Why is WMI lying to me?

[jabelli]

This isn't a JPSoft issue specifically, but it does affect tcmd/tcc.

25.6G C:\Users\jabelli> do forever (echos %_date %_time- & uptime & delay 3600)
2011-08-02 09:57:13-Up since 2011-08-01 10:28:47 (23h 28m 42s)
2011-08-02 10:57:29-Up since 2011-08-01 10:28:47 (1d 28m 43s)
2011-08-02 11:57:30-Up since 2011-08-01 15:54:21 (20h 3m 10s)
2011-08-02 12:57:31-Up since 2011-08-01 15:54:21 (21h 3m 11s)
2011-08-02 13:57:33-Up since 2011-08-01 15:54:21 (22h 3m 16s)
2011-08-02 14:57:37-Up since 2011-08-01 15:54:21 (23h 3m 17s)

No, I don't have a time machine. Does anyone else get this result?

@REM uptime.btm
@echo off
setlocal
set bootDT=%@left[14,%@wmi[.,"SELECT LastBootUpTime FROM Win32_OperatingSystem"]]
set nowDT=%@left[14,%@wmi[.,"SELECT LocalDateTime FROM Win32_OperatingSystem"]]
set bootD=%@left[4,%bootDT]-%@instr[4,2,%bootDT]-%@instr[6,2,%bootDT]
set bootT=%@instr[8,2,%bootDT]:%@instr[10,2,%bootDT]:%@instr[12,2,%bootDT]
set nowD=%@left[4,%nowDT]-%@instr[4,2,%nowDT]-%@instr[6,2,%nowDT]
set nowT=%@instr[8,2,%nowDT]:%@instr[10,2,%nowDT]:%@instr[12,2,%nowDT]
set upSec=%@eval[(%@makeage[%nowD,%nowT]-%@makeage[%bootD,%bootT])/1e+7]
set upD=%@eval[%upSec\86400]
set upH=%@eval[(%upSec %% 86400)\3600]
set upM=%@eval[(%upSec %% 86400)\60 %% 60]
set upS=%@eval[%upSec %% 86400 %% 60]
echo Up since %bootD %bootT (%@if[%upD GT 0,%[upD]d ,]%@if[%upH GT 0,%[upH]h ,]%@if[%upM GT 0,%[upM]m ,]%@if[%upS GT 0,%[upS]s ,]^b)

 

[samintz]

I have been getting consistent results
from the LastBootUpTime WMI call. But I'll run your batch file overnight
and see what happens.
-Scott




This isn't a JPSoft issue specifically,
but it does affect tcmd/tcc.
Code:
25.6G C:\Users\jabelli> do forever (echos
%_date %_time- & uptime & delay 3600)
2011-08-02 09:57:13-Up since 2011-08-01 10:28:47 (23h 28m 42s)
2011-08-02 10:57:29-Up since 2011-08-01 10:28:47 (1d 28m 43s)
2011-08-02 11:57:30-Up since 2011-08-01 15:54:21 (20h 3m 10s)
2011-08-02 12:57:31-Up since 2011-08-01 15:54:21 (21h 3m 11s)
2011-08-02 13:57:33-Up since 2011-08-01 15:54:21 (22h 3m 16s)
2011-08-02 14:57:37-Up since 2011-08-01 15:54:21 (23h 3m 17s)
No, I don't have a time machine. Does anyone
else get this result?
Code:
@REM uptime.btm
@echo off
setlocal
set bootDT=%@left[14,%@wmi[.,"SELECT LastBootUpTime FROM Win32_OperatingSystem"]]
set nowDT=%@left[14,%@wmi[.,"SELECT LocalDateTime FROM Win32_OperatingSystem"]]
set bootD=%@left[4,%bootDT]-%@instr[4,2,%bootDT]-%@instr[6,2,%bootDT]
set bootT=%@instr[8,2,%bootDT]:%@instr[10,2,%bootDT]:%@instr[12,2,%bootDT]
set nowD=%@left[4,%nowDT]-%@instr[4,2,%nowDT]-%@instr[6,2,%nowDT]
set nowT=%@instr[8,2,%nowDT]:%@instr[10,2,%nowDT]:%@instr[12,2,%nowDT]
set upSec=%@eval[(%@makeage[%nowD,%nowT]-%@makeage[%bootD,%bootT])/1e+7]
set upD=%@eval[%upSec\86400]
set upH=%@eval[(%upSec %% 86400)\3600]
set upM=%@eval[(%upSec %% 86400)\60 %% 60]
set upS=%@eval[%upSec %% 86400 %% 60]
echo Up since %bootD %bootT (%@if[%upD GT 0,%[upD]d ,]%@if[%upH GT 0,%[upH]h
,]%@if[%upM GT 0,%[upM]m ,]%@if[%upS GT 0,%[upS]s ,]^b)

 

[vefatica]

C:\Users\jabelli> do forever (echos
%_date %_time- & uptime & delay 3600)
2011-08-02 09:57:13-Up since 2011-08-01 10:28:47 (23h 28m 42s)
2011-08-02 10:57:29-Up since 2011-08-01 10:28:47 (1d 28m 43s)
2011-08-02 11:57:30-Up since 2011-08-01 15:54:21 (20h 3m 10s)
2011-08-02 12:57:31-Up since 2011-08-01 15:54:21 (21h 3m 11s)
2011-08-02 13:57:33-Up since 2011-08-01 15:54:21 (22h 3m 16s)
2011-08-02 14:57:37-Up since 2011-08-01 15:54:21 (23h 3m 17s)

jabelli, whose UPTIME are you using? It would seem a bit flaky. There's an UPTIME and a variable function @UP[] in my SYSUTILS plugin.

v:\> help @up
@UP[s|m|h|d|v|b|t] = uptime: secs|mins|hrs|days|verbose|boot|boot_datetime

Just in case there's something systemic going on, I'm testing mine now. Here's the first report:

v:\> do forever ( echos %_date %_time  ... up %@up[h] hours & uptime & delay 3600 )
08/02/11 22:05:22  ... up 19.6239 hours
Uptime: 19 hours 37 minutes 26 seconds
Boot:   2011-08-02,02:27:57

 

[jabelli]

jabelli, whose UPTIME are you using? It would seem a bit flaky. There's an UPTIME and a variable function @UP[] in my SYSUTILS plugin.

