I need to parse the XP event viewer to track reboots.

I need to evaluate the event viewer in XP sp2 to find out when reboots occur.
I found the code (vbs) for parsing the event viewer and producing a flat file with the results.
What I don't know is how to determine if a reboot has occured.

I didn't say this was hard. I am not an administrator, nor do I play one on TV.

Thank you.
Option Explicit
Dim strComputer, objWMIService, colEvents
Dim objFSO, objTS, objEvent
Dim sobj
Dim dtmStartDate
Dim dtmEndDate
Dim DateToCheck
Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
'create output file
Set objTS = objFSO.CreateTextFile("c:\bsod.csv",True)
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
DateToCheck = Date - 1
dtmEndDate.SetVarDate Date, True
dtmStartDate.SetVarDate DateToCheck, True
'connect to WMI
strComputer = "IT1D620"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where TimeWritten >= '" _ 
        & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'") 
'run through SaveDump events found
'and write to output file
For each objEvent in colEvents
	sobj = objEvent.Category&","&objEvent.ComputerName&","&objEvent.EventCode&","&objEvent.Message&"," _
	&objEvent.RecordNumber&","&objEvent.SourceName&","&objEvent.TimeWritten&","&objEvent.Type&"," _
MsgBox "Report written to c:\bsod.csv"

Open in new window

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I don't believe there are any specific events that say when Windows has been restarted. There are certain events that come close. For example,
"The Event log service was started." in the "System" section is probably as close as you can get to telling when the computer was started up
Also, you can check:

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
bparkbparkAuthor Commented:
Thanks much, good enough for me.
If you want to filter out all the "restarts" for the computer, simply right click the System Event Log, and filter out events ID 6009, that means OS name, start, in eventlog. Each one of these, is one computer boot, so if you have records from the last year for example, you have all the reboots documented.

Also you could use Event Comb tool to filter certain events with more features.


Filter out events ID 6009, that means OS name, start, in eventlog. Each one of these, is when computer boots.


To figure out when your PC was last rebooted, you can simply open up Event Viewer, head into the Windows Logs -> System log, and then filter by Event ID 6006, which indicates that the event log service was shut down—one of the last things that happens before a reboot. This technique won't help you figure out when there was a power outage, but you can filter by Event ID 6005 to see when the system was last turned on—that event shows when the event log service was started again.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.