Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd like to log the times when my computer starts up and shuts down. I don't need any diagnostic info or anything, just a simple note of the date and time, e.g. something like:

2011/04/29 08:17:34 AM Startup
2011/04/29 05:26:52 PM Shutdown

How can I do that?

My Google searches so far have yielded lots of people asking about reducing Windows startup times, but nothing of interest to the task at hand.

share|improve this question
add comment

2 Answers

up vote 19 down vote accepted

Windows uses event logs with Event Viewer to log this sort of thing:

Event ID #6005 indicates system startup

Event ID #6006 indicates system shutdown

You should create a custom view in Event Viewer that will filter those 2 event IDs with the source being the eventlog.

This is the simplest way.

Alternatively, you can use powershell's get-winevent cmdlet to create a custom filter and pipe those items to a text file.

Or... you can use the get-eventlog to pipe a custom event log (that you create with the custom views...) to a text file.

share|improve this answer
    
Is there any way to know system login\sleep times? –  Viktor Sehr Feb 1 '12 at 17:32
    
I don't have a clue how to create those views, even after I've read those pages. But, there is an easier way. Open up Event Viewer, click Windows Logs -> System. On the right side there is Filter Current Log..., click on it and when the new window appears insert 6006 on All Event ID's and click Ok. This will show up only system shutdown events. Do the same for system startup. –  machineaddict Aug 13 '13 at 9:05
add comment

Coming back on the above, admittedly, old thread. Reason that I was looking for the same. 6005 is showing the start of logging events, but I assume it will also show up in case of any reboots, i.e. Windows does not make a difference between a 'full start-up' or warm reboot.

If the purpose is to seek the first startup and last closedown only, one has to remove any double 6005 entries.

With me, event id 12 is the very first one and event id 13 is the last one.

12: The description for Event ID ( 12 ) in Source ( Microsoft-Windows-Kernel-General ) could not be found. Either the component that raises this event is not installed on the computer or the installation is corrupted.You can install or repair the component or try to change Description Server.

13: The description for Event ID ( 13 ) in Source ( Microsoft-Windows-Kernel-General ) could not be found. Either the component that raises this event is not installed on the computer or the installation is corrupted.You can install or repair the component or try to change Description Server.

The following information was included with the event (insertion strings): 2012-12-25T18:23:26.070181000Z

p.s.that aside, i have a number of instances where a few 6005's were logged, but no 6006 that follows. One has to manually add the actual log-off based on e.g. the last eventlog entry that day.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.