Solved

Pull warnings/errors from event viewer via script

Posted on 2010-09-06
11
652 Views
Last Modified: 2012-05-10
Hi Experts.  Much like another question I just asked, I was curious how I could go about using a script or batch file to look through a computers event viewer and export/dump the errors and warnings for a particular time period (last 2 months/1 month/1week, etc).

This would be for Windows based OS's.  Since I am not a programmer/scripter, I appreciate your help and patience with this!
0
Comment
Question by:samiam41
  • 7
  • 3
11 Comments
 
LVL 4

Expert Comment

by:erik_nodland
ID: 33612290
Hi

The easiest way is to use something like log parser. You can download it from here
http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

You can use this to get all sorts of information. To query your application event log for the last 2 months just do
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message
FROM Application
where TimeGenerated > '2010-07-06 00:00:00' into test.csv"

This should export it out to a CSV file called test.csv

HTH

Erik
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612380
Thanks erik_nodland.  So I install this on the pc and then run the command you wrote?
0
 
LVL 4

Expert Comment

by:erik_nodland
ID: 33612454
Yep. Just install it and then run the command from the directory where it was installed.

cheers

Erik
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612503
I was able to create a quick batch file which launches the parcer app and gets the command switches to run except I am getting this error message:

Error: Syntax Error: extra token(s) after query: 'into'

Thoughts?
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612514
Quick snapshot of the script
cd\

cd "c:\program files\log parser 2.2"

logparser -i:evt -o:csv "SELECT EventLog, RecordNumber, TimeGenerated, EventID,EventType, EventTypeName, EventCategory, SourceName,ComputerName, Message FROM Application where TimeGenerated > '2010-07-06 00:00:00' into test.csv"  

pause

Open in new window

0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 
LVL 9

Author Comment

by:samiam41
ID: 33612546
Got it!

Made a quick change to your command (see below):
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message into test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"

cd\

cd "c:\program files\log parser 2.2"

logparser -i:evt -o:csv "SELECT EventLog, RecordNumber, TimeGenerated, EventID,EventType, EventTypeName, EventCategory, SourceName, ComputerName, Message INTO test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"  

Open in new window

0
 
LVL 9

Author Comment

by:samiam41
ID: 33612552
my ref:  http://technet.microsoft.com/en-us/library/ee692659.aspx

C:\>LogParser "SELECT TimeGenerated, SourceName,
EventCategoryName, Message INTO report.txt FROM Security WHERE
EventID = 528 AND SID LIKE '%TESTUSER%'" -resolveSIDs:ON

Thanks for your help!!
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612596
@erik, if you copy/paste what I put in 33612546 into a new comment, I can accept your answer and award points.
0
 
LVL 4

Accepted Solution

by:
erik_nodland earned 500 total points
ID: 33612756
Ahh yes sorry. I should have tested it out first. Glad you got it all going.

Made a quick change to your command (see below):

logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message into test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"

Cheers

Erik
0
 
LVL 9

Author Closing Comment

by:samiam41
ID: 33612769
Thanks for the help!!  Hope to work with you again!

-Aaron
0
 
LVL 52

Expert Comment

by:Bill Prew
ID: 33612860
Another tool you could look at for this job:

http://technet.microsoft.com/en-us/sysinternals/bb897544.aspx

~bp
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Not long ago I saw a question in the VB Script forum that I thought would not take much time. You can read that question (Question ID  (http://www.experts-exchange.com/Programming/Languages/Visual_Basic/VB_Script/Q_28455246.html)28455246) Here (http…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now