Windows Forum

Ask something
Discussion Locked

shutdown log file

0 helpful
7 replies

by chin.parkfoh

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

In HP-UX, there is a log file to keep track of when the HP server was shutting down.

How about Win2k ?
Is there a file exists to check when Win2k
was shutdown and up ?

7 replies

by seeker2000

Not sure if windows has a log to that effect, but you always tell thru the event veiwer if that helps any. You don't have to check all the entries. Under the event columnif you see 6005 event veiwer was started, 6006 is the ID for stopped and it gives you the time and date for each

by intruzion

Win2K does not have a specific log for when the computer is shutting down. You can check the status of certain applications through the Event Viewer as mentioned. However, Win2k does have options for logging during boot up. When booting up your computer, press F8 to enter advanced start-up options. You will see an "Enable boot logging" option. Select this and Windows starts while logging all the drivers and services that were loaded (or not loaded) by the system to a file. This file is called ntbtlog.txt and it is located in the %windir% directory.

by khenkell

Seeker2000 is right. The best place to look is in the Event Logs in the Event Viewer. You will see events from the source "eventlog" and will have the following 4 events that will be of interest to you.

During bootup you will see the two messages in the System Log:
---
ID 6009
Microsoft (R) Windows 2000 (R) 5.0 2195
Multiprocessor Free.
---

followed by:

---
ID: 6005
The Event log service was started.
---

Sometimes you will also see this message if the system was not shut down cleanly.
---
ID:
The previous shutdown was unexpected.
---

If the system was shut down cleanly, you should be able to see the following message:

---
ID: 6006
The Event log service was stopped.
---

Also, if you need greater detail, I know Windows NT had a feature you could add (from MS, look in www.microsoft.com/technet) called a heartbeat. It would write to a log at set intervals so that you could pinpoint when the server died to a time within that interval. I am not sure if Windows 2000 has this, but I am pretty sure they would.

Hope this helps (and thank Seeker2000)
Keith Henkell
khenkell@chipscc.com

This discussion is closed to new replies.