How to grab last time windows awoke from sleep or hibernate modes?

Question

This question on superuser has some answers. I have looked through all the linked documentation provided, but it is a lot of documentation, and I do not really know what specific call I am looking for...

Essentially what I am trying to do is grab the last time (DateTime or otherwise) that Windows resumed from sleep or hibernate modes.

I also saw this question but I don't want to subscribe to events as the program might not be running when the sleep/resume from sleep occur, or in other words, I might need to check the last sleep resume hours or days after it occurs.

You might need to programmatically access the Event Log, looking for items under *Windows Logs\System* with the source "Power-Troubleshooter". Have a look manually and see if you think they'd be useful. — Matthew Watson, Aug 12 '19 at 14:25
@MatthewWatson thanks, that looks like exactly what I need. I guess I will start figuring out this EventLog class. Thanks again — M Y, Aug 12 '19 at 14:43

Matthew Watson · Accepted Answer · 2019-08-12T15:11:34.313

You can obtain this information using the Windows Event Log by looking at the most recent entry in the System log for a source of "Microsoft-Windows-Power-Troubleshooter".

Here's a sample console app to print out the time that the most recent item was written for that source:

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;

namespace Demo
{
    class Program
    {
        static void Main()
        {
            var eventLog = new EventLog("System");

            var mostRecentWake =
                EnumerateLog(eventLog, "Microsoft-Windows-Power-Troubleshooter")
                .OrderByDescending(item => item.TimeGenerated)
                .First();

            Console.WriteLine(mostRecentWake.TimeGenerated);
        }

        public static IEnumerable<EventLogEntry> EnumerateLog(EventLog log, string source)
        {
            foreach (EventLogEntry entry in log.Entries)
                if (entry.Source == source)
                    yield return entry;
        }
    }
}

Note that this assumes that the most recent entry will be for a wake, which (from inspection) it should be.

If you want to be sure that you're checking the correct entries, then you could do the following (but of course this will only work if the message is in English):

var mostRecentWake =
    EnumerateLog(eventLog, "Microsoft-Windows-Power-Troubleshooter")
    .Where(item => item.Message.StartsWith("The system has returned from a low power state."))
    .OrderByDescending(item => item.TimeGenerated)
    .First();

You wouldn't by any chance know thew prefix for "Kernel-Power" or where I can find a list of the prefixes? I tired "Microsoft-Windows-Kernel-Power" and it says sequence contains no elements. (I've moved on to grabbing beginning of sleep time) — M Y, Aug 12 '19 at 15:42
Actually nevermind I will find it in the log object and figure out what is going on — M Y, Aug 12 '19 at 15:44
@hellyale I tried `"Microsoft-Windows-Kernel-Power"` in place of `"Microsoft-Windows-Power-Troubleshooter"` and that returned some items for me. — Matthew Watson, Aug 12 '19 at 15:49
So I ended up using the EventID instead of the message because what appears to be permissions issues, messages on `Microsoft-Windows-Kernel-Power` are being replaced with "The description for Event ID '42' in Source 'Microsoft-Windows-Kernel-Power' cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'4', '4', '4', '0', '35'" — M Y, Aug 12 '19 at 16:07

How to grab last time windows awoke from sleep or hibernate modes?

1 Answers1