Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to view the Shutdown Event Tracker logs in the Event Viewer, on windows server 2008 r8, but I can't find the messages that I supplied when previously restart the server.

Where in the Event Viewer can I see these logs?

share|improve this question

4 Answers 4

up vote 32 down vote accepted

you open event viewer, expand windows logs, click system then either find or filter for event ID 1074 and you will see all your shut down logs

share|improve this answer
thanks, that's very handy. Windows doesn't make it easy to navigate the logs without knowing what you're looking for – Gordon Carpenter-Thompson May 23 '11 at 8:57
You need to also include 1076 (Unplanned shutdown) and filter for source user32 – user115557 Mar 27 '12 at 18:52
Also event 6008 "Unexpected Shutdown" might be interesting... – Nenotlep Jul 26 '13 at 7:56
@Jacob, How do you get the list of event IDs and what they represent? – Pacerier Jul 30 at 11:43

If you or others are just trying to find the most recent boot time, the easiest way I've found is to run this in cmd:

systeminfo | find "System Boot Time"


share|improve this answer
If you see nothing, just remove the find. I did not have that info there, but I did have "System Up Time". – Nenotlep Jul 26 '13 at 7:54
@Nenotlep, Best is to simply do a case insensitive search of: systeminfo | find /i "system" | find /i "time". Works on all systems – Pacerier Jul 30 at 11:46

I know this is a very old question. But this might help someone who is looking for the same solution. you can use a single line in powershell (which is available in all OS later than win 2003) to find out the reboot history. Just open powershell.exe from run prompt and enter the below command.

Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
share|improve this answer

Another useful approach I've found, since we frequently monitor our ISP hosted servers for outages, is to create a custom event view as follows:

Open Event Viewer then

  • Right click Custom Views
  • Click Create Custom View
  • Under the Filter tab
    • Keep Logged as Any time
    • Select all the Event level types (Critical, Warning, etc.)
    • Choose by source = Windows Logs > System
    • For Event ID under the Includes/Excludes Event IDs section enter 1074 for the Event ID
  • Click Ok
  • Enter a name like Shutdown Events and any description then
  • Click Ok again to complete the custom event log.

Your new custom view should show up in the list of custom views with the correct filter applied.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.