6005 System log · Event Log Service info severity low volume

System Event ID 6005 — The Event Log service was started

The Windows Event Log service started — typically indicates system boot. Used to identify system restart times.

Why event 6005 matters

Establish system uptime and boot timeline. Unexpected reboots (no corresponding shutdown event 6006) may indicate BSOD, power failure, or kill-switch-style attack.

How to detect it

Use to establish system boot timeline. Correlate with 6006 (stop) and 1074 (shutdown) for reboot analysis. Unexpected boots outside maintenance windows warrant investigation.

Log source
System
Logged by default in the System channel; no audit policy required.
Fields to pivot on
param1param2Computer

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
Event
| where EventLog == "System" and EventID == 6005   // The Event Log service was started
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:System" EventCode=6005
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The Event Log service was started — add EventData fields: param1, param2, Computer`
Hunt event 6005 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Event Log Service events

6006 The Event Log service was stopped 6008 The previous system shutdown was unexpected 6009 Microsoft Windows version 6013 The system uptime is

Frequently asked questions

What is System Event ID 6005?

The Event Log service was started. The Windows Event Log service started — typically indicates system boot. Used to identify system restart times.

Which log records event 6005?

Event 6005 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.

How do you detect activity around event 6005?

Use to establish system boot timeline. Correlate with 6006 (stop) and 1074 (shutdown) for reboot analysis. Unexpected boots outside maintenance windows warrant investigation.