How to find shutdown log in Windows VPS

Estimated reading: 2 minutes 340 views

If you are curious to know why your VPS is shutting down and what exactly happened during the shutdown process, you will be happy to know that Windows can monitor the shutdown process and write some events. in the system log ( Event Viewer ). In this article, we will see how to find them

Since the OS is using the default log format, all shutdown related events can be viewed with the “Event Viewer” tool

In Windows, there are 3 events (Events) connected with shutdown and restart.

  1. Event ID 1074 : Indicates that shutdown was initiated by an application. For example, it could be Windows Update.
  2. Event ID 6006 : Clean close event. This means Windows was correctly disabled
  3. Event ID 6008 : Indicates a sudden, improper shutdown. Appears in the log when you have previously shutdown unexpectedly, e.g. due to power failure or BSoD (Error Checking)

Here’s how to find these events.

To find the Shutdown log in Windows VPS, do the following:

  • Press Win + R key combination on the keyboard to open the Run dialog box -> type “eventvwr.msc” and press Enter key

  • In Event Viewer select Windows Logs -> Click System in the left window
  • In the right window -> Click and select the Filter Current Log path

  • In the next dialog, enter lines 1074, 6006, 6008 in the text box below “Includes/Excludes Event IDs…”

  • Click OK to filter the event log ( Event log )
  • Now the Event Viewer will only show shutdown related events

In this guide, we have shared how to find shutdown logs in Windows VPS. Good luck!

Leave a Comment