Windows 10: Reliability of Event ID 6008 on Windows

Hi, Not sure if this is the right forum/place to post this question, as this is more of a Windows System related question, but still wanted to post to see if I could get any answers from people familiar with WIndows.


I've started windows programming recently, and I was trying to find out how to get the latest Shut Down time for the device.


I know that the Windows Event Log event id 1704 shows the shutdown time when properly shutdown, and 6008 for unexpected shutdowns.


I was wondering however, how Event ID 6008 Works. I wasn't expecting it to, but it seems like windows manages to get the proper time for Event ID 6008 even when I just pull the plug on my device.


So, if I pull my plug at say 6:00pm, and turn on my computer back up at 6:10pm, then the event log leaves an event with if 6008 on 6:10pm, saying the computer shut down at 6:00pm. From this, I had two questions.


1. How does Windows keep track of the time it was shutdown? How does it know it got shutdown at 6:00pm when the plug was pulled thus had no time to run any procedures?


2. If I want to know the Last Shutdown time for Windows reliably, even during events such as blackouts, would checking for event 1704 and event 6008 be a reliable method? Would there be cases where windows fails to leave these logs or write wrong values for these logs?


Thank you.

:)

 

Event ID 6008, Windows 10 1809

Thanks for your reply Leocadia - I understand your suggestions thank you.

The point I was trying to make is our Win 10 Pro v1803 computers, log Event ID 6008 when an unexpected crash happens. However we have Win 10 pro v1809 machines that crashed when the power failed and did not record an Event ID 6008 so I was not able to tell
when the power actually failed, only when they were rebooted. - so my question is :- is this a bug in the 1809 release or by Microsoft design and has anybosy else experienced this situation ??

thanks Bob, IT Manager, Henry Riley LLP.

 

Event ID 6008, Windows 10 1809

We had a recent Power outage and I usually look for Event ID 6008 to tell me when the Unexpected shutdown occurred - I have looked at 5 PC's all affected by the power down and none have recorded a 6008, only 6009, 6005 & 6013 in that order.

I've simulated crashes and still 6008 not being logged.

This feature was active in 1803 but not being logged in 1809 - anybody else having this result ?

 

event id 6008


I believe that event id 6008 is meant to indicate that the previous shutdown was unexpected. However on my computer it happens at odd times with successful shut downs in between. See the attached. I looked at what was happenning at 9:10:19
on 23rd February and the computer was starting up (successfully) rather than shutting down.