# Any reboot log on old windows NT4?

**URL:** <https://boards.straightdope.com/t/any-reboot-log-on-old-windows-nt4/448437>\
**Category:** Factual Questions\
**Created:** [May 7, 2008, 3:39pm UTC](https://boards.straightdope.com/t/any-reboot-log-on-old-windows-nt4/448437 "2008-05-07T15:39:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\
**Post date:** [May 7, 2008, 3:39pm UTC](https://boards.straightdope.com/t/any-reboot-log-on-old-windows-nt4/448437/1 "2008-05-07T15:39:41Z")

</div>

Is there a log file I can check to tell me when the computer has been rebooted?

---

<div class="post-metadata">

**Author:** ![mks57](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@mks57](https://boards.straightdope.com/u/mks57)\
**Post date:** [May 7, 2008, 3:45pm UTC](https://boards.straightdope.com/t/any-reboot-log-on-old-windows-nt4/448437/2 "2008-05-07T15:45:58Z")

</div>

Use the event viewer to examine the event log.

---

<div class="post-metadata">

**Author:** ![dasgupta](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@dasgupta](https://boards.straightdope.com/u/dasgupta)\
**Post date:** [May 7, 2008, 4:25pm UTC](https://boards.straightdope.com/t/any-reboot-log-on-old-windows-nt4/448437/3 "2008-05-07T16:25:22Z")

</div>

Specifically you can filter the System event log for source Eventlog.

Event 6009 is logged at startup. It will look similar to the following:

“Microsoft ® Windows NT 4.0 1381 Service Pack 6 Multiprocessor free” It should be followed by Event 6005.

Previous to 6009, you should have one of these: Event 6006 is a clean shutdown of the system, 6008 is dirty.

ETA: I should have added that these events are only logged in SP4 and later, IIRC.