..., etc.

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====Outdated - use psloglist instead !!!====

Example syntax for querying the Windows Event logs and getting simple text format out:

  C:\>cscript.exe C:\windows\system32\eventquery.vbs /L Application /V /FI "Source
  eq AdsmClientService" /FI "Datetime gt 01/31/2008,12:00:00AM"

You must use cscript.exe as the vbs processor.

  C:\>cscript.exe C:\windows\system32\eventquery.vbs /L Application /V /FI "Source
  eq AdsmClientService" /FI "Datetime gt 01/31/2008,12:00:00AM"
  Microsoft (R) Windows Script Host Version 5.6
  Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
  
  
  ------------------------------------------------------------------------------
  Listing the events in 'application' log of host 'INFOED-DEV2'
  ------------------------------------------------------------------------------
  Type          Event  Date Time               Source            ComputerName
  Category        User                 Description
  ------------- ------ ----------------------- ----------------- ---------------
  --------------- -------------------- -----------
  Information   4097   1/31/2008 12:33:43 AM   AdsmClientService INFOED-DEV2
  None            NT AUTHORITY\SYSTEM  Execution of Schedule GEN_0030 Started
  Information   4100   1/31/2008 12:14:43 AM   AdsmClientService INFOED-DEV2
  None            NT AUTHORITY\SYSTEM  Next Scheduled Event Obtained from Server T
  SM (Windows):  
  -------------------------------------------------------------  
  Schedule Name:            GEN_0030  Action:
  Incremental  Objects:                           (none)  Options:
         (none)  Server Window Start:    00:30:00 on 01/31/2008  
  --------------------------------------------------------------
  Information   4097   1/31/2008 12:33:43 AM   AdsmClientService INFOED-DEV2
  None            NT AUTHORITY\SYSTEM  Incremental backup of volume '\\infoed-dev2\c$'
  
  Information   4097   1/31/2008 12:33:43 AM   AdsmClientService INFOED-DEV2
  None            NT AUTHORITY\SYSTEM  Incremental backup of volume '\\infoed-dev2\d$'
  
  Information   4097   1/31/2008 12:33:43 AM   AdsmClientService INFOED-DEV2
  None            NT AUTHORITY\SYSTEM  Incremental backup of volume 'SYSTEMSTATE'
  
  Information   4097   1/31/2008 1:34:29 AM    AdsmClientService INFOED-DEV2
  None            NT AUTHORITY\SYSTEM  Incremental backup of volume 'SYSTEMSERVICES'
   
  Error         4099   1/31/2008 1:34:43 AM    AdsmClientService INFOED-DEV2
  None            NT AUTHORITY\SYSTEM  ANS4987E Error processing '\\infoed-dev2\c$
  \Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations
  Manager\MOM2 Management Group\EventCons': the object is in use by another process
   
  Error         4099   1/31/2008 1:37:38 AM    AdsmClientService INFOED-DEV2
  None            NT AUTHORITY\SYSTEM  ANS4987E Error processing '\\infoed-dev2\c$
  \Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations
  Manager\MOM2 Management Group\EventCons': the object is in use by another process
..., etc.

User Tools

Site Tools

Page Tools
