The Core Technologies Blog

Our Software // Windows Services // 24×7 Operation


When did my Windows Service Start?

Windows Service Uptime

Here are four ways to determine when your windows service last started.

Solution #1: Search the Windows Event Logs with PowerShell

The Windows Event Logs hold a wealth of information about your computer’s activities. Indeed, a new record is added to the System event log whenever a windows service starts or stops.

The easiest way to find your service’s most recent start time is to use a specially crafted PowerShell command to search the System event log. For example, the following line will return the last time the “Print Spooler” service was started:

(Get-EventLog -LogName “System” -Source “Service Control Manager” -EntryType “Information” -Message “*Print Spooler service*running*” -Newest 1).TimeGenerated

Be sure to replace “Print Spooler” with the display name of the service you are investigating!


PowerShell - Windows Service Start Time

Solution #2: Search the Windows Event Logs using the Event Viewer

Instead of running a PowerShell command, you can also search the Event Log manually.

To find the event log record showing when your service was last started:

  1. Open the Event Viewer from the Control Panel (search for it by name).

  2. In the left-hand column, navigate to Windows Logs > System:


    Event Viewer - Open System Log

  3. Click Find… on the right to bring up the Find window. Enter the name of the service and click the Find Next button to highlight the first matching record in the middle panel. We have entered Spooler, for the Windows Spooler service:


    Event Viewer - Find

  4. If necessary, keep clicking the Find Next button until a record saying that your service has “entered the running state” comes up. The Source should be Service Control Manager, and the time your service started will be displayed in the Logged value. The screenshot show that the Print Spooler service last started at 8:04:55 AM on January 7th 2017:


    Print Spooler service start time

Solution #3: Figure out when the Service’s Process was Started

Each running windows service is backed by an underlying process. 99.9% of the time, that process was launched immediately when the service started. So finding the process start time will give us the service start time.

To find out when the service’s process was started:

  1. Determine the process identifier (PID) of the service’s process using the SC command. For a service named MyService, run:

    sc queryex MyService

    (Be sure to enclose the service name in quotes if it contains spaces.)

    Here is the result for the Spooler service:


    Use SC to find the Service PID

    Make a note of the number on the PID line (1276 in the screenshot above).

  2. Next, open a PowerShell window and run:

    Get-Process | select name, id, starttime | select-string <PID>

    where <PID> is the process identifier from step 1. The start time will come back in the result. Here is what we got for the spooler’s process (#1276):


    Run PowerShell Get-Process

Solution #4: Use the System Boot/Up Time (for Automatic Windows Services)

Most Windows Services start when your computer boots and run continuously, 24×7 in the background. For those services, the system boot time is a reasonable approximate.

You can run the built-in systeminfo command to discover when the system last started. Amongst the valuable information systeminfo returns, look for the “System Boot Time” line:


System Boot Time

However, if you’re ever in a situation where you can’t remember the command to use, know that the Task Manager’s Performance tab shows how long the computer has been up (“Up time”). The system boot time is a simple calculation away.


Task Manager - Uptime


So there are four easy ways to find out when your windows service started. Use whichever one best fits your situation. Good luck with your troubleshooting/investigation!

Posted in Windows Services | Tagged , , , , | Leave a comment

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>