is there a log file for shutdown/restart

[Arturo Galbiati]

Hi,
is there a log file in Windows where I can see the shutdown/restart of the server?
TIA,
Art

[Bryan Eley]

Hi Arturo,

Assuming I'm understanding your question correctly, "System" under Event Viewer should allow to you discover when your system started up or shut down. The actual file is generally located somewhere like C:\WINDOWS\system32\config\SysEvent.Evt, but you probably won't be able to access it directly since the file is locked during a Windows session.

Typically you'll see something like "Microsoft(R) Windows 2000 (R) Service Pack 4 Uniprocessor Free." (example is from a Win2k system), and this is listed under the Source column as "eventlog".

Under normal circumstances when the system shuts down you will usually see another "eventlog" listed saying "The Event log service was stopped", indicating the system has initiated a shutdown.

Bryan

[Ivan Ferreira · Accepted solution]

In the system event log you will get an entry for every restart of the server:

Source: eventlog
ID: 6006
Description: The event log service has ben stopped.

Source: eventlog
ID: 6005
Description: The event log service has ben started.

[Bryan Eley]

Thanks, Ivan. I should have specified the event log ID for simpler browsing. My excuse was that my Computer Management window was sized too small to show the column. ;-)

Bryan

[Arturo Galbiati]

Ivan reply is fine

[divesh4u]

hi Ivan
thanks for reply.

But Is there any loopwhole in your trick.

Event log service may be stopped manually or by any other process other than RESTART Process.


Your Fast Reply in this regard will be highly appriciated

Thanks

Divesh K. Jain