Create a Custom View in Event Viewer to show Reboot Events

Scenario

A server reboot can explain related events and alarms triggered by monitoring systems, so it’s always handy to check for reboots first when troubleshooting.

With this in mind, you want a quick and easy way of finding out when the server last rebooted.

Solution

You need to create a Custom View in Event Viewer, that will only show shutdown and startup events, including reasons why the server rebooted.

Here’s the steps to create the Custom View:

  1. Open Server Manager > Diagnostics >Event Viewer > Custom Views
  2. Right-click Custom Views and select Create Custom View:
    Create-Custom-View-for-Reboots-in-Event-Viewer_001
  3. Select System for the Event log, enter “12,13,22 (edit: and 1074,1076)” for the Event IDs, then click OK:
    Create-Custom-View-for-Reboots-in-Event-Viewer_002
  4. Enter a name (Reboot Events) and description (Shows shutdown/startup/reboot-reason events) for your Custom View, then click OK to save:
    Create-Custom-View-for-Reboots-in-Event-Viewer_003
  5. Your Custom View will now appear:
    Create-Custom-View-for-Reboots-in-Event-Viewer_004
  6. When you select the Custom View, only events with IDs of 12, 13, 22 and 1074 will be shown:
    Create-Custom-View-for-Reboots-in-Event-Viewer_008
  7. Here’s some examples of the events:
    Create-Custom-View-for-Reboots-in-Event-Viewer_005

    Create-Custom-View-for-Reboots-in-Event-Viewer_006

    Create-Custom-View-for-Reboots-in-Event-Viewer_007
  8. Although this only takes a minute to create, you might consider exporting the view, ready to import into another server:
    Create-Custom-View-for-Reboots-in-Event-Viewer_009
  9. Job done!

Trackbacks

  1. […] this link (Create a Custom View in Event Viewer to show Reboot […]