The Windows Event Viewer is managed by the main event log service. The Event Viewer records the history of server startup and shutdown. It also tracks the actions of each user while the device is in operation. It logs errors, and other messages and warnings that occur on Windows Server.
In this article, we will learn how to check shutdown/reboot logs on Windows 2012, 2016, and 2019 VPS servers.
Let's look at some of the most common codes related to server startup and shutdown times.
41: indicates that your server rebooted but did not shut down completely.
6005: indicates that the event log service was started.
1074: this event shows when an application forcibly shuts down or reboots your VPS server. This allows you to know when you or someone else restarted or shut down the server from the "Start" menu or via CTRL+ALT+DEL.
6008: this event appears if your computer was shut down or rebooted due to a blue screen of death.
6006: this event shows when the server has properly shut down.
Press Win + R and enter eventvwr
On the left side of the panel, open "Windows Logs => System"
In the Event ID column, we will see a list of events that occurred during the operation of Windows. The event log can be sorted by event ID.
To sort the events we need, on the right side, select "Filter Current Log"
Now enter the events we need, separated by commas, 41, 1074, 6006, 6008, 6006 and click OK.
Now we can observe the event log with the shutdown of our VPS server.
We can also view the server uptime event log. This corresponds to the identifier 6013.
Viewing the shutdown and restart log using PowerShell
If we need to quickly view the server shutdown/reboot logs, we can use the Get-EventLog command in the PowerShell shell.
To filter the last 1000 entries in the log and display only the events we need, (41, 1074, 6006, 6008, 6006) execute this command in PowerShell:
Get-EventLog System -Newest 1000 | ` Where EventId -in 41,1074,6006,6008 | ` Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap
Now you can independently check why your server was rebooted/shut down.