What windows logs, event codes are accurate to decide power off?

[mbnaidu]

Hello,
I would like to prepare a dashboard which shows status(power on/off) off devices in retails store, we have POS,MPOS devices. My question is on what basis(windows logs) I would assume a device powers off?? Could you please explain what windows logs, event codes are accurate to decide power off? Any help would be appreciated.

Thanks in advance

[wenthold · Accepted solution]

Look in the System event log for Event ID 13, type 4, sourcename Microsoft-Windows-Kernel-General - or, using the standard Splunk TA for Windows:

sourcetype=WinEventLog:System EventCode=13 EventType=4

[mbnaidu]

thank you wenthold...we have so many devices like IPhones, IPADS, scan guns, printers, MPOS s i am getting real time machine data into my splunk, how would i categorize them as power on/off

      i have one method in my hand, if any host is not sending logs to splunk i am treating them as off line or power off devices which could be a power issue, network issue, application issue or anything else. now i would like like to take only power off devices only as not off line devices

[wenthold]

From a high level, I would do something like this:

• Create a lookup table of assets including the fields isExpected
• Schedule a lookup search to identify when a new host sends data, and add it to the asset lookup table with the isExpected value to 1
• Schedule another search that looks for the poweroff event and sets the isExpected value to 0

Now you can identify when a host is expected and stops sending data. This is what I'd start with for Windows, I'm not sure what I'd do for the other systems or if it's possible, it depends on what's being logged to Splunk from those devices.