Windows Event ID 6005 – EventLog: Event Log Service Started

Check the current status and configuration of the Event Log service to ensure it's running properly.

1. Open Services console by pressing Win + R, typing services.msc, and pressing Enter
2. Locate Windows Event Log service in the list
3. Verify the service status shows Running and startup type is Automatic
4. Right-click the service and select Properties to check recovery settings
5. Use PowerShell to get detailed service information:

Get-Service -Name "EventLog" | Format-List *
Get-WmiObject -Class Win32_Service -Filter "Name='EventLog'" | Select-Object Name, State, StartMode, ProcessId

Check recent Event ID 6005 occurrences to identify restart patterns:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

Examine system startup events and service dependencies to understand Event ID 6005 context within the boot sequence.

1. Open Event Viewer → Windows Logs → System
2. Filter events around the time of Event ID 6005 to see related startup events
3. Look for Event ID 6009 (system startup) and Event ID 6013 (system uptime) in the same timeframe
4. Check service dependencies using PowerShell:

# Check services that depend on Event Log
Get-Service | Where-Object {$_.ServicesDependedOn -contains (Get-Service EventLog)} | Select-Object Name, Status

# Check what Event Log depends on
(Get-Service EventLog).ServicesDependedOn | Select-Object Name, Status

5. Review system boot performance using built-in tools:

# Get last boot time
(Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime

# Check boot duration
Get-WinEvent -FilterHashtable @{LogName='System'; Id=100} -MaxEvents 5

Implement monitoring to track Event Log service health and identify potential issues affecting logging reliability.

1. Create a PowerShell script to monitor Event ID 6005 frequency:

# Monitor Event Log service restarts over the last 30 days
$StartDate = (Get-Date).AddDays(-30)
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005; StartTime=$StartDate}

Write-Host "Event Log Service Starts in Last 30 Days: $($Events.Count)"
$Events | Group-Object {$_.TimeCreated.Date} | Sort-Object Name | Format-Table Name, Count -AutoSize

2. Check Event Log service memory usage and performance:

# Get Event Log service process information
$EventLogProcess = Get-Process | Where-Object {$_.ProcessName -eq "svchost" -and $_.Modules.ModuleName -contains "wevtsvc.dll"}
$EventLogProcess | Select-Object Id, ProcessName, WorkingSet, PagedMemorySize

3. Verify event log file integrity and sizes:

# Check system event log properties
Get-WinEvent -ListLog System | Select-Object LogName, FileSize, MaximumSizeInBytes, RecordCount, IsEnabled

4. Set up automated monitoring using Windows Task Scheduler to alert on unexpected service restarts

When Event ID 6005 appears unexpectedly, investigate potential causes and system issues that might trigger service restarts.

1. Check for corresponding Event ID 6006 (Event Log service stopped) events:

# Find Event Log stop/start pairs
$StopEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6006} -MaxEvents 10
$StartEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005} -MaxEvents 10

Write-Host "Recent Event Log Service Stops:"
$StopEvents | Format-Table TimeCreated, Message -AutoSize
Write-Host "Recent Event Log Service Starts:"
$StartEvents | Format-Table TimeCreated, Message -AutoSize

2. Examine system event logs for errors preceding Event ID 6005:

# Look for system errors in the hour before each Event ID 6005
foreach ($StartEvent in $StartEvents) {
    $SearchStart = $StartEvent.TimeCreated.AddHours(-1)
    $SearchEnd = $StartEvent.TimeCreated
    $Errors = Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=$SearchStart; EndTime=$SearchEnd} -ErrorAction SilentlyContinue
    if ($Errors) {
        Write-Host "Errors before Event Log restart at $($StartEvent.TimeCreated):"
        $Errors | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize
    }
}

3. Check Windows Update and maintenance activities:

# Check recent Windows Updates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Check Windows Update log for service restarts
Get-WinEvent -FilterHashtable @{LogName='Setup'; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue | Where-Object {$_.Message -like "*restart*"}

4. Review system reliability history in Control Panel → System and Security → Security and Maintenance → Reliability Monitor

Implement comprehensive monitoring for Event ID 6005 and related events to maintain system visibility and proactive issue detection.

1. Create a custom Windows Event Forwarding subscription for centralized monitoring:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>EventLogServiceMonitoring</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Query>
    <![CDATA[
    <QueryList>
      <Query Id="0">
        <Select Path="System">*[System[(EventID=6005 or EventID=6006)]]</Select>
      </Query>
    </QueryList>
    ]]>
  </Query>
</Subscription>

2. Configure registry settings for enhanced event logging:

# Enable detailed service control manager logging
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\ServiceControlManagerDebug" -Name "EnableLogging" -Value 1 -Type DWord -Force

# Increase System log size for better retention
Limit-EventLog -LogName System -MaximumSize 100MB

3. Create a PowerShell scheduled task for automated monitoring:

# Create monitoring script
$ScriptBlock = {
    $RecentStarts = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue
    if ($RecentStarts.Count -gt 1) {
        Write-EventLog -LogName Application -Source "Custom Monitor" -EventId 1001 -EntryType Warning -Message "Multiple Event Log service starts detected: $($RecentStarts.Count)"
    }
}

# Register scheduled task
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-WindowStyle Hidden -Command $ScriptBlock"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
Register-ScheduledTask -TaskName "EventLogServiceMonitor" -Action $Action -Trigger $Trigger -User "SYSTEM"

4. Implement WMI event monitoring for real-time service status changes:

# Register WMI event for Event Log service changes
Register-WmiEvent -Query "SELECT * FROM Win32_ServiceChangeEvent WHERE ServiceName='EventLog'" -Action {
    $Event = $Event.SourceEventArgs.NewEvent
    Write-Host "Event Log service state changed at $(Get-Date): $($Event.ServiceName)"
}