Wake Source - Read Event Viewer Log

How to Read the Wake Source Log in Event Viewer for Vista, Windows 7, and Windows 8​

   Information

This will show you how to read the wake source log in the Event Viewer to see what device, task, or etc... has woke up your computer from sleep or hibernation at listed dates and times.

You must be logged in as an administrator to be able to do the steps in this tutorial.

Here's How:

1. Press the Windows + R keys to open the Run dialog, type eventvwr.msc, and press enter.

2. If prompted by UAC, then click on Yes (Windows 7/8) or Continue (Vista).

3. In the left pane of Event Viewer, double click on Windows Logs to expand it, click on System to select it, then right click on System and click on Filter Current Log. (see screenshot below)

4. In the Event sources drop down menu, check the Power-Troubleshooter option, and click on OK. (see screenshots below)



5. In the middle pane of Event Viewer, you will now have a list of events with date and time to select to see the Wake Source of. (see screenshot below)
NOTE: For example, the HID-compliant Bluetooth Mouse was what woke my computer last at the selected event date and time.

6. When finished, close Event Viewer.


That's it,
Shawn

Related Tutorials

---

• How to See What Woke Up Your Computer Last
• How to Enable or Disable Windows Media Center Updates to Wake Up the Computer
• How to See a List of Devices that are able to Wake Up the Computer
• How to Allow or Prevent Devices to Wake Up Computer
• How to See Available Sleep States on Your System in Windows 7
• How to See Available Sleep States on Your Windows 8 PC
• How to See the Last Shutdown Time of Your Windows PC​
• How to Change the Return to Sleep Timeout for a Unattended Wake Up in Windows 7​
• How to Create a Power Troubleshoot Shortcut in Windows 7​
• How to Troubleshoot a Vista or Windows 7 Sleep Mode Problem​
• How to View and Override Power Availability Requests in Windows​
• How to Add or Remove "Allow wake timers" in Power Options in Windows
  ​

 

[sl2222]

My system is waking up at random times. After reading the event viewer it is being caused by a USB Root Hub.
How can I determine what's up at this point?

 

[Brink]

Hello sl2222,

You could try the tutorial below to see if you may be able to set the USB Root Hub to no longer be able to wake the computer to hopefully stop it.

http://www.sevenforums.com/tutorials/122027-devices-allow-prevent-wake-up-computer.html

 

[sl2222]

Thanks for the effort but when checking powercfg, the only armed items are the keyboard and mouse. No USB hubs listed (I did make sure already that they were set to not wake the computer.

I'll keep searching

Hello sl2222,

You could try the tutorial below to see if you may be able to set the USB Root Hub to no longer be able to wake the computer to hopefully stop it.

http://www.sevenforums.com/tutorials/122027-devices-allow-prevent-wake-up-computer.html

 

[Brink]

If you have not already, you might test to see how it behaves with "USB selective suspend setting" enable or disabled in your advanced power plan settings.


You could also unplug devices connected to the USB hub one at a time and test inbetween to see if it may ID which device is the culprit.

 

[sl2222]

Ok, it's been asleep for a few hours and didn't wake so maybe it's corrected.
I disabled the selective suspend setting.

Thanks for the suggestion.

 

[Brink]

Great news so far.

 

[sl2222]

If it sleeps thru the night then I know it's fixed. I'll report back and thanks again Brink.

 

[sl2222]

well, unfortunately that didn't do it. Next I'm going to try disconnecting the logitech receiver for the mouse and keyboard as a test. Next time it's going to be off for an hour or more. The reason I'm trying this is because of the powercfg results...
C:\windows\system32>powercfg -devicequery wake_armed
HID Keyboard Device (001)
Logitech HID-compliant Unifying keyboard (001)
HID-compliant mouse (002)
Logitech HID-compliant Unifying keyboard (004)
Logitech HID-compliant Unifying Mouse (006)
Logitech HID-compliant Unifying Mouse (007)
Logitech HID-compliant Unifying Mouse (008)
Logitech HID-compliant Unifying Mouse (009)
Logitech HID-compliant Unifying keyboard (005)
Logitech HID-compliant Unifying Mouse (010)

I wish I knew what all those referred to. I only have 1 wireless mouse connected and a logitech wireless keyboard with a touchpad (k400)

 

[Brink]

You might see if it may help to have the USB receiver for them connected in another USB port that's connected directly to the motherboard instead of a USB hub.

