On Feb 20, 2009, at 11:20 AM, Luis wrote:
Hiya,
You could parse the Event Log ('eventvwr' on the command line) and
check for Event ID 6005, which has the start time for the Event Log.
Not too sure if 6006 or 6008 indicates when it has stopped, although
I think you'd only need the start time and work out the rest from
there.
Event ID 6009 should time with the start of the Event Log, and also
includes the Windows version info, it that's of any use...
The PsTools from Microsoft have the 'psloglist' command line tool
that give you access to remote machines and includes authentication
access (can also dump the file to the server).
Another option is to use the built in script: cscript %systemroot%
\system32\eventquery.vbs
Append '-?' (without the quotes!) to get the switches. You'll find
in there several formats for the output file.
Thanks a bunch Luis! Look like great tips for this OS X user who only
occasionally uses Windows.
sims
_______________________________________________
use-revolution mailing list
[email protected]
Please visit this url to subscribe, unsubscribe and manage your subscription
preferences:
http://lists.runrev.com/mailman/listinfo/use-revolution
