Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 6006 Source: EventLog

Source
Level
Description
The Event log service was stopped.
Comments
 
This event can occur when the Windows logon (Winlogon.exe) process does not ignore the Windows logon screen saver time-out. See ME916719 for a hotfix applicable to Microsoft Windows Server 2003.

As per Microsoft: "This event is written during an expected restart or shutdown after the user initiates the restart or shutdown by clicking Start and then clicking Shut Down, or by pressing CTRL+ALT+DELETE and then clicking Shut Down". See MSW2KDB for additional information about this event.
Check ME196452 to see why WinNT Reports 6005, 6006, 6008, and 6009 event log entries.
Self-explanatory. It occurs during a shutdown.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...