Question

我需要找到计算机第一次启动的时间，并在一天内终于关闭。

对于前。我会在早上10点启动我的电脑，多次我会重新启动或处于闲置状态。最后在结束时（晚上9点），我将关闭机器。

我想在过去的两周内找到我在电脑前花了多长时间。

下面的命令会在事件日志消息中提供一天的正常运行时间，但它会以秒为单位显示多个正常运行时间。相反，如果我可以获得第一次启动时间和最后关闭时间，我可以轻松地计算它。

(get-eventlog -EntryType Information -LogName System -InstanceId 2147489661 -newest 25)

Answer 1

如何获取每天的第一个和最后一个日志条目
如果电脑关闭，只有一个用户。

此脚本获取前10天的第一个上次日志条目之间的时间跨度：

    -1..-10 | ForEach {
    $When =  (Get-Date).AddDays($_)
    $After =  Get-Date $When  -Hour 0  -Minute 0  -Second 0
    $Before = Get-Date $When  -Hour 23 -Minute 59 -Second 59
    $DayEvents =(Get-Eventlog -Entrytype Information -Logname System -After $After -Before $Before).TimeGenerated
    if($dayevents -ne $null) {
        $Span = New-Timespan -Start ($DayEvents | Select -Last 1) -End ($DayEvents | Select -First 1)
        "Your computer worked hard on {0} - for {1}:{2}:{3} hours" -F $When.ToString('yyyy-MM-dd'),$Span.Hours,$Span.Minutes,$Span.Seconds
    }
    else
    {
        $msg = "Holiday for your computer on {0}. It is not powered on" -F $When.ToString('yyyy-MM-dd') 
        Write-host $msg -foregroundcolor green
    }
}

示例输出

Your computer worked hard on 2018-04-19 - for 12:5:22 hours
Your computer worked hard on 2018-04-18 - for 8:38:51 hours
Your computer worked hard on 2018-04-17 - for 9:25:5 hours
Your computer worked hard on 2018-04-16 - for 10:36:36 hours
Holiday for your computer on 2018-04-15. It is not powered on
Your computer worked hard on 2018-04-14 - for 14:55:7 hours
Your computer worked hard on 2018-04-13 - for 13:47:32 hours
Your computer worked hard on 2018-04-12 - for 13:3:19 hours
Your computer worked hard on 2018-04-11 - for 12:35:29 hours
Your computer worked hard on 2018-04-10 - for 10:37:51 hours

Answer 2

我使用以前的代码来获取最近7天的最后一次启动和关闭时间，

我重命名InstanceID和TableHeaders以使结果清楚：

0..-7 | ForEach {
$When =  (Get-Date).AddDays($_)
$After =  Get-Date $When  -Hour 0  -Minute 0  -Second 0
$Before = Get-Date $When  -Hour 23 -Minute 59 -Second 59

Get-EventLog -LogName 'System' -InstanceID 12, 13 -After $After -Before $Before -Source 'Microsoft-Windows-Kernel-General'`
| Select @{Name = ’Action’; Expression = {$_.InstanceID -replace '12','Power ON' -replace '13','Power OFF'}}, @{Name = ’Date’; Expression = {$_.TimeGenerated}}`
| Format-Table -AutoSize
}

Answer 3

我从系统事件日志中获取事件。我可能会使用内核启动和停止时间：

## 12 is a startup
## 13 is a shutdown
Get-EventLog -LogName 'System' `
    -InstanceID 12, 13 `
    -Source 'Microsoft-Windows-Kernel-General' `
| Select InstanceID, TimeGenerated `
| sort TimeGenerated

我将下次发现的关机时间与启动时间区分开来。既然你只是想知道在哪里找时间，我就会停在那里。您还可以从systeminfo获取启动时间。

如何在特定的一天找到计算机的首次启动时间和最后关闭时间？

3 个答案: