Skip to content

Instantly share code, notes, and snippets.

@kshimi
Last active August 15, 2017 02:58
Show Gist options
  • Save kshimi/89107d7b99d3f6750986533bc977e613 to your computer and use it in GitHub Desktop.
Save kshimi/89107d7b99d3f6750986533bc977e613 to your computer and use it in GitHub Desktop.
List recent startup and shutdown time from windows event log
@ruby -x "%~f0" %* & exit /b
#!ruby
# list recent startup and shutdown time
require 'tempfile'
require 'csv'
require 'date'
file = Tempfile.new('event')
CMD = "Get-EventLog System -After (Get-Date).AddMonths(-2) | Where-Object { $_.InstanceId -eq 12 -or $_.InstanceId -eq 13 } | Sort-Object TimeGenerated | Export-CSV #{file.path} -notype "
begin
file.close
system("powershell.exe \"#{CMD}\"")
events = CSV.table(file.path)
dates = {}
events.each do |l|
d = DateTime.parse(l[:timegenerated])
dates[d.to_date] ||= { start: d.next.to_date.to_datetime, end: d.to_date.to_datetime }
case l[:instanceid]
when 12
dates[d.to_date][:start] = d if d < dates[d.to_date][:start]
when 13
dates[d.to_date][:end] = d if dates[d.to_date][:end] < d
end
end
dates.each do |key, d|
puts "#{key} #{d[:start].strftime('%H:%M')} - #{d[:end].strftime('%H:%M')}"
end
ensure
file.close
file.unlink
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment