Log Dejargonizer

Windows System Log · Event 6005

Event 6005: The event log service started

Windows started logging, which happens very early in boot. In practice this is the marker for 'the machine came up', and it is the standard way to work out when a computer was last started and how long it has been running.

Also written as 6005Event ID 6005The Event log service was startedboot time event id

What it means for you

On a personal computer

Your PC started up. One of these per boot is exactly what you should see.

For an analyst

Paired with 6006 it gives you a reliable uptime and reboot history without any extra instrumentation. A 6005 with no preceding 6006 means the machine went down unexpectedly.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The Event log service was started.

The fields that decide it

Everything else in the log line is context.

Record time
When the event log service started, which is effectively the boot time.

Ordinary reasons this happens

Most of the time it is one of these.

  • The machine booting normally.
  • A restart after updates.
  • A machine returning from a full shutdown rather than sleep or hibernate.

What to do next

  1. Use the timestamp as the boot marker for the machine.
  2. Check whether a 6006 appears shortly before it. If not, the previous shutdown was unclean.
  3. List them in sequence to build a reboot history.
  4. Compare unexpected boot times against your maintenance windows.

Queries to run

powershell A readable boot and shutdown history. Any Boot without a preceding Clean shutdown was an unclean stop. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006} -MaxEvents 40 | Sort-Object TimeCreated | Select-Object TimeCreated, Id, @{n='Meaning';e={ if ($_.Id -eq 6005) {'Boot'} else {'Clean shutdown'} }}
powershell The current boot time directly, when you only need the latest one. 
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

Common questions

How do I find when a Windows computer was last restarted?

Event 6005 in the System log marks each boot. For just the current uptime, `(Get-CimInstance Win32_OperatingSystem).LastBootUpTime` in PowerShell is quicker. For a history of restarts, list 6005 and 6006 together and read them in sequence.

What is the difference between Event 6005 and Event 6009?

6005 records that the event log service started, which is the practical boot marker. 6009 records the operating system version and build details detected at startup. Both appear at every boot; 6005 is the one to use for timing.

Does Event 6005 always mean the computer was restarted?

Almost always, because the event log service starts very early in boot and stops only at shutdown. The exception is the service being restarted on its own, which produces a 6005 without a reboot. To be certain, check for a matching Event 6006 or 6008 just before it — a 6005 with no preceding stop event is a machine that came up after a hard power loss rather than a clean restart.

Why does Event 6005 say 'The event log service was started'?

Because that is literally what it records. The message is about the logging service rather than about Windows as a whole, which is why the wording seems oddly narrow for something people use as a boot marker. It works as a boot marker because that service starts so early that its start time is within a second or two of the system's own.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026