如何从 Diagnostics-Performance 获取启动时间

Question

我正在尝试通过 powershell 从 event viewer 读取启动持续时间。这是我使用的命令：

Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Diagnostics-Performance/Operational"; id=100}

但我收到此错误消息：

Get-WinEvent : No events were found that match the specified selection criteria.
At line:1 char:15
+ ... ootevents = Get-WinEvent -FilterHashtable @{logname="Microsoft-Window ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : ObjectNotFound: (:) [Get-WinEvent], Exception
+ FullyQualifiedErrorId : NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand

Answer 1

要获取此信息，您必须运行 PowerShell 作为管理员。

那么下面的可能会做你想要的：

Get-WinEvent -FilterHashtable @{LogName="Microsoft-Windows-Diagnostics-Performance/Operational"; Id=100} -MaxEvents 10 | ForEach-Object {
    # convert the event to XML and grab the Event node
    $eventXml = ([xml]$_.ToXml()).Event
    # output 
    [PSCustomObject]@{
        'Computer' = $eventXml.System.Computer
        'BootTime' = [int64]($eventXml.EventData.Data | Where-Object {$_.Name -eq 'BootTime'}).InnerXml
        'BootFinished' = [datetime]($eventXml.EventData.Data | Where-Object {$_.Name -eq 'BootEndTime'}).InnerXml
    }
}

输出将是这样的：

Computer BootTime BootFinished      
-------- -------- ------------      
YourPC   118733   12-6-2019 15:17:42
YourPC    40259   12-6-2019 11:40:11
YourPC    43884   12-6-2019 6:00:27 
YourPC    46158   11-6-2019 12:26:17
YourPC    37759   11-6-2019 10:00:30
YourPC    53178   11-6-2019 6:49:03 
YourPC    49745   10-6-2019 16:25:59
YourPC    39130   10-6-2019 11:14:59
YourPC    57165   10-6-2019 6:57:30 
YourPC    48230   9-6-2019 11:03:02

^{P.S。 'BootTime' 是毫秒数。日期格式 d-MM-yyyy HH:mm:ss 是我荷兰计算机上的默认格式}

如何从 Diagnostics-Performance 获取启动时间

How to get boot time from Diagnostics-Performance

powershell

event-viewer