Windows Event ID 6003 – EventLog: Event Log Service Started

Open Event Viewer to examine the Event ID 6003 details and confirm normal service startup.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 6003 in the Event IDs field and click OK
5. Double-click the most recent Event ID 6003 to view details
6. Verify the event source shows EventLog and level shows Information
7. Check the timestamp to confirm when the Event Log service started

Use PowerShell to retrieve and analyze Event ID 6003 occurrences programmatically.

1. Open PowerShell as Administrator
2. Run the following command to get recent Event ID 6003 entries:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6003} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

3. To get the most recent boot time based on Event ID 6003:

$LastBoot = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6003} -MaxEvents 1
Write-Host "Last Event Log service start: $($LastBoot.TimeCreated)"

4. To calculate system uptime using Event ID 6003:

$LastBoot = (Get-WinEvent -FilterHashtable @{LogName='System'; Id=6003} -MaxEvents 1).TimeCreated
$Uptime = (Get-Date) - $LastBoot
Write-Host "System uptime: $($Uptime.Days) days, $($Uptime.Hours) hours, $($Uptime.Minutes) minutes"

Verify the Windows Event Log service is running properly and check its configuration.

1. Open Services console by pressing Windows + R, typing services.msc, and pressing Enter
2. Locate Windows Event Log in the services list
3. Verify the Status shows Running and Startup Type shows Automatic
4. Right-click the service and select Properties
5. On the General tab, confirm Startup type is set to Automatic
6. Check the Recovery tab to see what happens if the service fails
7. Use PowerShell to check service status programmatically:

Get-Service -Name EventLog | Format-List Name, Status, StartType, ServiceType

8. To restart the Event Log service if needed (requires Administrator privileges):

Restart-Service -Name EventLog -Force

Examine the Event Log service dependencies and boot sequence to understand startup order.

1. Check service dependencies using PowerShell:

Get-Service -Name EventLog | Select-Object -ExpandProperty ServicesDependedOn

2. View services that depend on Event Log:

Get-Service | Where-Object {$_.ServicesDependedOn -contains (Get-Service EventLog)} | Select-Object Name, Status

3. Examine the registry configuration for the Event Log service:

Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog" | Format-List

4. Check for any Event Log service startup errors in the System log:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'} -MaxEvents 50 | Where-Object {$_.Message -like "*EventLog*"} | Format-Table TimeCreated, Id, Message -Wrap

5. Review boot performance data to see Event Log startup timing:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Diagnostics-Performance/Operational'; Id=100} -MaxEvents 5 | Format-Table TimeCreated, Message -Wrap

Perform advanced configuration checks and troubleshooting for Event Log service issues.

1. Check Event Log file locations and sizes:

Get-WinEvent -ListLog * | Where-Object {$_.LogName -match "System|Application|Security"} | Select-Object LogName, FileSize, MaximumSizeInBytes, LogFilePath | Format-Table -AutoSize

2. Verify Event Log registry settings:

$RegPath = "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System"
Get-ItemProperty -Path $RegPath | Select-Object MaxSize, Retention, File

3. Check for Event Log corruption or issues:

wevtutil el | ForEach-Object { 
    try { 
        $LogInfo = wevtutil gli $_ 
        Write-Host "$_`: OK" -ForegroundColor Green 
    } catch { 
        Write-Host "$_`: ERROR - $($_.Exception.Message)" -ForegroundColor Red 
    } 
}

4. Monitor Event Log service performance counters:

Get-Counter "\Event Log\Events/sec" -SampleInterval 5 -MaxSamples 12

5. Create a custom event to test logging functionality:

Write-EventLog -LogName Application -Source "Application" -EventId 1000 -EntryType Information -Message "Test event created to verify Event Log service functionality"

6. Export Event ID 6003 events for analysis:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6003} -MaxEvents 100
$Events | Export-Csv -Path "C:\temp\EventID6003_History.csv" -NoTypeInformation