Start and shutdown log Windows 10

I would like to check when my PC started, I read about event log id 6006 and 6005 to check the log service start up and shutdown event... but this method doesn't work.

The last eventlog service restart was made 1 month ago, but I'm sure my PC is shutted down daily and I'm sure I made "shut down" and not "suspend"!

Why I cannot find this log? How can I see when my PC started up or shut down?

Tobia

Posted 2017-06-07T07:33:00.477

Reputation: 2 022

Having the same issue... 6005 and 6006 are logged just every now and then. Same for all the other IDs I can find when searching for this issue... Seems to be an exception though, as everyone is recommending the same IDs and nobody has issues like us. – MOnsDaR – 2017-11-25T13:09:23.533

1Please see the answer to myself – Tobia – 2017-11-25T13:16:31.757

I found that the tool ComputerTurnedOnTimes from NirSoft does the job. Seems it uses the EventLog too, as the results are similar, though it is able to give me correct results: http://www.nirsoft.net/utils/computer_turned_on_times.html

– MOnsDaR – 2017-11-27T13:19:10.700

Answers

At last my issue was the hybrid windows shutdown:

https://www.howtogeek.com/243901/the-pros-and-cons-of-windows-10s-fast-startup-mode/

With this option on (windows default) the service doesn't start at every windows startup. This is the cause of logs lack.

Tobia

Posted 2017-06-07T07:33:00.477

Reputation: 2 022

I found an alternative answer, for those who want to keep Fast-Restart ON.

event viewer->system-> Filter this log -> now filter on :
- events : 1, 42 ( 1= system time has changed=startup /42= system is entering sleep)
- Event Sources : Kernel-General, Kernel-Power (you'll get task category 5/64)

the only miss in the log is when you just close the lid without 'shutdown' this is also logged

coiskes

Posted 2017-06-07T07:33:00.477

Reputation: 11

I can confirm this works in Windows 10. Thanks! – Alex – 2019-05-06T05:34:42.777

could be that the logging mechanism was somehow stopped or corrupted for any number of reasons. You may need to clear and reset things to get things going again
could be malware/someone broke in and wiped your logs
could be that the logs are of a finite length and have had to be cropped in order to maintain that particular size and save space on your hard drive. Clear and reset is the only option here
could be that you're looking in the wrong place or that a filter of some sort has been placed on things which is stopping you from seeing things (I'm doubtful of that though because if you know where to look already you would already know this)
if you still can't get things working I'd consider creating a small script or program of some sort that logs things into a file of your own choosing because most of the options are there seem to be reliant on Event Viewer working properly. Make relevant entries to Windows Startup folder, Registry, msconfig to get things going or else turn it into a Windows service which polls events that you see during startup or shutdown. That should work as a fall back position...

https://www.maketecheasier.com/see-pc-startup-and-shutdown-history-in-windows/

https://www.thewindowsbulletin.com/view-startup-shutdown-history-windows-662/

dtbnguyen

Posted 2017-06-07T07:33:00.477

Reputation: 451