Windows System Log · Event 6006
Event 6006: The event log service stopped
Windows stopped logging as part of shutting down, which means the shutdown was orderly. Its real value is negative: when this event is missing before a boot, the machine did not shut down cleanly.
Also written as 6006Event ID 6006The Event log service was stoppedclean shutdown event
- How oftenUncommon
- Vendor calls itInformation
- LogSystem
- SourceEventLog
What it means for you
On a personal computer
Your PC shut down properly. This is the event you want to see.
For an analyst
Use the gap between 6006 and the following 6005 to measure how long a machine was down, and use a missing 6006 to identify unclean stops without relying on 6008.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
The Event log service was stopped.The fields that decide it
Everything else in the log line is context.
- Record time
- When logging stopped, which is close to the moment the machine finished shutting down.
Ordinary reasons this happens
Most of the time it is one of these.
- A normal shutdown or restart.
- A machine being powered off deliberately for maintenance.
- A virtual machine being shut down gracefully from the hypervisor.
What to do next
- Confirm a 6006 exists before each 6005. A missing one means the shutdown was unclean.
- Measure the gap to the following 6005 to work out downtime.
- Match against 1074 to see what requested the shutdown.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006,6008,1074} -MaxEvents 100 | Sort-Object TimeCreated | Select-Object TimeCreated, Id, MessageCommon questions
What does it mean if Event 6006 is missing?
That the machine did not shut down cleanly. Windows writes 6006 as part of an orderly shutdown, so a boot with no preceding 6006 means power was lost, the machine froze, or it crashed. You will usually find a 6008 or an Event 41 covering the same incident.
Is Event 6006 anything to worry about?
No — it is the good news event. It records the event log service stopping as part of an orderly shutdown, which means Windows closed down properly and had a chance to flush everything to disk. It is one of the few Event Viewer entries that positively confirms nothing went wrong.
How do I use Event 6006 to find unexpected shutdowns?
Pair each 6005 with the 6006 that should precede it. A 6005 with no 6006 before it means the machine came up after a shutdown that was never completed — a power cut, a hard reset, or a crash. Event 6008 records the same conclusion explicitly, but the missing-6006 method also catches cases where 6008 was not written.
Why is there no Event 6006 when I use Fast Startup?
Because Fast Startup does not fully shut Windows down — it hibernates the kernel session instead, so the event log service is suspended rather than stopped and restarted. On a machine with Fast Startup enabled, the 6005 and 6006 pattern becomes much less reliable as a record of restarts, which surprises people using it to measure uptime.
Read next
- Read alongside Event 6005: The event log service started The boot that follows. The pair bounds the downtime.
- Usually comes before Event 1074: Something asked Windows to shut down or restart What requested the shutdown.
- The equivalent of Event 6008: The previous system shutdown was unexpected The unexpected shutdown notice, written when this event is missing.
- The equivalent of Event 41: The system rebooted without shutting down cleanly The unclean shutdown record from the kernel.
Vendor documentation
Last reviewed 28 August 2026