PowerShell command: Event Time

gjacobse

My system shut down for some odd reason today,.. in looking over the event log, I see the normal this and that.

One of the items is:

Faulting application start time: 0x01d0b26dc6a4a844

Well I see the event logged time, but what does this mean? Is there a way to convert it?

Simple enough,.. You can do a bit of math or you can you a simple PowerShell command.

get-date 0x01d0b26dc6a4a844

PS C:\Users\user.PC> get-date 0x01d0b26dc6a4a844

Monday, June 29, 0415 1:16:14 PM

Don't know how useful it is,... since it is shown in the event log, but was interesting way to learn a new PS cmdlet.

scottalanmiller

Is this your production work desktop?

gjacobse

Yes, - Windows 10 Build: 10130

Martin9700

@g.jacobse said:

0x01d0b26dc6a4a844

That value isn't a .NET date/time value so Get-Date won't be able to process it properly (hence the year 0415). So I tried this: http://superuser.com/questions/398983/how-do-i-decode-the-faulting-application-start-time-in-a-windows-event-log-ent

(get-date "01/01/1601").AddSeconds(0x01d0b26dc6a4a844 / 10E+6)

And got:

Monday, June 29, 2015 1:16:14 PM

Seems much better!

gjacobse

@Martin9700
I didn't notice that - Thanks for pointing that out.

gjacobse

@Martin9700 said:

@g.jacobse said:

0x01d0b26dc6a4a844

That value isn't a .NET date/time value so Get-Date won't be able to process it properly (hence the year 0415). So I tried this: http://superuser.com/questions/398983/how-do-i-decode-the-faulting-application-start-time-in-a-windows-event-log-ent
(get-date "01/01/1601").AddSeconds(0x01d0b26dc6a4a844 / 10E+6)
And got:
Monday, June 29, 2015 1:16:14 PM
Seems much better!

Interesting - same link I used. I didn't notice that the read through.