17

Imagine your computer is doing strange things regarding turning on, off, sleeping, hibernating, restart, being on in the morning when you set it to sleep in the evening before and similar things.

I assume these "events" are somewhere in the Event Log / Viewer, but I couldn't find a real "filter" to show only events of these types.

How can I display only these specific events instead of manually sifting through thousands of events?

Improve this question
6
  • I found an event that I would like to have highlighted in such a tool: Event Time = 2017-10-12 13:33:28.829; Level = Information; Channel = System; Provider = Microsoft-Windows-Kernel-General; Description = The operating system started at system time ‎2017‎-‎10‎-‎12T11:33:28.493096500Z
    – janpio
    Oct 12, 2017 at 11:50
  • Another one: Event Time = 2017-10-12 13:35:12.829; Level = Information; Channel = System; Description = The process C:\WINDOWS\servicing\TrustedInstaller.exe (LENOVOX1) has initiated the Neustart of computer LENOVOX1 on behalf of user NT-AUTORITÄT\SYSTEM for the following reason: Betriebssystem: Aktualisierung (geplant) Reason Code: 0x80020003 Shutdown Type: Neustart Comment:
    – janpio
    Oct 12, 2017 at 11:57
  • You are asking an off-topic question (software shopping). Questions seeking product, service, or learning material recommendations are off-topic. See On Topic. Try softwarerecs.stackexchange.com but please first read What is required for a question to contain "enough information".
    – DavidPostill ♦
    Oct 12, 2017 at 19:45
  • I reworded my question to make clear that I am not looking for software, but a solution to the problem I have. I am happy no matter if it is a CLI command, a way to configure Event Viewer or another tool.
    – janpio
    Oct 13, 2017 at 8:24
  • The filter would be to find out the corresponding EventIDs and filter for EventIDs which is rather easy in the default view. Alternatively you could write a script e.g. using PowerShell using Get-EventLog.
    – Seth
    Oct 13, 2017 at 8:33

4 Answers 4

Reset to default
35

I think you also get what you want by running the following command (elevation required): 

powercfg /sleepstudy

Sleep Study report saved to file path C:\WINDOWS\system32\sleepstudy-report.html.

The report should contain all sleep, hibernate, shutdown related events and some other related information:

laptop sleep study

Note: also you might be interested in what powercfg /systemsleepdiagnostics generates.

Improve this answer
1
6

to get all such events and uptimes i used this tool: https://www.nirsoft.net/utils/computer_turned_on_times.html screenshot from author

posted in the same thread: https://softwarerecs.stackexchange.com/a/52443/40730

Improve this answer
0

One workaround that at least shows the times of start and shutdown would be to look at the event logs created by the event logging service itself:

https://softwarerecs.stackexchange.com/a/10541/34583

Unfortunately it doesn't say anything about the type of shutdown, reason for start or shutdown, etc.

Improve this answer
-1

I am having these troubles with an HP laptop I use to leave in hibernation. In addition to @Alexei's answer (I am frightened after finding the much higher than I expected frequency of the overnight activity of my computer...), I found some help in the approach by @MarkCarr here:

Hibernating laptop randomly wakes up and stays on when lid is closed

So you must "use the Event Viewer. Open the Windows System Log, choose Filter Current Log, and in Event Source find the Power-Troubleshooter option". However, you can make it faster:

enter image description here

Instead of filtering each time, create your own view, or even export it once it's been created.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .