How to calculate total uptime in my PC?

Just one point which is easily overlooked! If you are carrying out surveys, or studies on machine up-time, or anything like that, then remember that these programs only work accurately as long as the system they are on is running properly, and the system has not been re-installed, or any other changes made which prevent the program from running!

For accurate data you need a hardware log or counter/timer attached to the power supply of the machine itself, which operates and collects data automatically when the machine is switched on.

Regards....Mike Connor

You can always just find the 6005/6009 events in the event log (showing the reboot) and do the math. That's basically what these uptime programs are (trying) to do anyway.

GatisAvots said:

1) The Windows Event Log usually is cleaned up from time to time, so you might be missing some earlier recordings;

And if so, then a tool that stores it's own timestamps is useful. I tend to patch regularly, meaning this has never happened to me on a Windows client machine. Of note, if you're logging that many system events in your event log that you overrun the last boot, you have other problems you should probably be dealing with .

GatisAvots said:

2) If an unexpected power failure or similar event happens, the event log will be missing the event for shut-down;

It will still have the unclean boot and system start events (6008/6009), thus still giving you valid timestamps.

GatisAvots said:

3) As far as I remember, if Windows Suspend or Hibernate is used, then there are no specific entries about this inside the Event Log. So you can not actually calculate the time computer has been on;

On XP, correct, but incorrect for Vista and Windows 7 as sleep and wake events are logged.

GatisAvots said:

4) The accuracy of the uptime you get if you rely only on Event log is not so great, because if you read out what your Event Log says, and compare it to actual Uptime (you can check it also from the Command Line), you will see that the numbers differ (at least it does on my Windows XP)

Again, Windows XP doesn't go by UTC time, and as such it can be (wildly) off at times with power events. Everything in Vista/7 internally is done in UTC, and the clock is much more accurate. Usually within a few seconds, the event log calculations are correct.

GatisAvots said:

The System Uptime Monitor I mentioned above works without reading event from Windows Event log, but by relying on its own service.

Which simply stores and reads timestamps, just like the eventlog - so while a nice GUI is easier to use, it doesn't make it more accurate . Unless of course your system event log is getting overwritten within 60 days, which shouldn't be happening (see point #1).

Hi, cluberti

cluberti said:

Of note, if you're logging that many system events in your event log that you overrun the last boot, you have other problems you should probably be dealing with .

Hmm. Actually not that many events are logged. Only a line of some characters every minute or so to a text file (no performance issues here).

cluberti said:

It will still have the unclean boot and system start events (6008/6009), thus still giving you valid timestamps.

Yes, but what about the missing power off event? You will need to decide what time-stamp to use for it manually for each record. Most likely this will be the event entry just before the boot event, I guess. Not sure how acurate it will be.

cluberti said:

Again, Windows XP doesn't go by UTC time, and as such it can be (wildly) off at times with power events. Everything in Vista/7 internally is done in UTC, and the clock is much more accurate. Usually within a few seconds, the event log calculations are correct.

I mean something else here. I tired the following test case: Powered on my laptop (Vista) at 5:52:00 PM. The System Event log showed that computer started up at 5:52:55 PM (this is about when I saw the Vista logo inside the screen after all the loading). However, the Windows Uptime showed that it must have occurred at 5:52:15 PM (as calculating it from uptime seen in the Windows Task manager and actual time). So that is about 40 seconds difference between Uptime seen in Windows Task Manager and uptime I could calculate from the Event Log.

Event 6005 means "The Event log service was started". So the Task Manager does not take this time as the actual start time of your PC for calculating current Windows uptime.

Kind regards,
Gatis Avots