0

Windows' Event ID 6008 is Unexpected Shutdown event (see in System's Event Viewer). The problem is that time of the unexpected system's shutdown is written in bytes array (which is called EventData).

I want to fetch this date (in my C# application) from EventData but I don't know how time is encoded in bytes array.

patryk.beza
  • 4,876
  • 5
  • 37
  • 56
  • Why can't you use the [TimeGenerated](http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.timegenerated.aspx) property – rene Jul 07 '13 at 12:30
  • Because `TimeGenerated`>=`Time of the unexpected shutdown`. It's not the same. – patryk.beza Jul 07 '13 at 12:37

0 Answers0