var allEventLogs = System.Diagnostics.EventLog.GetEventLogs();
var systemEventLog = -1;

// Find the System event log
for(var i = 0; i < allEventLogs.Count(); i++) {
    //StrokesPlus.Console.Log(allEventLogs[i].Log);
    if (allEventLogs[i].Log == "System") {
        systemEventLog = i;
    }
}

// Start at the end of the event log and work backward (most recent first)
for(var i = allEventLogs[systemEventLog].Entries.Count - 1; i > 0; i--) {

    // EventLogEntry Properties:
    //https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlogentry?view=dotnet-plat-ext-6.0
    let entry = allEventLogs[systemEventLog].Entries.Item(i);

    // Looks like these types will show logoff/shutdown/etc (but see link in next section for better details)
    if(entry.EntryType.ToString() == "Information" 
       && entry.Source == "User32") {
        StrokesPlus.Console.Log(`${entry.TimeGenerated.ToString("yyyy-MM-dd hh:mm:ss tt")} - ${entry.EntryType.ToString()} - ${entry.Source} - ${entry.Message}`)
    }

    // Below are just 2 events I found to map here, the post below seems to cover a variety of event sources and IDs
    // https://serverfault.com/questions/885601/windows-event-codes-for-startup-shutdown-lock-unlock
    if(entry.EntryType.ToString() == "Information" 
       && entry.Source == "Microsoft-Windows-Kernel-General") 
    {
        switch(entry.EventID) {
            case 12:
                StrokesPlus.Console.Log(`${entry.TimeGenerated.ToString("yyyy-MM-dd hh:mm:ss tt")} - ${entry.EntryType.ToString()} - ${entry.Source} - System Started`)        
                break;
            case 13:
                StrokesPlus.Console.Log(`${entry.TimeGenerated.ToString("yyyy-MM-dd hh:mm:ss tt")} - ${entry.EntryType.ToString()} - ${entry.Source} - System Shudown`)        
                break;
        }
        
    }
}