Common Windows system log events

 

Common events: 107460056006

Event 1074: when the system event tracking program is enabled, you can view the computer startup, shutdown, and restart times, as well as the causes and comments.

In windows, we can use the system logs of the Event Viewer to view the computer's on/off records. This is because the Log service starts or closes with the computer and leaves a record in the log.

 

Event 6005:Indicates that the computer log service has been started. If the event ID number of a day is 6005 In the event viewer, the windows system is started normally on this day.

 

Event 6006:Indicates that the event log service has stopped. If the event ID 6006 is not found in the event viewer, it indicates that the computer has not been shut down or has not been shut down normally on this day (it may be because of system reasons or the power supply is directly cut off, and the normal shutdown operation is not performed ). If the record time of event 6005 and event 6006 is very short, it can be roughly determined to be restarted (of course, you can view it in detail through event 1074 ).

 

Event 1007:Indicates that the computer cannot obtain the relevant information from the DHCP server. In many network environments, the DHCP server is usually used to configure the IP address information of the client. If the client cannot find the DHCP server, it will automatically use an internal IP address to configure the client, in addition, an event with the event ID 1007 is generated in windows logs. If the user finds the serial number event in the event log, it means that the machine cannot obtain information from the DHCP server. Check whether the machine has a network fault or a DHCP server problem.