[SOLVED] Batch to read Kernel-Power event from System Event Viewer log?

Batch to read Kernel-Power event from System Event Viewer log?

I'm trying to read system status messages to make some decisions in my existing batch files.

For example I really need to know:

if the system is on because it woke from sleep, or if it was cold booted up via button or network etc.
the time at which (or how long ago) lastwake from sleep happened.

I can't find this info with powercfg commands.

And more broadly, would be nice if I could just read from the system log any message and when it was triggered.

Is this possible / accessible via cmd / bat? Can you query all the e.g. Kernel-Power events? Nothing comes up on SO about this.

Solution

On my Microsoft Windows [Version 10.0.22631.3527]: powercfg.exe /lastwake could return (some ad-hoc examples):

if the system is on because it was cold booted up:

Wake History Count - 0

if the system is on because it woke from sleep by Power Button:

Wake History Count - 1
Wake History [0]
  Wake Source Count - 1
  Wake Source [0]
    Type: Fixed Feature
    Power Button

if the system is on because it woke from sleep by a mouse click:

Wake History Count - 1
Wake History [0]
  Wake Source Count - 1
  Wake Source [0]
    Type: Device
    Instance Path: PCI\VEN_8086&DEV_7AE0&SUBSYS_7D461462&REV_11\3&11583659&0&A0
    Friendly Name: Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)
    Description: USB xHCI Compliant Host Controller
    Manufacturer: Generic USB xHCI Host Controller

The time at which lastwake from sleep happened:

wmic path Win32_NTLogEvent WHERE "logfile='system' and SourceName='Microsoft-Windows-Power-Troubleshooter' and EventCode=1" Get Message /Value | findstr /I "Time"

wmic path Win32_NTLogEvent WHERE "logfile='system' and SourceName='Microsoft-Windows-Power-Troubleshooter' and EventCode=1" Get TimeGenerated

Unfortunately, both above commands could produce a huge output which is hard to parse in cmd or in a .cmd script.

I'd recommend calling PowerShell commands as follows (easy to parse even in cmd):

powershell -noprofile -command "$x=Get-EventLog -LogName System -EntryType Information -InstanceId 1 -Source Microsoft-Windows-Power-Troubleshooter -After $(Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -ExpandProperty LastBootUpTime) -Newest 1 | Select-Object -ExpandProperty TimeGenerated; if ($x) {$x.ToString()} else {''}"

10.05.2024 16:35:46

Note: neglected the imponderable difference between TimeGenerated of an event and real Wake Time…