Display all power related events (turn-on/-off/sleep/hibernate/...)?

Question

Imagine your computer is doing strange things regarding turning on, off, sleeping, hibernating, restart, being on in the morning when you set it to sleep in the evening before and similar things.

I assume these "events" are somewhere in the Event Log / Viewer, but I couldn't find a real "filter" to show only events of these types.

How can I display only these specific events instead of manually sifting through thousands of events?

Solution 1

I think you also get what you want by running the following command (elevation required):

powercfg /sleepstudy

Sleep Study report saved to file path C:\WINDOWS\system32\sleepstudy-report.html.

The report should contain all sleep, hibernate, shutdown related events and some other related information:

Note: also you might be interested in what powercfg /systemsleepdiagnostics generates.

Solution 2

to get all such events and uptimes i used this tool: https://www.nirsoft.net/utils/computer_turned_on_times.html

posted in the same thread: https://softwarerecs.stackexchange.com/a/52443/40730

Comments

[Admin]

I found an event that I would like to have highlighted in such a tool: Event Time = 2017-10-12 13:33:28.829; Level = Information; Channel = System; Provider = Microsoft-Windows-Kernel-General; Description = The operating system started at system time ‎2017‎-‎10‎-‎12T11:33:28.493096500Z

[Admin]

Another one: Event Time = 2017-10-12 13:35:12.829; Level = Information; Channel = System; Description = The process C:\WINDOWS\servicing\TrustedInstaller.exe (LENOVOX1) has initiated the Neustart of computer LENOVOX1 on behalf of user NT-AUTORITÄT\SYSTEM for the following reason: Betriebssystem: Aktualisierung (geplant) Reason Code: 0x80020003 Shutdown Type: Neustart Comment:

[Admin]

You are asking an off-topic question (software shopping). Questions seeking product, service, or learning material recommendations are off-topic. See On Topic. Try softwarerecs.stackexchange.com but please first read What is required for a question to contain "enough information".

[Admin]

I reworded my question to make clear that I am not looking for software, but a solution to the problem I have. I am happy no matter if it is a CLI command, a way to configure Event Viewer or another tool.

[Admin]

The filter would be to find out the corresponding EventIDs and filter for EventIDs which is rather easy in the default view. Alternatively you could write a script e.g. using PowerShell using Get-EventLog.

[Admin]

So what are the all the relevant "corresponding EventIDs" for power type events? Looking through the log from last night I see e.g. an event with id "1" which "The system has returned from a low power state." - but event ID 1 is also used for totally unrelated things like "The system time has changed to ‎2017‎-‎10‎-‎12T11:40:03.500000000Z from ‎2017‎-‎10‎-‎12T11:40:01.675036400Z."