Event ID 6005: The event log service was started

Written at boot when the event log service starts, so it effectively marks system start-up.

Log: System
Category: System

Why it matters

Use it with 6006 and 6008 to build a timeline of restarts.

What to check

Check for restarts you cannot explain, especially around an incident.

How to turn it on

Logged by default.