Windows event log ยท System6005 The Event log service was started
Event 6005 is occurs at boot time showing that the Event Log service was started. It is also used to identify when a computer is started.
- System
- 1 field
System.evtxEventLog
Fields EvtxECmd extracts
1 column in the EvtxECmd CSV
- PayloadData1
Computer: %Computer%- %Computer% = /Event/System/Computer
Sample event
Event XML from the map file
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="EventLog"/>
<EventID Qualifiers="32768">6005</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2019-03-16T07:35:00.128212400Z"/>
<EventRecordID>346053</EventRecordID>
<Channel>System</Channel>
<Computer>pooh</Computer>
<Security/>
</System>
<EventData>
<Binary>E30703000600100007002300000080000000000000000000</Binary>
</EventData>
</Event>References
4 links
- manageengine.com/products/active-directory-audit/kb/system-events/event-id-6005.html(opens in new tab)
- howtogeek.com/277688/how-do-you-find-out-if-windows-was-running-at-a-given-time/(opens in new tab)
- community.spiceworks.com/topic/237386-event-log-time-when-computer-start-up-boot-up(opens in new tab)
- superuser.com/questions/767143/find-out-why-pc-just-restarted-for-no-reason(opens in new tab)
Source: evtx/Maps/System_EventLog_6005.map(opens in new tab) by Barrie Hill and contributors(opens in new tab), MIT License(opens in new tab)