Windows Event ID 6006 – EventLog: Event Log Service Stopped

Navigate to Event Viewer to analyze shutdown patterns and verify normal EventLog service behavior.

1. Open Event Viewer by pressing Windows + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter events by clicking Filter Current Log in the Actions pane
4. Enter Event ID 6006 in the Event IDs field and click OK
5. Review the timestamps to identify shutdown patterns and frequency
6. Check for corresponding Event ID 6005 entries after each 6006 to confirm normal service restarts

Query Event ID 6006 occurrences using PowerShell for detailed analysis and reporting.

1. Open PowerShell as Administrator
2. Run the following command to retrieve recent Event ID 6006 entries:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6006} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

3. For more detailed analysis, export results to CSV:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6006} -MaxEvents 100 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\Temp\EventID6006.csv" -NoTypeInformation

4. Analyze shutdown frequency with this command:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6006} -MaxEvents 50
$Events | Group-Object {$_.TimeCreated.Date} | Sort-Object Name | Format-Table Name, Count

Verify EventLog service configuration and monitor its operational status to ensure proper logging functionality.

1. Check EventLog service status using PowerShell:

Get-Service -Name EventLog | Format-List Name, Status, StartType, ServiceType

2. View detailed service configuration:

Get-WmiObject -Class Win32_Service -Filter "Name='EventLog'" | Format-List Name, State, StartMode, PathName, ProcessId

3. Monitor service dependencies:

Get-Service -Name EventLog -DependentServices
Get-Service -Name EventLog -RequiredServices

4. Check EventLog service registry configuration at:
5. HKLM\SYSTEM\CurrentControlSet\Services\EventLog
6. Verify the Start value is set to 2 (Automatic startup)

Analyze Event ID 6006 in context with other shutdown-related events to understand system behavior patterns.

1. Query multiple shutdown-related events simultaneously:

$ShutdownEvents = @(1074, 1076, 6005, 6006, 6008, 6009)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=$ShutdownEvents} -MaxEvents 50 | Sort-Object TimeCreated -Descending | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

2. Create a comprehensive shutdown analysis report:

$StartDate = (Get-Date).AddDays(-30)
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(1074,6006,6008); StartTime=$StartDate}
$GroupedEvents = $Events | Group-Object Id
foreach ($Group in $GroupedEvents) {
    Write-Host "Event ID $($Group.Name): $($Group.Count) occurrences"
}

3. Identify unexpected shutdowns by finding Event ID 6008 (unexpected shutdown) without preceding 6006:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6008} -MaxEvents 10 | Format-Table TimeCreated, Message -Wrap

4. Generate a timeline of shutdown events for the past week:

$LastWeek = (Get-Date).AddDays(-7)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(6005,6006); StartTime=$LastWeek} | Sort-Object TimeCreated | Format-Table TimeCreated, Id, Message

Perform advanced diagnostics when Event ID 6006 patterns indicate potential EventLog service issues.

1. Enable EventLog service debug logging by modifying registry:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Parameters" -Name "Debug" -Value 1 -PropertyType DWORD -Force

2. Check EventLog service memory usage and performance:

Get-Process -Name "svchost" | Where-Object {$_.Modules.ModuleName -contains "wevtsvc.dll"} | Format-List ProcessName, Id, WorkingSet, PagedMemorySize

3. Analyze EventLog service crash dumps if available:
4. Navigate to %SystemRoot%\Minidump or %SystemRoot%\MEMORY.DMP
5. Use Windows Debugging Tools to analyze dump files for EventLog service issues
6. Verify event log file integrity:

$LogFiles = Get-ChildItem "$env:SystemRoot\System32\winevt\Logs" -Filter "*.evtx"
foreach ($Log in $LogFiles) {
    try {
        $Events = Get-WinEvent -Path $Log.FullName -MaxEvents 1 -ErrorAction Stop
        Write-Host "$($Log.Name): OK" -ForegroundColor Green
    } catch {
        Write-Host "$($Log.Name): CORRUPTED" -ForegroundColor Red
    }
}

5. Reset EventLog service configuration if corruption is detected:

Stop-Service -Name EventLog -Force
Start-Service -Name EventLog