Boot time of Operating System - how is it determined?

written by Niall.Fraser

Hi,

I have been trying to find out when a Windows server was rebooted last - I found the inspector - “boot time of operating system” which I collect in an analysis which runs on each report time. I also collect the uptime in hours.

The results returned seem inconsistent - the majority of times, the time appears to be correct, but there are also results which are strange. Some servers which I know have been rebooted recently, report that they were last rebooted several weeks ago. and others which were rebooted on known date show the last reboot as several days later.

There is also inconsistencies between the uptime and the last reboot time, where the uptime says that the server has been up for longer than suggested by the boot time.

So that I can investigate this further - I would like to know where these inspectors ( boot time and uptime) get their information from, and I could then look on the servers to check the information on the server.

thanks

Niall

written by jgstew

Are any of the servers in question VMs? I believe if you reboot a VM host, then the VM guests will “sleep” and then be “awoken” rather than actually rebooted.

written by Niall.Fraser

Hi,

some are VMs but many are physical servers, seems to happen on Win2003, Win2008, Win2008R2. I have run the analysis on 1200 servers and 330 have differences between uptime and boottime.

Niall