I would like to check when my PC started, I read about event log id 6006 and 6005 to check the log service start up and shutdown event... but this method doesn't work.

The last eventlog service restart was made 1 month ago, but I'm sure my PC is shutted down daily and I'm sure I made "shut down" and not "suspend"!

Why I cannot find this log? How can I see when my PC started up or shut down?

  • Having the same issue... 6005 and 6006 are logged just every now and then. Same for all the other IDs I can find when searching for this issue... Seems to be an exception though, as everyone is recommending the same IDs and nobody has issues like us. – MOnsDaR Nov 25 '17 at 13:09
  • 1
    Please see the answer to myself – Tobia Nov 25 '17 at 13:16
  • I found that the tool ComputerTurnedOnTimes from NirSoft does the job. Seems it uses the EventLog too, as the results are similar, though it is able to give me correct results: nirsoft.net/utils/computer_turned_on_times.html – MOnsDaR Nov 27 '17 at 13:19

At last my issue was the hybrid windows shutdown:


With this option on (windows default) the service doesn't start at every windows startup. This is the cause of logs lack.


I found an alternative answer, for those who want to keep Fast-Restart ON.

event viewer->system-> Filter this log -> now filter on :
- events : 1, 42 ( 1= system time has changed=startup /42= system is entering sleep)
- Event Sources : Kernel-General, Kernel-Power (you'll get task category 5/64)

the only miss in the log is when you just close the lid without 'shutdown' this is also logged

  • I can confirm this works in Windows 10. Thanks! – Alex May 6 '19 at 5:34
  • could be that the logging mechanism was somehow stopped or corrupted for any number of reasons. You may need to clear and reset things to get things going again
  • could be malware/someone broke in and wiped your logs
  • could be that the logs are of a finite length and have had to be cropped in order to maintain that particular size and save space on your hard drive. Clear and reset is the only option here
  • could be that you're looking in the wrong place or that a filter of some sort has been placed on things which is stopping you from seeing things (I'm doubtful of that though because if you know where to look already you would already know this)
  • if you still can't get things working I'd consider creating a small script or program of some sort that logs things into a file of your own choosing because most of the options are there seem to be reliant on Event Viewer working properly. Make relevant entries to Windows Startup folder, Registry, msconfig to get things going or else turn it into a Windows service which polls events that you see during startup or shutdown. That should work as a fall back position...



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.