{"id":894,"date":"2024-11-29T04:02:31","date_gmt":"2024-11-28T22:32:31","guid":{"rendered":"https:\/\/vpswebhostingindia.com\/blog\/?p=894"},"modified":"2024-11-29T04:04:40","modified_gmt":"2024-11-28T22:34:40","slug":"check-reboot-shutdown-logs-in-windows","status":"publish","type":"post","link":"https:\/\/vpswebhostingindia.com\/blog\/check-reboot-shutdown-logs-in-windows\/","title":{"rendered":"How to check Reboot Shutdown logs in Windows server?"},"content":{"rendered":"\n<p>Check Reboot Shutdown logs in <a href=\"https:\/\/www.vpswebhostingindia.com\/vps-hosting\/\">Windows server<\/a>, keeping track of system shutdowns and reboots is crucial for monitoring server health and troubleshooting potential issues. The <strong>Event Viewer<\/strong> is a powerful tool that allows administrators to review detailed logs of system events, including when and why a server was shut down or restarted. By filtering the logs for specific event IDs, you can easily identify whether the shutdown or reboot was planned, user-initiated, or caused by an unexpected error. This guide walks you through the steps to check Reboot Shutdown logs in <a href=\"https:\/\/www.microsoft.com\/en-us\/evalcenter\/evaluate-windows-server-2022\" rel=\"nofollow noopener\" target=\"_blank\">Windows<\/a> using Event Viewer, providing insights into server activity and helping ensure optimal performance.<\/p>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li><a href=\"#step-1-open-event-viewer\">Step 1: Open Event Viewer<\/a><\/li><li><a href=\"#step-3-filter-relevant-events\">Step 3: Filter Relevant Events<\/a><\/li><li><a href=\"#step-4-analyze-the-logs\">Step 4: check Reboot Shutdown logs in Windows<\/a><\/li><li><a href=\"#step-5-understand-event-i-ds\">Step 5: Understand Event IDs<\/a><\/li><li><a href=\"#step-6-clear-or-export-logs-optional\">Step 6: Clear or Export Logs (Optional)<\/a><\/li><li><a href=\"#step-7-close-event-viewer\">Step 7: Close Event Viewer<\/a><\/li><li><a href=\"#key-notes\">Key Notes:<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"step-1-open-event-viewer\"><strong>Step 1: Open Event Viewer<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Access the Run Dialog<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Press the <code>Windows + R<\/code> keys on your keyboard to open the <strong>Run<\/strong> dialog box.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"444\" height=\"259\" src=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-6.png\" alt=\"\" class=\"wp-image-895\" style=\"width:290px;height:auto\" srcset=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-6.png 444w, https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-6-300x175.png 300w\" sizes=\"auto, (max-width: 444px) 100vw, 444px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Launch Event Viewer<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Type <code>eventvwr.msc<\/code> into the Run dialog box and press <code>Enter<\/code>. This will open the <strong>Event Viewer<\/strong> application to check Reboot Shutdown logs in Windows<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"243\" height=\"270\" src=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-7.png\" alt=\"\" class=\"wp-image-896\" style=\"width:167px;height:auto\" srcset=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-7.png 243w, https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-7-180x200.png 180w\" sizes=\"auto, (max-width: 243px) 100vw, 243px\" \/><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"step-2-navigate-to-system-logs\"><strong>Step 2: Navigate to System Logs<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Expand Windows Logs<\/strong>:\n<ul class=\"wp-block-list\">\n<li>In the left-hand navigation pane of Event Viewer, locate and expand the <strong>Windows Logs<\/strong> section by clicking the small triangle next to it.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"211\" height=\"132\" src=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-8.png\" alt=\"\" class=\"wp-image-897\" style=\"width:147px;height:auto\"\/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Select the System Log<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Under <strong>Windows Logs<\/strong>, click on <strong>System<\/strong>. This will display all system events in the middle pane to check Reboot Shutdown logs in Windows.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"241\" height=\"131\" src=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-9.png\" alt=\"\" class=\"wp-image-898\" style=\"width:138px;height:auto\"\/><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"step-3-filter-relevant-events\"><strong>Step 3: Filter Relevant Events<\/strong> <\/h3>\n\n\n\n<p>To focus only on check Reboot Shutdown logs in Windows events, filter the logs for specific Event IDs.