Click on below link to find out How to check shutdown and reboot logs in Windows servers:
https://manage.accuwebhosting.com/knowledgebase/3897/How-to-check-shutdown-and-reboot-logs-in-Windows-servers.html
Here are the steps on how to check logs for Windows Server
Method 1: Using Event Viewer
- Open the Start menu and search for Event Viewer.
- Click on the Event Viewer application to launch it.
- Expand the Custom Views section in the left-hand pane.
- Click on the Administrative Events option to view a comprehensive log of administrative events, including system reboots.
- In the search bar at the top of the Event Viewer window, type System to filter the list of events.
- Look for events with an Event ID of 1070, which indicates a system reboot. These events will provide the exact time of the reboot and any relevant messages.
Method 2: Using System Logs
- Open the File Explorer and navigate to the following directory: C:\Windows\System32\winevt\Logs
- In the Logs directory, locate the file named System.evtx. This file contains a record of system events, including system reboots.
- Double-click on the System.evtx file to open it in Event Viewer.
- Follow the same filtering steps as in Method 1 to locate events with an Event ID of 1070, indicating system reboots.
Method 3: Using Reliability Monitor
- Open the Start menu and search for Reliability Monitor.
- Click on the Reliability Monitor application to launch it.
- The Reliability Monitor will display a graph of system stability and recent events. Look for red dots on the graph, which represent critical events.
- Hover your mouse over each red dot to view a detailed description of the event. If the event description mentions a system reboot, you have identified the exact time of the reboot and any associated errors or warnings.
Additional Notes:
- The time displayed in the logs may be in Coordinated Universal Time (UTC). Adjust the time zone in your system settings to view the logs in your local time zone.
- If you are unable to find any logs related to system reboots, it may be due to a log retention policy or a corrupted log file. In such cases, you may need to consult with a system administrator for further assistance.