Do you have cat or something that could be bumping the mouse or stepping on the keyboard that's causing them to wake the PC?

 

[sl2222]

It's funny u mention the cats. There's 5 of them in this house! But I make sure the mouse is turned off and the keyboard is not accessible to them.
The logitech receiver is plugged into an extension is all so that I can bring it to the front for better reception but it's not in a hub.
I'll report back after I try just unplugging it and see what happens. Maybe overnight tonight.

You might see if it may help to have the USB receiver for them connected in another USB port that's connected directly to the motherboard instead of a USB hub.

Do you have cat or something that could be bumping the mouse or stepping on the keyboard that's causing them to wake the PC?

 

[sl2222]

It's fixed. It must have been the extension cable. I swapped that out with another and it hasn't awakened since.
weird cause it wasn't even an 'active' cable and the recvr worked fine.

 

[Brink]

Odd, but I'm glad to hear you got it sorted.

 

[pxfragonard]

Hi Shawn. Mine woke up at 3:30AM after being programmed to hibernate at 2:30 AM. The reason in Event Viewer was "unknown." Only the keyboard in a pullout drawer can wake from sleep but not hibernation: only the top of the case can do that, or a wake timer, which would have shown up in the logs. No cats, no dogs. We had moths a few years ago but I'm ruling them out.

 

[Brink]

Hey pxfragonard,

Did you also use the lastwake command to see if it may help ID the culprit?

In addition, double check to make sure that "Allow wake timers" under "Sleep" in your power plan settings is disabled in case it may be some task (ex: Automatic Maintenance) waking the PC to perform something.

http://www.sevenforums.com/tutorials/778-power-plan-settings-change.html

 

[pxfragonard]

Hey pxfragonard,

Did you also use the lastwake command to see if it may help ID the culprit?

In addition, double check to make sure that "Allow wake timers" under "Sleep" in your power plan settings is disabled in case it may be some task (ex: Automatic Maintenance) waking the PC to perform something.

http://www.sevenforums.com/tutorials/778-power-plan-settings-change.html

It probably was something programmed to run and wake to do so, Sean, but I can't disable it since I use it to wake up. But that's no doubt it. I wish I could find out specifically which. I suppose I could go into the scheduler and search for the one that corresponds to the particular time. It's only happened once anyway. Thanks again for your help.

 

[Brink]

Anytime. The next time it happens, see if the lastwake command may help ID it.

 

[pxfragonard]

Anytime. The next time it happens, see if the lastwake command may help ID it.

That's the problem. The cause in eventviewer was "unknown."

 

[pxfragonard]

Anytime. The next time it happens, see if the lastwake command may help ID it.

OK. Happened again. Here's what the log shows:

2:39:58 AM The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.

2:46:58 AM The Microsoft Software Shadow Copy Provider service entered the running state.

2:47:24 AM The Windows Modules Installer service entered the running state.

2:50:03 AM The Volume Shadow Copy service entered the stopped state.

2:53:03 AM The Microsoft Software Shadow Copy Provider service entered the stopped state.

3:00:07 AM The start type of the Windows Modules Installer service was changed from demand start to auto start.

3:00:07 AM The start type of the Windows Modules Installer service was changed from auto start to demand start.

3:00:08 AM The Windows Modules Installer service entered the stopped state.

3:02:28 AM The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state.

3:31:07 AM The Windows Image Acquisition (WIA) service entered the paused state.

3:31:17 AM The browser has forced an election on network \Device\NetBT_Tcpip_{985C0C45-C0B6-4C0C-A979-D4F66E9A13DF} because a master browser was stopped.

3:31:16 AM The system is entering sleep.

So it went back to sleep and then to hibernation an hour after that but how do I change the time of that installer service? I see you can do it in Windows 8 very easily but can't find out how in Windows 7... or do I want to ? It's not that big a deal in the grand scheme. But curious, as always.

 

[Brink]

Not sure what log that is, but I don't see where it woke the computer at.