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Open the Filter Current Log Window<\/strong>:\n<ul class=\"wp-block-list\">\n<li>On the right-hand side of the Event Viewer window, find the <strong>Actions<\/strong> pane and click <strong>Filter Current Log&#8230;<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"355\" height=\"407\" src=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-10.png\" alt=\"\" class=\"wp-image-899\" style=\"width:214px;height:auto\" srcset=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-10.png 355w, https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-10-174x200.png 174w\" sizes=\"auto, (max-width: 355px) 100vw, 355px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Enter Event IDs<\/strong>:\n<ul class=\"wp-block-list\">\n<li>In the <strong>Filter Current Log<\/strong> dialog box to check Reboot Shutdown logs in Windows<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"658\" height=\"674\" src=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-11.png\" alt=\"\" class=\"wp-image-900\" style=\"width:407px;height:auto\" srcset=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-11.png 658w, https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-11-195x200.png 195w\" sizes=\"auto, (max-width: 658px) 100vw, 658px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Locate the <strong>Event IDs<\/strong> field and enter the following IDs to check Reboot Shutdown logs in Windows, separated by commas:\n<ul class=\"wp-block-list\">\n<li><code>1074<\/code>: Clean shutdown or restart initiated by a user or application.<\/li>\n\n\n\n<li><code>6006<\/code>: Logs when the Event Log service was stopped (indicates a clean shutdown).<\/li>\n\n\n\n<li>41<strong>:<\/strong> This indicates that the Windows computer unexpectedly restarted without shutting down, and the related details can provide information about the potential causes of the issue.<\/li>\n\n\n\n<li><code>6008<\/code>: Logs unexpected shutdowns (e.g., power failures or crashes).<\/li>\n\n\n\n<li><code>6005<\/code>: Logs when the Event Log service started (indicates a system reboot).<\/li>\n\n\n\n<li>1076<strong>:<\/strong>&nbsp;&#8220;The reason supplied by user X for the last unexpected shutdown of this computer is: Y.&#8221; Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"515\" height=\"227\" src=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/1045_Look-for-events-with-the-Event-ID.png\" alt=\"\" class=\"wp-image-901\" style=\"width:365px;height:auto\" srcset=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/1045_Look-for-events-with-the-Event-ID.png 515w, https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/1045_Look-for-events-with-the-Event-ID-300x132.png 300w\" sizes=\"auto, (max-width: 515px) 100vw, 515px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Select Event Sources (Optional)<\/strong>:\n<ul class=\"wp-block-list\">\n<li>If desired, you can filter further by specifying <strong>User32 <\/strong>as the Event Source. This narrows down the logs to those related to user-initiated actions.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Apply the Filter<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Click <strong>OK<\/strong> to apply the filter and return to the Event Viewer window. The middle pane will now display only the filtered events.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"step-4-analyze-the-logs\"><strong>Step 4: check Reboot Shutdown logs in Windows<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>View Event Details<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Browse through the filtered events in the middle pane. Each log entry provides:\n<ul class=\"wp-block-list\">\n<li><strong>Date and Time<\/strong>: When the event occurred.<\/li>\n\n\n\n<li><strong>Source<\/strong>: The process or application responsible for the event.<\/li>\n\n\n\n<li><strong>Event ID<\/strong>: The unique identifier for the type of event.<\/li>\n\n\n\n<li><strong>User<\/strong>: The user account that initiated the action (if applicable).<\/li>\n\n\n\n<li><strong>Description<\/strong>: Detailed information about the event, such as the reason for shutdown or reboot.