Windows System Log · Event 6013
Event 6013: The system uptime, logged daily
Windows records how long the machine has been running, once a day. Nothing is wrong — it is a heartbeat. Its practical use is working out how long a machine has been up without touching it, and spotting reboots you did not know about.
Also written as Event ID 6013The system uptime is seconds6013 uptime event
- How oftenUncommon
- Vendor calls itInformation
- LogSystem
- SourceEventLog
What it means for you
On a personal computer
Just Windows noting how long your PC has been switched on. Entirely normal and appears once a day.
For an analyst
Useful for two things: proving a machine has been up continuously across a period, and finding reboots by looking for uptime counters that reset. A server whose uptime keeps resetting without a matching 1074 is rebooting on its own.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
The system uptime is 743280 seconds.The fields that decide it
Everything else in the log line is context.
- Uptime in seconds
- How long the machine has been running. Divide by 86400 for days.
- Reset pattern
- Not a field. An uptime value lower than the previous day's means the machine restarted in between.
Ordinary reasons this happens
Most of the time it is one of these.
- Normal daily logging, which is the only reason it exists.
- The counter resetting after a planned restart or patching.
What to do next
- Convert the value to days if you just want the uptime.
- Compare consecutive entries. A drop means a reboot happened between them.
- If the uptime resets with no matching 1074, look for 6008 and 41 — the machine went down on its own.
- Use the daily cadence as timeline anchors when reconstructing an incident.
Queries to run
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6013} -MaxEvents 30 | Select-Object TimeCreated, @{n='UptimeDays';e={[math]::Round(([regex]::Match($_.Message,'\d+').Value / 86400),2)}}(Get-CimInstance Win32_OperatingSystem).LastBootUpTimeCommon questions
How do I check how long a Windows machine has been running?
Event 6013 records it daily, but for the current value `(Get-CimInstance Win32_OperatingSystem).LastBootUpTime` in PowerShell is quicker. Task Manager also shows uptime on the Performance tab under CPU. Use 6013 when you need the history rather than the current figure.
Is Event 6013 an error?
No. It is an informational heartbeat Windows writes once a day, and its presence means the machine has been running normally. It is only interesting in sequence — an uptime value lower than the previous day's tells you a restart happened in between.
Read next
- Read alongside Event 6005: The event log service started The event log starting, which marks each boot.
- Usually comes before Event 1074: Something asked Windows to shut down or restart A deliberate restart, which resets the uptime counter.
- Usually comes before Event 6008: The previous system shutdown was unexpected An unexpected shutdown, which resets it without anyone asking.
- Usually comes before Event 41: The system rebooted without shutting down cleanly The kernel's record of an unclean shutdown.
Vendor documentation
Last reviewed 28 August 2026