Shulou(Shulou.com)06/01 Report--

This article mainly introduces how to check whether the computer restarts and shuts down from the log, which has certain reference value. Interested friends can refer to it. I hope you will have a lot of gains after reading this article. Let Xiaobian take you to understand it together.

When we want to know if a computer has been shut down or restarted, how do we find this information from logs?

9/14/2010,5:44:48 PM,EventLog,Information,None,6005,N/A,GBTAVA01,The Event log service was started.

9/14/2010,5:44:48 PM,EventLog,Information,None,6009,N/A,GBTAVA01,Microsoft (R) Windows (R) 5.02. 3790 Service Pack 2 Multiprocessor Free.

9/14/2010,5:40:51 PM,EventLog,Information,None,6006,N/A,GBTAVA01,The Event log service was stopped. "Such information, generally speaking, is that the system has had a related restart or shutdown; see if the log is generated when you start the computer, if not, it is an abnormal restart, or someone else has restarted artificially.

II. Enter "gpedit.msc" in the operation, open the Group Policy Editor, open "Computer Configuration-Management Template-System" in turn, and then find the setting item of "Show Close Tracking Program" in the window on the right, click the item with the mouse, select "Properties", select "Enable" in the "Show Close Tracking Program Properties" dialog box, and then click OK. At restart or shutdown, you will need to enter information, so that you can find traces by looking back at such information. For example:

9/14/2010,3:31:09 PM,USER32,Information,None,1074,NT AUTHORITY\SYSTEM,GBTAVA01,"The process svchost.exe has initiated the restart of computer GBTAVA01 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found

Reason Code: 0x80070020

Shutdown Type: restart

Comment: "This is the remote restart trace information in shutdown -i.

9/14/2010,5:31:05 PM,USER32,Information,None,1074,BEIJING\administrator,GBTAVA01,"The process Explorer.EXE has initiated the restart of computer GBTAVA01 on behalf of user BEIJING\Administrator for the following reason: Other (Planned)

Reason Code: 0x85000000

Shutdown Type: restart

Comment: restart_20100914"This is the restart message for the native shutdown tracker dialog box.

III. Use the "Security" item in the "Event Viewer" to find the information of account login and logout and system exit, so as to judge that the system has been restarted or shut down. For example:

9/14/2010,5:44:52 PM,Security,Success Audit,Logon/Logoff ,528,NT AUTHORITY\SYSTEM,GBTAVA01,"Successful Logon:

User Name: SYSTEM

Domain: NT AUTHORITY

Logon ID: (0x0,0x3E7)

Logon Type: 0

Logon Process: -

Authentication Package: -

Workstation Name: -

Logon GUID: -

Caller User Name: -

Caller Domain: -

Caller Logon ID: -

Caller Process ID: 4

Transited Services: -

Source Network Address: -

Source Port: -

"

9/14/2010,5:40:51 PM,SECURITY,Success Audit,System Event ,513,N/A,GBTAVA01,Windows is shutting down. All logon sessions will be terminated by this shutdown。

Thank you for reading this article carefully. I hope that Xiaobian's article "How to check whether the computer is restarted and shut down from the log" will be helpful to everyone. At the same time, I hope that everyone will support you a lot and pay attention to the industry information channel. More relevant knowledge is waiting for you to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.