JSI Tip 1425. Uptime.exe.

Starting with SP4, Uptime.exe will display information about system availability.

To install the tool, simply copy Uptime.exe to your %SystemRoot% or %SystemRoot%System32 folder.

Uptime.exe works best when run by an Administrator, but a user can get limited information. The tool makes use of the new System events to estimate availability. Here is a sample output, generated by typing Uptime /s /a JSI003 on my PDC, where JSI003 is a Windows NT workstation, which I just restarted:

Uptime Report for: \JSI003OS: Windows NT 4.0 (Build 1381), Service Pack 5, Uniprocessor Free.Time Zone: Eastern Daylight TimeSystem Events as of 6/25/99 10:55:02:Date:      Time:        Event:               Comment:---------- -----------  -------------------  -----------------------------------   6/25/99    10:49:59  Shutdown   6/25/99    10:51:59  Boot                 Prior downtime:0d 0h:2m:0sCurrent System Uptime: 0 day(s), 0 hour(s), 3 minute(s), 17 second(s)--------------------------------------------------------------------------------Since 6/25/99:           System Availability: 60.3960%                  Total Uptime: 0d 0h:3m:3s                Total Downtime: 0d 0h:2m:0s                 Total Reboots: 1     Mean Time Between Reboots: 0.00 days             Total Bluescreens: 0    Total Application Failures: 0

Typing Uptime /help returns:

UPTIME, Version 1.00(C) Copyright 1999, Microsoft CorporationUptime [server] [/s ] [/a] [/d:mm/dd/yyyy | /p:n] [/heartbeat] [/? | /help]        server          Name or IP address of remote server to process.        /s              Display key system events and statistics.        /a              Display application failure events (assumes /s).        /d:             Only calculate for events after mm/dd/yyyy.        /p:             Only calculate for events in the previous n days.        /heartbeat      Turn on/off the system's heartbeat        /?              Basic usage.        /help           Additional usage information.Description:UPTIME is a utility that processes the machine's event log to determinesystem availability and current uptime. The target system can either be thelocal system or a remote system. No special privileges are required for basicoperation although it is most accurate to run the tool under an administrativeaccount. Many factors affect these calculations, and the results displayedby this tool should be considered estimates.Requirements:    Availability calculations require:    Windows NT 4.0 Service Pack 4 or higher, including Windows 2000.    Additionally the system "heartbeat" must be active.The system "heartbeat" is a date/time stamp that is written to the systemregistry at a fixed interval. This heartbeat is available in Service Pack 4or higher. It is enabled by default on Windows NT Server. Since theheartbeat causes the registry to be written to the disk at regularintervals, it can interfere with systems running various forms of powermanagement. It is not recommended to enable the heartbeat of laptop systems.To enable the heartbeat use: UPTIME /heartbeat [\Machine]If the heartbeat is disabled, or if you are not running Service Pack 4 orgreater, UPTIME may report that the event logs do not contain sufficientinformation to calculate system availability. This is because UPTIME detectsan abnormal shutdown (for instance a bluescreen or power failure) but cannotdetermine how long the system was down during this abnormal outage.It is best to run uptime as an administrator, since much more informationis available to calculate system uptime and availability. For instancethe time zone of the system is important to many of the calculations, butthis information can only be reliably obtained by an administrator.Additionally, when calculating the Current System Uptime, this tool attemptsto use the System Performance Counter for Uptime. However, if the user is notan administrator, this counter may be unavailable. In this case an estimateis made based on the last recorded boot noted in the event log.Application Failures:Application Failure event detection is dependent upon Dr Watson being enabled.Bluescreens:Bluescreen detection is dependent upon the system being configured to write anevent to the event log if the system stops unexpectedly.To enable bluescreen event logging for Windows NT 4.0:   Go to the Control Panel and double click the System Icon.   Next select the startup/shutdown tab.   Finally check the "Write an event to the system log." check box.To enable bluescreen event logging for Windows 2000 Systems do the following:   Go to the Control Panel and double click the System Icon.   Next select the "Advanced" tab.   From the "Advanced" property sheet select the "Startup and Recovery" button.   Finally check the "Write an event to the system log." check box.Potential sources of error:All calculations are based on the entries in the event log.  If thesystem time is altered significantly, this can have a dramatic affect onthe calculations made.  Additionally if the event logs have been cleared,or have filled, such that additional events cannot be written, this willalso affect this tools ability to accurately estimate system availability.The heartbeat is generally written every 5 minutes, so the amount of downtimecalculated for abnormal outages is limited in accuracy to this window.Systems that are a member of a cluster are currently unsupported by UPTIME.If UPTIME detects that the target system may be a member of a cluster,UPTIME will display a message stating that the results may be in error.Where to go for more help:For further information about this tool please see:http://support.Microsoft.com/support and reference KB Article: Q232243.