怎么從日志中查看計算機是否重啟和關(guān)機

這篇文章主要介紹了怎么從日志中查看計算機是否重啟和關(guān)機，具有一定借鑒價值，感興趣的朋友可以參考下，希望大家閱讀完這篇文章之后大有收獲，下面讓小編帶著大家一起了解一下。

當我們想知道某臺計算機是否曾關(guān)機重啟過，從日志中怎么發(fā)現(xiàn)這一信息呢？
一、用“事件查看器”中的“系統(tǒng)”這一項，如果你發(fā)現(xiàn)多個例如“9/14/2010,5:44:48 PM,EventLog,Information,None,6005,N/A,GBTAVA01,The Event log service was started.
9/14/2010,5:44:48 PM,EventLog,Information,None,6009,N/A,GBTAVA01,Microsoft (R) Windows (R) 5.02. 3790 Service Pack 2 Multiprocessor Free.
9/14/2010,5:40:51 PM,EventLog,Information,None,6006,N/A,GBTAVA01,The Event log service was stopped.”這樣的信息，一般來說都是系統(tǒng)有過相關(guān)的重啟或關(guān)機； 看看該日志是不是在你啟動電腦時生成的，如果不是，就是非正常重啟過，或者別人人為重啟過。 
二、在運行里面輸入“gpedit.msc”，打開組策略編輯器，在里面依次打開“計算機配置--管理模版--系統(tǒng)”，然后在右邊的的窗口中找到“顯示關(guān)閉跟蹤程序”的設(shè)置項，用鼠標單擊該項，選擇“屬性”，在“顯示關(guān)閉跟蹤程序?qū)傩浴睂υ捒蛑羞x擇“啟用”，再單擊確認即可。在重啟或關(guān)機時，會需要輸入信息，這樣通過反查這樣的信息就可以發(fā)現(xiàn)蹤跡了。例如：
9/14/2010,3:31:09 PM,USER32,Information,None,1074,NT AUTHORITY\SYSTEM,GBTAVA01,"The process svchost.exe has initiated the restart of computer GBTAVA01 on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x80070020
 Shutdown Type: restart
 Comment: "                  這是shutdown -i中的遠程重啟跟蹤信息。
9/14/2010,5:31:05 PM,USER32,Information,None,1074,BEIJING\administrator,GBTAVA01,"The process Explorer.EXE has initiated the restart of computer GBTAVA01 on behalf of user BEIJING\Administrator for the following reason: Other (Planned)
 Reason Code: 0x85000000
 Shutdown Type: restart
 Comment: restart_20100914"    這是本機關(guān)機跟蹤程序?qū)υ捒虻闹貑⑿畔ⅰ?/p>

三、用“事件查看器”中的“安全”這一項，可以發(fā)現(xiàn)賬戶登錄和注銷、系統(tǒng)退出的信息，這樣來判斷系統(tǒng)有過相關(guān)的重啟或關(guān)機。例如：
9/14/2010,5:44:52 PM,Security,Success Audit,Logon/Logoff ,528,NT AUTHORITY\SYSTEM,GBTAVA01,"Successful Logon:
  User Name: SYSTEM
  Domain:  NT AUTHORITY
  Logon ID:  (0x0,0x3E7)
  Logon Type: 0
  Logon Process: -
  Authentication Package: -
  Workstation Name: -
  Logon GUID: -
  Caller User Name: -
  Caller Domain: -
  Caller Logon ID: -
  Caller Process ID: 4
  Transited Services: -
  Source Network Address: -
  Source Port: -
"
9/14/2010,5:40:51 PM,SECURITY,Success Audit,System Event ,513,N/A,GBTAVA01,Windows is shutting down. All logon sessions will be terminated by this shutdown。

感謝你能夠認真閱讀完這篇文章，希望小編分享的“怎么從日志中查看計算機是否重啟和關(guān)機”這篇文章對大家有幫助，同時也希望大家多多支持億速云，關(guān)注億速云行業(yè)資訊頻道，更多相關(guān)知識等著你來學習!