Event Log service stopped — typically indicates clean system shutdown.
Clean shutdown indicator. If 6005 (start) does not follow within reasonable time, the system may have crashed or been hard-reset.
Use to establish shutdown timeline. Missing 6006 before next 6005 = unclean shutdown (crash, power loss, or forced off).
param1param2Computer Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "System" and EventID == 6006 // The Event Log service was stopped
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:System" EventCode=6006
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The Event Log service was stopped — add EventData fields: param1, param2, Computer`The Event Log service was stopped. Event Log service stopped — typically indicates clean system shutdown.
Event 6006 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.
Use to establish shutdown timeline. Missing 6006 before next 6005 = unclean shutdown (crash, power loss, or forced off).