asked on

Windows 2008 Server R2 Event log issue

We're migrating to 2008 R2. As we move our printers, it has become apparent that the old method of exporting print events from the system log used with 2003 Server and before no longer works (dumpel). I've run into a few problems, not the least of which is my limited scripting ability. All we need to do is to be able to export the Microsoft-Windows-PrintService/Operational log to some kind of a flat, comma-or-tab delimited file, at which point it's no longer my problem as long as the requisite info is in the file (really only need the info from the 307 events). If anyone out there has a PS script, a VB script, or anything else that can query this specific live log and export the contents to a flat file, XML, or even the old .evt format, I'd be very interested to see it. My humble thanks in advance for any forthcoming assistance!

ASKER CERTIFIED SOLUTION

Darius Ghassem

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

DougAppel

ASKER

Thanks - since I posted this question I have been working with wevtutil, using wevtutil qe to dump events into a text file. Unfortunately, the format of the output file is neither TSV or CSV, rather something I've not seen before. Trying to figure out how to massage this format into a standard DB/spreadsheet-friendly format...

Cheers!

RobSampson

Hi, is PSLogList able to work on 2008 R2?
http://technet.microsoft.com/en-us/sysinternals/bb897544

The -s switch should output to a CSV compatible format.

Regards,

Rob.

DougAppel

ASKER

Thanks - I'll try this one out tomorrow. For anyone else with a similar issue, investigate the aforementioned wevtutil's qe function - I've succeeded in creating a command that'll execute a structured query from an xml file that will give me at least part of what I need (xml or text output to file). With any luck the new event log structure and formatting won't gum up PSLogList and I'll be able to extract a nice, simple CSV...

Thanks for the tip, Rob - I'll let you know how it goes!

RobSampson

Sure, see how you go. I was more hoping you could just use PSLogList straight up, and not wevtutil, but see what you can come up with. I don't have access to a 2008 R2 server at the moment, although I can if need be.

Rob.

DougAppel

ASKER

So far, no luck. The PsLogList doesn't seem to be able to locate the registry key:

HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-PrintService/Operational

where the specifics of the particular log I need to access reside.

It read the system log just fine, so it may just be a matter of getting the path syntax right...

RobSampson

Hmmm, I don't know anything about how the Event Logging works in Vista, Windows 7, or Server 2008, but, I did find this:
http://blogs.msdn.com/b/ntdebugging/archive/2009/09/08/exploring-and-decoding-etw-providers-using-event-log-channels.aspx

In my 2008 server, I right-click the PrintService/Operational log, and click Enable Log, but it doesn't show up in the Event Trace Sessions in Computer Management. I ran this in PowerShell -->
Get-WinEvent -ListProvider "print*"

but it didn't show the "Operational" log as having a provider with which to publish events. According to the above article, "Enabling" a log should automatically put the trace on it.

Anyway, while I keep looking, there's a couple of output commands in that article that may help you get what you need, although they all appear to be local commands, and not able to be executed remotely (presumably because it's not "published").

Regards,

Rob.

RobSampson

I just noticed that in the Performace --> Data Collector Sets --> Event Trace Sessions --> EventLog-Application data collector, under the Trace Providers tab is the Microsoft-Windows-PrintService provider, so I checked the Application Event Log, but I couldn't filter it by the PrintService source to show the events....I wonder where they're hiding....

RobSampson

Hmmm, the best I can do is run this PowerShell command:
Get-WinEvent -LogName "Microsoft-Windows-PrintService/Operational"

There's probably more options for Get-WinEvent for cleaner output, but I don't know PowerShell. If you want to run against a remote computer, try
Get-WinEvent -ComputerName "RemotePC" -LogName "Microsoft-Windows-PrintService/Operational"

It seems it's otherwise not possible to query this log using VBScript or PSLogList.

Regards,

Rob.

DougAppel

ASKER

Ended up scripting wevtutil in PS. Much massaging of output required, though.