01Fields in the event
The cited Microsoft page does not list field names for this event.
02How to use it
Use 6005 with 6006, 6008, 6009 and 1074 to list boot and shutdown cycles and to check whether the system was running during the period in question.
03Caveats
Filter on both event ID and source, since the same IDs are used by other sources.
05Sources
- Microsoft Learn — Troubleshoot unexpected reboots using system event logs checked 2026-10-18