Windows 10: Why does Event Viewer show the timestamp in the list correctly, but the general section...

On boot, immediately after crash, I get this error code saying the shutdown was unexpected. Error 4/13/2023 6:39:50 PM EventLog 6008 NoneGenreal :The previous system shutdown at 6:13:30 PM on ‎4/‎13/‎2023 was unexpected.Details XML:- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">- <System> <Provider Name="EventLog" /> <EventID Qualifiers="32768">6008</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opc

:)

 

Error in Event Viewer

Hi,



Thank you for writing to Microsoft Community Forums.



As you have mentioned, you have performed a repair installation on the computer and you see Event 508, 510 and 533 in Event Viewer.



I would like to inform that if you see any critical error in Event Viewer, please share the event logs with us to help you with the appropriate troubleshooting steps. Please follow the steps mentioned below to share the event logs:

1. Press Windows + X from the keyboard, select
   Event Viewer.
   
2. Expand Windows Logs from the left pane and select
   Applications.
   
3. Click Filter Current Log from extreme right pane. Then in the new windows check the box beside
   Error and click OK.
   
4. Now, look for a critical Error in the list and note down the message/information from the
   General Tab in the lower section.
   

Please reply with the status of the issue, we will be glad to help you further.



Regards,

Nikhar Khare

Microsoft Community - Moderator

 

Event Viewer stopped showing new events

I go to Event Viewer > Applications and Services Logs > Microsoft > Windows > Diagnostics-Performance > Operational.

But there are no events listed for the past several weeks even though I’ve rebooted many times during that period.

I clicked the Refresh button in the right column and this added one new event - the latest event 100. But no Event Viewer showing the system was shut down. I did several cold reboots so there should be many new entries but that’s not the case.

In the right column I looked at Operational > Properties. “Overwrite events as needed" is checked.

Any idea why new events are not showing up?

Thanks

 

TimeStamp In Security Events

I came across a weird issue of timestamp in security events.

When I am fetching the logs to SIEM system via RPC, the raw event that I see has a field called TimeCreated. The value of this fields looks like epoch time however, when I am converting the timestamp, it doesn't match up with the TimeStamp displayed in the event viewer console.