c# detect if event is a shutdown or a reboot

Question

I have a program that shuts down a UPS in the event of a computer shutdown. Since I would want the UPS to stay on for a reboot, how do I determine if the event is a shutdown (computer will actually power off), or if it's a restart?

I'm not trying to determine between logoff and shutdown. I'm trying to determine being shutdown and restart, which is not covered by the article marked.

Look through the event log, a start up has a specific ID, unexpecteds is 6008. you can therefore check if it was unexpected or not. — BugFinder, May 23 '16 at 14:10
Not what I'm asking -- need to know during shutdown, not during startup — oppassum, May 23 '16 at 14:15
If you tell the UPS to shut down, aren't you potentially in a race to see if the computer can successfully perform its shutdown processing before power is abruptly removed from it? — Damien_The_Unbeliever, May 23 '16 at 14:35
The UPS has a delay grace, settable up to 10 minutes, so that part of it was solved by the UPS manufacturer. — oppassum, May 23 '16 at 14:57
Not an answer to question: is there a way to cancel the UPS shutdown during the delay? At ten minutes, should be enough time to start the UPS shutdown during computer shutdown, then send a "cancel" to the UPS during boot. — Marc L., May 23 '16 at 15:21
Yes, this is for an APC Smart-UPS, and it allows an abort command, 0x7f. here's a list of commands if you're curious: http://networkupstools.org/protocols/apcsmart.html#async — oppassum, May 23 '16 at 15:22

score 0 · Answer 1 · answered May 23 '16 at 16:08

After some more research, I did find a "usable" answer to this...

There doesn't seem to be a direct way, but you can indirectly determine the shutdown type by reading the event logs. Here's the method to do so:

    private void readEventLogs()
    {
        string query = "*[System/EventID=1074]";
        EventLogQuery elq = new EventLogQuery("System", PathType.LogName, query);
        EventLogReader elr = new EventLogReader(elq);
        EventRecord entry;
        while ((entry = elr.ReadEvent()) != null)
        {
            if (entry.TimeCreated.HasValue && entry.TimeCreated.Value.AddMinutes(1) > DateTime.Now)
            {
                string xml = entry.ToXml();
                if (xml.ToLower().Contains("restart"))
                {
                    System.IO.File.WriteAllLines(@"C:\shutdown.txt", new string[] { "RESTART" });
                }
                else if (xml.ToLower().Contains("power off"))
                {
                    System.IO.File.WriteAllLines(@"C:\shutdown.txt", new string[] { "SHUT DOWN" });
                }
            }
        }
    }

This will cycle through all of the shutdown events and find one that happened within the last minute. Since it's very unlikely you've shutdown more than twice in the last minute, this should be your entry.

The entry contains lots of information, but the defining one that I cared about was that it denoted "restart" or "power off". Keying in on these, I tested by writing out to a text file which one happened.

Since these are event logs, they will likely be affected by localization.

c# detect if event is a shutdown or a reboot

1 Answers1