Logmon profile for system reboot time

[Akash Saini]

Hi Folks,

We tried to created profile for below mentioned details through Command Mode:--

Profile Mode :-- Command 

Command run--(get-date) - (gcim Win32_OperatingSystem).LastBootUpTime | select Days, Hours, Minutes, Seconds

And output :-

Days Hours Minutes Seconds

---- ----- ------- -------

16 2 48 28


Please help me alarm should be generated when the days value cross the 40 .

Thanks in advanced 

Akash Saini

[Gene Howard]

This would need to be pyt into a batch file or script. or you would need to start the command prompt first and then run this. As this can not be run with out a command prompt or powershell instance which you have not started.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Garin Walsh]

"Command" is essentially handed to cmd.exe as an argument. And it is subject to all the environment that the account running the nimbus watcher service is.

Power Shell comes with all kinds of issues related to security and so typically winds up being unusable as a command like this.

You can try to verify if you open a cmd prompt with the "run as" option and specify the account running UIM - it won't be the exact same but closer than using your interactive login.

Then paste in your command. You'll see the issues.

Alternatively set the logmon log level to 5 and watch that log for errors.

And with regards to your question, why not have the powershell command do all the date math for you and return a days since result or maybe do the comparison in powershell and return a YES/NO

[Dan Gill]

Since you only seem to need to check Days, this should work as the command:
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe "(get-date) - (gcim Win32_OperatingSystem).LastBootUpTime | select Days"

If you change select to fw, then you can just get the number without the word Days.

[Gregg Stillwell]

For windows I have used the System/System Uptime Performance counter which records in hours I believe. Use ntperf to send when greater then X.