Windows Event ID 1013 – Kernel-General: System Uptime Information

Access the basic event information through the Windows Event Viewer interface:

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 1013 in the Event IDs field and click OK
5. Double-click any Event ID 1013 entry to view detailed information
6. Review the General tab for basic uptime data and timestamps
7. Check the Details tab for raw XML data containing additional metrics

Use PowerShell to retrieve and analyze Event ID 1013 data programmatically:

# Get the most recent 10 Event ID 1013 entries
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1013} -MaxEvents 10

# Extract detailed information with custom formatting
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1013} -MaxEvents 5 | 
  Select-Object TimeCreated, Id, LevelDisplayName, Message | 
  Format-Table -AutoSize

# Get events from the last 30 days
$StartDate = (Get-Date).AddDays(-30)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1013; StartTime=$StartDate}

# Export uptime data to CSV for analysis
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1013} -MaxEvents 50 | 
  Select-Object TimeCreated, Message | 
  Export-Csv -Path "C:\temp\uptime_events.csv" -NoTypeInformation

For advanced analysis, parse the XML data to extract specific uptime values:

# Parse XML data for precise uptime information
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1013} -MaxEvents 10
foreach ($Event in $Events) {
    $XML = [xml]$Event.ToXml()
    $UptimeData = $XML.Event.EventData.Data
    Write-Host "Boot Time: $($Event.TimeCreated)"
    Write-Host "Uptime Data: $($Event.Message)"
    Write-Host "---"
}

Implement automated monitoring to track system uptime patterns and generate reports:

# Create a comprehensive uptime monitoring script
function Get-SystemUptimeReport {
    param(
        [int]$Days = 30
    )
    
    $StartDate = (Get-Date).AddDays(-$Days)
    $UptimeEvents = Get-WinEvent -FilterHashtable @{
        LogName='System'
        Id=1013
        StartTime=$StartDate
    } -ErrorAction SilentlyContinue
    
    if ($UptimeEvents) {
        $Report = @()
        foreach ($Event in $UptimeEvents) {
            $Report += [PSCustomObject]@{
                BootTime = $Event.TimeCreated
                Message = $Event.Message
                DayOfWeek = $Event.TimeCreated.DayOfWeek
            }
        }
        return $Report | Sort-Object BootTime -Descending
    }
}

# Generate and display the report
$UptimeReport = Get-SystemUptimeReport -Days 60
$UptimeReport | Format-Table -AutoSize

# Calculate average uptime between restarts
if ($UptimeReport.Count -gt 1) {
    $TimeDifferences = @()
    for ($i = 0; $i -lt ($UptimeReport.Count - 1); $i++) {
        $Diff = $UptimeReport[$i].BootTime - $UptimeReport[$i+1].BootTime
        $TimeDifferences += $Diff.TotalHours
    }
    $AverageUptime = ($TimeDifferences | Measure-Object -Average).Average
    Write-Host "Average uptime between restarts: $([math]::Round($AverageUptime, 2)) hours"
}

Combine Event ID 1013 data with shutdown events (1074, 6006, 6008) for complete system lifecycle tracking:

# Comprehensive system restart analysis
function Get-SystemRestartAnalysis {
    param([int]$Days = 14)
    
    $StartDate = (Get-Date).AddDays(-$Days)
    
    # Get startup events (1013)
    $StartupEvents = Get-WinEvent -FilterHashtable @{
        LogName='System'
        Id=1013
        StartTime=$StartDate
    } -ErrorAction SilentlyContinue
    
    # Get shutdown events (1074, 6006, 6008)
    $ShutdownEvents = Get-WinEvent -FilterHashtable @{
        LogName='System'
        Id=1074,6006,6008
        StartTime=$StartDate
    } -ErrorAction SilentlyContinue
    
    # Combine and sort all events
    $AllEvents = @()
    
    foreach ($Event in $StartupEvents) {
        $AllEvents += [PSCustomObject]@{
            Time = $Event.TimeCreated
            Type = "Startup"
            EventId = $Event.Id
            Message = $Event.Message
        }
    }
    
    foreach ($Event in $ShutdownEvents) {
        $AllEvents += [PSCustomObject]@{
            Time = $Event.TimeCreated
            Type = "Shutdown"
            EventId = $Event.Id
            Message = $Event.Message
        }
    }
    
    return $AllEvents | Sort-Object Time -Descending
}

# Run the analysis
$RestartAnalysis = Get-SystemRestartAnalysis -Days 30
$RestartAnalysis | Format-Table Time, Type, EventId, @{Name="Message";Expression={$_.Message.Substring(0,[Math]::Min(80,$_.Message.Length))}} -AutoSize

