Windows System Log · Event 6006
Event 6006: The event log service stopped
Windows stopped logging as part of shutting down, which means the shutdown was orderly. Its real value is negative: when this event is missing before a boot, the machine did not shut down cleanly.
Also written as 6006Event ID 6006The Event log service was stoppedclean shutdown event
- How oftenUncommon
- Vendor calls itInformation
- LogSystem
- SourceEventLog
What it means for you
On a personal computer
Your PC shut down properly. This is the event you want to see.
For an analyst
Use the gap between 6006 and the following 6005 to measure how long a machine was down, and use a missing 6006 to identify unclean stops without relying on 6008.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
The Event log service was stopped.The fields that decide it
Everything else in the log line is context.
- Record time
- When logging stopped, which is close to the moment the machine finished shutting down.
Ordinary reasons this happens
Most of the time it is one of these.
- A normal shutdown or restart.
- A machine being powered off deliberately for maintenance.
- A virtual machine being shut down gracefully from the hypervisor.
What to do next
- Confirm a 6006 exists before each 6005. A missing one means the shutdown was unclean.
- Measure the gap to the following 6005 to work out downtime.
- Match against 1074 to see what requested the shutdown.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006,6008,1074} -MaxEvents 100 | Sort-Object TimeCreated | Select-Object TimeCreated, Id, MessageCommon questions
What does it mean if Event 6006 is missing?
That the machine did not shut down cleanly. Windows writes 6006 as part of an orderly shutdown, so a boot with no preceding 6006 means power was lost, the machine froze, or it crashed. You will usually find a 6008 or an Event 41 covering the same incident.
Read next
- Read alongside Event 6005: The event log service started The boot that follows. The pair bounds the downtime.
- Usually comes before Event 1074: Something asked Windows to shut down or restart What requested the shutdown.
- The equivalent of Event 6008: The previous system shutdown was unexpected The unexpected shutdown notice, written when this event is missing.
- The equivalent of Event 41: The system rebooted without shutting down cleanly The unclean shutdown record from the kernel.
Vendor documentation
Last reviewed 28 August 2026