The batch file at the end of the message. It asks WMI "When did I last boot?" and "What time is it now?" and subtracts. The WMI answer to "When did I last boot?" keeps changing without actually being rebooted. It's a laptop so it sleeps often, but the times not only don't match sleep times, it doesn't change immediately on wakeup either.

Also it's Win7Pro SP1.

 

[samintz]

I ran it overnight and it performed flawlessly.
My PC doesn't go to sleep. I am running Win7 Enterprise x86
SP1.

-Scott





Quote:


Originally Posted by vefatica

jabelli, whose UPTIME are you using?
It would seem a bit flaky. There's an UPTIME and a variable function @UP[]
in my SYSUTILS plugin.
The batch file at the end of the message.
It asks WMI "When did I last boot?" and "What time is it
now?" and subtracts. The WMI answer to "When did I last boot?"
keeps changing without actually being rebooted. It's a laptop so it sleeps
often, but the times not only don't match sleep times, it doesn't change
immediately on wakeup either.

Also it's Win7Pro SP1.

 

[vefatica]

On Wed, 03 Aug 2011 13:59:31 -0400, jabelli <> wrote:

|The batch file at the end of the message. It asks WMI "When did I last boot?" and "What time is it now?" and subtracts. The WMI answer to "When did I last boot?" keeps changing without actually being rebooted. It's a laptop so it sleeps often, but the times not only don't match sleep times, it doesn't change immediately on wakeup either.

Sorry, I missed the whole batch file thing. I caught it later and have compared
you batch file results to my UPTIME and @UP[]. After 5 hours they match
(except, I believe, for the rounding in getting seconds (I round up at the
half-second)).

I wouldn't be surprised if the laptop's sleep/hibernate business screws things
up. And I'm curious whether you can do anything about it and whether they would
similarly screw up my functions.

Over many years I have implemented "uptime" in many ways (probably totalling 6
or 7). The functions in my SYSUTILS plugin use NtQuerySystemInformation()
(undocumented, the last I knew). I suppose that function and WMI ultimately get
that info from the same place or perhaps one gets it from the other. It's nice
to see that they agree.

 

[Steve Pitts]

I wouldn't be surprised if the laptop's sleep/hibernate business screws things up. And I'm curious whether you can do anything about it and whether they would similarly screw up my functions

I've been running the OP's code for the better part of a week now, on my work laptop which has TC v9 on 32 bit Windows 7, and the WMI data seems to be behave in a predictable fashion, in that the LastBootUpTime is adjusted by the period spent in Hibernation each time such that the total up time reflects how long the machine has been awake since the last reboot.

 

[vefatica]

On Tue, 09 Aug 2011 16:03:40 -0400, Steve Pitts <> wrote:

|I've been running the OP's code for the better part of a week now, on my work laptop which has TC v9 on 32 bit Windows 7, and the WMI data seems to be behave in a predictable fashion, in that the LastBootUpTime is adjusted by the period spent in Hibernation each time such that the total up time reflects how long the machine has been awake since the last reboot.

Is that the same as:

uptime = time not spent in hibernation
last boot = present - uptime?

That's odd.

I noticed that Win7 puts a "Kernel-General" entry in the system event log:

The operating system started at system time
?2011?-?08?-?08T16:15:31.109999300Z.

So there's (yet) another way to get uptime, seemingly official, and matching
what WMI and NTQuerySystemInformation(). My old MS DUMPEL.EXE prints the time
stamp of that log entry but not the message text, perhaps because of the oddball
characters ("?" above, Unicode 0x0E20 as they come out of the clipboard). (?)

Any Win7 laptops out there? Do you get such an entry after hibernation?

 

[Steve Pitts]

Is that the same as:

uptime = time not spent in hibernation
last boot = present - uptime?

That's odd

Indeed, that appears to be exactly what happens (based on my observations around periods of hibernation varying from a couple of hours to a couple of days). It makes sense from an uptime calculation point of view, but if you genuinely need to find the last boot time it is very, very unhelpful.

I noticed that Win7 puts a "Kernel-General" entry in the system event log

That event only appears when the machine is actually rebooted (at least for me, on a 32 bit Windows 7 - I never hibernate the desktop that runs 64 bit Windows 7 so cannot cross-check). For resume from hibernation (I rarely use sleep) I see a Kernel-General entry:

The system time has changed to ý2011ý-ý08ý-ý15T07:17:20.500000000Z from ý2011ý-ý08ý-ý15T05:36:51.935024800Z.

(with the same strange characters in the date values) although that event does seem to be generated in other contexts. There is also a Power-Troubleshooter entry that appears about fifteen seconds later:

The system has resumed from sleep.

Sleep Time: ý2011ý-ý08ý-ý15T05:36:28.338779300Z
Wake Time: ý2011ý-ý08ý-ý15T07:17:35.451855200Z

Wake Source: Unknown

No idea how useful any of that is for you - this is all academic stuff from my point of view as I have no real interest in either the last boot time or the uptime of my work laptop ;)