Library: Microsoft Windows Server 2003 Command Reference: EVENTQUERY

Library: Microsoft Windows Server 2003 Command Reference
EVENTQUERY

EVENTQUERY.vbs [/S system [/U username [/P password]]] [/V] [/FI filter]
               [/FO format] [/R range] [/NH] [/L logname | *]
 
Description:
    The EVENTQUERY.vbs script enables an administrator to list
    the events and event properties from one or more event logs.
 
Parameter List:
    /S     system          Specifies the remote system to connect to.
 
    /U     [domain\]user   Specifies the user context under which the
                           command should execute.
 
    /P     password        Specifies the password for the given
                           user context.
 
    /V                     Displays verbose information. Specifies that 
                           the detailed information should be displayed 
                           in the output.
 
    /FI    filter          Specifies the types of events to
                           filter in or out of the query.
 
    /FO    format          Specifies the format in which the output
                           is to be displayed.
                           Valid formats are "TABLE", "LIST", "CSV".
 
    /R     range           Specifies the range of events to list.
                           Valid Values are:
                               'N' - Lists 'N' most recent events.
                              '-N' - Lists 'N' oldest events.
                           'N1-N2' - Lists the events N1 to N2.
 
    /NH                    Specifies that the "Column Header" should
                           not be displayed in the output.
                           Valid only for "TABLE" and "CSV" formats.
 
    /L     logname         Specifies the log(s) to query.
 
    /?                     Displays this help/usage message.
 
    Valid Filters  Operators allowed   Valid Values
    -------------  ------------------  ------------
    DATETIME       eq,ne,ge,le,gt,lt   MM/dd/yy(yyyy),hh:mm:ssAM(/PM)
    TYPE           eq,ne               SUCCESS, ERROR, INFORMATION,
                                       WARNING, SUCCESSAUDIT,
                                       FAILUREAUDIT
    ID             eq,ne,ge,le,gt,lt   non-negative integer(0 - 65535)
    USER           eq,ne               string
    COMPUTER       eq,ne               string
    SOURCE         eq,ne               string
    CATEGORY       eq,ne               string
 
NOTE: Filter "DATETIME" can be specified as "FromDate-ToDate"
      Only "eq" operator can be used for this format.
 
Examples:
    EVENTQUERY.vbs 
    EVENTQUERY.vbs /L system  
    EVENTQUERY.vbs /S system /U user /P password /V /L *
    EVENTQUERY.vbs /R 10 /L Application /NH
    EVENTQUERY.vbs /R -10 /FO LIST /L Security
    EVENTQUERY.vbs /R 5-10 /L "DNS Server"
    EVENTQUERY.vbs /FI "Type eq Error" /L Application
    EVENTQUERY.vbs /L Application
            /FI "Datetime eq 08/15/02,03:15:00AM-08/15/02,03:15:00PM"
    EVENTQUERY.vbs /FI "Datetime gt 07/04/02,04:27:00PM" 
            /FI "Id gt 700" /FI "Type eq warning" /L System
    EVENTQUERY.vbs /FI "Type eq error OR Id gt 1000 "
Fun for Photographers