• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2061
  • Last Modified:

I need to parse the XP event viewer to track reboots.

I need to evaluate the event viewer in XP sp2 to find out when reboots occur.
I found the code (vbs) for parsing the event viewer and producing a flat file with the results.
What I don't know is how to determine if a reboot has occured.

I didn't say this was hard. I am not an administrator, nor do I play one on TV.

Thank you.
Option Explicit
Dim strComputer, objWMIService, colEvents
Dim objFSO, objTS, objEvent
Dim sobj
Dim dtmStartDate
Dim dtmEndDate
Dim DateToCheck
Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
'create output file
Set objTS = objFSO.CreateTextFile("c:\bsod.csv",True)
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
DateToCheck = Date - 1
dtmEndDate.SetVarDate Date, True
dtmStartDate.SetVarDate DateToCheck, True
'connect to WMI
strComputer = "IT1D620"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where TimeWritten >= '" _ 
        & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'") 
'run through SaveDump events found
'and write to output file
For each objEvent in colEvents
	sobj = objEvent.Category&","&objEvent.ComputerName&","&objEvent.EventCode&","&objEvent.Message&"," _
	&objEvent.RecordNumber&","&objEvent.SourceName&","&objEvent.TimeWritten&","&objEvent.Type&"," _
MsgBox "Report written to c:\bsod.csv"

Open in new window

1 Solution
I don't believe there are any specific events that say when Windows has been restarted. There are certain events that come close. For example,
"The Event log service was started." in the "System" section is probably as close as you can get to telling when the computer was started up
Also, you can check:
bparkbparkAuthor Commented:
Thanks much, good enough for me.
If you want to filter out all the "restarts" for the computer, simply right click the System Event Log, and filter out events ID 6009, that means OS name, start, in eventlog. Each one of these, is one computer boot, so if you have records from the last year for example, you have all the reboots documented.

Also you could use Event Comb tool to filter certain events with more features.


Filter out events ID 6009, that means OS name, start, in eventlog. Each one of these, is when computer boots.


To figure out when your PC was last rebooted, you can simply open up Event Viewer, head into the Windows Logs -> System log, and then filter by Event ID 6006, which indicates that the event log service was shut down—one of the last things that happens before a reboot. This technique won't help you figure out when there was a power outage, but you can filter by Event ID 6005 to see when the system was last turned on—that event shows when the event log service was started again.


Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now