CD.Smalley wrote:
Is there a command line switch available for the EventViewer which will allow
me to specify which directory to view the available logs from?
I will have multiple workstations writing to a mirrored set of really large
flash drives. The workstations will write to their specific standard .evt
files. I need to be able to start EventViewer and specify which
workstations's logs to go view at startup.
Is this possible w/o creating my own custom EventViewer?
This is not really a csharp question. Looking at the help file for the
Event Viewer, there is the following:
Open Command Prompt.
Type:
eventquery[.vbs] [-?] [-s Computer [-u Domain\User [-p Password]]] [-fi
FilterName ] [-fo {TABLE|LIST|CSV }] [-r EventRange [-nh] [-v] [-l
{APPLICATION|SY STEM|SECURITY|" DNS Server"|LOG|Dir ectoryLogName|* }]
Value Description
-? Displays Help on Eventquery.vbs
-s Computer Specifies the name of one or more remote computers (no
backslashes). The default is the local computer.
-u Domain\User This is used when a password is required.
-p Password This is used when required by network security policy.
-fi FilterName Specifies the types of events to include in or exclude
from the query.
-fo {TABLE|LIST|CSV } The format to use for the output.
-r EventRange The range of events to list.
-nh Supresses column headers in the output of table and .csv formats.
-v Specifies that verbose task information be displayed in the output.
-l {APPLICATION|SY STEM|SECURITY|" DNS Server"|LOG|Dir ectoryLogName|* }
Specifies the logs to monitor.
Notes
To open a command prompt, click Start, point to All Programs, point to
Accessories, and then click Command Prompt.
To view the complete syntax for this command, at a command prompt, type:
eventquery.vbs -?
The other computer can be a workstation running Windows XP Home Edition,
Windows XP Professional, Windows 2000 Professional, or Windows NT
Workstation, or a server or domain controller running Windows 2000
Server, Windows NT Server, or a LAN Manager 2.x server.
The following are valid for use with the -fi FilterName value:
Datetime eq, ne, ge, le, gt, lt mm/dd/yy(yyyy), hh:mm:ssAM(/PM)
Type eq, ne ERROR|INFORMATI ON|WARNING|SUCC ESSAUDIT|FAILUR EAUDIT
ID eq, ne, ge, le, gt, lt non-negative integer
User eq, ne Any valid string.
Computer eq, ne Any valid string.
Source eq, ne Any valid string.
Category eq, ne Any valid string
--
Tom Porterfield
