I have a C# application to find the "start working" and "finish working" events for a user. The goal is to get a list with datetime values, when a PC was "up" and when it is "down" again.
This is working for logon/logoff and hibernation but not for standby (save energy). Searching with eventvwr I could not find the correct events connected to "enter standby" and "wake up from standby".
With this I read from the windows event logs:
public SortedDictionary<string, UserProfileEvent> ReadUserProfileEvents() {
string queryString = string.Format("*[System[TimeCreated[@SystemTime>='{0}' and @SystemTime<='{1}']]]", this.StartDate.ToString("s"), this.EndDate.ToString("s"));
var q = new EventLogQuery("Microsoft-Windows-User Profile Service/Operational", PathType.LogName, queryString);
var r = new EventLogReader(q);
var liste = new SortedDictionary<string, UserProfileEvent>();
EventRecord e = r.ReadEvent();
UserProfileEvent upe = null;
while (e != null) {
upe = new UserProfileEvent(e);
try {
liste.Add(upe.SortKey, upe);
}
catch (Exception exp) {
throw new Exception("Some error text", exp);
}
e = r.ReadEvent();
}
return liste;
}
Any ideas where to find the correct events?
EDIT: I just found "Microsoft-Windows-Power-Troubleshooter" and "Microsoft-Windows-Kernel-Power". These protocolls seem to point in the right directions...
Not everything will be listed in the event logs, cause they are not that important that a write to a log (on disk) would be required (by default).
If your application could run in background you could subscribe to some of those events and react accordingly. As "C Sharper" already wrote you can find them in the SystemEvents class.