Solved

Query "application and services logs" with log parser

Posted on 2010-08-19
7
2,662 Views
Last Modified: 2012-05-10
Hello,
I have a script which collects printing logs from print server using logparser. We have moved our print server to Window 2008 R2. The problem is, I was querying printing logs from System logs (select ... from \\printserver\system), but on 2008 R2, these logs are under "application and services logs\Microsoft\Windows\PrintService\Operational". What must I use at the end of the query (select ..... \\printserver\????) ?
0
Comment
Question by:TAI-
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 26

Expert Comment

by:pony10us
ID: 33476848
Are you using WMIC to query the log files?

WMIC NTEVENT where "LogFile='application and services' and Type>'0'"

Adjust for what you are looking for.
0
 

Author Comment

by:TAI-
ID: 33482228
Hello, I am using "log parser", not WMIC.
0
 
LVL 26

Expert Comment

by:pony10us
ID: 33485969
It appears that either someone else is asking for the same information or this is also you on http://forums.iis.net/1140.aspx (the logparser forum) There is no answer as of yet.
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 

Author Comment

by:TAI-
ID: 33498229
Yes, this is my post too.Waiting for someone to help.
0
 
LVL 26

Expert Comment

by:pony10us
ID: 33501736
Let me see what I can find.  I haven't used log parser before. WMIC is pretty simple to use though.
0
 

Accepted Solution

by:
TAI- earned 0 total points
ID: 33509593
Ok, I have found it. Logparser checks "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog" for event logs. When I created a key named "Microsoft-Windows-PrintService/Operational", I have succesfully reached this log.

I have created this key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Microsoft-Windows-PrintService/Operational
0
 
LVL 26

Expert Comment

by:pony10us
ID: 33511284
Glad you were able to discover a solution.
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question