Solved

How can I easily log all PCs power off and power on time?

Posted on 2011-03-25
12
353 Views
Last Modified: 2012-05-11
Hi Experts,

Is there a way that can easily log/view all PCs in a domain the time it power off and/or power on?

I have tried to setup group policy startup/shutdown script to write a line to a text file on a remote server but it failed, I can do the same to log user's logon and logoff time by a logon/logoff script.

please advice.
0
Comment
Question by:nokyplease
  • 5
  • 3
  • 2
  • +1
12 Comments
 
LVL 4

Expert Comment

by:m_walker
ID: 35214016
Have a look at your event logs.  There should be a logon event when the computer logs onto the domain (as well as an event when the user logs on).  The issues is of the logoff event does not happen.  loss of power, user just turns off the computer etc.  So log off events can be hit and miss.

If there is not easy solution, then you can get creative, but will requre some work.  That is setup a process on each computer (a windows service would be the best) that sends the computer id to a logging server every X mins.  When you dont get a message for X * 2 mins,assume its off.  When I say some work someone will need to cut some code/script to do it... so wait and see if someone knows of a simple way.

BTW: on out 2003 servers we have a syslog addon that sends all windows events to a linux syslog server that logs them to a flat file. This can help for log searching...
0
 
LVL 23

Expert Comment

by:DanCh99
ID: 35214052
psshutdown from PS Tools is the best remote scriptable shutdown tool
http://technet.microsoft.com/en-us/library/bb842062.aspx

but you need to take care - will you Force a shutdown on a remote machine without saving work?  
0
 
LVL 23

Expert Comment

by:DanCh99
ID: 35214083
If you just want to check how long they're running, the PSList tool (same link as above) gives a good guide to the time since last reboot, if you query the IDLE time.

pslist idle \\<PCname>

it's only a guide, on my present PC, it shows 189 hours, but if I go to Task Manager, add the CPU Time column, and sort by time, I get 189 hours as the top entry, then 3 hours for AV, and everything below that is under an hour - therefore negligible, imho.  

To look at Event Logs, in the System Log, there is event 6005 to Start Event Log Service, and 6006 to Stop Event Log Service.  The latter doesn't get written in an uncontrolled shutdown takes place though.
0
 

Author Comment

by:nokyplease
ID: 35214140
I know i can view it from event log, but its a bit difficult to sort and trace it.

What I have done to check user logon/logoff is to setup a simple echo command in the logon/logoff script to save the username, time, computer name to a file with file name e.g. LogOnLogOffStat_<USERNAME>.txt and LogOnLogOffStat_<COMPUTERNAME>.txt

by doing so, i can easily look up a user has been logon to which PC and who has been logged on to a particular PC.

I would like to extend this logging to monitor PC power on and power off. However I tried to use the startup/shudwon script and failed.

My plan is to create something like PC_PowerOnOffStat_<COMPUTERNAME>.txt and hence i can easily check out when a particular PC had been reboot or power down as each PC has it power on off logs.  

Is that when running the startup/shutdown script, the computer cannot write to a network share? the network share i shared out with everyone read and write in both share and NTFS permission.  
0
 
LVL 4

Expert Comment

by:m_walker
ID: 35214158
For testing of your scripts, have the log file saved on the local PC.  That way you can be sure the script is working as expected (without any network related issues).  Then move back to the network knowing the script bit is fine.
 
0
 
LVL 6

Expert Comment

by:JRoyse
ID: 35215264
I think you would be better off using a network monitoring program and ping the hosts.  That would determine when they were on/off and at what times.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 4

Expert Comment

by:m_walker
ID: 35215308
JRoyse, I agree.  Just need to keep an eye on how much checking is done and the traffic it creates. 20 Computers every 15 mins would be nothing, but 1000 computers server min states to add network load.  

If the network load is to great, then a local app that every x mins updates a local log file.  Then on next startup sends the "last" time checked to the server would provide "this power on" and "est last power off".  
Very little traffic, you will just not know the last power off until its back on again.
0
 
LVL 6

Expert Comment

by:JRoyse
ID: 35216407
I used to monitor desktop workstations with pings ever few minutes with Nagios.  It let me know which computers were active.  

If each ping was 32 bytes, and you pinged each computer 5 times, X1000 computers is roughly 36MB an instance.  not much unless this is a WAN link.
0
 

Author Comment

by:nokyplease
ID: 35216890
the main purpose of the log file is for me to easily trace a particular PC on/off activity in a certain time.

I have nagios setup for monitoring all the servers but it seems too much if adding all PC under nagios monitoring and i also don;t want to get alerts of a PC's ping check is critical or recovered from nagios' email or the web interface. thanks for this idea anyway.

local log is a second choice if a centralized log location cannot be implemented.....
0
 
LVL 4

Accepted Solution

by:
m_walker earned 500 total points
ID: 35220202
nokyplease, you can do a local log, then upload that on startup/user logon scipt.  
on computer startup
- write the time to a log file. "startup : dd MMM YYYY hh:mm"
- start a background job ("at schedular") that runes ever x mins and writes to a log file : running : dd MMM YYYY hh:mm
On shutdown write t the log file :shutdown : dd MMM YYY hh:mm

This way you will get someething close if the computer is not shut down correctly.

Then say, on user logon, as part of the logn script
- copy local log to server
- clear local log.
0
 

Author Comment

by:nokyplease
ID: 35222152
This may work, but then I need to setup a scheduled task on every pcs.... is there a way to remotely set this up with a batch or script? can I add a scheduled task via winrs or wmic command?
0
 
LVL 4

Assisted Solution

by:m_walker
m_walker earned 500 total points
ID: 35224167
Chek out the "at" command from a windows dos box

at /? snipit...

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]
AT [\\computername] time [/INTERACTIVE]
    [ /EVERY:date[,...] | /NEXT:date[,...]] "command"

It will need testing and you will need to get the "command" batch file to the remote pc (maybe via a logon script copy.

0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now