Works on translated systems:
PowerShell
Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
Or on one line:
Get-EventLog System ^| Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
I’ve adapted the custom view to include all these event IDs above:
- 12: The operating system started at system time <iso8601utc>.
- 13: The operating system is shutting down at system time <iso8601utc>.
- 109: The kernel power manager has initiated a shutdown transition.
- 1074: [WayBack] The process <process> has initiated the restart of <computer name> for the following reason: No title for this reason could be found.
Minor Reason: <reason>
Shutdown Type: <type> - 1076: [WayBack] The reason supplied by user <user name> for the last unexpected shutdown of this computer is: <error description>
Reason Code: <error code>
Bug ID: <bug id>
Bugcheck String: <string>
Comment: <comment> - 6008: [WayBack] The previous system shutdown at <time> on <date> was unexpected.
Steps for the custom view:
Open Event Viewer then
- Right click Custom Views
- Click Create Custom View
- Under the Filter tab
- Keep Logged as Any time
- Select all the Event level types (Critical, Warning, etc.)
- Choose by source = Windows Logs > System
- For Event ID under the Includes/Excludes Event IDs section enter 12,13,1074,1076,6008 for the Event ID
- Click Ok
- Enter a name like Shutdown Events and any description then
- Click Ok again to complete the custom event log.
Your new custom view should show up in the list of custom views with the correct filter applied.
Source: [WayBack] eventviewer – View Shutdown Event Tracker logs under Windows Server 2008 R2 – Server Fault
–jeroen
The Wiert Corner - irregular stream of stuff 