How To Determine System Startups from Event LogWhen shutting down and starting, Microsoft Windows logs events in the Event Log. Although there are a variety of events which signify startup and shutdown, the simplest to check for startups is to filter by Event Id 6009 in the System log. Event Id 6008 is logged when the previous shutdown was unexected (“dirty shutdown”). See also: |