Windows Event Log SystemTime format

Question

The follwing timestamp was created during an Windows Security Log

TimeCreated 

   [ SystemTime]  2013-10-07T07:31:09.122037600Z

In this timestamp I can't understand what 122037600Z part means? Do they represent milliseconds or something? Please i need your help.

Placeholder
String  Meaning
YYYY    four-digit year
MM  two-digit month (01=January, etc.)
DD  two-digit day of month (01 through 31)
hh  two digits of hour (00 through 23)
mm  two digits of minute (00 through 59)
ss  two digits of second (00 through 59)
s   one or more digits representing a decimal fraction of a second
TZD time zone designator (“Z” or +hh:mm or -hh:mm)

You answer your own question in your message. What is it you wnat to know ? how to read the help ? — Stephane, Oct 07 '13 at 07:44

score 2 · Accepted Answer · answered Oct 07 '13 at 07:44

2

Do they represent milliseconds or something?

Yes... fractions of a second in Windows underlying system time format based on 100ns intervals (hence the last two digits are zero).

answered Oct 07 '13 at 07:44

Richard

5,309
1
22
20

score 2 · Answer 2 · answered Oct 07 '13 at 08:09

2

This is a standard ISO format for timestamps. The part after the past decimal is fractional seconds, and the trailing Z is a timezone (in this case indicating it's in UTC).

answered Oct 07 '13 at 08:09

Falcon Momot

24,975
13
61
92

Windows Event Log SystemTime format

2 Answers2