How do I obtain complete error message using logparser

nsr81
nsr81 used Ask the Experts™
on
I am trying to get some data out of eventlogs using logparser, however, the "Message" field which is returned contains an error code instead of complete description.

For example

"The USB Mass Storage Driver service failed to start due to the following error: %%1058"

If I look at the same event using EventViewer, the complete description is:

"The USB Mass Storage Driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. "

"%%1058" = "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it."

How do I get that information using logparser?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Hi nsr81,  I dont actually have a definate answer for you but I sourced this,
Log Parser (Microsoft) it has good documentation on using the Log Parser
http://128.175.24.251/forensics/logparser.htm

Author

Commented:
Although, it didn't address my issue, the link provided was a good resource.
Thanks nsr81
glad it assisted you .

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial