Based on eventviewer – View Shutdown Event Tracker logs under Windows Server 2008 R2 – Server Fault « The Wiert Corner – irregular stream of stuff, I’ve made similar filters for service stop/start events.
Works on translated systems:
PowerShell
Get-EventLog System | Where-Object {$_.EventID -eq "7036"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
Or on one line:
Get-EventLog System ^| Where-Object {$_.EventID -in "6005","6006","7000","7009","7036","7040","7042","7043","7045"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
Note the -In operator was introduced in PowerShell 3: [WayBack]
Source: PowerShell v3 – New -in Operator | Jonathan Medd’s Blog
I’ve adapted the custom view to include all these event IDs above (note some links have disappeared moving my notes to a blog post):
- [WayBack] 6005: The Event log service was started (indication for system startup).
- [WayBack] 6006: The Event log service was stopped (indication for system shutdown).
- [WayBack] 7000: The <servicename> service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
- [WayBack] 7009: A timeout was reached (30000 milliseconds) while waiting for the <servicename> service to connect.
- [WayBack] 7036:
- The <servicename> service entered the stopped state.
- The <servicename> service entered the running state.
- [WayBack] 7040: The start type of the <servicename> service was changed from demand start to auto start.
- [WayBack] 7042: The <servicename> service was successfully sent a stop control.
- [WayBack] 7043: The <servicename> service did not shut down properly after receiving a preshutdown control.
- [WayBack] 7045: A service was installed in the system.
Other event IDs that might be relevant via [WayBack] Windows Server restart / shutdown history – Server Fault:
- [WayBack] 6008: “The previous system shutdown was unexpected.” Records that the system started after it was not shut down properly.
- [WayBack] 6009: Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time.
- [WayBack] 6013: Displays the uptime of the computer. There is no TechNet page for this id.
- [WayBack] 1074: “The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z.” Indicates that an application or a user initiated a restart or shutdown.
- [WayBack] 1076: “The reason supplied by user X for the last unexpected shutdown of this computer is: Y.” Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.
- [WayBack] 41 (source: Microsoft-Windows-Kernel-Power)
- [WayBack] 1001: (source: BugCheck).
- [WayBack] 12, which is typically the first eventid to be logged after a reboot/reset etc and shows the actual “system start time”, i.e.: “The operating system started at system time 2017-09-19T02:46:06.582794900Z.”
A more complete list of Windows Kernel related Event IDs is at [WayBack] rootkit.com/NETEVENT.H at master · bowlofstew/rootkit.com.
Steps for the custom view:
Open Event Viewer then
- Right click Custom Views
- Click Create Custom View
- Under the Filter tab
- Keep Logged as Any time
- Select all the Event level types (Critical, Warning, etc.)
- Choose by source = Service Control Manager, Service Control Manager Performance Diagnostic Provider
- Optionally; For Event ID under the Includes/Excludes Event IDs section enter 6005,6006,7000,7009,7036,7040,7042,7043,7045 for the Event ID
- Click Ok
- Enter a name like Shutdown Events and any description then
- Click Ok again to complete the custom event log.
Your new custom view should show up in the list of custom views with the correct filter applied.
–jeroen
The Wiert Corner - irregular stream of stuff 