On Microsoft Windows NT, at system startup the event number 4608 is generated by
Microsoft-Windows-Security-Auditing and I can see that in the security event log. You can read more about it in this TechNet article if you've not come across this.
As the TechNet article says, Windows system administrators can use this to track when the system starts up, because this event is a fairly early and fundamental user-space subsystem starting up. There are a whole bunch of security auditing events that are logged, in fact.
I'm looking for the equivalent on Unix. Is there some sort of security event log, as on Windows, which I can scan for a specific (to use Windows NT terminology because I don't yet know enough to know even the right names of what I want) "device process name" or "Device Event Class ID"? If so, where is it and what do I look for?
Otherwise, how can I find out the same information about when the server started up, shut down, people failed to log in, and so forth? All of the same sorts of things that I'd find from looking for security auditing events in the Microsoft Windows NT system event log.