Solved

How can I easily log all PCs power off and power on time?

Posted on 2011-03-25
12
363 Views
Last Modified: 2012-05-11
Hi Experts,

Is there a way that can easily log/view all PCs in a domain the time it power off and/or power on?

I have tried to setup group policy startup/shutdown script to write a line to a text file on a remote server but it failed, I can do the same to log user's logon and logoff time by a logon/logoff script.

please advice.
0
Comment
Question by:nokyplease
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 2
  • +1
12 Comments
 
LVL 4

Expert Comment

by:m_walker
ID: 35214016
Have a look at your event logs.  There should be a logon event when the computer logs onto the domain (as well as an event when the user logs on).  The issues is of the logoff event does not happen.  loss of power, user just turns off the computer etc.  So log off events can be hit and miss.

If there is not easy solution, then you can get creative, but will requre some work.  That is setup a process on each computer (a windows service would be the best) that sends the computer id to a logging server every X mins.  When you dont get a message for X * 2 mins,assume its off.  When I say some work someone will need to cut some code/script to do it... so wait and see if someone knows of a simple way.

BTW: on out 2003 servers we have a syslog addon that sends all windows events to a linux syslog server that logs them to a flat file. This can help for log searching...
0
 
LVL 23

Expert Comment

by:Danny Child
ID: 35214052
psshutdown from PS Tools is the best remote scriptable shutdown tool
http://technet.microsoft.com/en-us/library/bb842062.aspx

but you need to take care - will you Force a shutdown on a remote machine without saving work?  
0
 
LVL 23

Expert Comment

by:Danny Child
ID: 35214083
If you just want to check how long they're running, the PSList tool (same link as above) gives a good guide to the time since last reboot, if you query the IDLE time.

pslist idle \\<PCname>

it's only a guide, on my present PC, it shows 189 hours, but if I go to Task Manager, add the CPU Time column, and sort by time, I get 189 hours as the top entry, then 3 hours for AV, and everything below that is under an hour - therefore negligible, imho.  

To look at Event Logs, in the System Log, there is event 6005 to Start Event Log Service, and 6006 to Stop Event Log Service.  The latter doesn't get written in an uncontrolled shutdown takes place though.
0
Salesforce Made Easy to Use

On-screen guidance at the moment of need enables you & your employees to focus on the core, you can now boost your adoption rates swiftly and simply with one easy tool.

 

Author Comment

by:nokyplease
ID: 35214140
I know i can view it from event log, but its a bit difficult to sort and trace it.

What I have done to check user logon/logoff is to setup a simple echo command in the logon/logoff script to save the username, time, computer name to a file with file name e.g. LogOnLogOffStat_<USERNAME>.txt and LogOnLogOffStat_<COMPUTERNAME>.txt

by doing so, i can easily look up a user has been logon to which PC and who has been logged on to a particular PC.

I would like to extend this logging to monitor PC power on and power off. However I tried to use the startup/shudwon script and failed.

My plan is to create something like PC_PowerOnOffStat_<COMPUTERNAME>.txt and hence i can easily check out when a particular PC had been reboot or power down as each PC has it power on off logs.  

Is that when running the startup/shutdown script, the computer cannot write to a network share? the network share i shared out with everyone read and write in both share and NTFS permission.  
0
 
LVL 4

Expert Comment

by:m_walker
ID: 35214158
For testing of your scripts, have the log file saved on the local PC.  That way you can be sure the script is working as expected (without any network related issues).  Then move back to the network knowing the script bit is fine.
 
0
 
LVL 6

Expert Comment

by:JRoyse
ID: 35215264
I think you would be better off using a network monitoring program and ping the hosts.  That would determine when they were on/off and at what times.
0
 
LVL 4

Expert Comment

by:m_walker
ID: 35215308
JRoyse, I agree.  Just need to keep an eye on how much checking is done and the traffic it creates. 20 Computers every 15 mins would be nothing, but 1000 computers server min states to add network load.  

If the network load is to great, then a local app that every x mins updates a local log file.  Then on next startup sends the "last" time checked to the server would provide "this power on" and "est last power off".  
Very little traffic, you will just not know the last power off until its back on again.
0
 
LVL 6

Expert Comment

by:JRoyse
ID: 35216407
I used to monitor desktop workstations with pings ever few minutes with Nagios.  It let me know which computers were active.  

If each ping was 32 bytes, and you pinged each computer 5 times, X1000 computers is roughly 36MB an instance.  not much unless this is a WAN link.
0
 

Author Comment

by:nokyplease
ID: 35216890
the main purpose of the log file is for me to easily trace a particular PC on/off activity in a certain time.

I have nagios setup for monitoring all the servers but it seems too much if adding all PC under nagios monitoring and i also don;t want to get alerts of a PC's ping check is critical or recovered from nagios' email or the web interface. thanks for this idea anyway.

local log is a second choice if a centralized log location cannot be implemented.....
0
 
LVL 4

Accepted Solution

by:
m_walker earned 500 total points
ID: 35220202
nokyplease, you can do a local log, then upload that on startup/user logon scipt.  
on computer startup
- write the time to a log file. "startup : dd MMM YYYY hh:mm"
- start a background job ("at schedular") that runes ever x mins and writes to a log file : running : dd MMM YYYY hh:mm
On shutdown write t the log file :shutdown : dd MMM YYY hh:mm

This way you will get someething close if the computer is not shut down correctly.

Then say, on user logon, as part of the logn script
- copy local log to server
- clear local log.
0
 

Author Comment

by:nokyplease
ID: 35222152
This may work, but then I need to setup a scheduled task on every pcs.... is there a way to remotely set this up with a batch or script? can I add a scheduled task via winrs or wmic command?
0
 
LVL 4

Assisted Solution

by:m_walker
m_walker earned 500 total points
ID: 35224167
Chek out the "at" command from a windows dos box

at /? snipit...

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]
AT [\\computername] time [/INTERACTIVE]
    [ /EVERY:date[,...] | /NEXT:date[,...]] "command"

It will need testing and you will need to get the "command" batch file to the remote pc (maybe via a logon script copy.

0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While working, an annoying popup showing below will come and we cannot cancel or close it form the screen. The error message will come again and again.
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question