| eventquery | new in WS2003 |
Displays events from event logs.
eventquery [/s Computer [/u Domain\User [/p Password]]] [/fi Filter]
[/fo {TABLE | LIST | CSV}] [/r EventRange [/nh] [/v]
[/l [APPLICATION] [SYSTEM] [SECURITY] ["DNS server"] [UserDefinedLog]
[DirectoryLogName] [*] ]
/s Computer
Name or IP address of remote computer (if omitted, defaults to local computer).
/u Domain\User /p Password
Credentials for running the command (if omitted, defaults to currently logged-on user).
/fi Filter
Filter for specifying types of events to search for (enclose in quotes). These can be:
/fo {TABLE | LIST | CSV}
Format for command output.
/r EventRange
Range of events to display. This can be:
N
Lists N most recent events
-N
Lists N oldest events
N1-N2
Lists events N1 to N2
/nh
No headers for columns in output (TABLE and CSV format only).
/v
Verbose information should be displayed.
/l [APPLICATION] [SYSTEM] [SECURITY] ["DNS server"] [UserDefinedLog] [DirectoryLogName] [*]
One or more logs to query, with the default being wildcard (*). Reuse the /l switch if you want to query more than one log.
Display five most recent events from System log:
eventquery /l system /r 5 Microsoft (R) Windows Script Host Version 5.6 Copyright (C) Microsoft Corporation 1996-2001. All rights reserved. ---------------------------------------------------------------------------- Listing the events in 'system' log of host 'ESRV210D' ---------------------------------------------------------------------------- Type Event Date Time Source ComputerName ------------- ------ ----------------------- ----------------- ------------ Warning 40961 3/26/2003 10:26:15 AM LSASRV ESRV210D Warning 36 3/26/2003 10:25:55 AM W32Time ESRV210D Warning 20 3/26/2003 9:51:41 AM Print ESRV210D Error 1111 3/26/2003 9:51:17 AM TermServDevices ESRV210D Error 1111 3/26/2003 9:51:17 AM TermServDevices ESRV210D
Search the System log for events with ID 36 and display the results in list format:
eventquery /fi "ID eq 36" /l SYSTEM /fo LIST Microsoft (R) Windows Script Host Version 5.6 Copyright (C) Microsoft Corporation 1996-2001. All rights reserved. ---------------------------------------------------------------------------- Listing the events in 'system' log of host 'ESRV210D' ---------------------------------------------------------------------------- Type: Warning Event: 36 Date Time: 3/26/2003 10:25:55 AM Source: W32Time ComputerName: ESRV210D Type: Warning Event: 36 Date Time: 3/11/2003 11:42:32 AM Source: W32Time ComputerName: ESRV210D
Repeat the command but display verbose output instead:
eventquery /fi "ID eq 36" /l SYSTEM /fo LIST /v Microsoft (R) Windows Script Host Version 5.6 Copyright (C) Microsoft Corporation 1996-2001. All rights reserved. ---------------------------------------------------------------------------- Listing the events in 'system' log of host 'ESRV210D' ---------------------------------------------------------------------------- Type: Warning Event: 36 Date Time: 3/26/2003 10:25:55 AM Source: W32Time ComputerName: ESRV210D Category: None User: N/A Description: The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. Monitor the system events displayed in the Event Viewer to make sure that a more serious problem does not exist. Type: Warning Event: 36 Date Time: 3/11/2003 11:42:32 AM Source: W32Time ComputerName: ESRV210D Category: None User: N/A Description: The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. Monitor the system events displayed in the Event Viewer to make sure that a more serious problem does not exist.
This command is a
.vbs script and requires CScript to run. You can make CScript your default script host by typing the following at the command prompt:
cscript //h:cscript //s
Event Logs