Windows Event ID 6013 – EventLog: System Uptime Information

Access the Event Viewer to examine Event ID 6013 details and uptime information:

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 6013 in the Event ID field and click OK
5. Double-click any Event ID 6013 entry to view detailed information
6. Review the General tab for uptime data and the Details tab for raw event data
7. Note the timestamp and uptime duration displayed in the event description

Use PowerShell to retrieve and analyze Event ID 6013 data programmatically:

1. Open PowerShell as Administrator
2. Run the following command to get recent Event ID 6013 entries:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6013} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. For more detailed analysis, use this command to extract uptime information:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6013} -MaxEvents 5 | ForEach-Object {
    $uptimeSeconds = ($_.Message -split ' ')[4]
    $uptimeDays = [math]::Round($uptimeSeconds / 86400, 2)
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        UptimeSeconds = $uptimeSeconds
        UptimeDays = $uptimeDays
        Message = $_.Message
    }
} | Format-Table -AutoSize

4. To export uptime data to CSV for reporting:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6013} | Select-Object TimeCreated, Message | Export-Csv -Path "C:\temp\uptime_report.csv" -NoTypeInformation

Set up automated monitoring for Event ID 6013 to track system uptime trends:

1. Open Task Scheduler by pressing Windows + R, typing taskschd.msc
2. In the Actions pane, click Create Basic Task
3. Name the task "Uptime Monitor" and provide a description
4. Set the trigger to On an event
5. Configure the event trigger:
• Log: System
• Source: EventLog
• Event ID: 6013
6. Set the action to Start a program
7. Program: powershell.exe
8. Arguments: -Command "Get-WinEvent -FilterHashtable @{LogName='System'; Id=6013} -MaxEvents 1 | Out-File -Append C:\logs\uptime.log"
9. Complete the wizard and test the task

Create comprehensive uptime analysis using PowerShell to identify patterns and generate management reports:

1. Create a PowerShell script to analyze historical uptime data:

# Get all Event ID 6013 entries from the last 30 days
$events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=6013; StartTime=(Get-Date).AddDays(-30)}

# Process events to extract uptime statistics
$uptimeData = $events | ForEach-Object {
    $message = $_.Message
    if ($message -match '(\d+) seconds') {
        $seconds = [int]$matches[1]
        $days = [math]::Round($seconds / 86400, 2)
        [PSCustomObject]@{
            Date = $_.TimeCreated.Date
            UptimeSeconds = $seconds
            UptimeDays = $days
            UptimeHours = [math]::Round($seconds / 3600, 2)
        }
    }
}

# Generate statistics
$stats = $uptimeData | Measure-Object UptimeDays -Average -Maximum -Minimum
Write-Host "Uptime Statistics (Last 30 Days):"
Write-Host "Average Uptime: $([math]::Round($stats.Average, 2)) days"
Write-Host "Maximum Uptime: $($stats.Maximum) days"
Write-Host "Minimum Uptime: $($stats.Minimum) days"

# Export detailed report
$uptimeData | Export-Csv -Path "C:\temp\detailed_uptime_report.csv" -NoTypeInformation

2. Run the script monthly to track uptime trends
3. Use the CSV output to create charts in Excel or Power BI
4. Set up alerts for systems with unusually low uptime values

Configure Event ID 6013 integration with enterprise monitoring platforms for centralized uptime tracking:

1. For SCOM integration, create a custom rule:
• Open Operations Manager Console
• Navigate to Authoring → Rules
• Create a new Event Collection Rule
• Target: Windows Computer
• Event Log: System
• Event ID: 6013
• Event Source: EventLog
2. For Azure Monitor integration, configure the Log Analytics agent:

# Configure Windows Event Log collection
$workspaceId = "your-workspace-id"
$workspaceKey = "your-workspace-key"

# Add System log with Event ID 6013 filter
Add-AzOperationalInsightsWindowsEventLog -ResourceGroupName "your-rg" -WorkspaceName "your-workspace" -EventLogName "System" -CollectErrors -CollectWarnings -CollectInformation

3. Create custom KQL queries in Azure Monitor:

Event
| where EventLog == "System" and EventID == 6013
| extend UptimeSeconds = extract(@"(\d+) seconds", 1, RenderedDescription)
| extend UptimeDays = todouble(UptimeSeconds) / 86400
| summarize avg(UptimeDays), max(UptimeDays), min(UptimeDays) by Computer
| order by avg_UptimeDays desc

4. Set up automated alerts for uptime thresholds
5. Create dashboards showing uptime trends across your infrastructure