Batch to read Kernel-Power event from System Event Viewer log?

Question

I'm trying to read system status messages to make some decisions in my existing batch files.

For example I really need to know:

• if the system is on because it woke from sleep, or if it was cold booted up via button or network etc.
• the time at which (or how long ago) lastwake from sleep happened.

I can't find this info with powercfg commands.

And more broadly, would be nice if I could just read from the system log any message and when it was triggered.

Is this possible / accessible via cmd / bat? Can you query all the e.g. Kernel-Power events? Nothing comes up on SO about this.

Answer 1

On my Microsoft Windows [Version 10.0.22631.3527]: powercfg.exe /lastwake could return (some ad-hoc examples):

• if the system is on because it was cold booted up:

Wake History Count - 0

• if the system is on because it woke from sleep by Power Button:

Wake History Count - 1
Wake History [0]
  Wake Source Count - 1
  Wake Source [0]
    Type: Fixed Feature
    Power Button

• if the system is on because it woke from sleep by a mouse click:

Wake History Count - 1
Wake History [0]
  Wake Source Count - 1
  Wake Source [0]
    Type: Device
    Instance Path: PCI\VEN_8086&DEV_7AE0&SUBSYS_7D461462&REV_11\3&11583659&0&A0
    Friendly Name: Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)
    Description: USB xHCI Compliant Host Controller
    Manufacturer: Generic USB xHCI Host Controller

The time at which lastwake from sleep happened:

wmic path Win32_NTLogEvent WHERE "logfile='system' and SourceName='Microsoft-Windows-Power-Troubleshooter' and EventCode=1" Get Message /Value | findstr /I "Time"

or

wmic path Win32_NTLogEvent WHERE "logfile='system' and SourceName='Microsoft-Windows-Power-Troubleshooter' and EventCode=1" Get TimeGenerated

Unfortunately, both above commands could produce a huge output which is hard to parse in cmd or in a .cmd script.

I'd recommend calling PowerShell commands as follows (easy to parse even in cmd):

powershell -noprofile -command "$x=Get-EventLog -LogName System -EntryType Information -InstanceId 1 -Source Microsoft-Windows-Power-Troubleshooter -After $(Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty LastBootUpTime) -Newest 1 | Select-Object -ExpandProperty TimeGenerated; if ($x) {$x.ToString()} else {''}"

10.05.2024 16:35:46

Note: neglected the imponderable difference between TimeGenerated of an event and real Wake Time…