81

I want to figure out when the services was start up and terminated. Are there any kind log file about it?

2
  • 1
    could be programming related if OP needs to add code to a service to enable logging. Jul 1, 2009 at 6:27
  • or may its his own service :) Jul 1, 2009 at 7:04

4 Answers 4

86

Under Windows 7, open the Event Viewer. You can do this the way Gishu suggested for XP, typing eventvwr from the command line, or by opening the Control Panel, selecting System and Security, then Administrative Tools and finally Event Viewer. It may require UAC approval or an admin password.

In the left pane, expand Windows Logs and then System. You can filter the logs with Filter Current Log... from the Actions pane on the right and selecting "Service Control Manager." Or, depending on why you want this information, you might just need to look through the Error entries.

enter image description here

The actual log entry pane (not shown) is pretty user-friendly and self-explanatory. You'll be looking for messages like the following:

"The Praxco Assistant service entered the stopped state."
"The Windows Image Acquisition (WIA) service entered the running state."
"The MySQL service terminated unexpectedly. It has done this 3 time(s)."

3
  • 4
    how do you raise the verbosity or loglevel? the current verbosity of these messages is a joke.
    – n611x007
    Mar 21, 2016 at 7:48
  • Under "Event level" you ought to be able to select "Critical" for less info or any of the other options for more info. Your guess is as good as mine as to why they ordered them up-and-down before left-and-right.
    – Pops
    Mar 21, 2016 at 16:26
  • 1
    For Windows 8 and 10, these events are not available anymore as per superuser.com/questions/1300506/…
    – riQQ
    Sep 4, 2020 at 14:13
58

Take a look at the System log in Windows EventViewer (eventvwr from the command line).
You should see entries with source as 'Service Control Manager'. e.g. on my WinXP machine,

Event Type: Information
Event Source:   Service Control Manager
Event Category: None
Event ID:   7036
Date:       7/1/2009
Time:       12:09:43 PM
User:       N/A
Computer:   MyMachine
Description:
The Background Intelligent Transfer Service service entered the running state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
4
  • 5
    If only it would also show the source of the command to the SC. ☹
    – Synetech
    Mar 12, 2013 at 19:20
  • What does N/A under User mean?
    – Axel2D
    Jan 9, 2019 at 9:39
  • Thank you very much. In my case ADAM service was not starting due to an incorrect password. I have managed to find the root cause only through EventViewer Apr 16, 2019 at 14:43
  • Still relevant on Win Server 2019 Mar 30, 2023 at 3:02
7

Through the Computer management console, navigate through Event Viewer > Windows Logs > System. Every services that change state will be logged here.

You'll see info like: The XXXX service entered the running state or The XXXX service entered the stopped state, etc.

3

The most likely place to find this sort of information is in the event viewer (under Administrative tools in XP or run eventvwr) This is where most services log warnings errors etc.

Not the answer you're looking for? Browse other questions tagged or ask your own question.