Skip navigation

JSI Tip 1425. Uptime.exe.

Starting with SP4, Uptime.exe will display information about system availability.

To install the tool, simply copy Uptime.exe to your %SystemRoot% or %SystemRoot%\System32 folder.

Uptime.exe works best when run by an Administrator, but a user can get limited information. The tool makes use of the new System events to estimate availability. Here is a sample output, generated by typing Uptime /s /a JSI003 on my PDC, where JSI003 is a Windows NT workstation, which I just restarted:

Uptime Report for: \\JSI003

OS: Windows NT 4.0 (Build 1381), Service Pack 5, Uniprocessor Free.
Time Zone: Eastern Daylight Time

System Events as of 6/25/99 10:55:02:

Date:      Time:        Event:               Comment:
---------- -----------  -------------------  -----------------------------------
   6/25/99    10:49:59  Shutdown
   6/25/99    10:51:59  Boot                 Prior downtime:0d 0h:2m:0s

Current System Uptime: 0 day(s), 0 hour(s), 3 minute(s), 17 second(s)


Since 6/25/99:

           System Availability: 60.3960%
                  Total Uptime: 0d 0h:3m:3s
                Total Downtime: 0d 0h:2m:0s
                 Total Reboots: 1
     Mean Time Between Reboots: 0.00 days
             Total Bluescreens: 0
    Total Application Failures: 0
Typing Uptime /help returns:
UPTIME, Version 1.00
(C) Copyright 1999, Microsoft Corporation

Uptime \[server\] \[/s \] \[/a\] \[/d:mm/dd/yyyy | /p:n\] \[/heartbeat\] \[/? | /help\]
        server          Name or IP address of remote server to process.
        /s              Display key system events and statistics.
        /a              Display application failure events (assumes /s).
        /d:             Only calculate for events after mm/dd/yyyy.
        /p:             Only calculate for events in the previous n days.
        /heartbeat      Turn on/off the system's heartbeat
        /?              Basic usage.
        /help           Additional usage information.

UPTIME is a utility that processes the machine's event log to determine
system availability and current uptime. The target system can either be the
local system or a remote system. No special privileges are required for basic
operation although it is most accurate to run the tool under an administrative
account. Many factors affect these calculations, and the results displayed
by this tool should be considered estimates.

    Availability calculations require:
    Windows NT 4.0 Service Pack 4 or higher, including Windows 2000.
    Additionally the system "heartbeat" must be active.

The system "heartbeat" is a date/time stamp that is written to the system
registry at a fixed interval. This heartbeat is available in Service Pack 4
or higher. It is enabled by default on Windows NT Server. Since the
heartbeat causes the registry to be written to the disk at regular
intervals, it can interfere with systems running various forms of power
management. It is not recommended to enable the heartbeat of laptop systems.

To enable the heartbeat use: UPTIME /heartbeat \[\\Machine\]

If the heartbeat is disabled, or if you are not running Service Pack 4 or
greater, UPTIME may report that the event logs do not contain sufficient
information to calculate system availability. This is because UPTIME detects
an abnormal shutdown (for instance a bluescreen or power failure) but cannot
determine how long the system was down during this abnormal outage.

It is best to run uptime as an administrator, since much more information
is available to calculate system uptime and availability. For instance
the time zone of the system is important to many of the calculations, but
this information can only be reliably obtained by an administrator.
Additionally, when calculating the Current System Uptime, this tool attempts
to use the System Performance Counter for Uptime. However, if the user is not
an administrator, this counter may be unavailable. In this case an estimate
is made based on the last recorded boot noted in the event log.

Application Failures:
Application Failure event detection is dependent upon Dr Watson being enabled.

Bluescreen detection is dependent upon the system being configured to write an
event to the event log if the system stops unexpectedly.
To enable bluescreen event logging for Windows NT 4.0:
   Go to the Control Panel and double click the System Icon.
   Next select the startup/shutdown tab.
   Finally check the "Write an event to the system log." check box.

To enable bluescreen event logging for Windows 2000 Systems do the following:
   Go to the Control Panel and double click the System Icon.
   Next select the "Advanced" tab.
   From the "Advanced" property sheet select the "Startup and Recovery" button.
   Finally check the "Write an event to the system log." check box.

Potential sources of error:
All calculations are based on the entries in the event log.  If the
system time is altered significantly, this can have a dramatic affect on
the calculations made.  Additionally if the event logs have been cleared,
or have filled, such that additional events cannot be written, this will
also affect this tools ability to accurately estimate system availability.

The heartbeat is generally written every 5 minutes, so the amount of downtime
calculated for abnormal outages is limited in accuracy to this window.

Systems that are a member of a cluster are currently unsupported by UPTIME.
If UPTIME detects that the target system may be a member of a cluster,
UPTIME will display a message stating that the results may be in error.

Where to go for more help:
For further information about this tool please see: and reference KB Article: Q232243.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.