PowerShell: Find System Errors in Event Log
Need to check for system-level startups, shutdowns, and unexpected crashes - for troubleshooting stability issues or confirming clean reboots? This one-liner filters the System log for the relevant events.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,6006,6008} -MaxEvents 5Example Output:
ProviderName: EventLog
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
7/14/2026 11:25:26 PM 6005 Information The Event log service was started.
7/14/2026 11:24:57 PM 6006 Information The Event log service was stopped.
7/14/2026 11:24:22 PM 6005 Information The Event log service was started.📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- LogName='System' targets the System log, where OS-level and driver events get recorded - separate from Application (program crashes) or Security (logon/audit events).
- Id=6005,6006,6008 filters for three related Event IDs: 6005 fires when the system starts up, 6006 fires on a clean/expected shutdown, and 6008 fires specifically for an unexpected shutdown (like a power loss or crash) - the most useful of the three for troubleshooting.
- -MaxEvents 5 limits the output to the most recent matches.