• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 378
  • Last Modified:

HOW DO I DISCOVER LAST REBOOT TIME IN WIN NT4?

IS THERE AN EASY WAY TO TELL IF A WINDOWS  NT 4.0 MACHINE HAS BEEN  REBOOTED ? LOOKING AT THE c/a/d SECURITY BOX WILL TELL ME WHEN I LAST LOGGED ON BUT NOT IF THE MACHINE HAS BEEN SHUTDOWN.  

ALSO... IF THIS IS POSSIBLE,  IS THERE A WAY TO  DISTINGUISH BETWEEN A POWEROFF/ON AND A c/a/d SHUTDOWN RESTART IN THE SAME WAY AS MS SCANDISK?

ANY HELP GREATLY APPRECIATED.

THANKS
0
KW82
Asked:
KW82
  • 3
  • 3
  • 3
  • +2
1 Solution
 
khang242Commented:
search microsoft's site for an uptime.exe, or just load up task manager and look at the cpu time of system idle process, or you can just scan through your event viewer's system log and look for the times event viewer started, since it usually gets loaded up by default
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
Uptime may work - it depends on what it's basing that on.

If your CPU is ever used, looking at system idle process is by far the least accurate way to do it.

Provided you don't stop and/or restart either the server service or the workstation service, you can type "net statistics workstation" (or "... server") and that will tell you when those service started.

A FAIRLY reliable way is to track event log start and stop messages.  But if that service is stopped and started manually, you'll get an inaccurate reading.

The best way to track this is to go to user manager and enable auditing for "Restart, Shutdown, and System" - This will log an event to the security log every reboot.

As for differentiating between a Warm Boot and a Cold boot, (Power OFF/ON tvs. "Shutdown and Restart" option) unless the security log tells you the exact kind of shutdown done - possible, but I'm not certain - there's no way to tell, short of putting a boot password in BIOS so if anyone reboots it, they can't go any further than the boot-up screen.  But doing this could seriously affect your business if this server is generally required to be up 24x7.
0
 
khang242Commented:
system idle process has never reached 100 for me, so it's a fairly good estimate, who knows, maybe uptime just calculates that
0
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

 
Lee W, MVPTechnology and Business Process AdvisorCommented:
My point is if you use MS Access or run a distributed computing program such as SETI at home, this eats up CPU cycles which takes away from the Idle process.  For example, on my system, my system Idle process is at 119:47.  But Seti is as 58:46.  Plus various other services and applications total in excess of 45 minutes.  If I close ANY program once it's opened, it causes my time count to be instantly off.  If you add all this time together, my uptime is about 179 hrs 18 minutes.  According to "UpTime" my system has only been on for 4 days 1 hour and 19 minutes (97:19) - which is more accurate - (I have dual CPUs and with each single second or realtime idleness, both CPUs experience it and therefore 1 second is equal to 2.  Now Uptime (from one of the resource kits) appears fairly accurate - according to the workstation service, my system has been up since May 4 at 5:14 pm
0
 
khang242Commented:
leew: i was wrong, i ran some tests and system idle time does stop when the cpu is fully used

the new uptime 2.0 in windows 2000 is very good, it calculates uptime availability as well, as well as some other useful facts, but it doesn't work for NT4 i don't believe
0
 
Tim HolmanCommented:
Look for the 6005 message in the event viewer - this will tell you when the event log was last started (ie when it was rebooted).
A power on / off will cause a dirty shutdown message in the event log - message ID 6008.
0
 
rwbergerCommented:
The way I do this is to enable "Restart, Shutdown and System" in the audit policy of User Manager.

You'll have to restart your system. This will log event 512 in the system log of the event viwer whenever the system boots.

Ramon Berger
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
rwberger,

Please reread the comments - you'll find I've already given that as an answer - to be courteous, I did not lock the question by "answering" it so others could also make suggestions.

0
 
rwbergerCommented:
rwberger changed the proposed answer to a comment
0
 
KW82Author Commented:
Thanks all for valid and helpful contributions, especially "leew."

I am however sure that there must be a way to distinguish between a cold reboot and a CAD shutdown/restart because Windows can tell the difference when it restarts - ie it runs scandisk or it doesn't.

Any ideas anyone??
0
 
Tim HolmanCommented:
I'll try again :

Look for the 6005 message in the event viewer - this will tell you when the event log was last started (ie when it was rebooted).

A power on / off will cause a dirty shutdown message in the event log - message ID 6008.   Every time a dirty shutdown is detected, SCANDISK will be run.

So - 6005 will tell you when there's been a graceful reboot.

6008 will tell you when there's been a power off, or a blue screen (which will be listed in the event viewer as well).
0
 
KW82Author Commented:
OK, guess I missed that one Tim. Sorry.
0
 
Tim HolmanCommented:
No probs - I thought you may have missed it !
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 3
  • 3
  • 3
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now