uptime

Uptime of a Windows, by SSH

Returns the time since a Windows started, in hours. One watch is proposed, set on the probe: the recent reboot.

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the OpenSSH server is built in from Windows Server 2019 and Windows 10 1809, installed from Win32-OpenSSH before. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

The collector runs one PowerShell command that reads the raw counter SystemUpTime of Win32_PerfRawData_PerfOS_System:

powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_PerfRawData_PerfOS_System | Select-Object SystemUpTime, Timestamp_Object, Frequency_Object | ConvertTo-Json -Compress"

• SystemUpTime is the instant the system started, Timestamp_Object the instant of the reading, both in ticks of Frequency_Object: the time since start is their difference over the frequency, returned in hours, rounded to a hundredth.
• All three are integers: no date, no time zone and no change of summer time to read.
• A restart shows as a time since boot shorter than the threshold of "Recent reboot".
• Nothing is skipped at the first run.
• An answer that is not the expected JSON stops the collector as misconfigured.

Nothing is written to the Windows: the command only reads.

Prerequisites

• The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
• The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
• Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
• An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
• The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
• The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).

Outputs

Watches

A restart is seen only while the time since start is under the threshold: with the default, the watch stays raised for the first half hour after the start, then clears by itself. A probe that runs less often than the threshold can miss a restart.

Limits

• With the "Fast startup" of Windows 8 and later desktops, a shutdown followed by a start is not a restart of the system: the time since start then goes on. A restart, from the Start menu or by an update, is one.