The Wiert Corner – irregular stream of stuff

Thanks [WayBack] gbabu for the below PowerShell ide

As PowerShell command:

Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap

Based on it and my own experience, thse Event IDs can be interesting:

• 41 – The system has rebooted without cleanly shutting down first
• 109 – The kernel power manager has initiated a shutdown transition.
• 1073 – The attempt by user [domain]\[username] to restart/shutdown computer [computername] failed.
• 1074 – The process [filename].[extension] has initiated the restart of computer [computername] on behalf of user [domain]\[username\ for the
• 1076 – ???
• 6008 – The previous system shutdown at [time-in-local-format] on [date-in-local-format] was unexpected.

You can also run this as a batch file, but not you need to escape the pipe | into ^| like this:

PowerShell Get-EventLog System ^| Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap

If you have PowerShell 3.0 or greater, then you can use the [Archive.is] -In operator:

PowerShell Get-EventLog System ^| Where-Object {$_.EventID -in "41", "109", "1074", "6008", "1076"} ^| ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap

–jeroen

• Source: [WayBack] eventviewer – View Shutdown Event Tracker logs under Windows Server 2008 R2 – Server Fault :: https://serverfault.com/questions/204417/view-shutdown-event-tracker-logs-under-windows-server-2008-r2cmd
• [WayBack] Useful Operational Insights Search Query Collection | musc@> $daniele.work.ToString() “Corporate” Blog of Daniele Muscetta, Premier Field Engineer.
• Event log IDs lists via [WayBack] List of all Windows 7 Event IDs and Sources? – Super User:
  • [WayBack] Windows Security Log Encyclopedia
  • [WayBack] Troubleshooting Microsoft Windows Event Logs
  • [WayBack] Events and Errors isn’t a list nor searchable any more nor is [WayBack] Events and Errors