryList>
      <Query Id="0" Path="System">
        <Select Path="System">
        *[System[Provider[@Name='User32'] and (Level=4 or Level=0) and (EventID=1074)]]
       and 
         *[EventData[Data[@Name='param5'] and (Data='power off')]]
        </Select>
      </Query>
    </QueryList>
      My Computer


  4. Posts : 16
    Windows 10 and Mac OS X
       #4

    Hi, I wanted to add a Thank you! This is working correctly on Win 11 OS version: 23H2.
    When adding the numbers 1074, 6006, 6008, and 41 to the filter area, just space them with commas and you are set like this:
    1074, 6006, 6008, 41

    Next, sort by date, as newest date first (recommended).


    Michael
      My Computer


  5. Posts : 69,982
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #5

    Exsosus said:
    Hi, I wanted to add a Thank you! This is working correctly on Win 11 OS version: 23H2.
    When adding the numbers 1074, 6006, 6008, and 41 to the filter area, just space them with commas and you are set like this:
    1074, 6006, 6008, 41

    Next, sort by date, as newest date first (recommended).


    Michael
      My Computers


 

Tutorial Categories

Read Shutdown Logs in Event Viewer in Windows Tutorial Index Network & Sharing Instalation and Upgrade Browsers and Email General Tips Gaming Customization Apps and Features Virtualization BSOD System Security User Accounts Hardware and Drivers Updates and Activation Backup and Restore Performance and Maintenance Mixed Reality Phone


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 13:17.
Find Us




Windows 10 Forums