How do I log startup and shut-down times in Windows 7?
I'd like to log the times when my computer starts up and shuts down. I don't need any diagnostic info or anything, just a simple note of the date and time, e.g. something like:
2011/04/29 08:17:34 AM Startup
2011/04/29 05:26:52 PM Shutdown
How can I do that?
My Google searches so far have yielded lots of people asking about reducing Windows startup times, but nothing of interest to the task at hand.
Solution 1:
Windows uses event logs with Event Viewer to log this sort of thing:
Event ID #6005 indicates system startup
Event ID #6006 indicates system shutdown
You should create a custom view in Event Viewer that will filter those two event IDs with the source being the eventlog.
This is the simplest way.
Alternatively, you can use PowerShell's Get-WinEvent cmdlet to create a custom filter and pipe those items to a text file.
Or... you can use the Get-EventLog to pipe a custom event log (that you create with the custom views...) to a text file.
Solution 2:
6005 is showing the start of logging events, but I assume it will also show up in case of any reboots, i.e. Windows does not make a difference between a 'full start-up' or warm reboot.
If the purpose is to seek the first startup and last closedown only, one has to remove any double 6005 entries.
With me, event id 12 is the very first one and event id 13 is the last one.
12: The description for Event ID ( 12 ) in Source ( Microsoft-Windows-Kernel-General ) could not be found. Either the component that raises this event is not installed on the computer or the installation is corrupted.You can install or repair the component or try to change Description Server.
13: The description for Event ID ( 13 ) in Source ( Microsoft-Windows-Kernel-General ) could not be found. Either the component that raises this event is not installed on the computer or the installation is corrupted.You can install or repair the component or try to change Description Server.
The following information was included with the event (insertion strings): 2012-12-25T18:23:26.070181000Z
PS: That aside, I have a number of instances where a few 6005's were logged, but no 6006 that follows. One has to manually add the actual log-off based on e.g. the last eventlog entry that day.