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"201\" src=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-12-1024x201.png\" alt=\"check Reboot and Shutdown logs in Windows\" class=\"wp-image-903\" style=\"width:718px;height:auto\" srcset=\"https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-12-1024x201.png 1024w, https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-12-300x59.png 300w, https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-12-768x151.png 768w, https:\/\/vpswebhostingindia.com\/blog\/wp-content\/uploads\/2024\/11\/image-12.png 1294w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Open an Event<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Double-click on any event entry to open the <strong>Event Properties<\/strong> window. This displays a detailed description of the selected event, including:\n<ul class=\"wp-block-list\">\n<li><strong>Reason Code<\/strong>: Explains why the action occurred.<\/li>\n\n\n\n<li><strong>Message<\/strong>: Provides context for the event, such as whether it was planned or unexpected.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"step-5-understand-event-i-ds\"><strong>Step 5: Understand Event IDs<\/strong><\/h3>\n\n\n\n<p>Here\u2019s a quick explanation of the most <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/application-security\/application-control\/app-control-for-business\/operations\/event-id-explanations\" rel=\"nofollow noopener\" target=\"_blank\">relevant Event IDs <\/a>you may encounter:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>1074<\/strong>: Logs planned shutdowns or restarts initiated by a user or application, often with a reason provided.<\/li>\n\n\n\n<li><strong>6006<\/strong>: Indicates a clean shutdown, logging that the Event Log service was stopped.<\/li>\n\n\n\n<li><strong>6005<\/strong>: Signifies a system restart, logging that the Event Log service started.<\/li>\n\n\n\n<li><strong>6008<\/strong>: Captures unexpected shutdowns, such as power failures or crashes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"step-6-clear-or-export-logs-optional\"><strong>Step 6: Clear or Export Logs (Optional)<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Clear Logs<\/strong>:\n<ul class=\"wp-block-list\">\n<li>If you want to clear old logs, right-click on <strong>System<\/strong> in the left pane and select <strong>Clear Log&#8230;<\/strong>. Be sure to save the logs first if needed.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Export Logs for Analysis<\/strong>:\n<ul class=\"wp-block-list\">\n<li>To save the logs for offline analysis:\n<ul class=\"wp-block-list\">\n<li>Right-click on <strong>System<\/strong> in the left-hand pane and choose <strong>Save All Events As&#8230;<\/strong>.<\/li>\n\n\n\n<li>Select a destination folder and save the file in <code>.evtx<\/code> format for compatibility with Event Viewer.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"step-7-close-event-viewer\"><strong>Step 7: Close Event Viewer<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Once you\u2019ve reviewed or exported the logs, close Event Viewer by clicking the <strong>X<\/strong> in the top-right corner.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"key-notes\">Key Notes:<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Regularly monitoring these logs helps in troubleshooting server issues and maintaining uptime.<\/li>\n\n\n\n<li>The descriptions provided in each event entry can help pinpoint whether a shutdown or reboot was planned, user-initiated, or caused by an unexpected issue like a crash.<\/li>\n<\/ul>\n\n\n\n<p>By following these steps, you can effectively identify and analyze reboot and shutdown logs on your Windows Server using Event Viewer.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Check Reboot Shutdown logs in Windows server, keeping track of system shutdowns and reboots is crucial for monitoring server health and troubleshooting potential issues. The Event Viewer is a powerful tool that allows administrators to review detailed logs of system events, including when and why a server was shut down or restarted. By filtering the [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":905,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[60],"class_list":["post-894","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-windows-server","tag-check-reboot-shutdown-logs-in-windows"],"_links":{"self":[{"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/posts\/894","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/comments?post=894"}],"version-history":[{"count":3,"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/posts\/894\/revisions"}],"predecessor-version":[{"id":907,"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/posts\/894\/revisions\/907"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/media\/905"}],"wp:attachment":[{"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/media?parent=894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/categories?post=894"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpswebhostingindia.com\/blog\/wp-json\/wp\/v2\/tags?post=894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}