Create a Custom View in Event Viewer to show Reboot Events

Scenario

A server reboot can explain related events and alarms triggered by monitoring systems, so it’s always handy to check for reboots first when troubleshooting.

With this in mind, you want a quick and easy way of finding out when the server last rebooted.

Solution

You need to create a Custom View in Event Viewer, that will only show shutdown and startup events, including reasons why the server rebooted.

Here’s the steps to create the Custom View:

1. Open Server Manager > Diagnostics >Event Viewer > Custom Views
2. Right-click Custom Views and select Create Custom View:
   
3. Select System for the Event log, enter “12,13,22 (edit: and 1074,1076)” for the Event IDs, then click OK:
   
4. Enter a name (Reboot Events) and description (Shows shutdown/startup/reboot-reason events) for your Custom View, then click OK to save:
   
5. Your Custom View will now appear:
   
6. When you select the Custom View, only events with IDs of 12, 13, 22 and 1074 will be shown:
   
7. Here’s some examples of the events:
   
   
   
   
   
   
8. Although this only takes a minute to create, you might consider exporting the view, ready to import into another server:
   
9. Job done!