Create a scheduled task to run this analysis weekly:

# Register a scheduled task for weekly restart analysis
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\RestartAnalysis.ps1"
$Trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At 9:00AM
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "Weekly Restart Analysis" -Action $Action -Trigger $Trigger -Settings $Settings -Description "Analyze system restart patterns using Event ID 1013"

Implement enterprise-level monitoring with custom alerting for abnormal restart patterns:

# Advanced monitoring script with alerting capabilities
function Monitor-SystemUptimePatterns {
    param(
        [int]$AlertThresholdHours = 2,
        [string]$SMTPServer = "mail.company.com",
        [string]$AlertEmail = "admin@company.com"
    )
    
    # Get recent startup events
    $RecentStartups = Get-WinEvent -FilterHashtable @{
        LogName='System'
        Id=1013
        StartTime=(Get-Date).AddHours(-24)
    } -ErrorAction SilentlyContinue
    
    if ($RecentStartups.Count -gt 3) {
        # Multiple restarts detected
        $AlertMessage = @"
Multiple system restarts detected on $($env:COMPUTERNAME):

Restart Times:
$($RecentStartups | ForEach-Object { "- $($_.TimeCreated)" } | Out-String)

This may indicate system instability or maintenance activity.
"@
        
        # Send alert email (configure SMTP settings as needed)
        try {
            Send-MailMessage -To $AlertEmail -From "monitoring@company.com" -Subject "Multiple Restarts Detected - $($env:COMPUTERNAME)" -Body $AlertMessage -SmtpServer $SMTPServer
            Write-Host "Alert sent for multiple restarts" -ForegroundColor Yellow
        } catch {
            Write-Warning "Failed to send alert email: $($_.Exception.Message)"
        }
    }
    
    # Check for unexpected restarts (Event ID 6008 - unexpected shutdown)
    $UnexpectedShutdowns = Get-WinEvent -FilterHashtable @{
        LogName='System'
        Id=6008
        StartTime=(Get-Date).AddHours(-24)
    } -ErrorAction SilentlyContinue
    
    if ($UnexpectedShutdowns) {
        Write-Warning "Unexpected shutdowns detected in the last 24 hours: $($UnexpectedShutdowns.Count)"
        $UnexpectedShutdowns | ForEach-Object {
            Write-Host "Unexpected shutdown at: $($_.TimeCreated)" -ForegroundColor Red
        }
    }
}

# Create Windows Event Log custom view for Event ID 1013
$CustomViewXML = @'

  
    *[System[(EventID=1013)]]
  

'@

# Save custom view to file
$CustomViewXML | Out-File -FilePath "$env:TEMP\Event1013_CustomView.xml" -Encoding UTF8
Write-Host "Custom view XML saved to: $env:TEMP\Event1013_CustomView.xml"
Write-Host "Import this file in Event Viewer under Custom Views for easy Event ID 1013 filtering"

# Run the monitoring function
Monitor-SystemUptimePatterns

Set up Windows Performance Toolkit (WPT) correlation:

# Correlate Event ID 1013 with boot performance data
# Requires Windows Performance Toolkit installation
function Get-BootPerformanceCorrelation {
    $BootEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1013} -MaxEvents 5
    
    foreach ($Event in $BootEvents) {
        $BootTime = $Event.TimeCreated
        Write-Host "Analyzing boot at: $BootTime" -ForegroundColor Green
        
        # Check for related performance events around boot time
        $StartWindow = $BootTime.AddMinutes(-2)
        $EndWindow = $BootTime.AddMinutes(10)
        
        $PerfEvents = Get-WinEvent -FilterHashtable @{
            LogName='Microsoft-Windows-Diagnostics-Performance/Operational'
            StartTime=$StartWindow
            EndTime=$EndWindow
        } -ErrorAction SilentlyContinue
        
        if ($PerfEvents) {
            Write-Host "  Found $($PerfEvents.Count) performance events during boot window"
        }
    }
}

Get-BootPerformanceCorrelation