Log Dejargonizer

Windows System Log · Event 6005

Event 6005: The event log service started

Windows started logging, which happens very early in boot. In practice this is the marker for 'the machine came up', and it is the standard way to work out when a computer was last started and how long it has been running.

Also written as 6005Event ID 6005The Event log service was startedboot time event id

What it means for you

On a personal computer

Your PC started up. One of these per boot is exactly what you should see.

For an analyst

Paired with 6006 it gives you a reliable uptime and reboot history without any extra instrumentation. A 6005 with no preceding 6006 means the machine went down unexpectedly.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The Event log service was started.

The fields that decide it

Everything else in the log line is context.

Record time
When the event log service started, which is effectively the boot time.

Ordinary reasons this happens

Most of the time it is one of these.

  • The machine booting normally.
  • A restart after updates.
  • A machine returning from a full shutdown rather than sleep or hibernate.

What to do next

  1. Use the timestamp as the boot marker for the machine.
  2. Check whether a 6006 appears shortly before it. If not, the previous shutdown was unclean.
  3. List them in sequence to build a reboot history.
  4. Compare unexpected boot times against your maintenance windows.

Queries to run

powershell A readable boot and shutdown history. Any Boot without a preceding Clean shutdown was an unclean stop. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006} -MaxEvents 40 | Sort-Object TimeCreated | Select-Object TimeCreated, Id, @{n='Meaning';e={ if ($_.Id -eq 6005) {'Boot'} else {'Clean shutdown'} }}
powershell The current boot time directly, when you only need the latest one. 
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

Common questions

How do I find when a Windows computer was last restarted?

Event 6005 in the System log marks each boot. For just the current uptime, `(Get-CimInstance Win32_OperatingSystem).LastBootUpTime` in PowerShell is quicker. For a history of restarts, list 6005 and 6006 together and read them in sequence.

What is the difference between Event 6005 and Event 6009?

6005 records that the event log service started, which is the practical boot marker. 6009 records the operating system version and build details detected at startup. Both appear at every boot; 6005 is the one to use for timing.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026