Windows Event ID 6004 – EventLog: Event Log Service Started

Check the current status of the Event Log service to ensure it's running properly:

1. Open Services console by pressing Win + R, typing services.msc, and pressing Enter
2. Locate Windows Event Log service in the list
3. Verify the status shows Running and startup type is Automatic
4. Alternatively, use PowerShell to check service status:

Get-Service -Name "EventLog" | Select-Object Name, Status, StartType
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6004} -MaxEvents 5 | Format-Table TimeCreated, Id, LevelDisplayName, Message

If the service isn't running, start it manually or investigate why it failed to start automatically.

Examine service dependencies to understand startup order and potential issues:

1. Open Command Prompt as Administrator
2. Check Event Log service dependencies:

sc qc EventLog
sc enumdepend EventLog

3. Use PowerShell to get detailed dependency information:

Get-Service -Name "EventLog" -DependentServices
Get-Service -Name "EventLog" -RequiredServices

4. Review the registry for service configuration:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog"

This helps identify if dependency issues are causing delayed or failed Event Log service startup.

Investigate the boot sequence timing to identify potential delays or issues:

1. Open Event Viewer → Windows Logs → System
2. Filter for Event ID 6004 to see Event Log service startup history:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6004} -MaxEvents 20 | 
  Select-Object TimeCreated, @{Name='Message';Expression={$_.Message}} | 
  Format-Table -AutoSize

3. Compare with other critical service startup events:

$StartTime = (Get-Date).AddDays(-7)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036,6005,6004; StartTime=$StartTime} | 
  Sort-Object TimeCreated | 
  Select-Object TimeCreated, Id, LevelDisplayName, Message | 
  Format-Table -Wrap

4. Check for any Event Log service failures preceding successful starts:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'} -MaxEvents 50 | 
  Where-Object {$_.Message -like "*EventLog*"} | 
  Format-Table TimeCreated, Id, LevelDisplayName, Message

Set up monitoring to track Event Log service performance and detect issues:

1. Create a custom PowerShell monitoring script:

# Monitor Event Log service health
$LogName = "System"
$EventID = 6004
$Hours = 24

$Events = Get-WinEvent -FilterHashtable @{
    LogName = $LogName
    Id = $EventID
    StartTime = (Get-Date).AddHours(-$Hours)
} -ErrorAction SilentlyContinue

if ($Events) {
    Write-Host "Event Log service started $($Events.Count) times in the last $Hours hours"
    $Events | Select-Object TimeCreated, Message | Format-Table
} else {
    Write-Warning "No Event Log service startup events found in the last $Hours hours"
}

2. Check Event Log service performance counters:

Get-Counter "\Process(services)\% Processor Time" -SampleInterval 5 -MaxSamples 3
Get-Counter "\Process(services)\Working Set" -SampleInterval 5 -MaxSamples 3

3. Verify log file integrity and space:

Get-WinEvent -ListLog * | Where-Object {$_.RecordCount -gt 0} | 
  Select-Object LogName, RecordCount, FileSize, MaximumSizeInBytes | 
  Sort-Object FileSize -Descending | Format-Table

Perform deep analysis of Event Log service configuration and potential issues:

1. Examine Event Log service registry configuration in detail:

$EventLogKey = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog"
Get-ChildItem $EventLogKey -Recurse | 
  ForEach-Object { 
    Write-Host "Key: $($_.Name)"
    Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
  }

2. Check for Event Log service crashes or failures:

# Look for service failures
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034,7031,7032} -MaxEvents 50 | 
  Where-Object {$_.Message -like "*EventLog*" -or $_.Message -like "*Event Log*"} | 
  Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

# Check Application event log for EventLog service issues
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='EventLog'} -MaxEvents 20 -ErrorAction SilentlyContinue

3. Analyze system file integrity related to Event Log service:

sfc /scannow
Dism /Online /Cleanup-Image /CheckHealth

4. Create a comprehensive Event Log service report:

$Report = @{
    ServiceStatus = Get-Service -Name "EventLog"
    RecentStarts = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6004} -MaxEvents 10 -ErrorAction SilentlyContinue
    ServiceConfig = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog"
    LogSizes = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount -gt 0} | Select-Object LogName, RecordCount, FileSize
}
$Report | ConvertTo-Json -Depth 3