Powershell小技巧之通过EventLog查看近期电脑开机和关机时间
机器开机和关机时写在EventLog中的第一条日志和最后一条日志分别为：6005和6006。
TimeCreatedIdLevelDisplayNameMessage ------------------------------------ 8/18/20149:23:04AM6005InformationTheEventlogservicewasstarted. 8/15/20147:03:48PM6006InformationTheEventlogservicewasstopped.
所以根据上面的信息很容易得出机器的开机，关机，在线时间，代码为：
FunctionGet-ComputerUptimeHistory{
$q='
<QueryList>
<QueryId="0"Path="System">
<SelectPath="System">*[System[(EventID=6005orEventID=6006)]]</Select>
</Query>
</QueryList>'
$events=Get-WinEvent-FilterXml$q
$i=-1
while($i+1-lt$events.length){
if($i-eq-1)
{
[PSCustomObject]@{
StartTime=$events[0].TimeCreated;
StopTime=$null;
UpTime=[datetime]::Now-$events[0].TimeCreated
}
}
else{
[PSCustomObject]@{
StartTime=$events[$i+1].TimeCreated;
StopTime=$events[$i].TimeCreated;
UpTime=$events[$i].TimeCreated-$events[$i+1].TimeCreated
}
}
$i+=2
}
}
输出为：
PS>Get-ComputerUptimeHistory|ft-AutoSize StartTimeStopTimeUpTime ----------------------- 8/18/20149:23:04AM2.05:00:22.5891685 8/13/20149:30:42AM8/15/20147:03:48PM2.09:33:06 7/22/201412:16:09PM8/13/20149:29:09AM21.21:13:00 7/22/20149:23:08AM7/22/201411:26:08AM02:03:00 7/17/201411:08:57AM7/21/20146:20:28PM4.07:11:31 7/14/20149:35:11AM7/17/201411:07:25AM3.01:32:14 7/10/20143:01:53PM7/14/20149:21:48AM3.18:19:55 7/8/20145:04:02PM7/10/20142:58:36PM1.21:54:34 6/30/20149:17:28AM7/8/20145:01:24PM8.07:43:56 6/29/201410:24:50AM6/29/20146:04:09PM07:39:19 6/20/20149:33:08AM6/27/20146:18:34PM7.08:45:26 6/16/20143:05:45PM6/20/20149:31:16AM3.18:25:31 6/12/20149:40:05AM6/16/20143:04:02PM4.05:23:57 6/6/20142:52:11PM6/12/20149:37:46AM5.18:45:35 6/5/201410:55:20AM6/6/20142:51:09PM1.03:55:49 6/5/20149:19:38AM6/5/201410:54:04AM01:34:26 6/3/20141:33:24PM6/4/20147:58:58PM1.06:25:34 5/30/201410:07:06AM6/3/20141:31:24PM4.03:24:18 5/29/20145:30:33PM5/30/20149:41:41AM16:11:08 5/29/20145:28:57PM5/29/20145:29:43PM00:00:46 5/29/20142:52:58PM5/29/20145:26:57PM02:33:59 5/29/20142:50:31PM5/29/20142:51:06PM00:00:35 5/27/201411:54:43AM5/29/20142:47:29PM2.02:52:46 5/23/20145:31:18PM5/26/20149:16:33AM2.15:45:15 5/22/20146:00:29PM5/23/20149:16:45AM15:16:16 5/21/20144:38:22PM5/21/20144:40:07PM00:01:45 5/21/20149:43:59AM5/21/20144:36:34PM06:52:35 5/19/201411:27:28AM5/21/20149:42:32AM1.22:15:04 5/19/20149:25:56AM5/19/20149:27:00AM00:01:04 5/15/20149:23:15AM5/15/20149:24:16AM00:01:01 5/15/201411:18:45AM5/15/201411:19:49AM00:01:04