4

I would like to check when my PC started, I read about event log id 6006 and 6005 to check the log service start up and shutdown event... but this method doesn't work.

The last eventlog service restart was made 1 month ago, but I'm sure my PC is shutted down daily and I'm sure I made "shut down" and not "suspend"!

Why I cannot find this log? How can I see when my PC started up or shut down?

Improve this question
3
  • Having the same issue... 6005 and 6006 are logged just every now and then. Same for all the other IDs I can find when searching for this issue... Seems to be an exception though, as everyone is recommending the same IDs and nobody has issues like us.
    – MOnsDaR
    Commented Nov 25, 2017 at 13:09
  • 1
    Please see the answer to myself
    – Tobia
    Commented Nov 25, 2017 at 13:16
  • I found that the tool ComputerTurnedOnTimes from NirSoft does the job. Seems it uses the EventLog too, as the results are similar, though it is able to give me correct results: nirsoft.net/utils/computer_turned_on_times.html
    – MOnsDaR
    Commented Nov 27, 2017 at 13:19

3 Answers 3

Reset to default
3

At last my issue was the hybrid windows shutdown:

https://www.howtogeek.com/243901/the-pros-and-cons-of-windows-10s-fast-startup-mode/

With this option on (windows default) the service doesn't start at every windows startup. This is the cause of logs lack.

Improve this answer
2

I found an alternative answer, for those who want to keep Fast-Restart ON.

event viewer->system-> Filter this log -> now filter on :
- events : 1, 42 ( 1= system time has changed=startup /42= system is entering sleep)
- Event Sources : Kernel-General, Kernel-Power (you'll get task category 5/64)

the only miss in the log is when you just close the lid without 'shutdown' this is also logged

Improve this answer
1
  • I can confirm this works in Windows 10. Thanks!
    – Alex
    Commented May 6, 2019 at 5:34
0
  • could be that the logging mechanism was somehow stopped or corrupted for any number of reasons. You may need to clear and reset things to get things going again
  • could be malware/someone broke in and wiped your logs
  • could be that the logs are of a finite length and have had to be cropped in order to maintain that particular size and save space on your hard drive. Clear and reset is the only option here
  • could be that you're looking in the wrong place or that a filter of some sort has been placed on things which is stopping you from seeing things (I'm doubtful of that though because if you know where to look already you would already know this)
  • if you still can't get things working I'd consider creating a small script or program of some sort that logs things into a file of your own choosing because most of the options are there seem to be reliant on Event Viewer working properly. Make relevant entries to Windows Startup folder, Registry, msconfig to get things going or else turn it into a Windows service which polls events that you see during startup or shutdown. That should work as a fall back position...

https://www.maketecheasier.com/see-pc-startup-and-shutdown-history-in-windows/

https://web.archive.org/web/20160304094624/https://www.thewindowsbulletin.com/view-startup-shutdown-history-windows-662/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .