13

I know I can get logs of shutdowns from the eventlog when the shutdown is proper and initiated by the user or due to software upgrades. But how do I determine if the last shutdown was due power failure, over heating etc?

unlimit
  • 233
  • 1
  • 2
  • 7

2 Answers2

16

In the System event log, look for EventID 41 Kernel-Power. It's description is:

The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

That sounds like what you're looking for, correct?

MDMarra
  • 100,734
  • 32
  • 197
  • 329
  • 1
    Also if the system was shut down cleanly there will allways be 3 events "Event Log" in a row. One stopping one stopped and one starting. – Zapto Aug 09 '12 at 14:25
  • Is there any way to know when the last shutdown happened due to the reasons mentioned in my question? – unlimit Aug 09 '12 at 19:07
  • You can have a scheduled task with that event as a trigger and have it send an email or do whatever else you want. – MDMarra Aug 09 '12 at 19:35
  • I was thinking of creating a service and maybe do a "touch" on a file every n minutes and then compare its last modified date with the event timestamp to figure this out. Do you think this will be efficient or do you have any better way? – unlimit Aug 09 '12 at 23:31
  • Why do you need that, there's a time listed with the event... – MDMarra Aug 10 '12 at 00:25
  • If the machine got shutdown because of a power failure, I don't think any event will be generated. Then how will I know when the shutdown happened? And it may be hours before the machine is turned on again. This machine will be run in a place where power is very erratic. I need both the boot time and shutdown(for any reason) time for a report. – unlimit Aug 10 '12 at 00:50
  • You mean in case of power failure a event is generated, can you please explain as to how can I dig this out? I checked eventid 41, only bootup time is present, not when the shutdown happened. – unlimit Aug 10 '12 at 02:31
2

You can create a custom event viewer view of the System log and restrict the source to

Source: Microsoft-Windows-Kernel-Power

These should notify you about power-loss and subsequent power-restored events.

Brent Pabst
  • 6,069
  • 2
  • 24
  • 36